Section TRANSL_LABEL.
Remark loadimm_label:
forall r n k, tail_nolabel k (loadimm r n k).
Hint Resolve loadimm_label: labels.
Remark addimm_label:
forall r1 r2 n k, tail_nolabel k (addimm r1 r2 n k).
Hint Resolve addimm_label: labels.
Remark andimm_base_label:
forall r1 r2 n k, tail_nolabel k (andimm_base r1 r2 n k).
Hint Resolve andimm_base_label: labels.
Remark andimm_label:
forall r1 r2 n k, tail_nolabel k (andimm r1 r2 n k).
Hint Resolve andimm_label: labels.
Remark orimm_label:
forall r1 r2 n k, tail_nolabel k (orimm r1 r2 n k).
Hint Resolve orimm_label: labels.
Remark xorimm_label:
forall r1 r2 n k, tail_nolabel k (xorimm r1 r2 n k).
Hint Resolve xorimm_label: labels.
Remark rolm_label:
forall r1 r2 amount mask k, tail_nolabel k (rolm r1 r2 amount mask k).
Hint Resolve rolm_label: labels.
Remark loadimm64_32s_label:
forall r n k, tail_nolabel k (loadimm64_32s r n k).
Hint Resolve loadimm64_32s_label: labels.
Remark loadimm64_label:
forall r n k, tail_nolabel k (loadimm64 r n k).
Hint Resolve loadimm64_label: labels.
Remark loadimm64_notemp_label:
forall r n k, tail_nolabel k (loadimm64_notemp r n k).
Hint Resolve loadimm64_notemp_label: labels.
Remark loadind_label:
forall base ofs ty dst k c,
loadind base ofs ty dst k = OK c -> tail_nolabel k c.
Remark storeind_label:
forall base ofs ty src k c,
storeind src base ofs ty k = OK c -> tail_nolabel k c.
Remark floatcomp_label:
forall cmp r1 r2 k, tail_nolabel k (floatcomp cmp r1 r2 k).
Hint Resolve floatcomp_label: labels.
Remark transl_cond_label:
forall cond args k c,
transl_cond cond args k = OK c -> tail_nolabel k c.
Remark transl_cond_op_label:
forall cond args r k c,
transl_cond_op cond args r k = OK c -> tail_nolabel k c.
Remark transl_select_op_label:
forall cond args r1 r2 rd k c,
transl_select_op cond args r1 r2 rd k = OK c -> tail_nolabel k c.
Remark transl_fselect_op_label:
forall cond args r1 r2 rd k c,
transl_fselect_op cond args r1 r2 rd k = OK c -> tail_nolabel k c.
Remark transl_op_label:
forall op args r k c,
transl_op op args r k = OK c -> tail_nolabel k c.
Remark transl_memory_access_label:
forall (mk1: constant -> ireg -> instruction) (mk2: ireg -> ireg -> instruction)
addr args temp k c,
transl_memory_access mk1 mk2 addr args temp k = OK c ->
(forall c r, nolabel (mk1 c r)) ->
(forall r1 r2, nolabel (mk2 r1 r2)) ->
tail_nolabel k c.
Remark transl_epilogue_label:
forall f k, tail_nolabel k (transl_epilogue f k).
End TRANSL_LABEL.
(** A valid branch in a piece of Mach code translates to a valid ``go to'' transition in the generated PPC code. *)
(** Existence of return addresses *)
(** * Proof of semantic preservation *)
(** Semantic preservation is proved using simulation diagrams of the following form. << st1 --------------- st2 |                   | t|                  *|t |                   | v                   v st1'--------------- st2' >> The invariant is the [match_states] predicate below, which includes: - The PPC code pointed by the PC register is the translation of the current Mach code sequence. - Mach register values and PPC register values agree. *)
Inductive match_states: Mach.state -> Asm.state -> Prop :=
| match_states_intro:
forall s fb sp c ep ms m m' rs f tf tc
(STACKS: match_stack ge s)
(FIND: Genv.find_funct_ptr ge fb = Some (Internal f))
(MEXT: Mem.extends m m')
(AT: transl_code_at_pc ge (rs PC) fb f c ep tf tc)
(AG: agree ms sp rs)
(DXP: ep = true -> rs#GPR11 = parent_sp s)
(LEAF: is_leaf_function f = true -> rs#LR = parent_ra s),
match_states (Mach.State s fb sp c ms m)
(Asm.State rs m')
| match_states_call:
forall s fb ms m m' rs
(STACKS: match_stack ge s)
(MEXT: Mem.extends m m')
(AG: agree ms (parent_sp s) rs)
(ATPC: rs PC = Vptr fb Ptrofs.zero)
(ATLR: rs RA = parent_ra s),
match_states (Mach.Callstate s fb ms m)
(Asm.State rs m')
| match_states_return:
forall s ms m m' rs
(STACKS: match_stack ge s)
(MEXT: Mem.extends m m')
(AG: agree ms (parent_sp s) rs)
(ATPC: rs PC = parent_ra s),
match_states (Mach.Returnstate s ms m)
(Asm.State rs m').
(** We need to show that, in the simulation diagram, we cannot take infinitely many Mach transitions that correspond to zero transitions on the PPC side.  Actually, all Mach transitions correspond to at least one PPC transition, except the transition from [Machsem.Returnstate] to [Machsem.State]. So, the following integer measure will suffice to rule out the unwanted behaviour. *)
Definition measure (s: Mach.state) : nat :=
match s with
| Mach.State _ _ _ _ _ _ => 0%nat
| Mach.Callstate _ _ _ _ => 0%nat
| Mach.Returnstate _ _ _ => 1%nat
end.
Remark preg_of_not_GPR11: forall r, negb (mreg_eq r R11) = true -> IR GPR11 <> preg_of r.
(** This is the simulation diagram.  We prove it by case analysis on the Mach transition. *)

Theorem transf_program_correct:
forward_simulation (Mach.semantics return_address_offset prog) (Asm.semantics tprog).