Skip to content

[PPC] Lift lswi/stswi as intrinsics and fix blrl return handling - #8560

Open
zznop wants to merge 1 commit into
devfrom
test_lift_ppc_dh_instrs
Open

zznop wants to merge 1 commit into
devfrom
test_lift_ppc_dh_instrs

Conversation

@zznop

@zznop zznop commented Sep 17, 2026

Copy link
Copy Markdown
Member

Adds PowerPC lswi and stswi lifting as memory intrinsics. Fixes blrl handling so GOT helpers return without decoding trailing data as code, while preserving ordinary indirect calls. I also started a PPC test_lift.py with regression tests for these instructions.

blrl fix before / after:

Screenshot 2026-09-17 at 2 34 58 PM Screenshot 2026-09-17 at 2 34 25 PM

lswi and stswi lifting before / after:

Screenshot 2026-09-17 at 2 37 42 PM Screenshot 2026-09-17 at 2 37 06 PM

@zznop zznop added this to the Langara milestone Sep 17, 2026
@zznop
zznop requested a review from rssor September 17, 2026 18:40
@zznop zznop self-assigned this Sep 17, 2026
@zznop zznop added Arch: PowerPC Issues with the PowerPC architecture plugin Lifting issues related to LLIL lifting labels Sep 17, 2026

@rssor rssor left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think there are actually issues that need fixing here, will need to dig a bit deeper. I don't think we can mark BLRL FunctionReturn that aggressively.

The TEMP thing makes me suspect this might warrant something in the core to help with conditional return analysis

Lift lswi and stswi with word-sized memory accesses and exact partial-word
handling. Support register wrapping, byte ordering, and PPC64 zero-extension.

Combine matching lswi/stswi pairs into a memory-copy intrinsic while
preserving loaded registers and respecting basic-block boundaries.

Preserve the original LR target and link-register update for blrl.
Recognize GOT helpers as contextual returns without decoding trailing
data as code, while retaining ordinary indirect calls and fallthrough.

Add lifting regression tests for 32/64-bit PowerPC in both endiannesses.
@zznop
zznop force-pushed the test_lift_ppc_dh_instrs branch from c8406f3 to 609c2e8 Compare September 18, 2026 14:24
@zznop

zznop commented Sep 18, 2026

Copy link
Copy Markdown
Member Author

Updated the PR to directly lift lswi and stswi when they are used in isolation. But use an intrinsic and lift them together as a string copy when they are used consecutively (with the same registers)

Screenshot 2026-09-18 at 10 01 15 AM

@zznop

zznop commented Sep 18, 2026

Copy link
Copy Markdown
Member Author

I think there are actually issues that need fixing here, will need to dig a bit deeper. I don't think we can mark BLRL FunctionReturn that aggressively.

The TEMP thing makes me suspect this might warrant something in the core to help with conditional return analysis

The FunctionReturn serves as a hint to the core's contextual-return analysis. This pattern is also used by ARM's blx lr instruction. The arch is lifting blrl as LLIL_CALL; it's not lifting it as a LLIL_RET.

The core initially treats it as a return, then checks the target through dataflow. If the target is anything other than ReturnAddressValue it restores call handling and reanalyzes the function to recover the fallthrough. The TEMP is needed to preserve the instructions actual ordering.

I get what you're saying in that there is no architectural guarantee that the callee can't branch back through the updated LR and take the fallthrough path, but I don't think that's likely in the case where the call target is RetrunAddressValue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Arch: PowerPC Issues with the PowerPC architecture plugin Lifting issues related to LLIL lifting

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants