(** ** Erased X86 machine is safe*)
From mathcomp.ssreflect Require Import ssreflect ssrbool ssrnat ssrfun eqtype seq fintype finfun.
Set Implicit Arguments.
(*NOTE: because of redefinition of [val], these imports must appear after Ssreflect eqtype.*)
Module X86Safe.
HybridMachineSig HybridCoarseMachine HybridFineMachine
FineConcSafe FineConcInitial.
Section X86Safe.
Context {U: seq.seq nat}
{the_program: Asm.program}
{Hsafe: Asm_core.safe_genv (@the_ge the_program)}.
Instance X86Sem : Semantics := @X86Sem the_program Hsafe.
Instance X86Axioms : CoreLanguage.SemAxioms := @X86Axioms U the_program Hsafe.
Existing Instance X86CoreErasure.X86Erasure.
Existing Instance X86Inj.X86Inj.
(* We don't really have an instance for that, it would require to prove that the initial memory has no invalid pointers *)
Context {FI : FineInit}.
Variable em : ClassicalFacts.excluded_middle.
Existing Instance dryCoarseMach.
Existing Instance dryFineMach.
Existing Instance bareMach.

Lemma x86SC_safe:
forall Main_ptr init_thread_target new_mem_target,
initial_core (event_semantics.msem semSem) 0 init_mem init_thread_target new_mem_target Main_ptr nil ->
let init_perm_target := permissions.getCurPerm init_mem in
let new_perm_target := permissions.getCurPerm new_mem_target in
let init_tpc_target := DryHybridMachine.initial_machine new_perm_target init_thread_target in
forall
(Hcsafe: forall n sched,
csafe
(ThreadPool:= threadPool.OrdinalPool.OrdinalThreadPool)
(resources:= DryHybridMachine.dryResources)
(Sem:= _)
(machineSig:= HybridMachine.DryHybridMachine.DryHybridMachineSig)
(sched, nil, init_tpc_target) (@diluteMem HybridCoarseMachine.DilMem new_mem_target) n),
let init_tp_bare := ThreadPool.mkPool
(resources:=BareMachine.resources)
(Krun init_thread_target) tt  in
forall n,
fsafe
(dilMem:= BareDilMem)
(ThreadPool:=threadPool.OrdinalPool.OrdinalThreadPool
(resources:=erased_machine.BareMachine.resources)
(Sem:=_))
(machineSig:= BareMachine.BareMachineSig)
init_tp_bare (@diluteMem BareDilMem new_mem_target) U n.