variadic functions broken on aarch64

[alexdevsec]

[Describe the bug

When I decompile a call to a variadic function, it references the wrong registers.

To Reproduce
Steps to reproduce the behavior:

1. Use this program:

#include <stdio.h>
#include <stdarg.h>

int main(int argc, char ** argv)
{

    printf("foo %d bar %s\n",1234,"quux");
    return 0;
}

2. Compile:
   $ gcc main.c -o test-vargs

3. In Ghidra, import file and do default analysis

4. Edit entry function to look like main() should:

int entry(int param_1,char **param_2)

6. See call to _printf contains reference to param_1 (which is register x1) and in_x2.

Expected behavior

I'd expect it to get the functions to

_fprintf() is properly labelled as a variadic function.

Using the _cdecl calling convention, it seems to be expecting args in x1 and x2, but entry() has them set up in x8 and x9.

Screenshots
If applicable, add screenshots to help explain your problem.

Attachments
If applicable, please attach any files that caused problems or log files generated by the software.

Environment (please complete the following information):

• OS: macOS Sequoia 15.3.2
• Java Version: 23.0.1
• Ghidra Version: 11.3.1
• Ghidra Origin: official GitHub distro

Additional context
Maybe I need a different calling convention for aarch64? I'd expect cdecl to do this properly.

[fmagin]

The arguments aren't in x8 and x9. These registers are just used to store the values to the stack. x9 is set to the stack pointer via mov x9, sp, and then the value (in x8) is stored to the stack via x9 with the instruction str x8, [x9].

This is nonetheless something that the Ghidra decompiler doesn't seem to support currently. Variadic functions on AARCH64 in general work (if the arguments are in the regular registers), but format string arguments on the stack do not.

[ghidracadabra]

Looks like apple uses a modification of the arm64 procedure call standard where the variable arguments of a variadic function are always passed on the stack. This will probably require a new cspec file.

[alexdevsec]

Okay. Is this a new feature request then? Thanks for your help.

And is this the same thing? #2723