gasm-sdk/verify/abi_riscv64.s

// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
// SPDX-License-Identifier: BSD-3-Clause

#include "textflag.h"

// ABI-checking trampoline for riscv64.  Sets a sentinel value in the
// register the Go ABI fixes across calls before entering the JIT function
// and checks whether it survived on return.
//
// The return trampoline (leaveJITCheckedRaw) is a raw TEXT symbol with no
// Go function declaration, so the toolchain does NOT interpose an
// ABIInternal wrapper — the JIT function RETs directly into the check
// code, which sees the registers exactly as the function left them.
//
// Go ABI on riscv64 guarantees:
//   - X27 holds the goroutine pointer (g) and must survive across any
//     call.  Go keeps no hardware frame pointer on riscv64.  The assembler
//     spells this register "g"; X27 is not accepted.

// Sentinel value chosen to be unlikely in normal execution.
#define SENTINEL_G  0x0BADF00DDEADBEEF

// GLOBL holding the raw address of the leave trampoline, read by Go.
GLOBL ·leaveCheckedPtr(SB), NOPTR, $8
DATA  ·leaveCheckedPtr(SB)/8, $·leaveJITCheckedRaw(SB)

// func enterJITChecked(fn uintptr, stack uintptr)
// Sets a sentinel in g (X27), switches to the prepared stack and jumps to
// fn.  The prepared stack's first word must be the address of
// leaveJITCheckedRaw (read from leaveCheckedPtr).  Only X5 and X6 are used
// as scratch: caller-saved, and X27 is not among them.
TEXT ·enterJITChecked(SB), NOSPLIT, $0-16
	MOV  fn+0(FP), X5          // target function address (T0)
	MOV  X1, savedRA(SB)       // save return address
	MOV  X2, savedSP(SB)       // save Go stack pointer
	MOV  g, savedG(SB)         // save g
	MOV  $SENTINEL_G, g        // sentinel in g
	MOV  stack+8(FP), X6       // load prepared stack pointer (T1)
	LD   0(X6), X1             // load leaveJITCheckedRaw into RA
	MOV  X6, X2                // SP stays on the leave slot: the kernel
	                           // reads its first argument at SP+8
	JALR X0, 0(X5)             // jump to JIT function

// leaveJITCheckedRaw is the raw return trampoline.  It has NO Go function
// declaration, so no ABIInternal wrapper is generated — the JIT function's
// RET lands here directly, seeing g exactly as the function left it.  It
// checks the sentinel, records violations in abiResult, then restores the
// Go stack and returns.
TEXT ·leaveJITCheckedRaw(SB), NOSPLIT, $0-0
	// Check g against the sentinel.
	MOV  $SENTINEL_G, X6
	BEQ  g, X6, g_ok
	MOV  ·abiResult(SB), X7
	MOV  $2, X5
	OR   X5, X7, X7
	MOV  X7, ·abiResult(SB)

g_ok:
	MOV  savedSP(SB), X6       // restore Go stack pointer
	MOV  X6, X2
	MOV  savedRA(SB), X1       // restore return address
	MOV  savedG(SB), g         // restore g: Go code needs it the moment it
	                           // resumes, violation or not
	JALR X0, 0(X1)             // return to Go caller

GLOBL savedG(SB), NOPTR, $8