End Csafety_Clight. *)
(*Infinite safety*)
Section safety_Clight.

(* Specifications: *)
(*First we change validty to preserve bounded memory*)
Lemma ksafe_new_step_ksafe_new_step_bounded: forall ge ds m,
(forall (n : nat) (sch : Sch),
new_valid  (mk_nstate (sch, nil, ds) m) sch ->
ksafe_new_step ge
(sch, nil, ds) m n) ->
forall (n : nat) sch,
new_valid_bound (mk_nstate (sch, nil, ds) m) sch ->
safety.ksafe new_state Sch
(new_step ge) new_valid_bound (*Notice the stronger validity*)
(mk_nstate (sch, nil, ds) m) sch n.
(* we prove safety that preserves bounded memory*)
Lemma Initial_bounded_dry_safety:
forall (U : semax_invariant.schedule) (n : nat),
exists init_U init_tr init_st,
(semantics.initial_core (MachineSemantics U (Some ( getCurPerm (juicy_mem.m_dry (init_jmem n)), empty_map)))) 0 init_genv (juicy_mem.m_dry (init_jmem n)) init_point nil =
Some ((init_U, init_tr, init_st), None) /\
forall U',
new_valid_bound (mk_nstate (U', init_tr, init_st) (proj1_sig (init_mem CPROOF))) U' ->
safe_new_step_bound (globalenv prog) (U', init_tr, init_st)
(proj1_sig (init_mem CPROOF)).
(*Facts aboud bounded memory, show it's preserved...*)
Lemma bounded_mem_step:
forall ge sm m sm' m',
MachStep ge sm m sm' m' ->
bounded_mem m ->
bounded_mem m'.
Lemma safe_new_step_bound_safe_new_step: forall sch ds m,
new_valid_bound (nil, ds, m) sch ->
safe_new_step_bound  (globalenv prog) (sch, nil, ds) m ->
safe_new_step  (globalenv prog) (sch, nil, ds) m.
Lemma bounded_empty_mem:
bounded_mem Mem.empty.
Lemma bounded_initial_mem:
bounded_mem (proj1_sig (init_mem CPROOF)).