Definition CoreSem:= semantics.csem (event_semantics.msem (@semantics.semSem Sem)).(* Ltac definition:
   yield and diluteMem are always identity for the Corase machines. 
   this tactic allows to fold the definitions, to use constructors and lemmas. *)
Ltac fold_ids:=
  repeat match goal with
         | [ U: schedule |-  _ ] =>
           match goal with
           | [  |- context[yield U] ] => fail 1
           | [  |- context[U] ] => replace U with (yield U) by auto 
           end 
         | [ m: mem |-  _ ] =>
           match goal with
           | [  |- context[diluteMem m] ] => fail 1
           | [  |- context[m] ] => replace m with (diluteMem m) by auto 
           end 
         end.(** *Setup *)
  (** We must reorganize the types of the machine to match those 
      from konig/safety. So we change the types of MachState and MachStep
   *)

  (* A correct schedule is one where, if there is a running thread, 
     it is the first one on the scheudle*)
  Definition correct_schedule (tp:  ThreadPool.t) U : Prop:=
    match schedPeek U with
    | Some i => unique_Krun tp i
    | None => True
    end.(* Bounded memory *)
  Definition bounded_mem (m: mem) := bounded_maps.bounded_map (snd (getMaxPerm m)) .(* kstate, packages trace, thread pool and memory, to use konig theorem. *)
  Definition kstate:Type:= (event_trace * ThreadPool.t * mem).Definition cstate2kstate (st:MachState) (m:mem): kstate:=
    (snd (fst st), snd st, m).Definition kstate2cstate (st:kstate) U: MachState:=
    (U, fst (fst st), snd (fst st)).Ltac simpl_state:=
    unfold kstate2cstate, cstate2kstate in *; simpl in *.(* Semantics that takes a step or loops when halted. *)
  Inductive sem_with_halt: MachState -> mem -> MachState -> mem -> Prop:=
  | halted_step st m:
      is_true (ssrbool.isSome (halted_machine st)) -> sem_with_halt st m st m
  | step_step st m st' m' :
      MachStep st m st' m' ->
      sem_with_halt st m st' m'.(* Semantics that takes a step or loops when halted. *)
  Inductive sem_with_halt: MachState -> mem -> MachState -> mem -> Prop:=
  | halted_step st m:
      is_true (ssrbool.isSome (halted_machine st)) -> sem_with_halt st m st m
  | step_step st m st' m' :
      MachStep st m st' m' ->
      sem_with_halt st m st' m'.(* Semantics that takes a step or loops when halted. *)
  Inductive sem_with_halt: MachState -> mem -> MachState -> mem -> Prop:=
  | halted_step st m:
      is_true (ssrbool.isSome (halted_machine st)) -> sem_with_halt st m st m
  | step_step st m st' m' :
      MachStep st m st' m' ->
      sem_with_halt st m st' m'.Definition kstep (st: kstate) U st' U': Prop:=
    sem_with_halt (kstate2cstate st U) (snd st) (kstate2cstate st' U') (snd st').(* Validity *)
  (* We really only care about states where the schedule is correct. *)
  Definition valid (kst:kstate) U := correct_schedule (snd (fst kst)) U.(* Also we might care only about bounded states. *)
  Definition valid_bound st U :=
    valid st U /\ bounded_mem (snd st).Definition ksafe_kstep (st : MachState) (m : mem) : nat -> Prop :=
    ksafe _ _ (kstep) valid (cstate2kstate st m) (fst (fst st)).Definition safe_kstep (st : MachState) (m : mem) : Prop :=
    safe _ _ (kstep) valid (cstate2kstate st m) (fst (fst st)).(** *Csafe and Ksafe*)
(** Prove of equivalence between Csafe and Ksafe.
    - Csafe is the safety notion used by top level (Clight) and 
      bottom level (Asm).
    - Ksafe is the notion of safety used by konig proof.
    Proofs in this section are for all dry and not diluted Coarse hybrid machines.
*)

       
  (* All machine steps are either Core or Angel (according to csafe)*)
  Inductive CoreOrAngel: MachState -> MachState -> Prop:=
  | IsCore st tr tp':
      CoreOrAngel st (fst (fst st), seq.cat (snd (fst st)) tr, tp')
  | IsAngel st tr tp':
      CoreOrAngel st (schedSkip (fst (fst st)), seq.cat (snd (fst st)) tr, tp').(** *Csafe and Ksafe*)
(** Prove of equivalence between Csafe and Ksafe.
    - Csafe is the safety notion used by top level (Clight) and 
      bottom level (Asm).
    - Ksafe is the notion of safety used by konig proof.
    Proofs in this section are for all dry and not diluted Coarse hybrid machines.
*)

       
  (* All machine steps are either Core or Angel (according to csafe)*)
  Inductive CoreOrAngel: MachState -> MachState -> Prop:=
  | IsCore st tr tp':
      CoreOrAngel st (fst (fst st), seq.cat (snd (fst st)) tr, tp')
  | IsAngel st tr tp':
      CoreOrAngel st (schedSkip (fst (fst st)), seq.cat (snd (fst st)) tr, tp').(** *Csafe and Ksafe*)
(** Prove of equivalence between Csafe and Ksafe.
    - Csafe is the safety notion used by top level (Clight) and 
      bottom level (Asm).
    - Ksafe is the notion of safety used by konig proof.
    Proofs in this section are for all dry and not diluted Coarse hybrid machines.
*)

       
  (* All machine steps are either Core or Angel (according to csafe)*)
  Inductive CoreOrAngel: MachState -> MachState -> Prop:=
  | IsCore st tr tp':
      CoreOrAngel st (fst (fst st), seq.cat (snd (fst st)) tr, tp')
  | IsAngel st tr tp':
      CoreOrAngel st (schedSkip (fst (fst st)), seq.cat (snd (fst st)) tr, tp').

(* Specifications: *)
Lemma step_CoreOrAngel: forall st m st' m', MachStep st m st' m' -> CoreOrAngel st st'.
Lemma csafe_monotone: forall n U tr tp m, csafe (U, tr, tp) m (S n) -> csafe (U, tr, tp) m (n) .