Inductive match_ctl : ctl -> ctl -> Prop :=
| match_Krun c c' : match_states c (fst (CC'.CC_state_to_CC_core c')) -> match_ctl (Krun c) (Krun c')
| match_Kblocked c c' : match_states c (fst (CC'.CC_state_to_CC_core c')) -> match_ctl (Kblocked c) (Kblocked c')
| match_Kresume c c' v : match_states c (fst (CC'.CC_state_to_CC_core c')) -> match_ctl (Kresume c v) (Kresume c' v)
| match_Kinit v v' : match_ctl (Kinit v v') (Kinit v v').Inductive match_ctl : ctl -> ctl -> Prop :=
| match_Krun c c' : match_states c (fst (CC'.CC_state_to_CC_core c')) -> match_ctl (Krun c) (Krun c')
| match_Kblocked c c' : match_states c (fst (CC'.CC_state_to_CC_core c')) -> match_ctl (Kblocked c) (Kblocked c')
| match_Kresume c c' v : match_states c (fst (CC'.CC_state_to_CC_core c')) -> match_ctl (Kresume c v) (Kresume c' v)
| match_Kinit v v' : match_ctl (Kinit v v') (Kinit v v').Inductive match_ctl : ctl -> ctl -> Prop :=
| match_Krun c c' : match_states c (fst (CC'.CC_state_to_CC_core c')) -> match_ctl (Krun c) (Krun c')
| match_Kblocked c c' : match_states c (fst (CC'.CC_state_to_CC_core c')) -> match_ctl (Kblocked c) (Kblocked c')
| match_Kresume c c' v : match_states c (fst (CC'.CC_state_to_CC_core c')) -> match_ctl (Kresume c v) (Kresume c' v)
| match_Kinit v v' : match_ctl (Kinit v v') (Kinit v v').Inductive match_ctl : ctl -> ctl -> Prop :=
| match_Krun c c' : match_states c (fst (CC'.CC_state_to_CC_core c')) -> match_ctl (Krun c) (Krun c')
| match_Kblocked c c' : match_states c (fst (CC'.CC_state_to_CC_core c')) -> match_ctl (Kblocked c) (Kblocked c')
| match_Kresume c c' v : match_states c (fst (CC'.CC_state_to_CC_core c')) -> match_ctl (Kresume c v) (Kresume c' v)
| match_Kinit v v' : match_ctl (Kinit v v') (Kinit v v').Inductive match_ctl : ctl -> ctl -> Prop :=
| match_Krun c c' : match_states c (fst (CC'.CC_state_to_CC_core c')) -> match_ctl (Krun c) (Krun c')
| match_Kblocked c c' : match_states c (fst (CC'.CC_state_to_CC_core c')) -> match_ctl (Kblocked c) (Kblocked c')
| match_Kresume c c' v : match_states c (fst (CC'.CC_state_to_CC_core c')) -> match_ctl (Kresume c v) (Kresume c' v)
| match_Kinit v v' : match_ctl (Kinit v v') (Kinit v v').

(* Specifications: *)
Lemma MTCH_compat: forall js ds m, match_st js ds -> mem_compatible js m -> mem_compatible ds m.
Lemma MTCH_install_perm: forall js ds m m' tid (MATCH : match_st js ds) (Hcmpt : mem_compatible js m) (Htid : containsThread js tid) (Htid' : containsThread ds tid) (Hperm : install_perm _ _ _ Hcmpt Htid m'), install_perm _ _ _ (MTCH_compat _ _ _ MATCH Hcmpt) Htid' m'.
Lemma MTCH_invariant: forall js ds (MATCH : match_st js ds) (Hinv : invariant js), invariant ds.
Lemma MTCH_updThreadC: forall tp tp' tid c c' (MATCH : match_st tp tp') (Htid : containsThread tp tid) (Htid' : containsThread tp' tid) (Hctl : match_ctl c c'), match_st (updThreadC Htid c) (updThreadC Htid' c').
Lemma MTCH_updLockSet: forall tp tp' a l (MATCH : match_st tp tp'), match_st (updLockSet tp a l) (updLockSet tp' a l).
Lemma MTCH_remLockSet: forall tp tp' a (MATCH : match_st tp tp'), match_st (remLockSet tp a) (remLockSet tp' a).
Lemma MTCH_addThread: forall tp tp' vf arg r (MATCH : match_st tp tp'), match_st (addThread tp vf arg r) (addThread tp' vf arg r).
Lemma updThread_twice : forall {res sem} (tp : @OrdinalPool.t res sem) i (cnti : containsThread(ThreadPool := OrdinalPool.OrdinalThreadPool) tp i) c c' r r' (cnti' : containsThread (updThread cnti c r) i), updThread cnti' c' r' = updThread cnti c' r'.
Lemma mem_ext: forall m1 m2, Mem.mem_contents m1 = Mem.mem_contents m2 -> Mem.mem_access m1 = Mem.mem_access m2 -> Mem.nextblock m1 = Mem.nextblock m2 -> m1 = m2.
Lemma restrPermMap_twice: forall p1 p2 m Hlt1 Hlt2 Hlt', @restrPermMap p2 (@restrPermMap p1 m Hlt1) Hlt2 = @restrPermMap p2 m Hlt'.
Lemma restrPermMap_compat: forall {Sem} (tp : t(ThreadPool:= OrdinalPool.OrdinalThreadPool(Sem:=Sem))) m p Hlt, mem_compatible tp (@restrPermMap p m Hlt) -> mem_compatible tp m.
Lemma restrPerm_sub_map: forall m p Hlt, sub_map (snd (getMaxPerm (@restrPermMap p m Hlt))) (snd (getMaxPerm m)).
Lemma csafe_restr: forall {Sem} n st m p' Hlt (Hext: forall c m m' e, at_external (msem semSem) c m = Some e -> at_external (msem semSem) c m' = Some e), @csafe _ Sem OrdinalPool.OrdinalThreadPool DryHybridMachineSig st (@restrPermMap p' m Hlt) n -> @csafe _ Sem OrdinalPool.OrdinalThreadPool DryHybridMachineSig st m n.
Lemma restr_Cur: forall p m Hlt, p = getCurPerm m -> @restrPermMap p m Hlt = m.