(* The following two lemmas is not now used. but after deep embedded hoare logic (SL_as_Logic) is ported, the frame does not need to be quantified in the semantic definition of semax. Then, these two lemmas can replace the other two afterwards. *)

(* Specifications: *)
Lemma assert_safe_except_0':
forall {Espec: OracleKind} gx vx tx PP1 PP2 rho (P: environ -> pred rmap) k,
PP1 && (P rho) && PP2 >=>
assert_safe Espec gx vx tx k rho =
PP1 && ((|> FF || P rho)) && PP2 >=>
assert_safe Espec gx vx tx k rho.
Lemma _guard_except_0':
forall {Espec: OracleKind} ge Delta (P: environ -> pred rmap) f k,
_guard Espec ge Delta P f k = _guard Espec ge Delta (fun rho => |> FF || P rho) f k.
Lemma guard_except_0':
forall {Espec: OracleKind} ge Delta (P: environ -> pred rmap) k,
guard Espec ge Delta P k = guard Espec ge Delta (fun rho => |> FF || P rho) k.
Lemma rguard_except_0':
forall {Espec: OracleKind} ge Delta (P: ret_assert) k,
rguard Espec ge Delta P k = rguard Espec ge Delta (except_0_ret_assert P) k.
Lemma assert_safe_except_0:
forall {Espec: OracleKind} gx vx tx PP1 PP2 rho (F P: environ -> pred rmap) k,
PP1 && (F rho * P rho) && PP2 >=>
assert_safe Espec gx vx tx k rho =
PP1 && (F rho * (|> FF || P rho)) && PP2 >=>
assert_safe Espec gx vx tx k rho.
Lemma _guard_except_0:
forall {Espec: OracleKind} ge Delta (F P: environ -> pred rmap) f k,
_guard Espec ge Delta (fun rho => F rho * P rho) f k = _guard Espec ge Delta (fun rho => F rho * (|> FF || P rho)) f k.
Lemma guard_except_0:
forall {Espec: OracleKind} ge Delta (F P: environ -> pred rmap) k,
guard Espec ge Delta (fun rho => F rho * P rho) k =
guard Espec ge Delta (fun rho => F rho * (|> FF || P rho)) k.
Lemma rguard_except_0:
forall {Espec: OracleKind} ge Delta (F: environ -> pred rmap) Q k,
rguard Espec ge Delta (frame_ret_assert Q F) k =
rguard Espec ge Delta (frame_ret_assert (except_0_ret_assert Q) F) k.
Lemma _guard_allp_fun_id:
forall {Espec: OracleKind} ge Delta' Delta (F P: environ -> pred rmap) f k,
tycontext_sub Delta Delta' ->
_guard Espec ge Delta' (fun rho => F rho * P rho) f k = _guard Espec ge Delta' (fun rho => F rho * (allp_fun_id Delta rho && P rho)) f k.
Lemma guard_allp_fun_id: forall {Espec: OracleKind} ge Delta' Delta (F P: environ -> pred rmap) k,
tycontext_sub Delta Delta' ->
guard Espec ge Delta' (fun rho => F rho * P rho) k = guard Espec ge Delta' (fun rho => F rho * (allp_fun_id Delta rho && P rho)) k.
Lemma rguard_allp_fun_id: forall {Espec: OracleKind} ge Delta' Delta (F: environ -> pred rmap) P k,
tycontext_sub Delta Delta' ->
rguard Espec ge Delta' (frame_ret_assert P F) k = rguard Espec ge Delta' (frame_ret_assert (conj_ret_assert P (allp_fun_id Delta)) F) k.
Lemma _guard_tc_environ:
forall {Espec: OracleKind} ge Delta' Delta (F P: environ -> pred rmap) f k,
tycontext_sub Delta Delta' ->
_guard Espec ge Delta' (fun rho => F rho * P rho) f k = _guard Espec ge Delta' (fun rho => F rho * (!! typecheck_environ Delta rho && P rho)) f k.
Lemma guard_tc_environ: forall {Espec: OracleKind} ge Delta' Delta (F P: environ -> pred rmap) k,
tycontext_sub Delta Delta' ->
guard Espec ge Delta' (fun rho => F rho * P rho) k = guard Espec ge Delta' (fun rho => F rho * (!! typecheck_environ Delta rho && P rho)) k.
Lemma rguard_tc_environ: forall {Espec: OracleKind} ge Delta' Delta (F: environ -> pred rmap) P k,
tycontext_sub Delta Delta' ->
rguard Espec ge Delta' (frame_ret_assert P F) k = rguard Espec ge Delta' (frame_ret_assert (conj_ret_assert P (fun rho => !! typecheck_environ Delta rho)) F) k.
Lemma semax_conseq {CS: compspecs} {Espec: OracleKind}:
forall Delta P' (R': ret_assert) P c (R: ret_assert) ,
(forall rho,  !!(typecheck_environ Delta rho) && (allp_fun_id Delta rho && P rho)
|-- bupd (|> FF || P' rho) )%pred ->
(forall rho,  !!(typecheck_environ Delta rho) && (allp_fun_id Delta rho && RA_normal R' rho)
|-- bupd (|> FF || RA_normal R rho)) ->
(forall rho, !! (typecheck_environ Delta rho) && (allp_fun_id Delta rho && RA_break R' rho)
|-- bupd (|> FF || RA_break R rho)) ->
(forall rho, !! (typecheck_environ Delta rho) && (allp_fun_id Delta rho && RA_continue R' rho)
|-- bupd (|> FF || RA_continue R rho)) ->
(forall vl rho, !! (typecheck_environ Delta rho) && (allp_fun_id Delta rho && RA_return R' vl rho)
|-- bupd (|> FF || RA_return R vl rho)) ->
semax Espec Delta P' c R' ->  semax Espec Delta P c R.
(* Part 2: Deriving simpler and older version of consequence rules from semax_conseq. *)
Lemma semax'_post_bupd:
forall {CS: compspecs} {Espec: OracleKind} (R': ret_assert) Delta (R: ret_assert) P c,
(forall ek vl rho,  !!(typecheck_environ Delta rho ) &&
proj_ret_assert R' ek vl rho
|-- bupd (proj_ret_assert R ek vl rho)) ->
semax' Espec Delta P c R' |-- semax' Espec Delta P c R.
Lemma semax'_post:
forall {CS: compspecs} {Espec: OracleKind} (R': ret_assert) Delta (R: ret_assert) P c,
(forall ek vl rho,  !!(typecheck_environ Delta rho) &&
proj_ret_assert R' ek vl rho
|-- proj_ret_assert R ek vl rho) ->
semax' Espec Delta P c R' |-- semax' Espec Delta P c R.
Lemma semax'_pre_bupd:
forall {CS: compspecs} {Espec: OracleKind} P' Delta R P c,
(forall rho, typecheck_environ Delta rho ->   P rho |-- bupd (P' rho))
->   semax' Espec Delta P' c R |-- semax' Espec Delta P c R.
Lemma semax'_pre:
forall {CS: compspecs} {Espec: OracleKind} P' Delta R P c,
(forall rho, typecheck_environ Delta rho ->   P rho |-- P' rho)
->   semax' Espec Delta P' c R |-- semax' Espec Delta P c R.
Lemma semax'_pre_post_bupd:
forall
{CS: compspecs} {Espec: OracleKind} P' (R': ret_assert) Delta (R: ret_assert) P c,
(forall rho, typecheck_environ Delta rho ->   P rho |-- bupd (P' rho)) ->
(forall ek vl rho, !!(typecheck_environ Delta rho)
&&  proj_ret_assert R ek vl rho
|-- bupd (proj_ret_assert R' ek vl rho)) ->
semax' Espec Delta P' c R |-- semax' Espec Delta P c R'.
Lemma semax'_pre_post:
forall
{CS: compspecs} {Espec: OracleKind} P' (R': ret_assert) Delta (R: ret_assert) P c,
(forall rho, typecheck_environ Delta rho ->   P rho |-- P' rho) ->
(forall ek vl rho, !!(typecheck_environ Delta rho)
&&  proj_ret_assert R ek vl rho
|-- proj_ret_assert R' ek vl rho) ->
semax' Espec Delta P' c R |-- semax' Espec Delta P c R'.
Lemma semax_post'_bupd {CS: compspecs} {Espec: OracleKind}:
forall (R': ret_assert) Delta (R: ret_assert) P c,
(forall ek vl rho,  !!(typecheck_environ Delta rho)
&&  proj_ret_assert R' ek vl rho
|-- bupd (proj_ret_assert R ek vl rho)) ->
semax Espec Delta P c R' ->  semax Espec Delta P c R.
Lemma semax_post_bupd {CS: compspecs} {Espec: OracleKind}:
forall (R': ret_assert) Delta (R: ret_assert) P c,
(forall rho,  !!(typecheck_environ Delta rho)
&&  RA_normal R' rho |-- bupd (RA_normal R rho)) ->
(forall rho, !! (typecheck_environ Delta rho)
&& RA_break R' rho |-- bupd (RA_break R rho)) ->
(forall rho, !! (typecheck_environ Delta rho)
&& RA_continue R' rho |-- bupd (RA_continue R rho)) ->
(forall vl rho, !! (typecheck_environ Delta rho)
&& RA_return R' vl rho |-- bupd (RA_return R vl rho)) ->
semax Espec Delta P c R' ->  semax Espec Delta P c R.
Lemma semax_post' {CS: compspecs} {Espec: OracleKind}:
forall (R': ret_assert) Delta (R: ret_assert) P c,
(forall ek vl rho,  !!(typecheck_environ Delta rho)
&&  proj_ret_assert R' ek vl rho
|-- proj_ret_assert R ek vl rho) ->
semax Espec Delta P c R' ->  semax Espec Delta P c R.
Lemma semax_post {CS: compspecs} {Espec: OracleKind}:
forall (R': ret_assert) Delta (R: ret_assert) P c,
(forall rho,  !!(typecheck_environ Delta rho)
&&  RA_normal R' rho |-- RA_normal R rho) ->
(forall rho, !! (typecheck_environ Delta rho)
&& RA_break R' rho |-- RA_break R rho) ->
(forall rho, !! (typecheck_environ Delta rho)
&& RA_continue R' rho |-- RA_continue R rho) ->
(forall vl rho, !! (typecheck_environ Delta rho)
&& RA_return R' vl rho |-- RA_return R vl rho) ->
semax Espec Delta P c R' ->  semax Espec Delta P c R.
Lemma semax_pre_bupd {CS: compspecs} {Espec: OracleKind} :
forall P' Delta P c R,
(forall rho,  !!(typecheck_environ Delta rho) &&  P rho |-- bupd (P' rho) )%pred ->
semax Espec Delta P' c R  -> semax Espec Delta P c R.
Lemma semax_pre {CS: compspecs} {Espec: OracleKind} :
forall P' Delta P c R,
(forall rho,  !!(typecheck_environ Delta rho) &&  P rho |-- P' rho )%pred ->
semax Espec Delta P' c R  -> semax Espec Delta P c R.
Lemma semax_pre_post_bupd {CS: compspecs} {Espec: OracleKind}:
forall P' (R': ret_assert) Delta P c (R: ret_assert) ,
(forall rho,  !!(typecheck_environ Delta rho) &&  P rho |-- bupd (P' rho) )%pred ->
(forall rho,  !!(typecheck_environ Delta rho)
&&  RA_normal R' rho |-- bupd (RA_normal R rho)) ->
(forall rho, !! (typecheck_environ Delta rho)
&& RA_break R' rho |-- bupd (RA_break R rho)) ->
(forall rho, !! (typecheck_environ Delta rho)
&& RA_continue R' rho |-- bupd (RA_continue R rho)) ->
(forall vl rho, !! (typecheck_environ Delta rho)
&& RA_return R' vl rho |-- bupd (RA_return R vl rho)) ->
semax Espec Delta P' c R' ->  semax Espec Delta P c R.
Lemma semax_pre_post {CS: compspecs} {Espec: OracleKind}:
forall P' (R': ret_assert) Delta P c (R: ret_assert) ,
(forall rho,  !!(typecheck_environ Delta rho) &&  P rho |-- P' rho )%pred ->
(forall rho,  !!(typecheck_environ Delta rho)
&&  RA_normal R' rho |-- RA_normal R rho) ->
(forall rho, !! (typecheck_environ Delta rho)
&& RA_break R' rho |-- RA_break R rho) ->
(forall rho, !! (typecheck_environ Delta rho)
&& RA_continue R' rho |-- RA_continue R rho) ->
(forall vl rho, !! (typecheck_environ Delta rho)
&& RA_return R' vl rho |-- RA_return R vl rho) ->
semax Espec Delta P' c R' ->  semax Espec Delta P c R.
Lemma semax_bupd_elim {CS: compspecs} {Espec: OracleKind}:
forall Delta P c R,
semax Espec Delta P c R -> semax Espec Delta (fun rho => bupd (P rho)) c R.
Lemma semax_skip {CS: compspecs} {Espec: OracleKind}:
forall Delta P, semax Espec Delta P Sskip (normal_ret_assert P).