val bind (a:Type) (b:Type)
         (opened_invariants:inames)
         (o1:eqtype_as_type observability)
         (o2:eqtype_as_type observability)
         (#framed_f:eqtype_as_type bool)
         (#framed_g:eqtype_as_type bool)
         (#[@@@ framing_implicit] pre_f:pre_t)
         (#[@@@ framing_implicit] post_f:post_t a)
         (#[@@@ framing_implicit] req_f:pure_pre)
         (#[@@@ framing_implicit] ens_f:pure_post a)
         (#[@@@ framing_implicit] pre_g:a -> pre_t)
         (#[@@@ framing_implicit] post_g:a -> post_t b)
         (#[@@@ framing_implicit] req_g:a -> pure_pre)
         (#[@@@ framing_implicit] ens_g:(a -> pure_post b))
         (#[@@@ framing_implicit] frame_f:vprop)
         (#[@@@ framing_implicit] frame_g:a -> vprop)
         (#[@@@ framing_implicit] post:post_t b)
         (#[@@@ framing_implicit] _ : squash (maybe_emp framed_f frame_f))
         (#[@@@ framing_implicit] _ : squash (maybe_emp_dep framed_g frame_g))
         (#[@@@ framing_implicit] pr:a -> prop)
         (#[@@@ framing_implicit] p1:squash
           (can_be_split_forall_dep pr
             (fun x -> post_f x `star` frame_f)
             (fun x -> pre_g x `star` frame_g x)))
         (#[@@@ framing_implicit] p2:squash
           (can_be_split_post
             (fun x y -> post_g x y `star` frame_g x) post))
         (f:repr a framed_f opened_invariants o1 pre_f post_f req_f ens_f)
         (g:(x:a -> repr b framed_g opened_invariants o2 (pre_g x) (post_g x) (req_g x) (ens_g x)))
 : Pure (repr b
              true
              opened_invariants
              (join_obs o1 o2)
              (pre_f `star` frame_f)
              post
              (STF.bind_req a req_f ens_f pr req_g)
              (STF.bind_ens a b ens_f ens_g))
        (requires obs_at_most_one o1 o2)
        (ensures fun _ -> True)
let bind (a:Type) (b:Type)
         (opened_invariants:inames)
         (o1:eqtype_as_type observability)
         (o2:eqtype_as_type observability)
         (#framed_f:eqtype_as_type bool)
         (#framed_g:eqtype_as_type bool)
         (#[@@@ framing_implicit] pre_f:pre_t)
         (#[@@@ framing_implicit] post_f:post_t a)
         (#[@@@ framing_implicit] req_f:Type0)
         (#[@@@ framing_implicit] ens_f:a -> Type0)
         (#[@@@ framing_implicit] pre_g:a -> pre_t)
         (#[@@@ framing_implicit] post_g:a -> post_t b)
         (#[@@@ framing_implicit] req_g:(a -> Type0))
         (#[@@@ framing_implicit] ens_g:(a -> b -> Type0))
         (#[@@@ framing_implicit] frame_f:vprop)
         (#[@@@ framing_implicit] frame_g:a -> vprop)
         (#[@@@ framing_implicit] post:post_t b)
         (#[@@@ framing_implicit] _x1 : squash (maybe_emp framed_f frame_f))
         (#[@@@ framing_implicit] _x2 : squash (maybe_emp_dep framed_g frame_g))
         (#[@@@ framing_implicit] pr:a -> prop)
         (#[@@@ framing_implicit] p1:squash
           (can_be_split_forall_dep pr
             (fun x -> post_f x `star` frame_f)
             (fun x -> pre_g x `star` frame_g x)))
         (#[@@@ framing_implicit] p2:squash
           (can_be_split_post
             (fun x y -> post_g x y `star` frame_g x) post))
         (f:repr a framed_f opened_invariants o1 pre_f post_f req_f ens_f)
         (g:(x:a -> repr b framed_g opened_invariants o2 (pre_g x) (post_g x) (req_g x) (ens_g x)))
 = weaken_repr (SEA.bind a b opened_invariants o1 o2
                         #framed_f
                         #framed_g
                         #pre_f
                         #post_f
                         #(fun _ -> req_f)
                         #(fun _ x _ -> ens_f x)
                         #pre_g
                         #post_g
                         #(fun x _ -> req_g x)
                         #(fun x _ y _ -> ens_g x y)
                         #frame_f
                         #frame_g
                         #post
                         #_x1
                         #_x2
                         #pr
                         #p1
                         #p2
                         f g) () ()
val bind (a:Type) (b:Type)
         (opened_invariants:inames)
         (o1:eqtype_as_type observability)
         (o2:eqtype_as_type observability)
         (#framed_f:eqtype_as_type bool)
         (#framed_g:eqtype_as_type bool)
         (#[@@@ framing_implicit] pre_f:pre_t)
         (#[@@@ framing_implicit] post_f:post_t a)
         (#[@@@ framing_implicit] req_f:pure_pre)
         (#[@@@ framing_implicit] ens_f:pure_post a)
         (#[@@@ framing_implicit] pre_g:a -> pre_t)
         (#[@@@ framing_implicit] post_g:a -> post_t b)
         (#[@@@ framing_implicit] req_g:a -> pure_pre)
         (#[@@@ framing_implicit] ens_g:(a -> pure_post b))
         (#[@@@ framing_implicit] frame_f:vprop)
         (#[@@@ framing_implicit] frame_g:a -> vprop)
         (#[@@@ framing_implicit] post:post_t b)
         (#[@@@ framing_implicit] _ : squash (maybe_emp framed_f frame_f))
         (#[@@@ framing_implicit] _ : squash (maybe_emp_dep framed_g frame_g))
         (#[@@@ framing_implicit] pr:a -> prop)
         (#[@@@ framing_implicit] p1:squash
           (can_be_split_forall_dep pr
             (fun x -> post_f x `star` frame_f)
             (fun x -> pre_g x `star` frame_g x)))
         (#[@@@ framing_implicit] p2:squash
           (can_be_split_post
             (fun x y -> post_g x y `star` frame_g x) post))
         (f:repr a framed_f opened_invariants o1 pre_f post_f req_f ens_f)
         (g:(x:a -> repr b framed_g opened_invariants o2 (pre_g x) (post_g x) (req_g x) (ens_g x)))
 : Pure (repr b
              true
              opened_invariants
              (join_obs o1 o2)
              (pre_f `star` frame_f)
              post
              (STF.bind_req a req_f ens_f pr req_g)
              (STF.bind_ens a b ens_f ens_g))
        (requires obs_at_most_one o1 o2)
        (ensures fun _ -> True)
let bind
      (a b: Type)
      (opened_invariants: inames)
      (o1 o2: eqtype_as_type observability)
      (#framed_f #framed_g: eqtype_as_type bool)
      (#[@@@ framing_implicit]pre_f: pre_t)
      (#[@@@ framing_implicit]post_f: post_t a)
      (#[@@@ framing_implicit]req_f: Type0)
      (#[@@@ framing_implicit]ens_f: (a -> Type0))
      (#[@@@ framing_implicit]pre_g: (a -> pre_t))
      (#[@@@ framing_implicit]post_g: (a -> post_t b))
      (#[@@@ framing_implicit]req_g: (a -> Type0))
      (#[@@@ framing_implicit]ens_g: (a -> b -> Type0))
      (#[@@@ framing_implicit]frame_f: vprop)
      (#[@@@ framing_implicit]frame_g: (a -> vprop))
      (#[@@@ framing_implicit]post: post_t b)
      (#[@@@ framing_implicit]_x1: squash (maybe_emp framed_f frame_f))
      (#[@@@ framing_implicit]_x2: squash (maybe_emp_dep framed_g frame_g))
      (#[@@@ framing_implicit]pr: (a -> prop))
      (#[@@@ framing_implicit]p1:
          squash (can_be_split_forall_dep pr
                (fun x -> (post_f x) `star` frame_f)
                (fun x -> (pre_g x) `star` (frame_g x))))
      (#[@@@ framing_implicit]p2:
          squash (can_be_split_post (fun x y -> (post_g x y) `star` (frame_g x)) post))
      (f: repr a framed_f opened_invariants o1 pre_f post_f req_f ens_f)
      (g: (x: a -> repr b framed_g opened_invariants o2 (pre_g x) (post_g x) (req_g x) (ens_g x)))
     =
weaken_repr (SEA.bind a b opened_invariants o1 o2 #framed_f #framed_g #pre_f #post_f
      #(fun _ -> req_f) #(fun _ x _ -> ens_f x) #pre_g #post_g #(fun x _ -> req_g x)
      #(fun x _ y _ -> ens_g x y) #frame_f #frame_g #post #_x1 #_x2 #pr #p1 #p2 f g)
  ()
  ()
Steel.ST.Effect.AtomicAndGhost.fst.checked
Steel.ST.Effect.fst.checked Steel.Memory.fsti.checked Steel.Effect.Common.fsti.checked Steel.Effect.Atomic.fst.checked Steel.Effect.fsti.checked prims.fst.checked FStar.Tactics.fst.checked FStar.Set.fsti.checked FStar.Pervasives.fsti.checked FStar.Monotonic.Pure.fst.checked FStar.Classical.Sugar.fsti.checked
Steel.ST.Effect.AtomicAndGhost.fst
Steel.Memory.inames FStar.Pervasives.eqtype_as_type Steel.Effect.Common.observability Prims.bool Steel.Effect.Common.pre_t Steel.Effect.Common.post_t Steel.Effect.Common.vprop Prims.squash Steel.Effect.Common.maybe_emp Steel.Effect.Common.maybe_emp_dep Prims.prop Steel.Effect.Common.can_be_split_forall_dep Steel.Effect.Common.star Steel.Effect.Common.can_be_split_post Steel.ST.Effect.AtomicAndGhost.repr Steel.ST.Effect.AtomicAndGhost.weaken_repr Steel.Effect.Common.join_obs Steel.Effect.Atomic.bind_req Steel.Effect.Common.rmem Steel.ST.Effect.bind_req Steel.Effect.Atomic.bind_ens Steel.ST.Effect.bind_ens Steel.Effect.Atomic.bind
(*
   Copyright 2020 Microsoft Research

   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.
   You may obtain a copy of the License at

       http://www.apache.org/licenses/LICENSE-2.0

   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
*)

module Steel.ST.Effect.AtomicAndGhost
friend Steel.Effect.Atomic
friend Steel.ST.Effect
module C = Steel.Effect.Common
open Steel.Memory
module T = FStar.Tactics
module STF = Steel.ST.Effect
module SEA = Steel.Effect.Atomic
open Steel.Effect.Atomic

/// This module defines atomic and ghost variants of the Steel effect

#set-options "--warn_error -330 --ide_id_info_off"  //turn off the experimental feature warning

let repr (a:Type u#a)
         (already_framed:bool)
         (opened_invariants:inames)
         (g:observability)
         (pre:pre_t)
         (post:post_t a)
         (req:Type0)
         (ens:a -> Type0)
  : Type u#(max a 2)
  = SEA.repr a already_framed opened_invariants g pre post
             (fun _ -> req)
             (fun _ x _ -> ens x)



let equiv_star_emp_r (p:vprop)
  : Lemma ((p `star` emp) `equiv` p)
  = cm_identity p;
    assert ((emp `star` p) `equiv` p);
    star_commutative p emp;
    equiv_trans (p `star` emp) (emp `star` p) p

let weaken_repr #a #framed #o #g
                (#pre:pre_t)
                (#post:post_t a)
                (#req #req':req_t pre)
                (#ens #ens':ens_t pre a post)
                ($f:SEA.repr a framed o g pre post req ens)
                (_:squash (forall (h0:hmem pre).
                            req' (mk_rmem _ h0) ==>
                            req (mk_rmem _ h0)))
                (_:squash (forall (h0:hmem pre) x (h1:hmem (post x)).
                            ens (mk_rmem _ h0)
                                x
                                (mk_rmem _ h1) ==>
                            ens' (mk_rmem _ h0) x (mk_rmem _ h1)))
  : Tot (SEA.repr a framed o g pre post req' ens')
  = let focus_rmem_refl (r:vprop) (h:rmem r)
      : Lemma (ensures focus_rmem #r h r == h)
              [SMTPat (focus_rmem #r h r)]
      = focus_rmem_refl r h
    in
    let equiv_trans (x y z:vprop) : Lemma
      (requires equiv x y /\ equiv y z)
      (ensures equiv x z)
      [SMTPat (equiv x z);
       SMTPat (equiv x y)]
     = equiv_trans x y z
    in
    let cbs (p:vprop)
      : Lemma (p `can_be_split` (p `star` emp))
              [SMTPat (p `can_be_split` (p `star` emp))]
      = star_commutative p emp;
        cm_identity p;
        equiv_sym (p `star` emp) p;
        equiv_can_be_split p (p `star` emp)
    in
    let epost ()
      : Lemma (equiv_forall post (fun x -> star (post x) emp))
      = introduce forall x. post x `equiv` (post x `star` emp)
        with (
          equiv_star_emp_r (post x);
          equiv_sym (post x `star` emp) (post x)
        );
        equiv_forall_elim post (fun x -> star (post x) emp)
    in
    epost ();
    SEA.subcomp_opaque a o g g #framed #framed
                         #pre #post
                         #req #ens
                         #pre #post
                         #req' #ens'
                         #emp
                         #True
                         #()
                         #()
                         #()
                         f

let return_ (a:Type u#a)
            (x:a)
            (opened_invariants:inames)
            (#[@@@ framing_implicit] p:a -> vprop)
  : repr a true opened_invariants Unobservable
         (return_pre (p x)) p
         True
         (fun v -> v == x)
  = weaken_repr (SEA.return_ a x opened_invariants #p) () ()


let bind (a:Type) (b:Type)
         (opened_invariants:inames)
         (o1:eqtype_as_type observability)
         (o2:eqtype_as_type observability)
         (#framed_f:eqtype_as_type bool)
         (#framed_g:eqtype_as_type bool)
         (#[@@@ framing_implicit] pre_f:pre_t)
         (#[@@@ framing_implicit] post_f:post_t a)
         (#[@@@ framing_implicit] req_f:Type0)
         (#[@@@ framing_implicit] ens_f:a -> Type0)
         (#[@@@ framing_implicit] pre_g:a -> pre_t)
         (#[@@@ framing_implicit] post_g:a -> post_t b)
         (#[@@@ framing_implicit] req_g:(a -> Type0))
         (#[@@@ framing_implicit] ens_g:(a -> b -> Type0))
         (#[@@@ framing_implicit] frame_f:vprop)
         (#[@@@ framing_implicit] frame_g:a -> vprop)
         (#[@@@ framing_implicit] post:post_t b)
         (#[@@@ framing_implicit] _x1 : squash (maybe_emp framed_f frame_f))
         (#[@@@ framing_implicit] _x2 : squash (maybe_emp_dep framed_g frame_g))
         (#[@@@ framing_implicit] pr:a -> prop)
         (#[@@@ framing_implicit] p1:squash
           (can_be_split_forall_dep pr
             (fun x -> post_f x `star` frame_f)
             (fun x -> pre_g x `star` frame_g x)))
         (#[@@@ framing_implicit] p2:squash
           (can_be_split_post
             (fun x y -> post_g x y `star` frame_g x) post))
         (f:repr a framed_f opened_invariants o1 pre_f post_f req_f ens_f)
val bind (a:Type) (b:Type)
         (opened_invariants:inames)
         (o1:eqtype_as_type observability)
         (o2:eqtype_as_type observability)
         (#framed_f:eqtype_as_type bool)
         (#framed_g:eqtype_as_type bool)
         (#[@@@ framing_implicit] pre_f:pre_t)
         (#[@@@ framing_implicit] post_f:post_t a)
         (#[@@@ framing_implicit] req_f:pure_pre)
         (#[@@@ framing_implicit] ens_f:pure_post a)
         (#[@@@ framing_implicit] pre_g:a -> pre_t)
         (#[@@@ framing_implicit] post_g:a -> post_t b)
         (#[@@@ framing_implicit] req_g:a -> pure_pre)
         (#[@@@ framing_implicit] ens_g:(a -> pure_post b))
         (#[@@@ framing_implicit] frame_f:vprop)
         (#[@@@ framing_implicit] frame_g:a -> vprop)
         (#[@@@ framing_implicit] post:post_t b)
         (#[@@@ framing_implicit] _ : squash (maybe_emp framed_f frame_f))
         (#[@@@ framing_implicit] _ : squash (maybe_emp_dep framed_g frame_g))
         (#[@@@ framing_implicit] pr:a -> prop)
         (#[@@@ framing_implicit] p1:squash
           (can_be_split_forall_dep pr
             (fun x -> post_f x `star` frame_f)
             (fun x -> pre_g x `star` frame_g x)))
         (#[@@@ framing_implicit] p2:squash
           (can_be_split_post
             (fun x y -> post_g x y `star` frame_g x) post))
         (f:repr a framed_f opened_invariants o1 pre_f post_f req_f ens_f)
         (g:(x:a -> repr b framed_g opened_invariants o2 (pre_g x) (post_g x) (req_g x) (ens_g x)))
 : Pure (repr b
              true
              opened_invariants
              (join_obs o1 o2)
              (pre_f `star` frame_f)
              post
              (STF.bind_req a req_f ens_f pr req_g)
              (STF.bind_ens a b ens_f ens_g))
        (requires obs_at_most_one o1 o2)
        (ensures fun _ -> True)

    a: Type ->
    b: Type ->
    opened_invariants: Steel.Memory.inames ->
    o1: FStar.Pervasives.eqtype_as_type Steel.Effect.Common.observability ->
    o2: FStar.Pervasives.eqtype_as_type Steel.Effect.Common.observability ->
    f: Steel.ST.Effect.AtomicAndGhost.repr a framed_f opened_invariants o1 pre_f post_f req_f ens_f ->
    g:
      (x: a
          -> Steel.ST.Effect.AtomicAndGhost.repr b
              framed_g
              opened_invariants
              o2
              (pre_g x)
              (post_g x)
              (req_g x)
              (ens_g x))
  -> Prims.Pure
    (Steel.ST.Effect.AtomicAndGhost.repr b
        true
        opened_invariants
        (Steel.Effect.Common.join_obs o1 o2)
        (Steel.Effect.Common.star pre_f frame_f)
        post
        (Steel.ST.Effect.bind_req a req_f ens_f pr req_g)
        (Steel.ST.Effect.bind_ens a b ens_f ens_g))