@asmlift/core 0.8.1 → 0.9.0

package/src/frontend/mips.ts

@@ -7,9 +7,9 @@
 // EXCEPT that a conditional branch reads its comparison operands as of the branch, so those
 // SSA values are captured BEFORE the delay slot runs, then the delay slot executes, then the
 // `cond_br` is emitted. A `jr ra` return's delay slot (which computes the return value) runs
-// first, then the value is read. Branch-likely ops (`beql`/`bnel`…, which annul the delay slot
-// when not taken) and calls (`jal`) are out of scope — both loud-fail (the control-transfer
-// pre-scan in `lift`).
+// first, then the value is read. A call's (`jal`) delay slot runs before the call, so it can set
+// an argument up. A branch-likely (`beql`/`bnel`…) annuls its slot when not taken, so the slot is
+// a block of its own on the taken edge (`toBlocks`).
 //
 // Comparison model: MIPS fuses compare-and-branch, so a branch lowers directly to an icmp
 // (the branch mnemonics are signed/equality only). `bltz/bgez/blez/bgtz` compare against zero; `beq/bne`
@@ -24,6 +24,7 @@ import { T } from '../ir/types';
 import type { Prototypes } from '../proto';
 import type { TargetDescription } from '../target';
 import { type AsmData, readJumpTable, textRelocAt } from './asmdata';
+import { callDeclarations } from './call-plan';
 import {
   type DisasmInstr,
   parseImm,
@@ -33,13 +34,14 @@ import {
   symbolStart,
 } from './disasm';
 import { mkEmitKit, pushSwitchBr } from './emit';
-import { FrontendUnsupportedError } from './errors';
+import { type FrontendRefusal, FrontendUnsupportedError } from './errors';
 import { assertInputFormat } from './format';
+import { fpPrecision, fpuArgSlots, refuseBothPrecisions, writesFloatReturn } from './fpu';
 import type { Frontend } from './frontend';
 import { makeHighHalves } from './high-half';
 import { opaqueDest } from './opaque';
-import { isSplatMips, parseSplatMips } from './splat';
-import { abiSortEntryParams, stackSlotKey } from './ssa';
+import { MIPS_FP_REG, isSplatMips, mipsEvenFpKey, parseSplatMips } from './splat';
+import { abiSortEntryParams, mintArgSlotHoles, stackSlotKey } from './ssa';
 import { makeSsaBuilder } from './ssa';
 
 type Instr = DisasmInstr;
@@ -73,10 +75,39 @@ const LIKELY_BASE: Record<string, string> = {
 // code nor the compare is modelled, so these refuse whether or not they are also likely.
 const isFpCondBranch = (m: string) => m.startsWith('bc1');
 
+/** The FPU arithmetic this frontend lifts, onto the float opcodes (`mov.s`/`mov.d` are copies and
+ *  have none), with the precision each computes in: `.s` single, `.d` double, one per function
+ *  (`frontend/fpu.ts` `fpPrecision`). Every other FPU instruction — the conversions, the moves to and
+ *  from the integer file and memory, the compares — keeps the register-file refusal `opaqueDest`
+ *  gives it, and so does one of these naming an odd register (a double's second half, or a single
+ *  this frontend does not key) or a target with no `fpu` homes. `docs/floating-point.md` says what
+ *  the next layer is. */
+const FP_ARITH: Readonly<Record<string, { op: Opcode | 'copy'; width: 32 | 64 }>> = {
+  'add.s': { op: 'fadd', width: 32 },
+  'sub.s': { op: 'fsub', width: 32 },
+  'mul.s': { op: 'fmul', width: 32 },
+  'div.s': { op: 'fdiv', width: 32 },
+  'neg.s': { op: 'fneg', width: 32 },
+  'mov.s': { op: 'copy', width: 32 },
+  'add.d': { op: 'fadd', width: 64 },
+  'sub.d': { op: 'fsub', width: 64 },
+  'mul.d': { op: 'fmul', width: 64 },
+  'div.d': { op: 'fdiv', width: 64 },
+  'neg.d': { op: 'fneg', width: 64 },
+  'mov.d': { op: 'copy', width: 64 },
+};
+const FP_ARITH_MNEMONICS: ReadonlySet<string> = new Set(Object.keys(FP_ARITH));
+/** A key the SSA builder holds for the FPU's file: `mipsEvenFpKey`'s canonical spelling. */
+const isFpKey = (k: string) => /^\$f\d+$/.test(k);
+
 const isZero = (r: string) => r === 'zero' || r === '$0';
 // The stack pointer (`$29`). A `sw/lw` through it is not a store/load through a data pointer — it
 // is a spill/reload of a stack SLOT (an argument home slot or a local). See emitStore/emitLoad.
 const isStackPtr = (r: string) => r === 'sp' || r === '$sp' || r === '$29';
+// Where O32 puts a call's argument k ≥ 4: the caller's outgoing area keeps `[0,16)` as the home of
+// a0..a3, and argument k is the word at `16 + 4(k − 4)` above the `sp` the call is made at.
+// Compiled on ido7.1, gcc2.7.2kmc and gcc2.7.2: `g(a, b, 1, 2, 3)` stores the 3 to `16(sp)`.
+const STACK_ARGS_AT = 16;
 // SSA-variable name for the stack slot at a constant `sp`-offset. Distinct namespace from the
 // register names (which are alphabetic / `$N`), so it never collides with a real register var.
 const stackSlot = stackSlotKey; // shared spelling: frontend/ssa.ts
@@ -135,6 +166,10 @@ const parseDisasm = (disasm: string): Instr[] => parseSharedDisasm(disasm, { zer
 // A recovered JUMP TABLE's dispatch is untouched: Regime B reads the table through `asmdata.ts` and
 // prunes the dispatch block, so its `lui %hi(.rodata)` never reaches `decode`.
 //
+// `R_MIPS_26` is a `jal`'s callee, and a `j`'s target where the jump stays in this section. objdump
+// prints the field, which in a relocatable object is the addend and not the address, so the callee
+// is read off this record alone.
+//
 // `R_MIPS_GOT16`/`R_MIPS_CALL16`/`R_MIPS_GPREL16` are PIC/small-data access, already refused by the
 // `gp`-as-data guard; widening this carrier to them would trade those messages for worse ones
 // without recovering an address.
@@ -145,7 +180,7 @@ const parseDisasm = (disasm: string): Instr[] => parseSharedDisasm(disasm, { zer
 function attachMipsRelocs(name: string, instrs: Instr[], ad: AsmData): void {
   const byAddr = new Map(instrs.map((ins) => [ins.addr, ins]));
   for (const r of ad.relocs) {
-    if (r.section !== '.text' || (r.type !== 'R_MIPS_HI16' && r.type !== 'R_MIPS_LO16')) {
+    if (r.section !== '.text' || (r.type !== 'R_MIPS_HI16' && r.type !== 'R_MIPS_LO16' && r.type !== 'R_MIPS_26')) {
       continue;
     }
     const ins = byAddr.get(r.offset);
@@ -582,13 +617,13 @@ function toBlocks(
   return { blocks: blocks.filter((b) => reachable.has(b)), succAddrs };
 }
 
-/** Lift disassembled MIPS text → an L1 Fn with block-argument SSA. `prototypes` reserved for
- *  call arity (calls are a later milestone). */
+/** Lift disassembled MIPS text → an L1 Fn with block-argument SSA. `prototypes` declares each
+ *  callee's arity (`frontend/call-plan.ts`). */
 export function lift(
   name: string,
   asm: string,
   target: TargetDescription,
-  _prototypes: Prototypes = {},
+  prototypes: Prototypes = {},
   asmData?: AsmData,
 ): Fn {
   // Two input dialects reach this frontend: `objdump -d` text (IDO/KMC — no compiler-emitted asm),
@@ -655,16 +690,24 @@ export function lift(
     attachMipsRelocs(name, instrs, asmData);
   }
   // TRUSTWORTHINESS: fail LOUD on a control transfer this frontend cannot model — the `opaque`
-  // path cannot catch these (implicit or no register destination). `jal`/`jalr` clobber `v0`
-  // implicitly, so dropping a call fabricates `v0` from a stale value; a `jr` to anything but `ra`
-  // (jump table / computed goto) is not a plain return. Calls are a later milestone; until then
-  // they are a catchable "out of scope" signal, mirroring the PPC frontend.
+  // path cannot catch these (implicit or no register destination). A `jalr` clobbers `v0`
+  // implicitly, so dropping it fabricates `v0` from a stale value, and the callee it reaches is a
+  // register's value; a `jr` to anything but `ra` (jump table / computed goto) is not a plain
+  // return. `jal` is lowered where its block is filled (`lowerJal`).
   for (const ins of instrs) {
-    if (ins.mnemonic === 'jal' || ins.mnemonic === 'jalr') {
+    if (ins.mnemonic === 'jalr') {
       throw new FrontendUnsupportedError(
         `cannot lift '${name}': function call '${ins.mnemonic}' at 0x${ins.addr.toString(16)} — MIPS calls not yet modelled`,
       );
     }
+    // A `j` relocated against a symbol leaves this section's code for another function's, which is
+    // a tail call; the target objdump prints is the field, not the address.
+    if (ins.mnemonic === 'j' && ins.reloc !== undefined && !ins.reloc.sym.startsWith('.')) {
+      throw new FrontendUnsupportedError(
+        `cannot lift '${name}': 'j' at 0x${ins.addr.toString(16)} jumps to '${ins.reloc.sym}' — a tail call into ` +
+          'another function is not modelled',
+      );
+    }
     if (ins.mnemonic === 'jr' && ins.ops[0] !== 'ra' && !recoveredJr.has(ins.addr)) {
       throw new FrontendUnsupportedError(
         `cannot lift '${name}': indirect jump 'jr ${ins.ops[0] ?? ''}' at 0x${ins.addr.toString(16)} — jump tables / tail calls not supported`,
@@ -682,6 +725,20 @@ export function lift(
   }
   checkDelaySlots(name, instrs);
   const { blocks, succAddrs } = toBlocks(instrs, jts, likelyAddrs);
+  // PREHEADER, as in frontend/ppc.ts: an entry that is a branch target gets an empty block ahead of
+  // it, whose live-ins are the function's parameters. One word below the function, so it falls
+  // through to it.
+  if (blocks.some((b) => succAddrs.get(b)!.includes(blocks[0].startAddr))) {
+    const ph: MipsBlock = {
+      startAddr: blocks[0].startAddr - 4,
+      body: [],
+      branch: null,
+      delay: null,
+      delayAnnulled: false,
+    };
+    succAddrs.set(ph, [blocks[0].startAddr]);
+    blocks.unshift(ph);
+  }
   const idxOf = new Map(blocks.map((b, i) => [b.startAddr, i]));
 
   // CFG predecessors by block index.
@@ -706,24 +763,48 @@ export function lift(
   // `[0,16)` as the caller-owned home area (in NEITHER range — caller-owned, but not an argument)
   // with stack arguments from 16 up, which is what `mips32be.cspec`'s `<localrange>` and stack
   // `<pentry offset="16">` encode.
-  const ssa = makeSsaBuilder(name, blocks.length, preds);
+  const fpType = fpPrecision(instrs, (m) => FP_ARITH[m]?.width);
+  const ssa = makeSsaBuilder(name, blocks.length, preds, undefined, (k) =>
+    isFpKey(k) ? (fpType ?? T.f32()) : undefined,
+  );
   const { irBlocks, readVar, writeVar, paramReg } = ssa;
   const RET = target.returnReg;
   const ARG_REGS = target.argRegs;
+  const fpu = target.fpu;
+  const floatReturn = writesFloatReturn(
+    blocks.flatMap((b) => (b.delay ? [...b.body, b.delay] : b.body)),
+    FP_ARITH_MNEMONICS,
+    mipsEvenFpKey,
+    fpu,
+  );
 
   // The pending `%hi` halves of this function's global addresses, keyed by the SSA VALUE each `lui`
   // defines (frontend/high-half.ts holds the invariant and why a register-keyed map cannot answer
   // the question; frontend/ppc.ts folds the same one). FUNCTION-scoped, because a value is: a pair
   // split across blocks folds when SSA says the half reaches, and refuses when what arrives is the
   // block parameter standing for a merge.
-  const highHalves = makeHighHalves({
-    hi: '%hi',
-    hiArticle: 'a',
-    lo: '%lo',
-    fail: (message) => {
-      throw new FrontendUnsupportedError(message);
-    },
-  });
+  /** This frontend's refusal, for the shared code that refuses on its behalf. */
+  const fail: FrontendRefusal = (message) => {
+    throw new FrontendUnsupportedError(message);
+  };
+  const highHalves = makeHighHalves({ hi: '%hi', hiArticle: 'a', lo: '%lo', fail });
+  // O32 passes the words past a0..a3 on the stack and returns a word in v0. This lowering builds no
+  // register pair and receives no struct through a hidden pointer, so the plan refuses both. A call
+  // through an argument register bounds no arity here: a leading float leaves a0 free.
+  const calls = callDeclarations(
+    name,
+    target,
+    prototypes,
+    { pairs: false, memoryReturn: false, stackArgs: true, voidReturn: true, argRegisterBoundsArity: false },
+    fail,
+  );
+  // The first instruction naming the FPU's file, a data register or the control register. A call
+  // in a function that has one refuses: which floating-point registers a callee reads, returns in
+  // and destroys is not modelled. A float that crosses the call untouched in $f12 or $f0 names no
+  // register here, so only the callee's declaration shows it (`plan`).
+  const fpuInstr = instrs.find(
+    (ins) => /^(cfc1|ctc1)$/i.test(ins.mnemonic) || ins.ops.some((o) => MIPS_FP_REG.test(o)),
+  );
 
   // SOUNDNESS GUARD. The word stack-slot model (emitLoad/emitStore) is safe ONLY when every
   // sp-relative access in the function is word-width. If a SUB-WORD sp access aliases a word slot
@@ -737,6 +818,42 @@ export function lift(
       SUBWORD_MEM.has(ins.mnemonic) && ins.ops.length > 0 && isStackPtr(parseMem(ins.ops[ins.ops.length - 1]).base),
   );
 
+  // THE FRAME A CALL'S STACK ARGUMENTS ARE STAGED IN: the bytes one `addiu sp,sp,-N` pushed. Its
+  // outgoing area is `[16, N)`; a word at or above N is this function's own incoming home area, which
+  // IDO stores a0..a3 to, so it is never an argument of a call made here. Undefined where the
+  // function pushes no frame or more than one.
+  const pushes = instrs.filter(
+    (ins) =>
+      (ins.mnemonic === 'addiu' || ins.mnemonic === 'addi') &&
+      isStackPtr(ins.ops[0]) &&
+      isStackPtr(ins.ops[1] ?? '') &&
+      parseImm(ins.ops[2] ?? '') < 0,
+  );
+  const frameSize = pushes.length === 1 ? -parseImm(pushes[0].ops[2]) : undefined;
+
+  // THE FRAME'S SAVES. A word store of `ra`, or of a register O32 does not let a callee destroy,
+  // made while the register still holds what the caller left in it, is a SAVE: the word holds the
+  // caller's value, which no C value names, so the store mints no parameter. The reload into the
+  // same register is the restore, and what it writes refuses any use, as a `%hi` half does: a read
+  // at once, a use reached through a merge once the function is built. A reload into another
+  // register refuses. Every other word store is a VALUE slot, and a slot is one kind for the whole
+  // function. Keyed by the raw `sp` offset, as every slot here is, so a prologue save matches an
+  // epilogue restore in any block.
+  const saveSlots = new Map<number, string>();
+  const valueSlots = new Set<number>();
+  const restores = new Map<Value, { reg: string; addr: number }>();
+  // A `$`-spelt operand is an FPU register or a bare number, and the target's list names neither.
+  const savedByCallee = (r: string) =>
+    r === 'ra' || (!r.startsWith('$') && !target.callerSaved.includes(r) && !['zero', 'sp', 'gp'].includes(r));
+  const refuseMixedSlot = (ins: Instr, mem: string, off: number, kind: 'save' | 'value') => {
+    if (kind === 'save' ? valueSlots.has(off) : saveSlots.has(off)) {
+      throw new FrontendUnsupportedError(
+        `cannot lift '${name}': local stack frames not supported — '${mem}' at 0x${ins.addr.toString(16)} ` +
+          `is a word this function both saves a register in and stores a value to`,
+      );
+    }
+  };
+
   // Hardware divide state (capabilities.hwDivide). MIPS `div`/`divu rs,rt` set the hi/lo pair
   // implicitly; a later `mflo`/`mfhi` reads the quotient/remainder. FUNCTION-scoped: GCC schedules
   // the `mflo` into a SEPARATE block after the trap-check branch (`bnez rt; break 7`), so a
@@ -780,7 +897,15 @@ export function lift(
       }
       // A register holding the high half of an address is NOT a value. The legitimate consumers
       // (`addiu %lo`, a `%lo` load/store base) reach the half through `foldLoHalf` instead.
-      return highHalves.guardRead(name, r, readVar(r, bi));
+      const v = readVar(r, bi);
+      const restore = restores.get(v);
+      if (restore) {
+        throw new FrontendUnsupportedError(
+          `cannot lift '${name}': ${r} is read after the 'lw' at 0x${restore.addr.toString(16)} restores the ` +
+            `caller's ${restore.reg} into it — no C value names it`,
+        );
+      }
+      return highHalves.guardRead(name, r, v);
     };
     // `slt`-family results, so a following `beqz`/`bnez` can fold into one compare.
     //
@@ -1076,6 +1201,24 @@ export function lift(
         case 'sb':
           emitStore(ins, d, s, 1);
           break;
+        // A call reaches here only from a delay slot (the fill loop lowers every other one), and a
+        // transfer in a delay slot is one the ISA leaves undefined.
+        case 'jal':
+          throw new FrontendUnsupportedError(`${site(ins)} sits in the delay slot of a transfer`);
+        case 'add.s':
+        case 'sub.s':
+        case 'mul.s':
+        case 'div.s':
+        case 'neg.s':
+        case 'mov.s':
+        case 'add.d':
+        case 'sub.d':
+        case 'mul.d':
+        case 'div.d':
+        case 'neg.d':
+        case 'mov.d':
+          emitFpArith(ins);
+          break;
         default:
           emitOpaqueDest(ins);
           break; // unmodelled: an honest opaque, never a silent drop
@@ -1108,9 +1251,16 @@ export function lift(
       if (ins.reloc) {
         relocPlaceholder(ins);
       }
-      // storeClass: unmodelled MIPS stores — incl. the unaligned pair swl/swr and the FPU stores,
-      // whose FIRST token is a register (a SOURCE, not a dest) that would otherwise fabricate an
-      // opaque write to it while dropping the real memory write.
+      // storeClass: unmodelled MIPS stores, whose FIRST token is a register (a SOURCE, not a dest)
+      // that would otherwise fabricate an opaque write to it while dropping the real memory write.
+      // `swc1`/`sdc1` are in the list and are NOT reached by any spelling `fpReg` covers — an FPU
+      // store's `rt` is an FP register by ISA, so the arm above claims it first — but that is a
+      // claim about the PREDICATE, not about the ISA, and it is false for every register spelling
+      // the predicate misses: the store then arrives here and is named by the memory it writes
+      // instead of by the file it moves. So they are kept as a live backstop, and
+      // `test/fp-refusal.test.ts` asserts the FP arm wins on each spelling rather than assuming it.
+      // Everything else here is genuinely reachable: `swl`/`swr` are the unaligned pair, `sc`/`sd*`
+      // the rest.
       // skipSafe `break`: the compiler-emitted divide-by-zero guard trap inside the hw-divide
       // idiom (KMC GCC `break 0x7`); recompiling the recovered `/` regenerates it, so it is
       // transparent by the same modelling as the divide itself (byte-exactness proven by the
@@ -1118,6 +1268,22 @@ export function lift(
       const od = opaqueDest(ins.mnemonic, ins.ops, {
         isReg: isMipsReg,
         isZero,
+        // The coprocessor-1 register file. `isMipsReg` rejects `$f12` — the `$`-prefixed forms it
+        // takes are the numeric GPRs (`$4`) — so without this arm an `add.s` is refused for the
+        // lesser reason, "no register destination", while `mfc1 v0,$f12` has a destination it
+        // ACCEPTS and would build an opaque whose source list quietly omits the register the
+        // instruction actually read. The file is what is missing; say so.
+        //
+        // BOTH DIALECTS AND EVERY SPELLING, which is why this is `frontend/splat.ts`'s exported
+        // constant and not a literal: the reader decides which tokens still carry a sigil when they
+        // get here, so a predicate written twice is a predicate that can disagree with itself, and
+        // each half of that disagreement is silent. Its docblock lists the spellings and says why
+        // the sigil is required.
+        fpReg: MIPS_FP_REG,
+        // The FPU CONTROL register, which both moves spell `$31` — a GPR-shaped token no register
+        // predicate can tell from an integer one. `ctc1`'s first operand is its SOURCE, so this
+        // also stops an opaque being fabricated on a register the instruction only reads.
+        fpControl: /^(cfc1|ctc1)$/i,
         storeClass: /^(sb|sh|sw|swl|swr|sc|sd|sdl|sdr|swc1|sdc1)$/i,
         skipSafe: /^(nop|ssnop|break)$/i,
         context: `${name} @0x${ins.addr.toString(16)}`,
@@ -1131,6 +1297,28 @@ export function lift(
       write(od.dst, res);
     };
     const emitUn = kit.un;
+    // Arithmetic on the FPU's file, keyed by `mipsEvenFpKey` so both dialects' spellings of one
+    // register are one SSA variable. Anything it cannot key — an odd half, a target with no float
+    // homes — keeps the register-file refusal.
+    const emitFpArith = (ins: Instr) => {
+      const keys = ins.ops.map(mipsEvenFpKey);
+      if (fpu === undefined || keys.length === 0 || keys.some((k) => k === null)) {
+        emitOpaqueDest(ins);
+        return;
+      }
+      if (fpType === null) {
+        refuseBothPrecisions(name, ins.mnemonic);
+      }
+      const [dst, ...srcs] = keys as string[];
+      const { op } = FP_ARITH[ins.mnemonic];
+      if (op === 'copy') {
+        write(dst, read(srcs[0]));
+        return;
+      }
+      const v = mkValue(fpType);
+      ops.push(mkOp(op, { operands: srcs.map(read), results: [v] }));
+      write(dst, v);
+    };
     // `%lo` completes the address a `lui %hi` began. The pairing asks SSA — through `readVar`, not
     // `read`, which refuses a half — what `rHi` holds HERE, so a pair separated by unrelated
     // instructions folds while a register reused between the halves does not, and a half that
@@ -1174,6 +1362,19 @@ export function lift(
       // spurious pointer parameter). Compiler spills/reloads are always word-width; sub-word `sp`
       // access is not spill output, so it stays on the memory path.
       if (spSlotSafe && isStackPtr(base) && width === 4) {
+        const saved = saveSlots.get(off);
+        if (saved !== undefined) {
+          if (saved !== d) {
+            throw new FrontendUnsupportedError(
+              `cannot lift '${name}': reload of '${mem}' into ${d}, a slot ${saved} was saved into — the ` +
+                `word holds the caller's ${saved}, which no C value names`,
+            );
+          }
+          const caller = mkValue(T.unk(32));
+          restores.set(caller, { reg: d, addr: ins.addr });
+          write(d, caller);
+          return;
+        }
         // SOUNDNESS GUARD (mirrors PPC frameLoad): only route through the slot SSA var if that slot was
         // actually STORED (has a reaching def). A word `lw` from an sp offset that was NEVER spilled is an
         // incoming STACK-PASSED argument (5th+ param, O32) or an uninitialised local — neither modelled.
@@ -1210,14 +1411,118 @@ export function lift(
       // slot's value in SSA, do NOT emit a `store` through `sp`. A never-reloaded spill (the ABI
       // home-slot store) then has no uses and simply drops. See isStackPtr / spSlotSafe.
       if (spSlotSafe && isStackPtr(base) && width === 4) {
+        if (savedByCallee(srcReg) && ssa.holdsEntryValue(srcReg, bi)) {
+          refuseMixedSlot(ins, mem, off, 'save');
+          saveSlots.set(off, srcReg);
+          return;
+        }
+        refuseMixedSlot(ins, mem, off, 'value');
+        valueSlots.add(off);
         writeVar(stackSlot(off), bi, read(srcReg));
         return;
       }
       ops.push(mkOp('store', { operands: [read(base), read(srcReg)], attrs: { off, width } }));
     };
 
-    for (const ins of b.body) {
-      decode(ins);
+    // A CALL, WITH ITS DELAY SLOT RUN FIRST: the word at `jal + 4` executes before the callee is
+    // entered, so it can set an argument up (KMC stores argument 5 there). The plan answers what
+    // the callee's declaration says (`frontend/call-plan.ts`); what is O32's alone is here: where
+    // argument k ≥ 4 lives, and the guess that cannot see past a3.
+    const lowerJal = (ins: Instr) => {
+      const at = `0x${ins.addr.toString(16)}`;
+      const callee = splat ? ins.ops[0] : ins.reloc?.type === 'R_MIPS_26' ? ins.reloc.sym : undefined;
+      if (callee?.startsWith('.')) {
+        throw new FrontendUnsupportedError(
+          `${site(ins)} is relocated against the section '${callee}' — a callee known only by its offset ` +
+            'in a section has no name to call it by',
+        );
+      }
+      if (callee === undefined || !/^[A-Za-z_]\w*$/.test(callee)) {
+        throw new FrontendUnsupportedError(
+          `${site(ins)} has no callee symbol — no R_MIPS_26 relocation names it, and its operand ` +
+            `'${ins.ops[0] ?? ''}' is not a name`,
+        );
+      }
+      if (fpuInstr !== undefined) {
+        throw new FrontendUnsupportedError(
+          `cannot lift '${name}': '${fpuInstr.mnemonic}' at 0x${fpuInstr.addr.toString(16)} uses the FPU and ` +
+            `'jal' at ${at} makes a call — the floating-point registers a call reads, returns in and destroys ` +
+            'are not modelled',
+        );
+      }
+      if (frameSize === undefined) {
+        throw new FrontendUnsupportedError(
+          `cannot lift '${name}': the call at ${at} is made in a frame that is not one 'addiu sp,sp,-N', so ` +
+            'where its outgoing stack arguments end is not known',
+        );
+      }
+      calls.lower({
+        callee,
+        ssa,
+        bi,
+        read,
+        write,
+        // ARGUMENT WORD k ≥ 4 travels in `16+4(k-4)(sp)`, inside the one frame this function pushed
+        stackWord: (k) => {
+          const off = STACK_ARGS_AT + 4 * (k - ARG_REGS.length);
+          if (off >= frameSize) {
+            throw new FrontendUnsupportedError(
+              `cannot lift '${name}': outgoing stack argument ${k + 1} of '${callee}' at ${at} travels in ` +
+                `${off}(sp), past the ${frameSize}-byte frame this function pushed`,
+            );
+          }
+          if (!valueSlots.has(off) || !ssa.hasReachingDef(stackSlot(off), bi)) {
+            throw new FrontendUnsupportedError(
+              `cannot lift '${name}': outgoing stack argument ${k + 1} of '${callee}' at ${at} travels in ` +
+                `${off}(sp), and no value stored there reaches the call`,
+            );
+          }
+          return readVar(stackSlot(off), bi);
+        },
+        // a pending `%hi` half is not an argument
+        highHalves,
+        guess: {
+          // a gap in the argument registers refuses, naming this address (`fallbackArgc`)
+          at: ins.addr,
+          // A GUESS THAT FILLS a0..a3 CANNOT SAY WHERE THE LIST ENDS: a word of the outgoing area that
+          // reaches the call is argument 5 onward, or a local the compiler put there.
+          refuse: (argc) => {
+            if (argc < ARG_REGS.length) {
+              return;
+            }
+            const passed = [...valueSlots]
+              .filter((off) => off >= STACK_ARGS_AT && off < frameSize && ssa.hasReachingDef(stackSlot(off), bi))
+              .sort((x, y) => x - y)[0];
+            if (passed !== undefined) {
+              throw new FrontendUnsupportedError(
+                `cannot lift '${name}': outgoing stack arguments not modelled — the undeclared call to '${callee}' ` +
+                  `at ${at} fills a0..a3, and the word stored to ${passed}(sp) reaches it where an argument past ` +
+                  'the registers travels',
+              );
+            }
+          },
+        },
+      });
+      // hi and lo are the callee's to overwrite
+      divState = null;
+      mulState = null;
+    };
+    for (let i = 0; i < b.body.length; i++) {
+      const ins = b.body[i];
+      if (ins.mnemonic !== 'jal') {
+        decode(ins);
+        continue;
+      }
+      const slot = b.body[i + 1];
+      if (slot?.addr !== ins.addr + 4) {
+        throw new FrontendUnsupportedError(
+          `${site(ins)} — its delay slot at 0x${(ins.addr + 4).toString(16)} is not the next instruction of ` +
+            'its block (a branch target, a control transfer, or missing), so it does not run before this call alone',
+        );
+      }
+      decode(slot);
+      i++;
+      lowerJal(ins);
     }
 
     // Terminator. For a conditional branch, capture the comparison operands from the register
@@ -1277,17 +1582,25 @@ export function lift(
       // loud, but for a merge that never happened. Rejecting it gives the honest void return.
       // PowerPC reads its return register through the guard, so the refusal it would get is already
       // the right one; it passes this same predicate to its call-arity count.
-      const retOps = ssa.hasReachingDef(RET, bi, (v) => !highHalves.has(v)) ? [readVar(RET, bi)] : [];
+      //
+      // NOR IS WHAT A VOID CALLEE LEFT IN v0. The call writes no v0 and destroys it, and `holdsValue`
+      // ends a path there, so a function that ends on that call returns nothing.
       if (!br) {
         // A nullified slot's block leaves by its branch's TARGET, which need not be the next
         // address, so `fallthrough` is claimed only where control really does fall through.
         const to = succAddrs.get(b)![0];
         const next = (b.body[b.body.length - 1]?.addr ?? b.startAddr) + 4;
         ops.push(mkOp('br', { attrs: to === next ? { fallthrough: true } : {}, successors: [succ(to)] }));
-      } // fall-through
-      else {
-        ops.push(mkOp('ret', { operands: retOps }));
+        return;
       }
+      // A FLOAT RETURN is decided for the whole function (frontend/fpu.ts `writesFloatReturn`), and
+      // then `v0` is scratch like any other integer register.
+      const retOps = floatReturn
+        ? [read(fpu!.returnReg)]
+        : ssa.holdsValue(RET, bi, (v) => !highHalves.has(v))
+          ? [readVar(RET, bi)]
+          : [];
+      ops.push(mkOp('ret', { operands: retOps }));
       return;
     }
     // unconditional branch
@@ -1299,15 +1612,25 @@ export function lift(
     ssa.markFilled(bi);
   });
   highHalves.assertAllConsumed(name);
+  const argSlots = fpuArgSlots(name, fpu, ARG_REGS, isFpKey, fpType);
+  mintArgSlotHoles(ssa, preds[0].length > 0, argSlots);
   ssa.finish();
   highHalves.assertNoneEscaped(name, irBlocks);
+  for (const blk of irBlocks) {
+    const used = [
+      ...blk.params,
+      ...blk.ops.flatMap((op) => [...op.operands, ...op.results, ...op.successors.flatMap((s) => s.args)]),
+    ];
+    const restore = used.map((v) => restores.get(v)).find((r) => r !== undefined);
+    if (restore) {
+      throw new FrontendUnsupportedError(
+        `cannot lift '${name}': the caller's ${restore.reg}, which the 'lw' at 0x${restore.addr.toString(16)} ` +
+          `restores, reaches a value this function computes with — no C value names it`,
+      );
+    }
+  }
 
-  // ABI-ordered entry parameters (a0, a1, …) — a callee-saved copy can read a later argument
-  // register first. Only the true entry (no predecessors) is sorted; a loop header's phis are
-  // index-aligned with predecessor args and must not be reordered.
-  const entry = irBlocks[0];
-  // non-ABI live-in ranks FIRST (indexOf's -1) — deliberate MIPS/PPC tie-break; Thumb's is 99/last
-  abiSortEntryParams(entry, preds[0].length > 0, (v) => ARG_REGS.indexOf(paramReg.get(v) ?? ''));
+  abiSortEntryParams(irBlocks[0], preds[0].length > 0, paramReg, argSlots);
   return ssa.fn;
 }