V850 Decompiler GP is callee-saved issues

IDA General Bugs
1

V850 decompilation: GP is callee-saved and does not function correctly. As shown in the figure below, after the sub_28790 function, GP becomes undefined.

image
image1177×718 63.1 KB

2

Hello,

Generally, on V850 gp is used as a global register. If this is not the case, enable the corresponding setting in the processor-specific options.

image
image330×368 6.95 KB

If it’s still not working as expected, please create a ticket on support.hex-ray.com and add a sample.

3

V850 Option

image
image358×351 71.9 KB

4

Thank you for the update. Could you please submit an issue with sample as requested?

5

xx.bin.i64.zip (2.1 MB)

sample function sub_287DC

6

Thank you. It seems the callee-saved option is a red herring, and gp is a standard global register in this binary, but its value is not used by the decompiler for some reason. We’ll investigate this.

7

This pattern has been fixed in 9.3 SP1.

8

The issue has not been resolved and remains undefined. Taking the sub_287DC function as an example, the decompilation results are shown in the figure below.

image
image553×449 13.2 KB

9

You need to disable “GP is callee-saved” option, because it’s wrong for this firmware.

int __fastcall sub_287DC(unsigned __int8 a1, unsigned __int8 a2, char a3)
{
  int v4; // r29
  int result; // r10

  v4 = a1;
  result = sub_28790(a1, a2);
  if ( result == 1 )
  {
    MEMORY[0xFEE03B80] = 127;
    MEMORY[0xFEE03B82] = a3;
    MEMORY[0xFEE03B81] = MEMORY[0xFEE03C01];
    result = sub_29386(v4, 0xFEE03B80, 3, 0);
    if ( result == 1 )
    {
      MEMORY[0xFEE03C01] = 0;
      MEMORY[0xFEE03BBF] = 0;
      MEMORY[0xFEE03C00] = 0;
    }
  }
  return result;
}
10

Once I set the value for the GP register, it can’t be disabled. Even after I disable it and click OK, it remains the same, and when I open the settings again, the “GP is callee-saved” option is automatically checked again.

11

This is a recording of my actions; after clicking “OK,” I pressed F5 to refresh.

PixPin_2026-03-30_16-07-56.zip (806.9 KB)

12

Thanks. After more checking, it seems that after all the fix for this specific issue was not merged in time for 9.3SP1 so it will be available in 9.4.

13

image
image597×452 15.7 KB

Still regarding the IDB file mentioned above, there is another issue: after a function call, the function’s parameters can no longer be correctly associated with the subsequent code. This is illustrated by the function `sub_29F76` in the figure below.

This issue also exists in the PPC decompiler.

14

This depends on the prototypes of the called functions. Could you have the idb files?

15

use __spoils<> for function

16

It’s still this idb. V850 Decompiler GP is callee-saved issues - #5 by sskki

17

Indeed, use __spoils<>
The decompiler assumes that all input arguments of the function may be spoiled by default. If a function does not do that, the decompiler needs to be informed about it.