(** Erasure Safety *)
(** Derive safety from the simulations. Erasure proven in [erasure_proof.v] and [erasure_signature.v] is stated as a simulation. Here we prove that the simulation implies safety. *)
(** *Imports*)
(* This file uses Proof Irrelevance: forall (P : Prop) (p1 p2 : P), p1 = p2. *)
(* CompCert imports*)
(* VST imports *)
(* Concurrency Imports *)
(*Erasure simulation*)
(*SSReflect*)
From mathcomp.ssreflect Require Import ssreflect ssrbool ssrnat eqtype seq.
From mathcomp.ssreflect Require Import ssreflect seq.
(*The simulations*)
(* Require Import VST.concurrency.common.machine_simulation.*)
Set Bullet Behavior "Strict Subproofs".
Module ErasureSafety.
Module ErasureProof := erasure_proof.Parching.
Module Erasure := ErasureFnctr ErasureProof.
Section ErasureSafety.
Context (initU: HybridMachineSig.schedule).
Context (init_rmap : @res JR).
Context (init_pmap : @res DR).
Context (init_rmap_perm:  match_rmap_perm init_rmap init_pmap).
(*Definition local_erasure:= erasure initU init_rmap init_pmap init_rmap_perm.*)
Definition step_diagram:= ErasureProof.core_diagram.
Existing Instance DMS.

(*there is something weird about this theorem.*)
(*The injection is trivial... but it shouldn't*)
(*  Theorem initial_safety: forall genv (U : HybridMachineSig.schedule) (js : jstate genv) (vals : seq Values.val) m (rmap0 : rmap) (pmap : access_map * access_map) main h, match_rmap_perm rmap0 pmap -> no_locks_perm rmap0 -> initial_core (JMachineSem U (Some rmap0)) h m (U, [::], js) main vals  -> exists (ds : dstate genv), initial_core (ClightMachineSem U (Some pmap)) h m (U, [::], ds) main vals /\ invariant ds /\ match_st genv js ds.  End ErasureSafety.  End ErasureSafety.  Require Import VST.concurrency.juicy.semax_to_juicy_machine.  Lemma no_locks_no_locks_perm : forall r, Parching.no_locks_perm r <-> initial_world.no_locks r.  (* unused *)
Lemma juice2Perm_match : forall m r, access_cohere' m r ->
Parching.match_rmap_perm r (juice2Perm r m, empty_map).