(** ** Proofs of internal step safety and simulation*)

(* Specifications: *)
Lemma tsim_fstep_safe:
forall tpc tpc' tpf mc mc' mf i fi fg tr
(pfc: containsThread tpc i) (pff: containsThread tpf i)
(Hcompc: mem_compatible tpc mc)
(Hcompf: mem_compatible tpf mf)
(HmaxF: max_inv mf)
(HinvF: invariant tpf)
(Hge_wd: ge_wd fg the_ge)
(Hfg: forall b1 b2, fg b1 = Some b2 -> b1 = b2)
(Hren_incr: ren_incr fg fi)
(Hstrong_sim: strong_tsim fi pfc pff Hcompc Hcompf)
(Hmem_wd: valid_mem mc)
(Hstep_internal: internal_step pfc Hcompc tpc' mc'),
exists tpf' mf' fi' tr',
(forall U, fmachine_step (i :: U, tr, tpf) mf (U, tr', tpf') mf') /\
max_inv mf' /\
ren_incr fi fi' /\
ren_separated fi fi' mc mf /\
(forall (pfc': containsThread tpc' i) (pff': containsThread tpf' i)
(Hcompc': mem_compatible tpc' mc') (Hcompf': mem_compatible tpf' mf'),
strong_tsim fi' pfc' pff' Hcompc' Hcompf' /\
(forall b2, (~exists b1, fi' b1 = Some b2) ->
forall ofs, (getThreadR pff').1 # b2 ofs = (getThreadR pff).1 # b2 ofs /\
(getThreadR pff').2 # b2 ofs = (getThreadR pff).2 # b2 ofs)) /\
(forall j (pffj : containsThread tpf j),
i <> j ->
forall (b1 b2 : block),
fi' b1 = Some b2 ->
fi b1 = None ->
forall ofs, (getThreadR pffj).1 # b2 ofs = None /\ (getThreadR pffj).2 # b2 ofs = None) /\
(forall (bl : block) (ofsl : Z)
rmap
(b1 b2 : block) (ofs : Z),
fi' b1 = Some b2 ->
fi b1 = None ->
lockRes tpf (bl, ofsl) = Some rmap -> rmap.1 # b2 ofs = None /\ rmap.2 # b2 ofs = None).
(*TODO: move this *)
Lemma setMaxPerm_valid:
forall m b, Mem.valid_block m b <-> Mem.valid_block (setMaxPerm m) b.
Lemma weak_tsim_fstep:
forall tpc tpf tpf' mc mf mf' i j f U tr tr'
(pffi: containsThread tpf i)
(pfcj: containsThread tpc j) (pffj: containsThread tpf j)
(pffj': containsThread tpf' j)
(Hcompc: mem_compatible tpc mc)
(Hcompf: mem_compatible tpf mf)
(Hcompf': mem_compatible tpf' mf')
(HinvF: invariant tpf),
let mrestr := restrPermMap (((compat_th _ _ Hcompf) pffi).1) in
forall (Hinternal: pffi$mrestr @ I)
(Hstep: fmachine_step (i :: U, tr, tpf) mf (U, tr',tpf') mf')
(HweakSim: weak_tsim f pfcj pffj Hcompc Hcompf),
weak_tsim f pfcj pffj' Hcompc Hcompf'.
Lemma cmachine_step_invariant:
forall tpc mc trc tpc' mc' trc' tpc'' trc'' mc'' U U' U'' n
(HstepN: corestepN n
(U, trc, tpc) mc (U', trc',tpc') mc')
(Hstep: cmachine_step (U', trc', tpc') mc' (U'',trc'', tpc'') mc''),
invariant tpc.