(** In this file we prove the equivalence between several types of safety. In particular, an equivalence between csafe and safe. - Csafe: the safety used almost everywhere else in the development - Ksafe: the safety used by konig theorem. - Safe: the coinductive safety used by konig. - Explicit_safety: the safety preserved by machine simulations.  The proofs apply to all Coarse, dry hybrid machines. *)
(** *Juicy safetyn*)
(** *Erasure Imports*)
(** *SAFETY*)
(** *SSROMEGA*)
Set Bullet Behavior "Strict Subproofs".
(** *Excluded middle*)
Section SafetyEquivalence.
(* We put in our context a generic, coarse, dry hybrid machine. *)
Context (resources:semantics.Resources)
(Sem:semantics.Semantics)
(TP: threadPool.ThreadPool.ThreadPool).
Definition CoreSem:= semantics.csem (event_semantics.msem (@semantics.semSem Sem)).
Context (Machine: MachineSig).
Existing Instance Machine.
Existing Instance DilMem.
Existing Instance scheduler.
(* Ltac definition: yield and diluteMem are always identity for the Corase machines. this tactic allows to fold the definitions, to use constructors and lemmas. *)
Ltac fold_ids:=
repeat match goal with
| [ U: schedule |-  _ ] =>
match goal with
| [  |- context[yield U] ] => fail 1
| [  |- context[U] ] => replace U with (yield U) by auto
end
| [ m: mem |-  _ ] =>
match goal with
| [  |- context[diluteMem m] ] => fail 1
| [  |- context[m] ] => replace m with (diluteMem m) by auto
end
end.
(** *Setup *)
(** We must reorganize the types of the machine to match those from konig/safety. So we change the types of MachState and MachStep *)
(* A correct schedule is one where, if there is a running thread, it is the first one on the scheudle*)
Definition correct_schedule (tp:  ThreadPool.t) U : Prop:=
match schedPeek U with
| Some i => unique_Krun tp i
| None => True
end.
(* Bounded memory *)
Definition bounded_mem (m: mem) := bounded_maps.bounded_map (snd (getMaxPerm m)) .
(* kstate, packages trace, thread pool and memory, to use konig theorem. *)
Definition kstate:Type:= (event_trace * ThreadPool.t * mem).
Definition cstate2kstate (st:MachState) (m:mem): kstate:=
(snd (fst st), snd st, m).
Definition kstate2cstate (st:kstate) U: MachState:=
(U, fst (fst st), snd (fst st)).
Ltac simpl_state:=
unfold kstate2cstate, cstate2kstate in *; simpl in *.
(* Semantics that takes a step or loops when halted. *)
Inductive sem_with_halt: MachState -> mem -> MachState -> mem -> Prop:=
| halted_step st m:
is_true (ssrbool.isSome (halted_machine st)) -> sem_with_halt st m st m
| step_step st m st' m' :
MachStep st m st' m' ->
sem_with_halt st m st' m'.
Definition kstep (st: kstate) U st' U': Prop:=
sem_with_halt (kstate2cstate st U) (snd st) (kstate2cstate st' U') (snd st').
(* Validity *)
(* We really only care about states where the schedule is correct. *)
Definition valid (kst:kstate) U := correct_schedule (snd (fst kst)) U.
(* Also we might care only about bounded states. *)
Definition valid_bound st U :=
valid st U /\ bounded_mem (snd st).
Definition ksafe_kstep (st : MachState) (m : mem) : nat -> Prop :=
ksafe _ _ (kstep) valid (cstate2kstate st m) (fst (fst st)).
Definition safe_kstep (st : MachState) (m : mem) : Prop :=
safe _ _ (kstep) valid (cstate2kstate st m) (fst (fst st)).
Section Csafe_KSafe.
(** *Csafe and Ksafe*)
(** Prove of equivalence between Csafe and Ksafe. - Csafe is the safety notion used by top level (Clight) and bottom level (Asm). - Ksafe is the notion of safety used by konig proof. Proofs in this section are for all dry and not diluted Coarse hybrid machines. *)
(* All machine steps are either Core or Angel (according to csafe)*)
Inductive CoreOrAngel: MachState -> MachState -> Prop:=
| IsCore st tr tp':
CoreOrAngel st (fst (fst st), seq.cat (snd (fst st)) tr, tp')
| IsAngel st tr tp':
CoreOrAngel st (schedSkip (fst (fst st)), seq.cat (snd (fst st)) tr, tp').

Lemma csafe_monotone:
forall n U tr tp m,
csafe (U, tr, tp) m (S n) ->
csafe (U, tr, tp) m (n) .