Section TRANSL_LABEL.
Remark loadimm_z_label: forall sz rd l k, tail_nolabel k (loadimm_z sz rd l k).
Remark loadimm_n_label: forall sz rd l k, tail_nolabel k (loadimm_n sz rd l k).
Remark loadimm_label: forall sz rd n k, tail_nolabel k (loadimm sz rd n k).
Hint Resolve loadimm_label: labels.
Remark loadimm32_label: forall r n k, tail_nolabel k (loadimm32 r n k).
Hint Resolve loadimm32_label: labels.
Remark loadimm64_label: forall r n k, tail_nolabel k (loadimm64 r n k).
Hint Resolve loadimm64_label: labels.
Remark addimm_aux: forall insn rd r1 n k,
(forall rd r1 n, nolabel (insn rd r1 n)) ->
tail_nolabel k (addimm_aux insn rd r1 n k).
Remark addimm32_label: forall rd r1 n k, tail_nolabel k (addimm32 rd r1 n k).
Hint Resolve addimm32_label: labels.
Remark addimm64_label: forall rd r1 n k, tail_nolabel k (addimm64 rd r1 n k).
Hint Resolve addimm64_label: labels.
Remark logicalimm32_label: forall insn1 insn2 rd r1 n k,
(forall rd r1 n, nolabel (insn1 rd r1 n)) ->
(forall rd r1 r2 s, nolabel (insn2 rd r1 r2 s)) ->
tail_nolabel k (logicalimm32 insn1 insn2 rd r1 n k).
Remark logicalimm64_label: forall insn1 insn2 rd r1 n k,
(forall rd r1 n, nolabel (insn1 rd r1 n)) ->
(forall rd r1 r2 s, nolabel (insn2 rd r1 r2 s)) ->
tail_nolabel k (logicalimm64 insn1 insn2 rd r1 n k).
Remark move_extended_label: forall rd r1 ex a k, tail_nolabel k (move_extended rd r1 ex a k).
Hint Resolve move_extended_label: labels.
Remark arith_extended_label: forall insnX insnS rd r1 r2 ex a k,
(forall rd r1 r2 x, nolabel (insnX rd r1 r2 x)) ->
(forall rd r1 r2 s, nolabel (insnS rd r1 r2 s)) ->
tail_nolabel k (arith_extended insnX insnS rd r1 r2 ex a k).
Remark loadsymbol_label: forall r id ofs k, tail_nolabel k (loadsymbol r id ofs k).
Hint Resolve loadsymbol_label: labels.
Remark transl_cond_label: forall cond args k c,
transl_cond cond args k = OK c -> tail_nolabel k c.
Remark transl_cond_branch_default_label: forall cond args lbl k c,
transl_cond_branch_default cond args lbl k = OK c -> tail_nolabel k c.
Hint Resolve transl_cond_branch_default_label: labels.
Remark transl_cond_branch_label: forall cond args lbl k c,
transl_cond_branch cond args lbl k = OK c -> tail_nolabel k c.
Remark transl_op_label:
forall op args r k c,
transl_op op args r k = OK c -> tail_nolabel k c.
Remark transl_addressing_label:
forall sz addr args insn k c,
transl_addressing sz addr args insn k = OK c ->
(forall ad, nolabel (insn ad)) ->
tail_nolabel k c.
Remark transl_load_label:
forall chunk addr args dst k c,
transl_load chunk addr args dst k = OK c -> tail_nolabel k c.
Remark transl_store_label:
forall chunk addr args src k c,
transl_store chunk addr args src k = OK c -> tail_nolabel k c.
Remark indexed_memory_access_label:
forall insn sz base ofs k,
(forall ad, nolabel (insn ad)) ->
tail_nolabel k (indexed_memory_access insn sz base ofs k).
Remark loadind_label:
forall base ofs ty dst k c,
loadind base ofs ty dst k = OK c -> tail_nolabel k c.
Remark storeind_label:
forall src base ofs ty k c,
storeind src base ofs ty k = OK c -> tail_nolabel k c.
Remark loadptr_label:
forall base ofs dst k, tail_nolabel k (loadptr base ofs dst k).
Remark storeptr_label:
forall src base ofs k, tail_nolabel k (storeptr src base ofs k).
Remark make_epilogue_label:
forall f k, tail_nolabel k (make_epilogue f k).
End TRANSL_LABEL.
(** A valid branch in a piece of Mach code translates to a valid ``go to'' transition in the generated Asm code. *)
(** Existence of return addresses *)
(** * Proof of semantic preservation *)
(** Semantic preservation is proved using simulation diagrams of the following form. << st1 --------------- st2 |                   | t|                  *|t |                   | v                   v st1'--------------- st2' >> The invariant is the [match_states] predicate below, which includes: - The Asm code pointed by the PC register is the translation of the current Mach code sequence. - Mach register values and Asm register values agree. *)
Inductive match_states: Mach.state -> Asm.state -> Prop :=
| match_states_intro:
forall s fb sp c ep ms m m' rs f tf tc
(STACKS: match_stack ge s)
(FIND: Genv.find_funct_ptr ge fb = Some (Internal f))
(MEXT: Mem.extends m m')
(AT: transl_code_at_pc ge (rs PC) fb f c ep tf tc)
(AG: agree ms sp rs)
(DXP: ep = true -> rs#X29 = parent_sp s),
match_states (Mach.State s fb sp c ms m)
(Asm.State rs m')
| match_states_call:
forall s fb ms m m' rs
(STACKS: match_stack ge s)
(MEXT: Mem.extends m m')
(AG: agree ms (parent_sp s) rs)
(ATPC: rs PC = Vptr fb Ptrofs.zero)
(ATLR: rs RA = parent_ra s),
match_states (Mach.Callstate s fb ms m)
(Asm.State rs m')
| match_states_return:
forall s ms m m' rs
(STACKS: match_stack ge s)
(MEXT: Mem.extends m m')
(AG: agree ms (parent_sp s) rs)
(ATPC: rs PC = parent_ra s),
match_states (Mach.Returnstate s ms m)
(Asm.State rs m').
(** We need to show that, in the simulation diagram, we cannot take infinitely many Mach transitions that correspond to zero transitions on the Asm side.  Actually, all Mach transitions correspond to at least one Asm transition, except the transition from [Machsem.Returnstate] to [Machsem.State]. So, the following integer measure will suffice to rule out the unwanted behaviour. *)
Definition measure (s: Mach.state) : nat :=
match s with
| Mach.State _ _ _ _ _ _ => 0%nat
| Mach.Callstate _ _ _ _ => 0%nat
| Mach.Returnstate _ _ _ => 1%nat
end.
Remark preg_of_not_X29: forall r, negb (mreg_eq r R29) = true -> IR X29 <> preg_of r.
(** This is the simulation diagram.  We prove it by case analysis on the Mach transition. *)

Theorem transf_program_correct:
forward_simulation (Mach.semantics return_address_offset prog) (Asm.semantics tprog).