(*+ CSL to progress and preservation *)
(* In this file, we use the same notion of thread safety as in the rest of VST, which is defined using specifications for external functions. In the rest of VST, we derive safety of the concurrent (juicy) machine from [progress] and [preservation] of an invariant.  We give a toy version of those definitions and proofs here, simplifying greatly problems related to step indexing, external calls and spawning. *)
(* standard files distributed with Coq *)
(* local file *)
Definition interp_lock := resourcemaps.interp_lock.
Definition islock (l : nat) (R : map -> Prop) (m : map) :=
exists lock, m l = Some (inr lock) /\ interp_lock lock = R.
intros v R1 R2 m [lock1 [E1 H1]] [lock2 [E2 H2]].
congruence.
Qed.
(*+ Core steps *)
Variable C' : Set.
Variable corestep : C' -> map -> C' -> map -> Prop.
Variable corestep_fun : forall c m c1 m1 c2 m2,
corestep c m c1 m1 ->
corestep c m c2 m2 ->
c1 = c2 /\ m1 = m2.
Variable corestep_sameperms : forall c m c' m', corestep c m c' m' -> sameperms m m'.
Variable corestep_samelocks : forall c m c' m' l lock,
corestep c m c' m' -> (m l = Some (inr lock) <-> m' l = Some (inr lock)).
Variable cancellative : forall m1 m1' m2 m3, join m1 m2 m3 -> join m1' m2 m3 -> m1 = m1'.
(** Concurrent instructions are built on top of those [C'] *)
Inductive C : Set :=
| acquire : nat -> C -> C
| release : nat -> C -> C
| normal : C' -> C.
(*+ Joinability hypotheses *)
(* Those lemmas can be proved if the support set of maps is finite. We omit those for conveninence, here. *)
Variable jointo : forall {A} (maps : A -> map) (m : map), Prop.

Axiom jointo_swapped :
forall {A} {m1 m2 : A -> map} (Adec:forall x y:A,{x=y}+{x<>y})
i j Phi e a b a' b',
swapped m1 m2 i j a b a' b' ->
join a b e ->
join a' b' e ->
jointo m1 Phi ->
jointo m2 Phi.