Section Clight_safety_equivalence.
Context (CPROOF : semax_to_juicy_machine.CSL_proof).
Definition prog:= CPROOF.(CSL_prog).
Definition ge:= Clight.globalenv prog.
Definition init_mem:= proj1_sig (init_mem CPROOF).
(*We should be able to construct a Clight.state from the proof... *)
Definition f_main : {f | Genv.find_funct_ptr (Clight.genv_genv ge) (projT1 (spr CPROOF)) = Some f}.
Inductive match_ctl : ctl -> ctl -> Prop :=
| match_Krun c c' : match_states c (fst (CC'.CC_state_to_CC_core c')) -> match_ctl (Krun c) (Krun c')
| match_Kblocked c c' : match_states c (fst (CC'.CC_state_to_CC_core c')) -> match_ctl (Kblocked c) (Kblocked c')
| match_Kresume c c' v : match_states c (fst (CC'.CC_state_to_CC_core c')) -> match_ctl (Kresume c v) (Kresume c' v)
| match_Kinit v v' : match_ctl (Kinit v v') (Kinit v v').
(* This should essentially reproduce Clight_sim at the hybrid machine level. *)
Inductive match_st (tp : ThreadPool.t(resources := dryResources)(ThreadPool:= threadPool.OrdinalPool.OrdinalThreadPool(Sem:=Clight_newSem ge)))
(tp' : ThreadPool.t(resources := dryResources)(ThreadPool:= threadPool.OrdinalPool.OrdinalThreadPool(Sem:=ClightSem ge))) : Prop :=
MATCH_ST: forall (mtch_cnt: forall {tid},  containsThread tp tid -> containsThread tp' tid)
(mtch_cnt': forall {tid}, containsThread tp' tid -> containsThread tp tid)
(mtch_gtc: forall {tid} (Htid:containsThread tp tid)(Htid':containsThread tp' tid),
match_ctl (getThreadC Htid) (getThreadC Htid'))
(mtch_gtr1: forall {tid} (Htid:containsThread tp tid)(Htid':containsThread tp' tid)
b ofs,
(fst (getThreadR Htid)) !! b ofs = (fst (getThreadR Htid')) !! b ofs)
(mtch_gtr2: forall {tid} (Htid:containsThread tp tid)(Htid':containsThread tp' tid),
snd (getThreadR Htid) = snd (getThreadR Htid'))
(mtch_locks: forall a, lockRes tp a = lockRes tp' a)
(mtch_latest: latestThread tp = latestThread tp'),
match_st tp tp'.
Existing Instance scheduler.
Existing Instance DilMem.
Instance ClightAxioms : @CoreLanguage.SemAxioms (ClightSem ge).
Opaque updThread updThreadC containsThread getThreadC getThreadR lockRes.
Definition MachStateDry := @MachState dryResources (Clight_newSem ge)
(@OrdinalPool.OrdinalThreadPool dryResources (Clight_newSem ge)).
(* SearchHead (MachState -> _). Print Val.inject. Definition flat_inject (v: memval) *)
Definition threadpool_of (st: MachStateDry) :=    match st with (_, _, tp) => tp end.
Definition dryThreadPool := @ThreadPool.t dryResources (Clight_newSem ge)
(@OrdinalPool.OrdinalThreadPool dryResources (Clight_newSem ge)).
Definition ctl_ok nextb (c: @ctl Clight_new.corestate) : Prop :=
match c with
| Krun q => corestate_ok nextb q
| Kblocked q => corestate_ok nextb q
| Kresume q v => corestate_ok nextb q /\ val_ok nextb v
| Kinit v1 v2 => val_ok nextb v1 /\ val_ok nextb v2
end.
Definition mem_ok (tp: dryThreadPool) m :=
Smallstep.globals_not_fresh (Clight.genv_genv ge) m /\
mem_wd2 m /\
(forall i (CT: containsThread tp i),
ctl_ok (Mem.nextblock m) (getThreadC CT)).

Lemma mem_ok_step: forall st m st' m' (Hmem: mem_ok (threadpool_of st) m),
MachStep(Sem := Clight_newSem ge)
(ThreadPool:= OrdinalPool.OrdinalThreadPool)
(machineSig:= HybridMachine.DryHybridMachine.DryHybridMachineSig)
st m st' m' ->
mem_ok (threadpool_of st') m'.