Section TRANSL_LABEL.
Remark iterate_op_label:
forall op1 op2 l k,
(forall so, nolabel (op1 so)) ->
(forall so, nolabel (op2 so)) ->
tail_nolabel k (iterate_op op1 op2 l k).
Hint Resolve iterate_op_label: labels.
Remark loadimm_label:
forall r n k, tail_nolabel k (loadimm r n k).
Hint Resolve loadimm_label: labels.
Remark addimm_label:
forall r1 r2 n k, tail_nolabel k (addimm r1 r2 n k).
Hint Resolve addimm_label: labels.
Remark andimm_label:
forall r1 r2 n k, tail_nolabel k (andimm r1 r2 n k).
Hint Resolve andimm_label: labels.
Remark rsubimm_label:
forall r1 r2 n k, tail_nolabel k (rsubimm r1 r2 n k).
Hint Resolve rsubimm_label: labels.
Remark orimm_label:
forall r1 r2 n k, tail_nolabel k (orimm r1 r2 n k).
Hint Resolve orimm_label: labels.
Remark xorimm_label:
forall r1 r2 n k, tail_nolabel k (xorimm r1 r2 n k).
Hint Resolve xorimm_label: labels.
Remark indexed_memory_access_label:
forall mk_instr mk_immed base ofs k,
(forall r n, nolabel (mk_instr r n)) ->
tail_nolabel k (indexed_memory_access mk_instr mk_immed base ofs k).
Hint Resolve indexed_memory_access_label.
Remark loadind_label:
forall base ofs ty dst k c, loadind base ofs ty dst k = OK c -> tail_nolabel k c.
Remark storeind_label:
forall base ofs ty src k c, storeind src base ofs ty k = OK c -> tail_nolabel k c.
Remark save_lr_label:
forall ofs k, tail_nolabel k (save_lr ofs k).
Remark transl_cond_label:
forall cond args k c, transl_cond cond args k = OK c -> tail_nolabel k c.
Remark transl_op_label:
forall op args r k c, transl_op op args r k = OK c -> tail_nolabel k c.
Remark transl_memory_access_label:
forall (mk_instr_imm: ireg -> int -> instruction)
(mk_instr_gen: option (ireg -> shift_op -> instruction))
(mk_immed: int -> int)
(addr: addressing) (args: list mreg) c k,
transl_memory_access mk_instr_imm mk_instr_gen mk_immed addr args k = OK c ->
(forall r n, nolabel (mk_instr_imm r n)) ->
(match mk_instr_gen with
| None => True
| Some f => forall r sa, nolabel (f r sa)
end) ->
tail_nolabel k c.
End TRANSL_LABEL.
(** A valid branch in a piece of Mach code translates to a valid ``go to'' transition in the generated PPC code. *)
(** Existence of return addresses *)
(** * Proof of semantic preservation *)
(** Semantic preservation is proved using simulation diagrams of the following form. << st1 --------------- st2 |                   | t|                  *|t |                   | v                   v st1'--------------- st2' >> The invariant is the [match_states] predicate below, which includes: - The ARM code pointed by the PC register is the translation of the current Mach code sequence. - Mach register values and ARM register values agree. *)
Inductive match_states: Mach.state -> Asm.state -> Prop :=
| match_states_intro:
forall s fb sp c ep ms m m' rs f tf tc
(STACKS: match_stack ge s)
(FIND: Genv.find_funct_ptr ge fb = Some (Internal f))
(MEXT: Mem.extends m m')
(AT: transl_code_at_pc ge (rs PC) fb f c ep tf tc)
(AG: agree ms sp rs)
(DXP: ep = true -> rs#IR12 = parent_sp s),
match_states (Mach.State s fb sp c ms m)
(Asm.State rs m')
| match_states_call:
forall s fb ms m m' rs
(STACKS: match_stack ge s)
(MEXT: Mem.extends m m')
(AG: agree ms (parent_sp s) rs)
(ATPC: rs PC = Vptr fb Ptrofs.zero)
(ATLR: rs RA = parent_ra s),
match_states (Mach.Callstate s fb ms m)
(Asm.State rs m')
| match_states_return:
forall s ms m m' rs
(STACKS: match_stack ge s)
(MEXT: Mem.extends m m')
(AG: agree ms (parent_sp s) rs)
(ATPC: rs PC = parent_ra s),
match_states (Mach.Returnstate s ms m)
(Asm.State rs m').
(** We need to show that, in the simulation diagram, we cannot take infinitely many Mach transitions that correspond to zero transitions on the ARM side.  Actually, all Mach transitions correspond to at least one ARM transition, except the transition from [Machsem.Returnstate] to [Machsem.State]. So, the following integer measure will suffice to rule out the unwanted behaviour. *)
Definition measure (s: Mach.state) : nat :=
match s with
| Mach.State _ _ _ _ _ _ => 0%nat
| Mach.Callstate _ _ _ _ => 0%nat
| Mach.Returnstate _ _ _ => 1%nat
end.
Remark preg_of_not_R12: forall r, negb (mreg_eq r R12) = true -> IR IR12 <> preg_of r.
(** This is the simulation diagram.  We prove it by case analysis on the Mach transition. *)

Theorem transf_program_correct:
forward_simulation (Mach.semantics return_address_offset prog) (Asm.semantics tprog).