Disassemble mips privileged instruction code bug

[junchao-loongson]

bug

I used radare2 to analyze a mips kernel

$ radare2 vmlinux
[0xffffffff80affa10]> pd 2
;-- entry0:
;-- kernel_entry:
;-- pc:
0xffffffff80affa10 03800c40 mfc0 t4, s0, 3
0xffffffff80affa14 80008c35 ori t4, t4, 0x80

In the disassemble result of the first instruction，mfc0 t4, s0, 3 ，s0 is a general register， but mfc0 is a privileged instruction.
For privileged instructions (mfc0 mtc0), the name should be indexed in Coprocessor 0 registers , not in general registers.

Expected behavior

[0xffffffff80affa10]> pd 2
;-- entry0:
;-- kernel_entry:
;-- pc:
0xffffffff80affa10 03800c40 mfc0 t4, config, 3
0xffffffff80affa14 80008c35 ori t4, t4, 0x80

or

[0xffffffff80affa10]> pd 2
;-- entry0:
;-- kernel_entry:
;-- pc:
0xffffffff80affa10 03800c40 mfc0 t4, $16, 3
0xffffffff80affa14 80008c35 ori t4, t4, 0x80

I'm try to fix this bug with minimal bad influence, but the trouble is that not only the radare2 code but also the capstone module code needs to be modified.

Work environment

Questions	Answers
OS/arch/bits (mandatory)	fedora mips 64
File format of the file you reverse (mandatory)	ELF .
Architecture/bits of the file (mandatory)	MIPS.
r2 -v full output, not truncated (mandatory)	radare2 4.6.0-git 3 @ linux-mips-32 git.4.6.0-git
commit: 8b9b97c13e3677296d781d54ddf1b723f96ddbd4 build: 2020-07-30__08:54:47

ps:
I have a Loongson machine based on mips arch, and I want to add support for this machine in the future.

[XVilka]

It might be a bug in capstone - could you please check with cstool?

[trufae]

You can try with the gnu disassembler which is taken from the loongson branch

[trufae]

e asm.arch=mips.gnu

[junchao-loongson]

You can try with the gnu disassembler which is taken from the loongson branch

It seems to get worse with gnu disassembler

[0xffffffff80affa10]> e asm.arch=mips.gnu
[0xffffffff80affa10]> pd 5
;-- entry0:
;-- kernel_entry:
;-- pc:
0xffffffff80affa10 03800c40 0x400c8003
0xffffffff80affa14 80008c35 ori t4, t4, 0x80
0xffffffff80affa18 03808c40 0x408c8003
0xffffffff80affa1c 01280c40 0x400c2801
0xffffffff80affa20 0020013c lui at, 0x2000

[0xffffffff80affa10]> e asm.arch=mips
[0xffffffff80affa10]> pd 5
;-- entry0:
;-- kernel_entry:
;-- pc:
0xffffffff80affa10 03800c40 mfc0 t4, s0, 3
0xffffffff80affa14 80008c35 ori t4, t4, 0x80
0xffffffff80affa18 03808c40 mtc0 t4, s0, 3
0xffffffff80affa1c 01280c40 mfc0 t4, a1, 1
0xffffffff80affa20 0020013c lui at, 0x2000

[junchao-loongson]

It might be a bug in capstone - could you please check with cstool?

I found after testing that it is indeed a bug in capstone .
I will submit this bug to capstone.
Thinks

[ret2libc]

Thank you @junchao-loongson ! Please paste a link to the issue you are going to create in capstone here as well, just for reference.
I'm going to close this issue as it seems there is nothing to do for radare2. Thanks again!

[XVilka]

I created this issue in capstone since found none reported yet: capstone-engine/capstone#1673