(* *********************************************************************)
(*                                                                     *)
(*              The Compcert verified compiler                         *)
(*                                                                     *)
(*          Xavier Leroy, INRIA Paris-Rocquencourt                     *)
(*                                                                     *)
(*  Copyright Institut National de Recherche en Informatique et en     *)
(*  Automatique.  All rights reserved.  This file is distributed       *)
(*  under the terms of the GNU General Public License as published by  *)
(*  the Free Software Foundation, either version 2 of the License, or  *)
(*  (at your option) any later version.  This file is also distributed *)
(*  under the terms of the INRIA Non-Commercial License Agreement.     *)
(*                                                                     *)
(* *********************************************************************)
(** This file defines the interface for the memory model that is used in the dynamic semantics of all the languages used in the compiler. It defines a type [mem] of memory states, the following 4 basic operations over memory states, and their properties: - [load]: read a memory chunk at a given address; - [store]: store a memory chunk at a given address; - [alloc]: allocate a fresh memory block; - [free]: invalidate a memory block. *)
(** Memory states are accessed by addresses [b, ofs]: pairs of a block identifier [b] and a byte offset [ofs] within that block. Each address is associated to permissions, also known as access rights. The following permissions are expressible: - Freeable (exclusive access): all operations permitted - Writable: load, store and pointer comparison operations are permitted, but freeing is not. - Readable: only load and pointer comparison operations are permitted. - Nonempty: valid, but only pointer comparisons are permitted. - Empty: not yet allocated or previously freed; no operation permitted.  The first four cases are represented by the following type of permissions. Being empty is represented by the absence of any permission. *)
Inductive permission: Type :=
| Freeable: permission
| Writable: permission
| Readable: permission
| Nonempty: permission.
(** In the list, each permission implies the other permissions further down the list.  We reflect this fact by the following order over permissions. *)
Inductive perm_order: permission -> permission -> Prop :=
| perm_refl:  forall p, perm_order p p
| perm_F_any: forall p, perm_order Freeable p
| perm_W_R:   perm_order Writable Readable
| perm_any_N: forall p, perm_order p Nonempty.
Hint Constructors perm_order: mem.

(* Specifications: *)
Lemma perm_order_trans:
forall p1 p2 p3, perm_order p1 p2 -> perm_order p2 p3 -> perm_order p1 p3.