Skip to content

Fix RISC-V JALR lift when rs1==rd#6213

Merged
emesare merged 1 commit into
Vector35:devfrom
ehntoo:riscv-jalr-lifting-fix
Dec 1, 2024
Merged

Fix RISC-V JALR lift when rs1==rd#6213
emesare merged 1 commit into
Vector35:devfrom
ehntoo:riscv-jalr-lifting-fix

Conversation

@ehntoo
Copy link
Copy Markdown
Contributor

@ehntoo ehntoo commented Nov 30, 2024

When the source and destination register are the same, the current implementation of lifting for jalr in RISC-V results in the jump target being overwritten by the return address. This PR avoids the issue by copying the jump target to a LLIL temporary register before writing the destination register.

This situation comes up in certain binaries when LLVM optimizes for size and performs compiler outlining of register stack spills. The attached zipfile contains a build of a rust RISC-V Embassy project that demonstrates the issue in a function at 0x00000b08.
riscv-jalr-issue.zip

@emesare emesare self-assigned this Nov 30, 2024
@emesare
Copy link
Copy Markdown
Member

emesare commented Nov 30, 2024

The lifting change is good, however will require changes to the function recognizer, see the second pair of images.

Before:
image
After:
image

Before:
image
After:
image

@emesare emesare merged commit 395fd8e into Vector35:dev Dec 1, 2024
@emesare
Copy link
Copy Markdown
Member

emesare commented Dec 1, 2024

I went ahead and added the required changes, thank you for the PR!

Also thank you to @jeanmicheldeva, apologies that your PR wasn't merged, I am going to try and get your other changed merged shortly.

Relevant PR: #6064

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants