Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove an unconstrained context variable in mips16.sinc #7303

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

plucia-mitre
Copy link
Contributor

@plucia-mitre plucia-mitre commented Dec 19, 2024

Removing a line which seems to allow the aregs field to be set to any value for encodings of the "restore" instruction, some of which are invalid/reserved. The MIPS sleigh specification contains a constructor for the "restore" instruction which produces a result that differs from the MIPS instruction manual. More specifically, the aregs field is encoded incorrectly in the sleigh specification, as the current encoding includes a mask for the aregs field that is too general.

Take for example the instruction restore 0x1b8,ra,s0-s1, which contains no aregs arguments. According to page 120 of MIPS32® Architecture for Programmers Volume IV-a: The MIPS16e™ Application Specific Extension to the MIPS32® Architecture[1], valid encodings of this scenario for the aregs field include 0000, 0100, 1000, 1100, and 1110.

[1] https://s3-eu-west-1.amazonaws.com/downloads-mips/documents/MD00076-2B-MIPS1632-AFP-02.63.pdf

However, when assembling this instruction in Ghidra, one AssemblyResolution that is returned contains an AssemblyPatternBlock where the mask for the aregs field is 0000. This means that any encoding for the aregs field is valid for restore 0x1b8,ra,s0-s1, but that is incorrect. Only the five encodings listed in the paragraph above are valid for that specific instruction. We have found that removing line 172 from mips16.sinc removes the AssemblyResolution with a 0000 mask.

It's unclear to us what the purpose of this line we have removed is, however this change removes a "reserved" encoding from showing up in the "right-click" > "patch instruction" -> "autocomplete" output and fixes an incorrectly broad mask from being returned to pickled canary when assembling the example instruction above.

It also seems like this problem also exists for at least some other instructions as well with their own unconstrained context variables (e.g. the save instruction, specifically line 208 of this file).

Removing a line which seems to allow the aregs field to be set to any value for encodings of the "restore" instruction, some of which are invalid/reserved.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Feature: Processor/MIPS Status: Triage Information is being gathered
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants