@asmlift/core 0.8.0 → 0.9.0

package/src/frontend/ppc.ts

@@ -20,9 +20,10 @@
 //    genuine rotate/insert stays an opaque.
 //  • CALLS (`bl`) — the callee symbol comes from the interleaved `R_PPC_REL24` relocation (an
 //    unresolved `bl` in a .o encodes a 0 placeholder); arguments come from r3.. per the callee
-//    prototype (falling back to argument-register liveness). The frame — `stwu r1`, `mflr`/`mtlr`,
-//    r1-relative spills — is transparent to dataflow, so a value in a callee-saved register
-//    survives the call.
+//    prototype (falling back to argument-register liveness). The frame bookkeeping — `stwu r1`,
+//    the link-register save, callee-saved saves — is transparent to dataflow, so a value in a
+//    callee-saved register survives the call; a word stored to the frame with a value is a
+//    stack-slot variable (`frameStore`).
 //  • RECORD FORM (`.` = the Rc bit, e.g. `andi.`/`add.`) also sets cr0 from a signed compare of
 //    the result against 0; that implicit compare is wired so a following `beq`/`bne` fuses.
 //
@@ -39,9 +40,10 @@
 import { Fn, Op, Successor, Value, mkOp, mkValue } from '../ir/core';
 import type { Opcode } from '../ir/opcodes';
 import { T } from '../ir/types';
-import { type Prototypes, protoArity } from '../proto';
+import type { Prototypes } from '../proto';
 import type { TargetDescription } from '../target';
 import { type AsmData, readJumpTable } from './asmdata';
+import { callDeclarations } from './call-plan';
 import {
   type DisasmInstr,
   parseImm,
@@ -50,13 +52,16 @@ import {
   sliceSymbol,
 } from './disasm';
 import { mkEmitKit, pushSwitchBr } from './emit';
-import { FrontendUnsupportedError } from './errors';
+import { type FrontendRefusal, FrontendUnsupportedError } from './errors';
+import { inheritFlags } from './flags-edge';
 import { assertInputFormat } from './format';
+import { fpPrecision, fpuArgSlots, refuseBothPrecisions, writesFloatReturn } from './fpu';
 import type { Frontend } from './frontend';
 import { makeHighHalves } from './high-half';
+import { makeLocalStatics, readObjectLocalObject } from './local-object';
 import { opaqueDest } from './opaque';
-import { unspellableReason } from './reloc-symbol';
-import { abiSortEntryParams } from './ssa';
+import { classifyRelocSymbol, unspellableReason } from './reloc-symbol';
+import { abiSortEntryParams, mintArgSlotHoles, stackSlotKey } from './ssa';
 import { makeSsaBuilder } from './ssa';
 
 type Instr = DisasmInstr;
@@ -116,6 +121,33 @@ const isModeledBranch = (ins: Instr) => isXfer(ins) || ins.mnemonic === 'bl';
 
 const isReg = (s: string | undefined): s is string => /^r\d+$/.test(s ?? '');
 
+/** The FPU arithmetic this frontend lifts, onto the float opcodes, with the precision each computes
+ *  in; `fmr` is a copy and has no opcode. `fneg` and `fmr` carry no precision at all — an FPR holds a
+ *  double either way — so they take the function's (`frontend/fpu.ts` `fpPrecision`); in a function
+ *  of only those, the floats state none (`T.fUnstated`), because the float and double spellings of a
+ *  negation or a copy compile to one object. Everything else in the file keeps the register-file refusal `opaqueDest` gives it: `frsp`, the
+ *  loads and stores, the conversions, the compares, the fused multiply-adds, paired singles — and a
+ *  record form (`fadds.`), which sets `cr1`. */
+const FP_ARITH: Readonly<Record<string, { op: Opcode | 'copy'; width: 32 | 64 | null }>> = {
+  fadds: { op: 'fadd', width: 32 },
+  fsubs: { op: 'fsub', width: 32 },
+  fmuls: { op: 'fmul', width: 32 },
+  fdivs: { op: 'fdiv', width: 32 },
+  fadd: { op: 'fadd', width: 64 },
+  fsub: { op: 'fsub', width: 64 },
+  fmul: { op: 'fmul', width: 64 },
+  fdiv: { op: 'fdiv', width: 64 },
+  fneg: { op: 'fneg', width: null },
+  fmr: { op: 'copy', width: null },
+};
+const FP_ARITH_MNEMONICS: ReadonlySet<string> = new Set(Object.keys(FP_ARITH));
+
+/** An FPU register: the token, and the key the SSA builder holds it under. ONE predicate for the
+ *  decode above and the register-file refusal below (`fpReg`), so a token one of them reads as an
+ *  FPR cannot be one the other does not. */
+const PPC_FP_REG = /^f\d+$/;
+const isFpKey = (k: string) => PPC_FP_REG.test(k);
+
 // Shared objdump scaffolding (frontend/disasm.ts). parseMem narrowed to `r\d+` bases — a
 // non-register base is an SDA/global placeholder assertOrdinaryMem declines.
 const parseMem = (operand: string): { off: number; base: string } => parseSharedMem(operand, /r\d+/);
@@ -138,6 +170,20 @@ const rlwinmMask = (mb: number, me: number): number => {
 // stripping, the mnemonic misses the cond tables and the branch is silently dropped).
 const parseDisasm = (disasm: string): Instr[] => parseSharedDisasm(disasm, { relocs: true, hintSuffixes: true });
 
+/** A compare a `cr` field holds: its operands and signedness, which the reading branch turns into a
+ *  condition. */
+type CrCompare = { lhs: Value; rhs: Value; signed: boolean };
+
+/** What a block leaves in the condition register for a successor to inherit. `fields` holds, per
+ *  field, the compare it holds, or the sentence saying what overwrote it. A field absent from the map
+ *  never held a compare on the chain of edges that reached here, and `none` is why: the sentence
+ *  from the block where that chain started. */
+type CrExit = { fields: ReadonlyMap<string, CrCompare | string>; none: string };
+
+/** The `cr` fields the EABI makes volatile across a call: cr0, cr1 and cr5–cr7. The callee may
+ *  write any of them, so a compare in one does not survive a `bl`. cr2–cr4 are nonvolatile. */
+const CR_VOLATILE = ['cr0', 'cr1', 'cr5', 'cr6', 'cr7'] as const;
+
 interface PpcBlock {
   startAddr: number;
   body: Instr[];
@@ -356,6 +402,71 @@ function toBlocks(instrs: Instr[], name: string, jts: Map<number, PpcJT>): { blo
   };
 }
 
+/** The link register's save word, as an offset from the entry r1: the second word of the caller's
+ *  frame header, after the back chain. mwcc 2.3.3 spells it `4(r1)` before the push and 2.4.x
+ *  `N+4(r1)` after it (`r1Displacements`). */
+const LR_SAVE_WORD = 4;
+
+/** Where r1 stands, relative to its value at entry, just BEFORE an instruction runs: a byte count
+ *  (0 before the frame push, -N after `stwu r1,-N(r1)`), or why it is not known there.
+ *
+ *  A frame slot has to be named by its offset from the ENTRY r1, because the compilers disagree on
+ *  which side of the push they save the link register. mwcc 2.4.x pushes first and saves at
+ *  `N+4(r1)`; mwcc 2.3.3 saves at `4(r1)` BEFORE `stwu r1,-N(r1)` and restores from `N+4(r1)`. That is
+ *  one word of the caller's frame spelled at two offsets, and an offset from the CURRENT r1 reads it
+ *  as two different words.
+ *
+ *  Forward dataflow over the block graph, per instruction. Only the two forms a compiler uses to
+ *  move r1 are counted: `stwu r1,-N(r1)` from the entry value, and `addi r1,r1,N`. Anything else
+ *  that writes r1 — a second push, an `addi r1,rX,N` from another register, an `mr r1,r11` — makes
+ *  the displacement unknown from there on, and so does a join whose predecessors arrive at
+ *  different depths. Unknown is not a refusal by itself: a displacement nothing reads decides
+ *  nothing. The frame accesses and the push that DO read it refuse loud (`lift`, `entryOffset`). */
+function r1Displacements(blocks: PpcBlock[], succIdx: number[][]): Map<Instr, number | string> {
+  const at = new Map<Instr, number | string>();
+  const into: Array<number | string | undefined> = blocks.map(() => undefined);
+  // A block whose displacement is unknown stays unknown, under the first reason found.
+  const meet = (bi: number, d: number | string): boolean => {
+    const old = into[bi];
+    let next = d;
+    if (typeof old === 'string' || old === d) {
+      next = old;
+    } else if (typeof old === 'number' && typeof d === 'number') {
+      const where = blocks[bi].startAddr >= 0 ? `0x${blocks[bi].startAddr.toString(16)}` : 'a synthesized return';
+      next = `the paths into ${where} arrive with r1 at two depths (${old} and ${d} bytes from its entry value)`;
+    }
+    into[bi] = next;
+    return next !== old;
+  };
+  const writesR1 = (ins: Instr) => ins.ops[0] === 'r1' && !/^(st|cmp|tw|mt|dc|ic)/.test(ins.mnemonic);
+  meet(0, 0);
+  const work = [0];
+  while (work.length) {
+    const bi = work.pop()!;
+    let d = into[bi]!;
+    for (const ins of [...blocks[bi].body, ...(blocks[bi].branch ? [blocks[bi].branch] : [])]) {
+      at.set(ins, d);
+      const where = `0x${ins.addr.toString(16)}`;
+      if (ins.mnemonic === 'stwu' && ins.ops[0] === 'r1' && parseMem(ins.ops[1]).base === 'r1') {
+        d =
+          d === 0
+            ? parseMem(ins.ops[1]).off
+            : `the frame push at ${where} is a second one (r1 already moved from its entry value)`;
+      } else if (ins.mnemonic === 'addi' && ins.ops[0] === 'r1' && ins.ops[1] === 'r1' && !ins.reloc) {
+        d = typeof d === 'number' ? d + parseImm(ins.ops[2]) : d;
+      } else if (writesR1(ins)) {
+        d = `'${ins.mnemonic} ${ins.ops.join(',')}' at ${where} sets r1 to a value this frontend does not track`;
+      }
+    }
+    for (const s of succIdx[bi]) {
+      if (meet(s, d)) {
+        work.push(s);
+      }
+    }
+  }
+  return at;
+}
+
 /** Lift disassembled PowerPC text → an L1 Fn with block-argument SSA. `asmData` (optional) supplies
  *  the data-section jump table for dense-switch (Regime-B) recovery; absent ⇒ a `bctr` dispatch
  *  loud-fails. */
@@ -395,12 +506,26 @@ export function lift(
    *  `R_PPC_EMB_SDA21` is `a0 & 0`). An UNmodelled instruction refuses earlier and for a better
    *  reason: `lfs`/`lfd` under either relocation name the float gap, not this one. */
   let relocTaken = false;
+  const statics = makeLocalStatics();
   /** The symbol a relocation names, once the naming policy has passed it. Every recovery below goes
    *  through here FIRST, so an unspellable name can never reach the declaration minter looking like
-   *  an ordinary identifier — recovering the address is only half of being able to write it down. */
+   *  an ordinary identifier — recovering the address is only half of being able to write it down.
+   *
+   *  A function-scope static is the one kind no `extern` can name that a lift can still WRITE: the
+   *  function defines it, so its definition, read out of the side table, is recorded beside the Fn
+   *  under the linker name the IR keeps, and structure spells it by its source name. */
   const spellableSym = (ins: Instr): string => {
     relocTaken = true;
     const sym = ins.reloc?.sym ?? '';
+    if (classifyRelocSymbol(sym) === 'local-static') {
+      const read = asmData
+        ? readObjectLocalObject(asmData, sym, name)
+        : { refused: "whose definition needs the object's data, which this lift was not given" };
+      if ('refused' in read) {
+        throw new PpcUnsupportedError(`${relocSite(ins)} names a function-scope static ('${sym}') ${read.refused}`);
+      }
+      return statics.define(read);
+    }
     const why = unspellableReason(sym);
     if (why) {
       throw new PpcUnsupportedError(`${relocSite(ins)} ${why}`);
@@ -429,6 +554,17 @@ export function lift(
     }
   }
   const { blocks, succIdx } = toBlocks(instrs, name, jts);
+  // PREHEADER. A function whose first block is a branch target (`do b = b * b; while (--n);` is a
+  // loop at the entry) would take its parameters as that loop header's phis. An empty block ahead
+  // of it becomes the entry, and its live-ins are the function's parameters (frontend/ssa.ts
+  // `ArgSlots`). It starts where the function does, which is what its label says.
+  if (succIdx.some((ss) => ss.includes(0))) {
+    blocks.unshift({ startAddr: blocks[0].startAddr, body: [], branch: null });
+    succIdx.forEach((ss, i) => (succIdx[i] = ss.map((j) => j + 1)));
+    succIdx.unshift([1]);
+  }
+
+  const r1At = r1Displacements(blocks, succIdx);
 
   const preds: number[][] = blocks.map(() => []);
   blocks.forEach((_, i) => {
@@ -437,8 +573,32 @@ export function lift(
     }
   });
 
-  const ssa = makeSsaBuilder(name, blocks.length, preds);
+  const fpu = target.fpu;
+  // A CALL IN A FUNCTION THAT COMPUTES ON FLOATS refuses — at the float instruction, so a refusal
+  // the stream reaches first keeps its own reason: which FPRs a callee destroys, which it reads as
+  // float arguments and which it returns in are all unmodelled, so a float live across a call — or
+  // handed to one in f1 — would resolve to a value the callee overwrote or be dropped. Both scans
+  // read the blocks the entry reaches: a `bl` on no path makes no call.
+  const reached = blocks.flatMap((b) => b.body);
+  const callInsn = reached.find((ins) => ins.mnemonic === 'bl');
+  const floatReturn = writesFloatReturn(reached, FP_ARITH_MNEMONICS, (t) => (isFpKey(t) ? t : null), fpu);
+  const fpType = fpPrecision(reached, (m) => FP_ARITH[m]?.width);
+
+  const ssa = makeSsaBuilder(name, blocks.length, preds, undefined, (k) =>
+    isFpKey(k) ? (fpType ?? T.f32()) : undefined,
+  );
   const { irBlocks, readVar, writeVar, paramReg } = ssa;
+  /** This frontend's refusal, for the shared code that refuses on its behalf. */
+  const fail: FrontendRefusal = (message) => {
+    throw new PpcUnsupportedError(message);
+  };
+  const calls = callDeclarations(
+    name,
+    target,
+    prototypes,
+    { pairs: false, memoryReturn: false, stackArgs: false, voidReturn: false, argRegisterBoundsArity: false },
+    fail,
+  );
 
   /** The HIGH half of a relocated address, per value standing for one. The invariant, and every
    *  way a placeholder could leak past it, lives in frontend/high-half.ts — shared with
@@ -457,71 +617,61 @@ export function lift(
     hi: '@ha',
     hiArticle: 'an',
     lo: '@l',
-    fail: (message) => {
-      throw new PpcUnsupportedError(message);
-    },
+    fail,
   });
   /** Reading a register AS A VALUE. A register holding a high half is not one, so this refuses loud
    *  rather than handing back a plausible number standing for an address. `foldLoHalf` is the only
    *  code entitled to look at a high half, which is why it reaches `readVar` directly. */
   const readReg = (r: string, at: number): Value => highHalves.guardRead(name, r, readVar(r, at));
+  /** The return address `mflr rD` copies out of the link register, per value standing for one, with
+   *  the address of the `mflr`. Like a high half it is a definition and not a value: storing it to
+   *  the link register's save word is the LR save (`frameStore`), and moving it back with `mtlr` is
+   *  the return. Any other use is a function reading its own return address (MP4's
+   *  `asm { mflr retaddr }` does, to tag an allocation with its caller), which no C expression
+   *  spells, so that use refuses: a store at once, anything else once the function is built. */
+  const returnAddresses = new Map<Value, number>();
   const RET = target.returnReg;
   const ARG_REGS = target.argRegs;
 
-  // Best-effort call arity when a callee has no prototype: the count of contiguous argument
-  // registers (r3..) with a VALUE reaching the call. A prototype's `params` is authoritative when
-  // supplied; this liveness heuristic covers the rest.
+  // THE FRAME, as two kinds of word slot, each named by its offset from the ENTRY r1
+  // (`r1Displacements`).
   //
-  // A pending `@ha` high half is a def but not a value, and it must not raise the count: a `lis`
-  // hoisted into the prologue leaves its half in r4 across an intervening call, and counted, it
-  // makes `strlen(s)` into `strlen(s, <half>)` — which then refuses at the read. Measured on
-  // `pikmin:searchKanjiCode__FUs`, whose `lis r4` at 0x4 pairs only at 0x28, past the `bl strlen`.
+  // A SAVE holds an entry value that is no C value: a callee-saved register's, the link register's
+  // word, or the back chain the frame push stores (the caller's r1). Nothing but the caller reads it
+  // back, so its restore — a load into the register it was saved from — is dropped, and a load into
+  // any other register refuses. Function-scoped, so a save in the prologue matches a restore in any
+  // epilogue.
   //
-  // A GAP REFUSES. The count is contiguous, so an argument register with nothing reaching it ends
-  // it — and one is empty for two opposite reasons. Either the call really takes that few
-  // arguments, or the register still holds this function's own untouched incoming argument, a value
-  // the machine passes on that SSA has no definition for because nothing ever wrote it. When a
-  // LATER argument register does hold a value the second reading is the only one left, and taking
-  // the first drops that argument and every one after it: `ac-decomp:evw_anime_colreg_manual` sets
-  // up seven registers for `evw_color_set` and, with r4 at its incoming value, lifts to
-  // `evw_color_set(a0);` — its divide, its multiply and five arguments gone. Which reading it is
-  // cannot be decided here — the function's own arity is exactly what is missing — so this refuses
-  // and names the gap rather than guessing. A prototype answers it (`protoArity` is asked first).
-  const fallbackArgc = (bi: number, at: number): number => {
-    const holdsValue = (k: number) => ssa.hasReachingDef(ARG_REGS[k], bi, (v) => !highHalves.has(v));
-    let n = 0;
-    while (n < ARG_REGS.length && holdsValue(n)) {
-      n++;
+  // Every other word store is a VALUE — an argument's home, or a live value spilled — and it is the
+  // shared stack-slot variable (`stackSlotKey`, frontend/ssa.ts) MIPS and Thumb use. A reload into
+  // any register reads it; a reload on a path that never stored it refuses in the builder; a store
+  // nothing reloads refuses at the end of `lift`.
+  //
+  // A slot is one kind for the whole function: a word both saved and stored with a value has no
+  // single reading, and refuses.
+  const saveSlots = new Map<number, string>();
+  const valueSlots = new Map<number, { addr: number; mem: string; read: boolean }>();
+  const refuseMixedSlot = (ins: Instr, mem: string, off: number, kind: 'save' | 'value') => {
+    if (kind === 'save' ? valueSlots.has(off) : saveSlots.has(off)) {
+      throw new PpcUnsupportedError(
+        `cannot lift '${name}': local stack frames not supported — '${mem}' at 0x${ins.addr.toString(16)} ` +
+          `is a word this function both saves a register in and stores a value to`,
+      );
     }
-    for (let k = n + 1; k < ARG_REGS.length; k++) {
-      if (holdsValue(k)) {
-        throw new PpcUnsupportedError(
-          `cannot lift '${name}': the call at 0x${at.toString(16)} has no prototype, ${ARG_REGS[k]} holds a ` +
-            `value and ${ARG_REGS[n]} holds none — an argument register left at its incoming value and one ` +
-            `the call does not pass look the same here, so the argument count is not decidable`,
-        );
-      }
+  };
+  /** The slot an r1-relative operand names: its offset from the entry r1. Where r1's displacement is
+   *  not known, no offset can be named, and a save or restore there refuses rather than being
+   *  matched against a slot it may not be. */
+  const entryOffset = (ins: Instr, mem: string): number => {
+    const d = r1At.get(ins);
+    if (typeof d !== 'number') {
+      throw new PpcUnsupportedError(
+        `cannot lift '${name}': stack-frame access '${mem}' at 0x${ins.addr.toString(16)} — the stack ` +
+          `pointer's offset from its entry value is not known there: ${d ?? 'the instruction is unreachable'}`,
+      );
     }
-    return n;
+    return parseMem(mem).off + d;
   };
-
-  // Frame slots (r1-relative offsets) that hold a TRANSPARENT save, and WHICH REGISTER each one
-  // holds — a callee-saved register's entry value or the saved link register. A reload is dropped
-  // (the value is unchanged, so the in-register SSA value already carries it) only when it restores
-  // the very register the slot was saved from. Function-scoped so a save in the prologue block
-  // matches a restore in a different epilogue block. Any OTHER r1 access is a genuine local spill /
-  // address-taken stack object this frontend cannot model — those fail LOUD (below), never silently
-  // drop, because a dropped local spill is a silent miscompile.
-  //
-  // THE REGISTER IS PART OF THE SLOT, not bookkeeping about it. `stw r3,8(r1)` / `lwz r4,8(r1)` is
-  // mwcc spilling an incoming ARGUMENT and reading it back into another register — a real value
-  // moving through memory, not a save/restore pair, and an offset-only record cannot tell the two
-  // apart. Dropping that reload leaves the destination with no definition at all, and
-  // `fallbackArgc`'s contiguous scan then takes every LATER argument with it.
-  // `pikmin:__ct__7ActFreeFP4Piki` is the benchmark's inhabitant — it reads `this` back into r4 —
-  // and 28 Mario Party 4 checkout functions share the shape, each losing an argument the relocation
-  // fold recovered.
-  const savedSlots = new Map<number, string>();
   // `stmw rS,D(r1)` saves rS..r31 into consecutive words from D; `lmw rD,D(r1)` restores the same
   // range.
   const frameRange = (firstReg: string, off: number): Array<{ off: number; reg: string }> => {
@@ -533,13 +683,27 @@ export function lift(
     return slots;
   };
 
+  // What each filled block left in the condition register. Written as blocks are filled, so a lookup
+  // finds only blocks filled earlier, which is what `inheritFlags` needs to tell "not known" from
+  // "none".
+  const exitCr = new Map<number, CrExit>();
+  const blockLabel = (bi: number): string =>
+    blocks[bi].startAddr >= 0
+      ? `${name}+0x${blocks[bi].startAddr.toString(16)}`
+      : `the return block '${name}' synthesizes`;
+
+  // A FLOAT RETURN is decided for the whole function (frontend/fpu.ts `writesFloatReturn`), and then
+  // r3 is scratch like any other integer register.
+  const returnOperands = (bi: number): Value[] =>
+    floatReturn ? [readReg(fpu!.returnReg, bi)] : ssa.hasReachingDef(RET, bi) ? [readReg(RET, bi)] : [];
+
   const fillBlock = (b: PpcBlock, bi: number) => {
     const ops = irBlocks[bi].ops;
     const succ = (j: number): Successor => ({ block: irBlocks[j], args: [] });
 
     // A synthetic conditional-return block: just return the current return register.
     if (b.synthReturn) {
-      const retOps = ssa.hasReachingDef(RET, bi) ? [readReg(RET, bi)] : [];
+      const retOps = returnOperands(bi);
       ops.push(mkOp('ret', { operands: retOps }));
       return;
     }
@@ -576,39 +740,75 @@ export function lift(
         );
       }
     };
-    // A word store/load based on r1. Returns true if it is TRANSPARENT frame bookkeeping (skip):
-    // a save of a register with no reaching def (callee-saved entry value / saved lr), or a reload
-    // from a recorded save slot. A store of a LIVE (reaching-def) value is a real local spill →
-    // fail LOUD. A reload from an unrecorded slot is a genuine stack local → fail LOUD.
-    const frameStore = (srcReg: string, mem: string): boolean => {
-      const { base, off } = parseMem(mem);
-      if (base !== 'r1') {
+    // A word store/load based on r1: a SAVE or a VALUE slot (see `saveSlots` above). Returns false
+    // for any other base, which is ordinary memory.
+    const frameStore = (ins: Instr, srcReg: string, mem: string): boolean => {
+      if (parseMem(mem).base !== 'r1') {
         return false;
       }
-      if (!ssa.hasReachingDef(srcReg, bi)) {
-        savedSlots.set(off, srcReg);
+      const off = entryOffset(ins, mem);
+      const isArg = ARG_REGS.includes(srcReg);
+      // The LR SAVE stores the return address `mflr` copied out, and only into the link register's
+      // save word, 4 bytes above the entry r1. Anywhere else the word is a value — past the push,
+      // 8 bytes up is the callee's parameter area, where it is a ninth argument — and a register
+      // holding the return address on some paths and another value on others is not a save at all.
+      if (ssa.hasReachingDef(srcReg, bi, (v) => returnAddresses.has(v))) {
+        const mixed = ssa.hasReachingDef(srcReg, bi, (v) => !returnAddresses.has(v));
+        if (mixed || off !== LR_SAVE_WORD) {
+          throw new PpcUnsupportedError(
+            `cannot lift '${name}': the store to '${mem}' at 0x${ins.addr.toString(16)} is not the link ` +
+              `register's save — ${
+                mixed
+                  ? `${srcReg} holds the return address an 'mflr' copies out on some paths and another value on others`
+                  : `the return address an 'mflr' copies out lands ${off} bytes from the entry r1, not in the ` +
+                    `save word ${LR_SAVE_WORD} bytes up, so it is used as a value`
+              }`,
+          );
+        }
+        refuseMixedSlot(ins, mem, off, 'save');
+        saveSlots.set(off, srcReg);
         return true;
       }
-      throw new PpcUnsupportedError(
-        `cannot lift '${name}': spill of a live value to the stack ('${srcReg},${mem}') — local stack frames not supported`,
-      );
+      // Any other save stores what the register held at entry: nothing defined it on any path. An
+      // argument register nothing defined holds the argument, which is a value.
+      if (!isArg && !ssa.hasReachingDef(srcReg, bi)) {
+        refuseMixedSlot(ins, mem, off, 'save');
+        saveSlots.set(off, srcReg);
+        return true;
+      }
+      refuseMixedSlot(ins, mem, off, 'value');
+      // An argument moved to its home is not an argument set up for the next call.
+      const v = (isArg ? ssa.entryValue(srcReg, bi) : undefined) ?? readReg(srcReg, bi);
+      writeVar(stackSlotKey(off), bi, v);
+      if (!valueSlots.has(off)) {
+        valueSlots.set(off, { addr: ins.addr, mem, read: false });
+      }
+      return true;
     };
-    const frameLoad = (dstReg: string, mem: string): boolean => {
-      const { base, off } = parseMem(mem);
-      if (base !== 'r1') {
+    const frameLoad = (ins: Instr, dstReg: string, mem: string): boolean => {
+      if (parseMem(mem).base !== 'r1') {
         return false;
       }
-      const saved = savedSlots.get(off);
+      const off = entryOffset(ins, mem);
+      const saved = saveSlots.get(off);
       if (saved === dstReg) {
         return true;
       }
-      throw new PpcUnsupportedError(
-        saved === undefined
-          ? `cannot lift '${name}': reload of a stack local ('${mem}') — local stack frames not supported`
-          : `cannot lift '${name}': reload of '${mem}' into ${dstReg}, a slot ${saved} was saved into — ` +
-              `a load that does not restore the register the slot holds is a value read back through the ` +
-              `stack, which is a local stack frame this frontend does not model`,
-      );
+      if (saved !== undefined) {
+        throw new PpcUnsupportedError(
+          `cannot lift '${name}': reload of '${mem}' into ${dstReg}, a slot ${saved} was saved into — the ` +
+            `word holds the caller's ${saved}, which no C value names`,
+        );
+      }
+      const slot = valueSlots.get(off);
+      if (slot === undefined || !ssa.hasReachingDef(stackSlotKey(off), bi)) {
+        throw new PpcUnsupportedError(
+          `cannot lift '${name}': reload of a stack local ('${mem}') — local stack frames not supported`,
+        );
+      }
+      slot.read = true;
+      write(dstReg, readVar(stackSlotKey(off), bi));
+      return true;
     };
     const write = (r: string, v: Value) => {
       writeVar(r, bi, v);
@@ -626,6 +826,29 @@ export function lift(
       // must throw, never skip (its first token is the SOURCE register).
       const od = opaqueDest(ins.mnemonic, ins.ops, {
         isReg,
+        // The floating-point register file. `isReg` is `r\d+`, so an `fN` operand is invisible to
+        // it: `fadds f1,f1,f2` reads as "no register destination" and `fcmpo cr0,f1,f2` as the same
+        // thing about a CONDITION register, when both are one missing file. `stfs`/`stfd` reach
+        // this arm ahead of `^st` deliberately — they are refused for the file they move, not for
+        // the memory they move it to.
+        //
+        // NO SIGIL, WHICH IS THE OPPOSITE OF THE MIPS CHOICE, and it needs its own argument because
+        // PowerPC objdump prints an FPU register bare (`f1`) and has no sigil to require. The
+        // collision the MIPS predicate pays a sigil to avoid is live here in principle — objdump
+        // writes a branch target as bare lower-case hex, so `f0`/`f4`/`f8` are addresses AND
+        // matches. What makes it unreachable is not this pattern but the branch handling above: a
+        // `b*` mnemonic in `isModeledBranch` is decoded as a transfer or a call and never falls to
+        // `emitOpaqueDest`, and every other `b*` is refused by the whole-function control-transfer
+        // pre-pass before a block is even filled. Those two are exhaustive over the mnemonics that
+        // can carry an address, so no operand reaching this policy is one. `test/fp-refusal.test.ts`
+        // pins it, and moving the FPU check into a pre-pass ahead of that one turns it red.
+        fpReg: PPC_FP_REG,
+        // The FPSCR moves that name no `fN` operand at all: `mtfsfi 7,0` takes a field number,
+        // `mtfsb0`/`mtfsb1` a bit number, `mcrfs cr0,cr1` two condition registers. Without this
+        // they read as "no register destination to degrade", which is the message that hides a
+        // missing file behind the shape of the instruction. `mffs f0` and `mtfsf 0xff,f0` DO name
+        // one and are `fpReg`'s.
+        fpControl: /^(mtfsfi|mtfsb0|mtfsb1|mcrfs)$/i,
         storeClass: /^st/i,
         skipSafe: /^nop$/i,
         context: `${name} @0x${ins.addr.toString(16)}`,
@@ -743,7 +966,30 @@ export function lift(
     };
 
     // cr-field compare state, so a following branch fuses. Keyed by cr name ("cr0" default).
-    const cmpDef = new Map<string, { lhs: Value; rhs: Value; signed: boolean }>();
+    //
+    // A block starts with what its predecessor left, under the edge rule both frontends share
+    // (`inheritFlags`, frontend/flags-edge.ts): one predecessor, already filled, not a jump-table
+    // dispatch. The edge out of a CONDITIONAL branch carries too, because a `bc` writes no CR field:
+    // mwcc's switch dispatch `cmpwi r0,1; beq- case1; bge- default` reads one compare from the
+    // `beq-` and then from the `bge-` on its fall-through, which begins a block of its own.
+    //
+    // The clobber rule is this frontend's own: a compare writes its field, a record-form op writes
+    // cr0, and a call destroys every volatile field (CR_VOLATILE). A field something else wrote holds
+    // the sentence saying so rather than an entry, so the branch that reads it can name the writer.
+    // Every other instruction that writes a CR field (`crxor`, `mtcrf`, `fcmpu`, …) names no
+    // register destination and is refused outright by the opaque policy, so it never reaches here.
+    const inherited = inheritFlags(bi, {
+      preds,
+      exit: exitCr,
+      label: blockLabel,
+      dispatches: (i) => {
+        const pbr = blocks[i].branch;
+        return pbr !== null && jts.has(pbr.addr);
+      },
+      refusesConditional: () => false,
+    });
+    const cmpDef = new Map<string, CrCompare | string>(typeof inherited === 'string' ? [] : inherited.fields);
+    const noCmpWhy = typeof inherited === 'string' ? inherited : inherited.none;
     // One operand-grammar normalizer for the four compare decodes: `cmpX rA,…` (cr0 implicit)
     // or `cmpX crN,rA,…` → the cr field, the lhs register token, and the rhs token (register or
     // immediate — the case reads/parses it).
@@ -771,45 +1017,102 @@ export function lift(
           break;
         // --- call + frame/link-register bookkeeping ---
         // `bl <sym>`: read the argument registers (r3..), produce the return value in r3. The
-        // callee symbol comes from the relocation (ins.reloc); caller-saved clobbering is implicit
-        // (anything live across the call has already been moved to a callee-saved register).
+        // callee symbol comes from the relocation (ins.reloc), and the caller-saved set is recorded
+        // as destroyed (`calls.lower`) — a read of one past here names bytes the callee overwrote,
+        // and it has a reaching definition all the same.
         case 'bl': {
           relocTaken = ins.reloc?.type === 'R_PPC_REL24';
           const sym = ins.reloc?.sym ?? 'func';
-          const declared = protoArity(prototypes[sym]);
-          const argc = declared ?? fallbackArgc(bi, ins.addr);
-          const args: Value[] = [];
-          for (let k = 0; k < argc; k++) {
-            args.push(read(ARG_REGS[k]));
+          calls.lower({
+            callee: sym,
+            ssa,
+            bi,
+            read,
+            write,
+            // a pending `@ha` half is not an argument
+            highHalves,
+            guess: {
+              // a gap in the argument registers refuses, naming this address (`fallbackArgc`)
+              at: ins.addr,
+              // A GUESS THAT FILLS EVERY ARGUMENT REGISTER CANNOT SAY WHERE THE LIST ENDS. The ninth
+              // argument travels in the callee's parameter area, 8 bytes above the pushed r1 (past the
+              // back chain and the LR save word), and a value stored there that reaches the call is that
+              // argument or a local the compiler put in the same words. Reading the word back, before or
+              // after the call, does not decide it, so the end-of-lift check for a store nothing reloads
+              // is not enough here. Without a prototype this refuses; a declared arity says which.
+              //
+              // A guess of seven is the same question for one shape. A 64-bit argument takes an aligned
+              // register pair, so one that follows seven words skips r10 and fills the first two words
+              // of the parameter area (mwcc 2.3.3 builds `g(1, 2, 3, 4, 5, 6, 7, x)` with `long long x`
+              // that way). A single word there cannot be an argument after seven: the eighth word would
+              // have gone in r10.
+              refuse: (argc) => {
+                if (argc < ARG_REGS.length - 1) {
+                  return;
+                }
+                const depth = r1At.get(ins);
+                const reaching = (off: number) => valueSlots.has(off) && ssa.hasReachingDef(stackSlotKey(off), bi);
+                const inParamArea = (off: number) => typeof depth !== 'number' || (off >= depth + 8 && off < 0);
+                const word = [...valueSlots.keys()].find((off) => inParamArea(off) && reaching(off));
+                const passed =
+                  argc === ARG_REGS.length || typeof depth !== 'number'
+                    ? word
+                    : reaching(depth + 8) && reaching(depth + 12)
+                      ? depth + 8
+                      : undefined;
+                if (passed !== undefined) {
+                  const slot = valueSlots.get(passed)!;
+                  throw new PpcUnsupportedError(
+                    `cannot lift '${name}': outgoing stack arguments not modelled — the undeclared call to '${sym}' at ` +
+                      `0x${ins.addr.toString(16)} fills ${argc} argument registers, and the value ` +
+                      `stored to '${slot.mem}' at 0x${slot.addr.toString(16)} reaches it in the callee's ` +
+                      `parameter area, where an argument past the registers travels`,
+                  );
+                }
+              },
+            },
+          });
+          for (const cr of CR_VOLATILE) {
+            cmpDef.set(
+              cr,
+              `the call at 0x${ins.addr.toString(16)} destroyed it (the EABI does not preserve ${cr} across a call)`,
+            );
           }
-          // Pushed with `tmp` rather than `emit` so the result register is written separately from
-          // the op — r3.. are volatile under the EABI, so a GUESSED arity that counted a register
-          // set up before an intervening call passes an argument the caller never set up
-          // (`finish()` cuts those back — frontend/ssa.ts), and the call's OWN result is the
-          // CALLEE's write, so `noteCall` records the clobber after it rather than before.
-          const res = kit.tmp('call', args, { target: sym });
-          if (declared === undefined) {
-            ssa.recordGuessedCall(ops[ops.length - 1], bi, { argRegs: ARG_REGS, returnReg: RET });
-          }
-          write(RET, res);
-          ssa.noteCall(bi);
           break;
         }
         // Stack-frame + link-register bookkeeping. `stwu r1,-N(r1)` / `addi r1,r1,N` adjust the frame
-        // pointer; `mflr`/`mtlr` save/restore the return address. Transparent. Register saves/restores
-        // (individual r1 spills, and `stmw`/`lmw` of a callee-saved range) are transparent ONLY when
-        // they move an unchanged entry value — `frameStore`/`frameLoad` enforce that (a spill of a
-        // LIVE value fails loud); `stmw`/`lmw` record/consume the slot directly.
+        // pointer; `mflr` copies the return address out (`returnAddresses`) and `mtlr` puts it back.
+        // A word store or load on r1 is a save or a value slot (`frameStore`/`frameLoad`); `stmw`
+        // records save slots.
         // The GENERAL form `stwu rS,D(rA)` (base ≠ r1) is a real store-with-BASE-UPDATE
         // (`*(rA+D)=rS; rA+=D`) — neither effect is modelled here, so loud-fail rather than drop both.
+        // The push itself must be the only one, taken from the entry r1: every slot is named by its
+        // offset from there (`r1Displacements`), and a push from anywhere else moves that origin.
         case 'stwu':
           if (parseMem(s).base === 'r1') {
+            if (d !== 'r1' || r1At.get(ins) !== 0) {
+              throw new PpcUnsupportedError(
+                `cannot lift '${name}': '${ins.mnemonic} ${ins.ops.join(',')}' at 0x${ins.addr.toString(16)} ` +
+                  `is not the one frame push from the entry stack pointer — ` +
+                  `${d !== 'r1' ? `it stores ${d}, not the back chain` : `r1 had already moved (${r1At.get(ins)})`}`,
+              );
+            }
+            // The push also STORES: the entry r1, at its new top, which is the entry offset of `s`
+            // because r1 has not moved yet. A value stored there before the push is overwritten, and
+            // a load from it afterwards reads the caller's r1.
+            refuseMixedSlot(ins, s, parseMem(s).off, 'save');
+            saveSlots.set(parseMem(s).off, 'r1');
             break;
           }
           throw new PpcUnsupportedError(
             `cannot lift '${name}': stwu with update on ${parseMem(s).base} (store-with-base-update) not modelled`,
           );
-        case 'mflr':
+        case 'mflr': {
+          const lr = mkValue(T.unk(32));
+          returnAddresses.set(lr, ins.addr);
+          write(d, lr);
+          break;
+        }
         case 'mtlr':
           break;
         // `mtctr rS` initialises the CTR loop counter — track it as the `ctr` pseudo-register so
@@ -821,21 +1124,20 @@ export function lift(
           break;
         case 'stmw':
           if (parseMem(s).base === 'r1') {
-            for (const slot of frameRange(d, parseMem(s).off)) {
-              savedSlots.set(slot.off, slot.reg);
+            for (const slot of frameRange(d, entryOffset(ins, s))) {
+              refuseMixedSlot(ins, s, slot.off, 'save');
+              saveSlots.set(slot.off, slot.reg);
             }
             break;
           }
           assertOrdinaryMem(s);
           emitOpaqueDest(ins);
           break;
-        // The restore half. Every word it reads must be the slot the matching `stmw` wrote, for the
-        // same register — `frameLoad` asks that question one word at a time, and refuses loud when
-        // the answer is no, exactly as the single-register `lwz` does.
+        // The restore half: `frameLoad` judges each word it reads, exactly as for a single `lwz`.
         case 'lmw':
           if (parseMem(s).base === 'r1') {
             for (const slot of frameRange(d, parseMem(s).off)) {
-              frameLoad(slot.reg, `${slot.off}(r1)`);
+              frameLoad(ins, slot.reg, `${slot.off}(r1)`);
             }
             break;
           }
@@ -924,6 +1226,20 @@ export function lift(
             }
             break;
           }
+          // An rA field of 0 is the literal 0, not r0: `addi rD,0,SIMM` is `li`. A disassembler that
+          // prints it as `addi rD,r0,SIMM` still means the constant.
+          if (mnem === 'addi' && s === 'r0') {
+            write(d, constVal(parseImm(t)));
+            break;
+          }
+          // `addi rD,rS,0` is a register move: rS + 0 is rS, as Thumb's `add rD,rS,#0` is
+          // (frontend/thumb.ts). mwcc 2.3.3 spells its moves this way. Lifted as an add, the `+ 0`
+          // makes a pointer an integer sum, and C++ will not pass `(u32)&table + 0` as a
+          // `const char *`. `addic` sets the carry and is not a move.
+          if (mnem === 'addi' && parseImm(t) === 0) {
+            write(d, read(s));
+            break;
+          }
           emitBin('add', d, read(s), constVal(parseImm(t)));
           break;
         // add immediate SHIFTED — the register-based `%ha` anchor: mwcc derives an absolute base
@@ -932,6 +1248,10 @@ export function lift(
         // arithmetic, and a reloc-carrying one never gets here — the choke point in `decode` takes
         // it.
         case 'addis':
+          if (s === 'r0') {
+            write(d, constVal((parseImm(t) << 16) >> 0)); // `addis rD,0,SIMM` is `lis`, as for `addi`
+            break;
+          }
           emitBin('add', d, read(s), constVal((parseImm(t) << 16) >> 0));
           break;
         case 'subf':
@@ -1084,10 +1404,10 @@ export function lift(
           emitOpaqueDest(ins);
           break;
         }
-        // Word load/store: a transparent frame save/restore is skipped; a live-value spill or a
-        // stack local fails loud (frameStore/frameLoad); otherwise it is ordinary memory.
+        // Word load/store: an r1-relative word is a frame slot (frameStore/frameLoad); otherwise it is
+        // ordinary memory.
         case 'lwz':
-          if (frameLoad(d, s)) {
+          if (frameLoad(ins, d, s)) {
             break;
           }
           emitLoad(ins, d, s, 4, true);
@@ -1102,7 +1422,7 @@ export function lift(
           emitLoad(ins, d, s, 1, false);
           break;
         case 'stw':
-          if (frameStore(d, s)) {
+          if (frameStore(ins, d, s)) {
             break;
           }
           emitStore(ins, d, s, 4);
@@ -1162,6 +1482,41 @@ export function lift(
           recordCmp(c.cr, read(c.lhsTok), rhs, false);
           break;
         }
+        case 'fadds':
+        case 'fsubs':
+        case 'fmuls':
+        case 'fdivs':
+        case 'fadd':
+        case 'fsub':
+        case 'fmul':
+        case 'fdiv':
+        case 'fneg':
+        case 'fmr': {
+          const { op } = FP_ARITH[mnem];
+          if (rc || fpu === undefined || ins.ops.length === 0 || !ins.ops.every(isFpKey)) {
+            emitOpaqueDest(ins);
+            break;
+          }
+          if (callInsn) {
+            throw new PpcUnsupportedError(
+              `cannot lift '${name}': '${ins.mnemonic}' computes on a float and '${callInsn.mnemonic}' at ` +
+                `0x${callInsn.addr.toString(16)} makes a call — the floating-point registers a call reads, returns ` +
+                `in and destroys are not modelled`,
+            );
+          }
+          if (fpType === null) {
+            refuseBothPrecisions(name, ins.mnemonic);
+          }
+          const [dst, ...srcs] = ins.ops;
+          if (op === 'copy') {
+            writeVar(dst, bi, read(srcs[0]));
+            break;
+          }
+          const v = mkValue(fpType);
+          ops.push(mkOp(op, { operands: srcs.map(read), results: [v] }));
+          writeVar(dst, bi, v);
+          break;
+        }
         default:
           emitOpaqueDest(ins);
           break; // unmodelled: an honest opaque, never a silent drop
@@ -1170,6 +1525,11 @@ export function lift(
       // next branch reading cr0 fuses (`andi. r0,r3,1; beq …` → `if ((a0 & 1) == 0)`).
       if (rc && lastDef) {
         cmpDef.set('cr0', { lhs: lastDef, rhs: constVal(0), signed: true });
+      } else if (rc) {
+        cmpDef.set(
+          'cr0',
+          `'${ins.mnemonic}' at 0x${ins.addr.toString(16)} wrote it from no value this frontend models`,
+        );
       }
       // THE CHOKE POINT. Everything above either took the relocation or threw; a relocation still
       // sitting here was dropped, and a dropped relocation is the printed placeholder standing in
@@ -1182,6 +1542,11 @@ export function lift(
     for (const ins of b.body) {
       decode(ins);
     }
+    // No terminator writes a CR field (a `bc` reads one, `bdnz` writes CTR), so the state after the
+    // body is the state at the block's exit. Recorded for EVERY block, including those whose edges
+    // `inheritFlags` will refuse: the edge rule lives in one place, and a second copy of it here
+    // could disagree with the first.
+    exitCr.set(bi, { fields: cmpDef, none: noCmpWhy });
 
     const br = b.branch;
     // Recovered dense switch: the bounds block dispatches a `switch_br` over the scrutinee — N case
@@ -1248,11 +1613,14 @@ export function lift(
       // The branch names its cr field as the first operand when not cr0.
       const crName = br.ops[0]?.startsWith('cr') ? br.ops[0] : 'cr0';
       const cmp = cmpDef.get(crName);
-      // `cmpDef` is block-local; a compare split from its branch by a block boundary is a
-      // cross-block cr dependency this frontend does not model. Decline loud.
+      if (typeof cmp === 'string') {
+        throw new PpcUnsupportedError(
+          `cannot lift '${name}': conditional branch '${base}' tests ${crName}, but ${cmp}`,
+        );
+      }
       if (!cmp) {
         throw new PpcUnsupportedError(
-          `cannot lift '${name}': conditional branch '${base}' has no reaching compare (${crName}) in its block`,
+          `cannot lift '${name}': conditional branch '${base}' has no reaching compare (${crName}): ${noCmpWhy}`,
         );
       }
       const table = !cmp.signed ? COND_UNSIGNED : COND_SIGNED;
@@ -1265,8 +1633,7 @@ export function lift(
         ops.push(mkOp('br', { attrs: { fallthrough: true }, successors: [succ(succIdx[bi][0])] }));
         return;
       }
-      const retOps = ssa.hasReachingDef(RET, bi) ? [readReg(RET, bi)] : [];
-      ops.push(mkOp('ret', { operands: retOps }));
+      ops.push(mkOp('ret', { operands: returnOperands(bi) }));
       return;
     }
     // unconditional branch
@@ -1281,14 +1648,38 @@ export function lift(
   // float load's displacement) lands here, which is what keeps "not modelled" from becoming "not
   // emitted".
   highHalves.assertAllConsumed(name);
+  // A value stored to the frame that nothing reloads is either a home the body never reads or an
+  // OUTGOING stack argument (`stw r4,8(r1)` before a nine-argument `bl` passes the ninth in the
+  // callee's parameter area, as ac-decomp's `aQMgr_order_decide_trade_*` do). The two are the same
+  // store, and dropping the second loses an argument.
+  for (const { addr, mem, read } of valueSlots.values()) {
+    if (!read) {
+      throw new PpcUnsupportedError(
+        `cannot lift '${name}': local stack frames not supported — '${mem}' is stored at 0x${addr.toString(16)} ` +
+          `and never read back, and an unread home and a call's argument passed on the stack are the same store`,
+      );
+    }
+  }
+  const argSlots = fpuArgSlots(name, fpu, ARG_REGS, isFpKey, fpType);
+  mintArgSlotHoles(ssa, preds[0].length > 0, argSlots);
   ssa.finish();
   highHalves.assertNoneEscaped(name, irBlocks);
+  // Checked on the finished function, after `finish` pruned the joins nothing reads, because a
+  // return address reaches a use through a join's incoming arguments as well as directly.
+  for (const b of irBlocks) {
+    for (const op of b.ops) {
+      const lr = [...op.operands, ...op.successors.flatMap((s) => s.args)].find((v) => returnAddresses.has(v));
+      if (lr !== undefined) {
+        throw new PpcUnsupportedError(
+          `cannot lift '${name}': the return address the 'mflr' at 0x${returnAddresses.get(lr)!.toString(16)} ` +
+            `copies out is used as a value — a function reading its own return address has no C spelling`,
+        );
+      }
+    }
+  }
 
-  // ABI-ordered entry parameters (r3, r4, …) — a callee-saved copy can read a later argument
-  // register first, so sort the true entry's params by argument-register index.
-  const entry = irBlocks[0];
-  // non-ABI live-in ranks FIRST (indexOf's -1) — deliberate MIPS/PPC tie-break; Thumb's is 99/last
-  abiSortEntryParams(entry, preds[0].length > 0, (v) => ARG_REGS.indexOf(paramReg.get(v) ?? ''));
+  abiSortEntryParams(irBlocks[0], preds[0].length > 0, paramReg, argSlots);
+  ssa.fn.localObjects = statics.finish();
   return ssa.fn;
 }