Section TRANSL_LABEL.
Remark mk_mov_label:
forall rd rs k c, mk_mov rd rs k = OK c -> tail_nolabel k c.
Hint Resolve mk_mov_label: labels.
Remark mk_shrximm_label:
forall n k c, mk_shrximm n k = OK c -> tail_nolabel k c.
Hint Resolve mk_shrximm_label: labels.
Remark mk_shrxlimm_label:
forall n k c, mk_shrxlimm n k = OK c -> tail_nolabel k c.
Hint Resolve mk_shrxlimm_label: labels.
Remark mk_intconv_label:
forall f r1 r2 k c, mk_intconv f r1 r2 k = OK c ->
(forall r r', nolabel (f r r')) ->
tail_nolabel k c.
Hint Resolve mk_intconv_label: labels.
Remark mk_storebyte_label:
forall addr r k c, mk_storebyte addr r k = OK c -> tail_nolabel k c.
Hint Resolve mk_storebyte_label: labels.
Remark loadind_label:
forall base ofs ty dst k c,
loadind base ofs ty dst k = OK c ->
tail_nolabel k c.
Remark storeind_label:
forall base ofs ty src k c,
storeind src base ofs ty k = OK c ->
tail_nolabel k c.
Remark mk_setcc_base_label:
forall xc rd k,
tail_nolabel k (mk_setcc_base xc rd k).
Remark mk_setcc_label:
forall xc rd k,
tail_nolabel k (mk_setcc xc rd k).
Remark mk_jcc_label:
forall xc lbl' k,
tail_nolabel k (mk_jcc xc lbl' k).
Remark mk_sel_label:
forall xc rd r2 k c,
mk_sel xc rd r2 k = OK c ->
tail_nolabel k c.
Remark transl_cond_label:
forall cond args k c,
transl_cond cond args k = OK c ->
tail_nolabel k c.
Remark transl_op_label:
forall op args r k c,
transl_op op args r k = OK c ->
tail_nolabel k c.
Remark transl_load_label:
forall chunk addr args dest k c,
transl_load chunk addr args dest k = OK c ->
tail_nolabel k c.
Remark transl_store_label:
forall chunk addr args src k c,
transl_store chunk addr args src k = OK c ->
tail_nolabel k c.
End TRANSL_LABEL.
(** A valid branch in a piece of Mach code translates to a valid ``go to'' transition in the generated PPC code. *)
(** Existence of return addresses *)
(** * Proof of semantic preservation *)
(** Semantic preservation is proved using simulation diagrams of the following form. << st1 --------------- st2 |                   | t|                  *|t |                   | v                   v st1'--------------- st2' >> The invariant is the [match_states] predicate below, which includes: - The PPC code pointed by the PC register is the translation of the current Mach code sequence. - Mach register values and PPC register values agree. *)
Inductive match_states: Mach.state -> Asm.state -> Prop :=
| match_states_intro:
forall s fb sp c ep ms m m' rs f tf tc
(STACKS: match_stack ge s)
(FIND: Genv.find_funct_ptr ge fb = Some (Internal f))
(MEXT: Mem.extends m m')
(AT: transl_code_at_pc ge (rs PC) fb f c ep tf tc)
(AG: agree ms sp rs)
(AXP: ep = true -> rs#RAX = parent_sp s),
match_states (Mach.State s fb sp c ms m)
(Asm.State rs m')
| match_states_call:
forall s fb ms m m' rs
(STACKS: match_stack ge s)
(MEXT: Mem.extends m m')
(AG: agree ms (parent_sp s) rs)
(ATPC: rs PC = Vptr fb Ptrofs.zero)
(ATLR: rs RA = parent_ra s),
match_states (Mach.Callstate s fb ms m)
(Asm.State rs m')
| match_states_return:
forall s ms m m' rs
(STACKS: match_stack ge s)
(MEXT: Mem.extends m m')
(AG: agree ms (parent_sp s) rs)
(ATPC: rs PC = parent_ra s),
match_states (Mach.Returnstate s ms m)
(Asm.State rs m').
(** We need to show that, in the simulation diagram, we cannot take infinitely many Mach transitions that correspond to zero transitions on the PPC side.  Actually, all Mach transitions correspond to at least one Asm transition, except the transition from [Mach.Returnstate] to [Mach.State]. So, the following integer measure will suffice to rule out the unwanted behaviour. *)
Definition measure (s: Mach.state) : nat :=
match s with
| Mach.State _ _ _ _ _ _ => 0%nat
| Mach.Callstate _ _ _ _ => 0%nat
| Mach.Returnstate _ _ _ => 1%nat
end.
(** This is the simulation diagram.  We prove it by case analysis on the Mach transition. *)

Theorem transf_program_correct:
forward_simulation (Mach.semantics return_address_offset prog) (Asm.semantics tprog).