@asmlift/core 0.4.0 → 0.6.0

package/src/frontend/opaque.ts

@@ -46,8 +46,9 @@ export interface OpaquePolicy {
   /** token cleanup before classification — e.g. Thumb strips `[`/`]` off a memory operand.
    *  Default: identity. */
   normalize?: (s: string) => string;
-  /** true iff the register is hardwired-zero (MIPS `$zero`/`$0`): writing it is a no-op, so it is
-   *  NOT a real destination and the instruction is safe to skip. Default: nothing is zero. */
+  /** true iff the register is hardwired-zero (MIPS `$zero`/`$0`). It is then not a real
+   *  destination — so there is nothing to degrade and the instruction is REFUSED, not skipped
+   *  (`teq zero, zero` is a trap). Default: nothing is zero. */
   isZero?: (r: string) => boolean;
   /** Mnemonics that WRITE MEMORY in this ISA: the "no register destination ⇒ safe to fall
    *  through" premise is FALSE for stores — skipping one silently deletes the write (Thumb
@@ -63,10 +64,10 @@ export interface OpaquePolicy {
    *  canonical name but must report the one the input file actually contains — otherwise a decline
    *  names an instruction the reader cannot find in their own .s. Defaults to `mnemonic`. */
   display?: string;
-  /** Mnemonics PROVABLY effect-free — or deliberately transparent (Thumb push/pop frame ops) —
-   *  in this ISA: the ONLY unmodelled no-destination instructions that may be skipped. Any other
-   *  no-destination unmodelled instruction THROWS: a side-effect-only instruction (swi, syscall,
-   *  sync, cache…) skipped silently is a deleted effect — a silent miscompile. Default: none. */
+  /** Mnemonics PROVABLY effect-free — or deliberately transparent (Thumb push/pop frame ops) — in
+   *  this ISA: the only unmodelled instructions that may be skipped at all. Anything else with no
+   *  degradable destination THROWS, because a side-effect-only instruction (swi, syscall, sync,
+   *  cache…) skipped silently is a deleted effect. Default: none. */
   skipSafe?: RegExp;
 }
 
@@ -79,16 +80,28 @@ export interface OpaqueDest {
 
 /** Decide the opaque destination + register source operands for an unmodelled instruction
  *  `mnemonic` with operand list `ops` (operands in objdump order — destination first). Returns
- *  `null` only when the instruction is provably skippable: a write to a hardwired-zero register,
- *  or a policy.skipSafe mnemonic. An unmodelled STORE-CLASS instruction (policy.storeClass)
- *  throws loud (a skipped memory write is a silent miscompile) — and so does any OTHER
- *  no-destination instruction not in skipSafe: with no register to degrade to a live-`?`
- *  sentinel, skipping would silently delete a side effect (swi/syscall/sync/cache).
+ *  `null` only for a policy.skipSafe mnemonic. An unmodelled STORE-CLASS instruction
+ *  (policy.storeClass) throws loud (a skipped memory write is a silent miscompile), and so does any
+ *  instruction with no degradable destination: with no register to carry the live-`?` sentinel,
+ *  skipping would silently delete a side effect (swi/syscall/sync/cache).
  *
  *  When non-null, the caller MUST emit an `opaque` op that writes `dst` and consumes `srcRegs`
- *  (read through the frontend's own SSA): a DEAD opaque is DCE'd away harmlessly, while a LIVE one
- *  reaches structuring as the sentinel `?` and trips `assertResolved` — the loud failure the
- *  contract requires, instead of a stale/absent value surfacing as confidently-wrong source. */
+ *  (read through the frontend's own SSA). It reaches structuring as the sentinel `?` and trips
+ *  `assertResolved` — the loud failure the contract requires — WHETHER OR NOT anything reads `dst`;
+ *  `opaque` carries `effects: true` (ir/opcodes.ts) for the same reason `call` does.
+ *
+ *  Two properties of `ops[0]` read as permission to skip and are not. Both describe the
+ *  DESTINATION, while the risk is everything else the instruction does:
+ *    - nobody reads it — a dead register says nothing about a memory or system effect;
+ *    - it is hardwired zero — MIPS `teq zero, zero` is a conditional TRAP.
+ *  So `skipSafe`, a short per-ISA list of provably transparent mnemonics, is the only way an
+ *  unmodelled instruction leaves no trace.
+ *
+ *  `storeClass` is not load-bearing for soundness — a missed store degrades loudly like anything
+ *  else — but it throws naming the memory write instead of an unresolvable value, and it catches
+ *  the shape where `ops[0]` is a SOURCE (MIPS `swl rt, off(base)`) before a `dst` is fabricated
+ *  from it. It and `skipSafe` match case-INSENSITIVELY: mnemonic case is a property of the
+ *  disassembler, not of the instruction. */
 export function opaqueDest(mnemonic: string, ops: string[], policy: OpaquePolicy): OpaqueDest | null {
   const shown = policy.display ?? mnemonic;
   if (policy.storeClass?.test(mnemonic)) {
@@ -102,7 +115,10 @@ export function opaqueDest(mnemonic: string, ops: string[], policy: OpaquePolicy
   }
   const norm = policy.normalize ?? ((s) => s);
   const dst = norm(ops[0] ?? '');
-  if (!policy.isReg(dst)) {
+  // No DEGRADABLE destination: `ops[0]` is not a register, or it is the hardwired zero. Same answer
+  // for both — a zero write is a genuine no-op only for a MODELLED instruction, and by construction
+  // nothing modelled reaches here.
+  if (!policy.isReg(dst) || policy.isZero?.(dst)) {
     if (policy.skipSafe?.test(mnemonic)) {
       return null;
     } // explicitly transparent for this ISA
@@ -111,9 +127,6 @@ export function opaqueDest(mnemonic: string, ops: string[], policy: OpaquePolicy
       `${where}unmodelled effect instruction '${shown}' — no register destination to degrade, and skipping it would silently delete its effect`,
     );
   }
-  if (policy.isZero?.(dst)) {
-    return null;
-  } // writes hardwired zero → a genuine no-op
   const srcRegs = ops.slice(1).map(norm).filter(policy.isReg);
   return { dst, srcRegs };
 }

package/src/frontend/ppc.ts

@@ -24,7 +24,7 @@
 //    the result against 0; that implicit compare is wired so a following `beq`/`bne` fuses.
 //
 // TRUSTWORTHINESS: an unmodelled instruction with a register destination emits an `opaque` value
-// (dead ⇒ vanishes, live ⇒ fails LOUD downstream); an unmodelled CONTROL TRANSFER throws
+// that fails LOUD downstream read or not; an unmodelled CONTROL TRANSFER throws
 // PpcUnsupportedError in `lift`. Never plausible-but-wrong C.
 //
 // Scope: straight-line + `if`/diamond integer functions (incl. the conditional-return idiom),
@@ -353,6 +353,17 @@ export function lift(
   // it is exempted from the loud-fail below; an UNrecovered `bctr` still fails loud.
   const jts = asmData ? recoverPpcJumpTables(instrs, asmData) : new Map<number, PpcJT>();
   const recoveredBctr = new Set([...jts.values()].map((j) => j.bctrAddr));
+  // A data reloc on an immediate-forming instruction means objdump printed a LINK-TIME
+  // placeholder (`lis r4,0` + R_PPC_ADDR16_HA sym): the real value is the symbol's half, and
+  // lifting the 0 silently reads the wrong address — plausible-but-wrong C, the forbidden class.
+  // The jump-table idiom's own @tbl pair never reaches these guards: a recovered dispatch block
+  // is the bounds branch's replaced fall-through, pruned as unreachable before decode.
+  const relocPlaceholder = (ins: Instr): void => {
+    throw new PpcUnsupportedError(
+      `cannot lift '${name}': '${ins.mnemonic}' at 0x${ins.addr.toString(16)} carries a data relocation ` +
+        `('${ins.sym}') — the printed immediate is a link-time placeholder, not the value`,
+    );
+  };
   // TRUSTWORTHINESS: fail loud on an unmodelled control transfer rather than dropping it (which
   // would silently miscompile the control flow). CTR-counted loops and indirect branches land here.
   for (const ins of instrs) {
@@ -480,15 +491,15 @@ export function lift(
     const constVal = kit.cnst;
     const emit = kit.emit;
     // TRUSTWORTHINESS GUARD: an unmodelled instruction must not silently drop its destination —
-    // emit an honest `opaque` instead: dead ⇒ DCE'd; live ⇒ assertResolved fails LOUD (see
-    // frontend/opaque.ts for the policy).
+    // emit an honest `opaque` instead, which fails LOUD at assertResolved whether or not anything
+    // reads that register (see frontend/opaque.ts for the policy).
     const emitOpaqueDest = (ins: Instr) => {
       // storeClass: every PPC store mnemonic is st* — an unmodelled one (`stwbrx`, `sthbrx`, …)
       // must throw, never skip (its first token is the SOURCE register).
       const od = opaqueDest(ins.mnemonic, ins.ops, {
         isReg,
-        storeClass: /^st/,
-        skipSafe: /^nop$/,
+        storeClass: /^st/i,
+        skipSafe: /^nop$/i,
         context: `${name} @0x${ins.addr.toString(16)}`,
       });
       if (!od) {
@@ -567,12 +578,23 @@ export function lift(
         // (anything live across the call has already been moved to a callee-saved register).
         case 'bl': {
           const sym = ins.sym ?? 'func';
-          const argc = protoArity(prototypes[sym]) ?? fallbackArgc(bi);
+          const declared = protoArity(prototypes[sym]);
+          const argc = declared ?? fallbackArgc(bi);
           const args: Value[] = [];
           for (let k = 0; k < argc; k++) {
             args.push(read(ARG_REGS[k]));
           }
-          emit('call', RET, args, { target: sym });
+          // Pushed with `tmp` rather than `emit` so the result register is written separately from
+          // the op — r3.. are volatile under the EABI, so a GUESSED arity that counted a register
+          // set up before an intervening call passes an argument the caller never set up
+          // (`finish()` cuts those back — frontend/ssa.ts), and the call's OWN result is the
+          // CALLEE's write, so `noteCall` records the clobber after it rather than before.
+          const res = kit.tmp('call', args, { target: sym });
+          if (declared === undefined) {
+            ssa.recordGuessedCall(ops[ops.length - 1], bi, { argRegs: ARG_REGS, returnReg: RET });
+          }
+          write(RET, res);
+          ssa.noteCall(bi);
           break;
         }
         // Stack-frame + link-register bookkeeping. `stwu r1,-N(r1)` / `addi r1,r1,N` adjust the frame
@@ -618,9 +640,16 @@ export function lift(
           write(d, read(s));
           break; // move register (or rD,rS,rS)
         case 'li':
+          // SDA21 address formation encodes rA=0, so objdump prints `li rD,0` + R_PPC_EMB_SDA21
+          if (ins.sym) {
+            relocPlaceholder(ins);
+          }
           write(d, constVal(parseImm(s)));
           break; // load immediate (addi rD,0,imm)
         case 'lis':
+          if (ins.sym) {
+            relocPlaceholder(ins);
+          }
           write(d, constVal((parseImm(s) << 16) >> 0));
           break; // load immediate shifted
         case 'add':
@@ -630,11 +659,25 @@ export function lift(
         // `addi r1,r1,N` is frame teardown (skip); any other addi is a real add-immediate.
         case 'addi':
         case 'addic':
+          // reloc first: a data reloc on a stack adjust is no known compiler's output — loud
+          if (ins.sym) {
+            relocPlaceholder(ins);
+          }
           if (d === 'r1') {
             break;
           }
           emitBin('add', d, read(s), constVal(parseImm(t)));
           break;
+        // add immediate SHIFTED — the register-based `%ha` anchor: mwcc derives an absolute base
+        // from a scaled index (`addis r4,r3,-32736` = r3 + 0x80200000). The jump-table lis/addi
+        // pair recognizer is the only reloc-carrying consumer; an addis over a register is plain
+        // arithmetic, and a reloc-carrying one is a placeholder (guard above).
+        case 'addis':
+          if (ins.sym) {
+            relocPlaceholder(ins);
+          }
+          emitBin('add', d, read(s), constVal((parseImm(t) << 16) >> 0));
+          break;
         case 'subf':
         case 'subfc':
         case 'subfo':
@@ -686,6 +729,10 @@ export function lift(
           emitBin('or', d, read(s), read(t));
           break;
         case 'ori':
+          // `ori rD,rA,sym@l` is the other @l half-former — same placeholder hazard as addi
+          if (ins.sym) {
+            relocPlaceholder(ins);
+          }
           emitBin('or', d, read(s), constVal(parseImm(t)));
           break;
         case 'xor':