(** We need to show that, in the simulation diagram, we cannot take infinitely many Mach transitions that correspond to zero transitions on the ARM side.  Actually, all Mach transitions correspond to at least one ARM transition, except the transition from [Machsem.Returnstate] to [Machsem.State]. So, the following integer measure will suffice to rule out the unwanted behaviour. *)
Definition measure (s: Mach.state) : nat :=
match s with
| Mach.State _ _ _ _ _ _ => 0%nat
| Mach.Callstate _ _ _ _ => 0%nat
| Mach.Returnstate _ _ _ => 1%nat
end.
Remark preg_of_not_R12: forall r, negb (mreg_eq r R12) = true -> IR IR12 <> preg_of r.
(** This is the simulation diagram.  We prove it by case analysis on the Mach transition. *)

Theorem step_simulation:
forall S1 t S2, Mach.step return_address_offset ge S1 t S2 ->
forall S1' (MS: match_states S1 S1'),
(exists S2', plus step tge S1' t S2' /\ match_states S2 S2')
\/ (measure S2 < measure S1 /\ t = E0 /\ match_states S2 S1')%nat.