Section Clight_safety_equivalence.
Context (CPROOF : semax_to_juicy_machine.CSL_proof).
Definition prog:= CPROOF.(CSL_prog).
Definition ge:= Clight.globalenv prog.
Definition init_mem:= proj1_sig (init_mem CPROOF).
(*We should be able to construct a Clight.state from the proof... *)
Definition f_main : {f | Genv.find_funct_ptr (Clight.genv_genv ge) (projT1 (spr CPROOF)) = Some f}.
Inductive match_ctl : ctl -> ctl -> Prop :=
| match_Krun c c' : match_states c (fst (CC'.CC_state_to_CC_core c')) -> match_ctl (Krun c) (Krun c')
| match_Kblocked c c' : match_states c (fst (CC'.CC_state_to_CC_core c')) -> match_ctl (Kblocked c) (Kblocked c')
| match_Kresume c c' v : match_states c (fst (CC'.CC_state_to_CC_core c')) -> match_ctl (Kresume c v) (Kresume c' v)
| match_Kinit v v' : match_ctl (Kinit v v') (Kinit v v').
(* This should essentially reproduce Clight_sim at the hybrid machine level. *)
Inductive match_st (tp : ThreadPool.t(resources := dryResources)(ThreadPool:= threadPool.OrdinalPool.OrdinalThreadPool(Sem:=Clight_newSem ge)))
(tp' : ThreadPool.t(resources := dryResources)(ThreadPool:= threadPool.OrdinalPool.OrdinalThreadPool(Sem:=ClightSem ge))) : Prop :=
MATCH_ST: forall (mtch_cnt: forall {tid},  containsThread tp tid -> containsThread tp' tid)
(mtch_cnt': forall {tid}, containsThread tp' tid -> containsThread tp tid)
(mtch_gtc: forall {tid} (Htid:containsThread tp tid)(Htid':containsThread tp' tid),
match_ctl (getThreadC Htid) (getThreadC Htid'))
(mtch_gtr1: forall {tid} (Htid:containsThread tp tid)(Htid':containsThread tp' tid)
b ofs,
(fst (getThreadR Htid)) !! b ofs = (fst (getThreadR Htid')) !! b ofs)
(mtch_gtr2: forall {tid} (Htid:containsThread tp tid)(Htid':containsThread tp' tid),
snd (getThreadR Htid) = snd (getThreadR Htid'))
(mtch_locks: forall a, lockRes tp a = lockRes tp' a)
(mtch_latest: latestThread tp = latestThread tp'),
match_st tp tp'.
Existing Instance scheduler.
Existing Instance DilMem.
Instance ClightAxioms : @CoreLanguage.SemAxioms (ClightSem ge).

Lemma CoreSafe_plus : forall n U tr tp m tid (c : @semC (ClightSem ge)) c' tp' m' ev m1
(HschedN: schedPeek U = Some tid)
(Htid: containsThread tp tid)
(Hcmpt: mem_compatible tp m)
(Hrestrict_pmap: restrPermMap (proj1 (compat_th _ _ Hcmpt Htid)) = m1)
(Hinv: invariant tp)
(Hcode: getThreadC Htid = Krun c)
(Hcoresteps: ev_plus ge c m1 ev c' m')
(Htp': tp' = updThread Htid (Krun c') (getCurPerm m', snd (getThreadR Htid)))
(Hsafe: csafe(ThreadPool:= OrdinalPool.OrdinalThreadPool(Sem:=ClightSem ge))
(machineSig:= HybridMachine.DryHybridMachine.DryHybridMachineSig)
(yield U, seq.cat tr (map (fun mev => Events.internal tid mev) ev), tp') (diluteMem m') n),
csafe(ThreadPool:= OrdinalPool.OrdinalThreadPool(Sem:=ClightSem ge))
(machineSig:= HybridMachine.DryHybridMachine.DryHybridMachineSig)
(U, tr, tp) m (S n).