Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix RISC-V JALR lift when rs1==rd #6213

Merged
merged 1 commit into from
Dec 1, 2024

Conversation

ehntoo
Copy link
Contributor

@ehntoo ehntoo commented Nov 30, 2024

When the source and destination register are the same, the current implementation of lifting for jalr in RISC-V results in the jump target being overwritten by the return address. This PR avoids the issue by copying the jump target to a LLIL temporary register before writing the destination register.

This situation comes up in certain binaries when LLVM optimizes for size and performs compiler outlining of register stack spills. The attached zipfile contains a build of a rust RISC-V Embassy project that demonstrates the issue in a function at 0x00000b08.
riscv-jalr-issue.zip

@emesare emesare self-assigned this Nov 30, 2024
@emesare
Copy link
Member

emesare commented Nov 30, 2024

The lifting change is good, however will require changes to the function recognizer, see the second pair of images.

Before:
image
After:
image

Before:
image
After:
image

@emesare emesare merged commit 395fd8e into Vector35:dev Dec 1, 2024
1 check passed
@emesare
Copy link
Member

emesare commented Dec 1, 2024

I went ahead and added the required changes, thank you for the PR!

Also thank you to @jeanmicheldeva, apologies that your PR wasn't merged, I am going to try and get your other changed merged shortly.

Relevant PR: #6064

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants