Section TRANSL_LABEL.
Remark loadimm32_label:
forall r n k, tail_nolabel k (loadimm32 r n k).
Hint Resolve loadimm32_label: labels.
Remark opimm32_label:
forall op opimm r1 r2 n k,
(forall r1 r2 r3, nolabel (op r1 r2 r3)) ->
(forall r1 r2 n, nolabel (opimm r1 r2 n)) ->
tail_nolabel k (opimm32 op opimm r1 r2 n k).
Hint Resolve opimm32_label: labels.
Remark loadimm64_label:
forall r n k, tail_nolabel k (loadimm64 r n k).
Hint Resolve loadimm64_label: labels.
Remark opimm64_label:
forall op opimm r1 r2 n k,
(forall r1 r2 r3, nolabel (op r1 r2 r3)) ->
(forall r1 r2 n, nolabel (opimm r1 r2 n)) ->
tail_nolabel k (opimm64 op opimm r1 r2 n k).
Hint Resolve opimm64_label: labels.
Remark addptrofs_label:
forall r1 r2 n k, tail_nolabel k (addptrofs r1 r2 n k).
Hint Resolve addptrofs_label: labels.
Remark transl_cond_float_nolabel:
forall c r1 r2 r3 insn normal,
transl_cond_float c r1 r2 r3 = (insn, normal) -> nolabel insn.
Remark transl_cond_single_nolabel:
forall c r1 r2 r3 insn normal,
transl_cond_single c r1 r2 r3 = (insn, normal) -> nolabel insn.
Remark transl_cbranch_label:
forall cond args lbl k c,
transl_cbranch cond args lbl k = OK c -> tail_nolabel k c.
Remark transl_cond_op_label:
forall cond args r k c,
transl_cond_op cond r args k = OK c -> tail_nolabel k c.
Remark transl_op_label:
forall op args r k c,
transl_op op args r k = OK c -> tail_nolabel k c.
Remark indexed_memory_access_label:
forall (mk_instr: ireg -> offset -> instruction) base ofs k,
(forall r o, nolabel (mk_instr r o)) ->
tail_nolabel k (indexed_memory_access mk_instr base ofs k).
Remark loadind_label:
forall base ofs ty dst k c,
loadind base ofs ty dst k = OK c -> tail_nolabel k c.
Remark storeind_label:
forall src base ofs ty k c,
storeind src base ofs ty k = OK c -> tail_nolabel k c.
Remark loadind_ptr_label:
forall base ofs dst k, tail_nolabel k (loadind_ptr base ofs dst k).
Remark storeind_ptr_label:
forall src base ofs k, tail_nolabel k (storeind_ptr src base ofs k).
Remark transl_memory_access_label:
forall (mk_instr: ireg -> offset -> instruction) addr args k c,
(forall r o, nolabel (mk_instr r o)) ->
transl_memory_access mk_instr addr args k = OK c ->
tail_nolabel k c.
Remark make_epilogue_label:
forall f k, tail_nolabel k (make_epilogue f k).
End TRANSL_LABEL.
(** A valid branch in a piece of Mach code translates to a valid ``go to'' transition in the generated Asm code. *)
(** Existence of return addresses *)
(** * Proof of semantic preservation *)
(** Semantic preservation is proved using simulation diagrams of the following form. << st1 --------------- st2 |                   | t|                  *|t |                   | v                   v st1'--------------- st2' >> The invariant is the [match_states] predicate below, which includes: - The Asm code pointed by the PC register is the translation of the current Mach code sequence. - Mach register values and Asm register values agree. *)
Inductive match_states: Mach.state -> Asm.state -> Prop :=
| match_states_intro:
forall s fb sp c ep ms m m' rs f tf tc
(STACKS: match_stack ge s)
(FIND: Genv.find_funct_ptr ge fb = Some (Internal f))
(MEXT: Mem.extends m m')
(AT: transl_code_at_pc ge (rs PC) fb f c ep tf tc)
(AG: agree ms sp rs)
(DXP: ep = true -> rs#X30 = parent_sp s),
match_states (Mach.State s fb sp c ms m)
(Asm.State rs m')
| match_states_call:
forall s fb ms m m' rs
(STACKS: match_stack ge s)
(MEXT: Mem.extends m m')
(AG: agree ms (parent_sp s) rs)
(ATPC: rs PC = Vptr fb Ptrofs.zero)
(ATLR: rs RA = parent_ra s),
match_states (Mach.Callstate s fb ms m)
(Asm.State rs m')
| match_states_return:
forall s ms m m' rs
(STACKS: match_stack ge s)
(MEXT: Mem.extends m m')
(AG: agree ms (parent_sp s) rs)
(ATPC: rs PC = parent_ra s),
match_states (Mach.Returnstate s ms m)
(Asm.State rs m').
(** We need to show that, in the simulation diagram, we cannot take infinitely many Mach transitions that correspond to zero transitions on the Asm side.  Actually, all Mach transitions correspond to at least one Asm transition, except the transition from [Machsem.Returnstate] to [Machsem.State]. So, the following integer measure will suffice to rule out the unwanted behaviour. *)
Definition measure (s: Mach.state) : nat :=
match s with
| Mach.State _ _ _ _ _ _ => 0%nat
| Mach.Callstate _ _ _ _ => 0%nat
| Mach.Returnstate _ _ _ => 1%nat
end.
Remark preg_of_not_X30: forall r, negb (mreg_eq r R30) = true -> IR X30 <> preg_of r.
(** This is the simulation diagram.  We prove it by case analysis on the Mach transition. *)

Theorem transf_program_correct:
forward_simulation (Mach.semantics return_address_offset prog) (Asm.semantics tprog).