(** ***Lemmas about suspend steps*)

(* Specifications: *)
(** [suspend_thread] is deterministic*)
Lemma suspend_step_det:
forall m tp tp' tp'' i (cnt: containsThread tp i)
(Hstep: suspend_thread m cnt tp')
(Hstep': suspend_thread m cnt tp''),
tp' = tp''.
(** [suspend_thread] does not change the number of threads*)
Lemma suspend_containsThread:
forall m tp tp' i j (cnti: containsThread tp i)
(Hsuspend: suspend_thread m cnti tp'),
containsThread tp j <-> containsThread tp' j.
(** [mem_compatible] is preserved by [suspend_thread]*)
Corollary suspend_compatible:
forall tp tp' m i (cnt: containsThread tp i)
(Hcomp: mem_compatible tp m)
(Hsuspend: suspend_thread m cnt tp'),
mem_compatible tp' m.
Lemma gsoThreadC_blocked:
forall (tp : t) i j (cntj : containsThread tp j)
c (Hneq: i <> j) (cnti : containsThread tp i)
(cntj' : containsThread (updThreadC cnti (Kblocked c)) j),
getThreadC cntj = getThreadC cntj'.
Corollary gsoThreadC_suspend:
forall m tp tp' i j (cnt: containsThread tp i) (cntj: containsThread tp j)
(cntj': containsThread tp' j) (Hneq: i <> j)
(Hsuspend: suspend_thread m cnt tp'),
getThreadC cntj = getThreadC cntj'.
Lemma gsoThreadR_suspend:
forall m tp tp' i j (cnt: containsThread tp i) (cntj: containsThread tp j)
(cntj': containsThread tp' j)
(Hsuspend: suspend_thread m cnt tp'),
getThreadR cntj = getThreadR cntj'.
(** [invariant] is preserved by [suspend_thread]*)
Lemma suspend_invariant:
forall m tp tp' i
(pff: containsThread tp i)
(Hinv: invariant tp)
(Hsuspend: suspend_thread m pff tp'),
invariant tp'.
(** [lockRes] is not changed by [suspend_thread]*)
Lemma suspend_lockRes:
forall m tp tp' i
(pff: containsThread tp i)
(Hsuspend: suspend_thread m pff tp'),
lockRes tp = lockRes tp'.
Lemma suspend_lockPool :
forall m (tp tp' : t) i (pfc : containsThread tp i)
(Hsuspend: suspend_thread m pfc tp') addr,
lockRes tp addr = lockRes tp' addr.
(** [mem_compatible] is preserved by [setMaxPerm] *)
Lemma mem_compatible_setMaxPerm :
forall tp m
(Hcomp: mem_compatible tp m),
mem_compatible tp (setMaxPerm m).
(** Any state that steps, requires its threadpool and memory to be [mem_compatible]*)
Lemma step_mem_compatible:
forall U tr tp m U' tr' tp' m'
(Hstep: MachStep (U, tr, tp) m (U', tr', tp') m'),
mem_compatible tp m.
(** Any state that steps satisfies the [invariant] *)
Lemma step_invariant:
forall U tr tp m U' tr' tp' m'
(Hstep: MachStep (U, tr, tp) m (U', tr', tp') m'),
invariant tp.
Lemma step_containsThread :
forall tp tp' m m' i j U tr tr'
(cntj: containsThread tp j)
(Hstep: MachStep (i :: U, tr, tp) m (U, tr', tp') m'),
containsThread tp' j.
Lemma gsoThreadR_step:
forall tp tp' m m' i j U tr tr'
(Hneq: i <> j)
(pfj: containsThread tp j)
(pfj': containsThread tp' j)
(Hstep: MachStep (i :: U,tr, tp) m (U,tr', tp') m'),
getThreadR pfj = getThreadR pfj'.
Lemma permission_at_step:
forall tp tp' m m' i j U tr tr'
(Hneq: i <> j)
(pfj: containsThread tp j)
(pfj': containsThread tp' j)
(Hcomp: mem_compatible tp m)
(Hcomp': mem_compatible tp' m')
(Hstep: MachStep (i :: U, tr, tp) m (U,tr',tp') m') b ofs,
permission_at (restrPermMap ((compat_th _ _ Hcomp) pfj).1) b ofs Cur =
permission_at (restrPermMap ((compat_th _ _ Hcomp') pfj').1) b ofs Cur.
Lemma safeC_invariant:
forall tpc trc mc n
(Hn: n > 0)
(Hsafe: forall U,
HybridCoarseMachine.csafe (U,trc,tpc) mc n),
invariant tpc.
Lemma safeC_compatible:
forall tpc trc mc n
(Hn: n > 0)
(Hsafe: forall U,
HybridCoarseMachine.csafe (U,trc,tpc) mc n),
mem_compatible tpc mc.