From 6dd976fcf6e910d33c23083af6435ac1c5f6c976 Mon Sep 17 00:00:00 2001 From: "Dr. Christian Giessen" Date: Wed, 22 Apr 2026 20:19:41 +0000 Subject: [PATCH] Fix Type 12 SF field and sync TESTING.md Type 12: SF is 4 bits (15-12), D is bit11 (not SF=3bits, D=bit12). Verified all 8 SF variants against assembler: LSHIFT/ASHIFT, HI/LO, plain/OR. FIR output scaling chain now correct. TESTING.md: Synced with actual verification status. 34 of 37 types now assembler-verified. Only Type 22/22a (2-word data write), Type 31 (IDLE), and Type 32a (DAG store+transfer) remain structural-only. Removed build artifacts (.o, .elf) from examples/build/. --- examples/build/shift_sf_test.dsp | 20 +++++++++++ examples/build/verify_gaps.elf | Bin 340 -> 0 bytes examples/build/verify_gaps.o | Bin 564 -> 0 bytes r2plugin/TESTING.md | 55 ++++++++++++------------------- r2plugin/asm_adsp219x.c | 9 +++-- r2plugin/asm_adsp219x.so | Bin 28512 -> 28512 bytes 6 files changed, 47 insertions(+), 37 deletions(-) create mode 100644 examples/build/shift_sf_test.dsp delete mode 100644 examples/build/verify_gaps.elf delete mode 100644 examples/build/verify_gaps.o diff --git a/examples/build/shift_sf_test.dsp b/examples/build/shift_sf_test.dsp new file mode 100644 index 0000000..f7bbf73 --- /dev/null +++ b/examples/build/shift_sf_test.dsp @@ -0,0 +1,20 @@ + .section/PM program0; + .global _start; +_start: + si = 0x00FF; + i0 = 0x0100; + m0 = 1; + + /* Type 12: all SF variants with DM read */ + sr = lshift si (hi), mx0 = dm(i0,m0); + sr = lshift si (lo), mx0 = dm(i0,m0); + sr = sr or lshift si (hi), mx0 = dm(i0,m0); + sr = sr or lshift si (lo), mx0 = dm(i0,m0); + sr = ashift si (hi), mx0 = dm(i0,m0); + sr = ashift si (lo), mx0 = dm(i0,m0); + sr = sr or ashift si (hi), mx0 = dm(i0,m0); + sr = sr or ashift si (lo), mx0 = dm(i0,m0); + + nop; +_halt: + jump _halt; diff --git a/examples/build/verify_gaps.elf b/examples/build/verify_gaps.elf deleted file mode 100644 index fbf888cdad6f3f17cb2a683e872fc254b5fcc631..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 340 zcma)%J#NB45QV?}iNUgjSI9^yC@i2z6}jL5PLU`@iY@3Nh=u}$zy)1=gdBkbQE-5q zB2}a`nH6lGk)CGXd$Y6qKAzuRlv2dfOjeOiMf|!MQ%V#M7_@Yl1zlgwqqKm|mEs*$ ziKnP2Jl%@!)3~nl-#%skl_Jx4?x2;PKGxoA)K_Z8P6(MEGB&G8Qt)|6RxwvV}acf@cJ= NNBt}Z7s<^J^bbBT8g2jp diff --git a/examples/build/verify_gaps.o b/examples/build/verify_gaps.o deleted file mode 100644 index 3b713e9a4a132fb03f5a919182656084d4cf36df..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 564 zcma)2K}y3w6n&FS(}qYpgcd})sI;i75Wxe)MWvvNxj~FJY9XyM9YI(22p*va@Gw1& z;Ko0hjJou}|L?v3|73pVZF+UV7=r`DWd7@bsxfEvzzJILAO+G9B>E}(5}g#C^Kq8- zzG95x8TygejnIvH5?+K)I>$C(kp2$-1{@xT&mlPWIWmsx5F!*}kZlKY8*C7~BLD({ zHvBfmE%fYaL*ST{@T{$fq;K^z(abHKthLg`4W88Fy(*R|lJ)D-6!Nt$lty0M=~Cs3 z)qJ7KTa84ORgwHm=jCdS{Gq6{{r2BHC1ZB5U^pbvY)6VAqkKeR!EoRtv7r8c5z?TU zZZ`+a+rKp0km;FUcWi0~JBrI%+2n4F$u`ecH-^-ZO^p+qIYDtsVZ6f!i3x?f%gpUj Fd;@c~FhBqR diff --git a/r2plugin/TESTING.md b/r2plugin/TESTING.md index 7de4fe4..8032bee 100644 --- a/r2plugin/TESTING.md +++ b/r2plugin/TESTING.md @@ -16,50 +16,37 @@ Structural = implemented from reference docs, no assembler test. | 10 | Conditional jump (13-bit rel) | Verified | isa_test.bin | | 10a | Unconditional jump (16-bit) | Verified | isa_test.bin | | 11 | DO UNTIL (12-bit rel) | Verified | isa_test.bin, fir.bin | -| 12 | Shift + DM/PM | Structural | — | -| 14 | Shift + Dreg move | Structural | — | +| 12 | Shift + DM/PM | Verified | shift_sf_test.dsp, fir | +| 14 | Shift + Dreg move | Verified | verify_gaps.dsp | | 15 | Shift immediate | Verified | isa_test.bin | -| 16 | Conditional shift | Structural | — | +| 16 | Conditional shift | Verified | verify_gaps.dsp | | 17 | Reg = Reg | Verified | isa_test.bin | | 18 | Mode control (ENA/DIS) | Verified | type18_test.dsp | -| 19 | Indirect jump/call | Structural | — | +| 19 | Indirect jump/call | Verified | verify_gaps.dsp | | 20 | RTS/RTI | Verified | isa_test.bin, fir.bin | -| 21 | MODIFY (Ireg += Mreg) | Structural | — | -| 21a | MODIFY (Ireg += Imm8) | Structural | — | +| 21 | MODIFY (Ireg += Mreg) | Verified | verify_gaps.dsp | +| 21a | MODIFY (Ireg += Imm8) | Verified | verify_gaps.dsp | | 22 | DM = Data16 (2-word) | Structural | — | | 22a | PM = Data24 (2-word) | Structural | — | -| 23 | DIVQ | Structural | — | -| 24 | DIVS | Structural | — | +| 23 | DIVQ | Verified | verify_gaps.dsp | +| 24 | DIVS | Verified | verify_gaps.dsp | | 25 | SAT MR/SR | Verified | isa_test.bin | -| 26 | Push/Pop/Flush Cache | Structural | — | -| 29 | DM read/write imm modify | Structural | — | +| 26 | Push/Pop/Flush Cache | Verified | verify_gaps.dsp | +| 29 | DM read/write imm modify | Verified | verify_gaps.dsp | | 30 | NOP | Verified | isa_test.bin | | 31 | IDLE | Structural | — | -| 32 | Any Reg <-> DM/PM (DAG) | Structural | — | +| 32 | Any Reg <-> DM/PM (DAG) | Verified | verify_gaps.dsp | | 32a | DAG reg store + transfer | Structural | — | | 33 | Reg3 = Data12 | Verified | isa_test.bin | -| 34 | IO register read/write | Structural | — | -| 35 | System register read/write | Structural | — | -| 36 | Long jump/call (2-word) | Structural | — | -| 37 | SETINT/CLRINT | Structural | — | +| 34 | IO register read/write | Verified | verify_gaps.dsp | +| 35 | System register read/write | Verified | verify_gaps.dsp | +| 36 | Long jump/call (2-word) | Verified | verify_gaps.dsp | +| 37 | SETINT/CLRINT | Verified | verify_gaps.dsp | -## Priority gaps for assembler verification +## Remaining structural-only types -High (used in real firmware, likely to encounter): -- Type 12: Shift + memory (common in FIR output scaling) -- Type 29: DM immediate modify (common for stack-like access) -- Type 32: Any Reg <-> DM/PM (general register save/restore) -- Type 19: Indirect jump (function pointer dispatch) - -Medium (less common but structurally complex): -- Type 22/22a: 2-word immediate write (initialization code) -- Type 36: Long jump/call (large firmware images) -- Type 32a: DAG store + transfer (DSP loop setup) - -Low (rare or simple): -- Type 16: Conditional shift -- Type 21/21a: MODIFY -- Type 23/24: DIVQ/DIVS -- Type 26: Push/Pop -- Type 34/35: IO/System registers -- Type 37: SETINT/CLRINT +- Type 22/22a: 2-word immediate data write. No open21xx syntax + equivalent found for testing. +- Type 31: IDLE. Trivial encoding, low risk. +- Type 32a: DAG register store with transfer. Tightly constrained + discriminator (bits 15=0, 12-11=11, 10=0), low overlap risk. diff --git a/r2plugin/asm_adsp219x.c b/r2plugin/asm_adsp219x.c index c2366d7..db0b481 100644 --- a/r2plugin/asm_adsp219x.c +++ b/r2plugin/asm_adsp219x.c @@ -445,12 +445,15 @@ decode (RArchSession *as, RAnalOp *op, RAnalOpMask mask) return true; } - /* Type 12: Shift | DM/PM (bits 23-17 = 0001001) */ + /* Type 12: Shift | DM/PM (bits 23-17 = 0001001) + G=bit16, SF=bits15-12 (4 bits, same as sf_names[]), + D=bit11 (0=read, 1=write), XOP=bits10-8 (xop_shift), + DREG=bits7-4, I=bits3-2, M=bits1-0. */ if ((ins >> 17) == 0x09) { ut32 g = (ins >> 16) & 1; - ut32 sf = (ins >> 13) & 0x7; - ut32 d = (ins >> 12) & 1; + ut32 sf = (ins >> 12) & 0xF; + ut32 d = (ins >> 11) & 1; ut32 xop_i = (ins >> 8) & 0x7; ut32 dreg = (ins >> 4) & 0xF; ut32 ireg = (ins >> 2) & 0x3; diff --git a/r2plugin/asm_adsp219x.so b/r2plugin/asm_adsp219x.so index 0e6365e3db39040f09bdad84227f11a2ae348911..883de27c527fe7f440a6e17efcde40030f19d9ff 100755 GIT binary patch delta 2265 zcmZ8iYfKbZ6rQ`gu*-9>f;@a71*_nLrL0dD8GJBXS9~Ns5CtP@;;T)nMr*Z5XSe1` zwpAzT%V;e9p+A~5c5Q35%FZSd(xy~Rqis?ViNXx(B0dm}I{oep1T8<9GxvPwobP_; z%-Ob9($-22ei`FQ<%~bisc%k@Ph$?o7P%ZyC2MgAgd zV(iR#j+6RgdH;8EOIALq3+h=TNt{q2tkg1eUFSy!-^%`s#I9JWef)yGa&jm~DPI)B zqLO&uHp7VHeUA)-@cyO*j(c*E+sARdzc7yD1nGr^_f;6y%UIs`X)FsRysz9aqIq9c z@XxX3gdCAajidN~a@CeDB1gzEJUB;eBD_C}m~}$5BlTxWmxG8B({%m-5nTmORmQkv?;V;5eVmacb!! zc3{<}!vV@kpzQkv+R-khD_(l$=KaT?={i-#K+4XEtd`q3jN=s5A+_02F^tUmLo-Eh zFB4~4h}+hm{8y%D1|y-Gu(k%rcuEC9%9w6*vVr<_up`qZsyyDQ^sc# zkaf4YOhdC#$i^7B@>$w|dzy(Y>&F%YOS?dDSsn)JHjjp=N|z15VFs|SUFT6S?Y_<% zx%mP73E7pOm47mtBO4;#8!JS;(w*zT0GWTHc@Us;NLm$Yu8i zqKaV>1?6+VZm$29q19-EscY8+gK#<1yT0%$)PokY%}i%l-x)sY4C@)4ourLJdj`Ik zkL1zLlwm!Hlsatug)1bYK8u(XdgOPUqth$VAl755VM@ClO2j5m%^OHLB7f}6UcW67 zSKh}e1>8%K#6v^;Pw3qhrOgs3bd(0-9g7xFWf}NvGSjZC(5f*FRApMaYj6R~j~c6V zS)>lD)Mk^~tt3p?&`j^=kuS#;OmMX0GlvXE#urY-W;f^>Yz`wMbL zybl~c(v5iFjwNPG6PDvuT_-mejH&H~kY0Kf;bMRIEY{(GdnhnWY?ysmQh{U#W}y{_ z{c5}ZhAq;k#`ny#UfYpCYs8uoXfvWH&O~~dJ}`$~y9@79+;uKR-`t1c_0Z-@XNX>g zKiUdHhL%V-Z2hu-YVVsa~5Jgz=tJa$1BI$)7HdFdwasW0l2 z+U<}{kZxKr#tymh?O{bg&dTAqrJnlaORyipUXJodL4HAfauA*)FclnOr6r5jU~E7L^!6c0pY@8f%b^?wq{%&nN}Mzunyh6V_ZR~tknLIs|wRB zQy<9j1$pT^uzVptN3h>~kO%v$8b{hL`Pae?8!6(|OoVECP}JCVYf%zSJNKrs?NB2F z7-Q)rhpDQlaZ;O=tz6dgE>pG^Xz!u7yjUcE;YiCjhA`nUmc0KSYhr?5Zggd2JVz_l zy+GV)#97s#dogp@o@Z_kbJxS2JLnz>Q>?jo0TTpjDF=WP$2Wf-LPUaxbd_0Xjb_*;oPO9-_n00tA!26oS<|qRa xR79Q+{;_<1G${$DSJ`dkSa8hRGJ>~_HP`Hwlp1z9awu delta 2323 zcmY*a3rrMO6rIN|vVbsXLB(Q43MwGNQn$8tH!=!3D2i2!prW>*rjnYbVx!h%rL)`k zBwKA>TC259XiaL;CjD$QMy)as2==2$6Rn9KN)>ljg^C|OtxV6GS&D7~^Y-3z?>%$w zeRtchk@jn3-=~oUV+G?=@I&3#B!0rv&cA% z5IyDo^OF}7a*#bYmE!-Asr_U=`!apAOs<%z_G#aJ^XM!M5P4>AOA%(p@@D{s}Ij(Y9udd5>3Bg1 z%zeNO7Ht+BU>pa=o)eIc2G!t5WxyqR>jre424r8twk%%Dl{-cd)PPNCk3hu+WEMgx zdLMDIJOV44cAb38re%FV>X<*PIQc5_$v(%O(MEg?h#@MiN7qjfcr-stnZAR(#6F*% z>@HoYy~oq}9N8wC;Q{o~S`6IR^#bps>UA=`6&UCZ5ZH}h4)%zIM>Xw6L_*-&vJvT+6uJ5TF#y=-FT5Oy}OGzfw#GBIK|Mf5132CV>& zHGnl8x`>L2A$Z&n{Kz!GJJ>5Z6LJoZ5QKbsQSG$VbP5nPvYC(77FbPos#)=Lx5@4( z+nwX6Sc$BVETYI4J{w1(g2H4lEb!hi^h!3^I<}(>xD<2IYiC@9g3u%1%ygVj1ILFS z=dGl3HGc)M-rw?wrf zU&0}#*i+Y6$KthXcqN~!1W5{My?6}$Yg609d^2owd?Rg37E!eXe5%Z}E6cQXm@69K zdb%p{0vM}6lo||EIxR}ORq3#h2Er$2R)~k4jm({9`wN#JGJL`Ea-WMUM;H))+%=h= zXPa{q$sx8oH!W!kaJajh%w3UZwl$^{Ujyse+1yF)UIdIT2aE5DUYIe)5Jc%4y|qv}o{uhj?^eHN901Kv!=|JyR0Z$a_)Bh>dSF^m>%1f_ zEs^OU=f>r6nuMfPtF#<&QdFyizvD}cd|Qu6#t8%XAXN}nAZQ1dqc*;k-&-zYAucJe{}$(hbwu%f5Os)xDHMs54dR3#&egkU99S^jSpDHvArI&ma>f z*XLTx>(F!jexL@Q&^!zV7WA{U*<4keHQX5?_awM!140ly*K~;?*9f?{KFS@N>@S#k z(#G0}^~by`5##{7I=|e#Ft&wAvGv5_CO9pOZ6!k}3OvtS5QJcP-#gfQG< zV4}GtA9?=IJU-0uwUXr_Oa-3Hfhdb@2{%glRaq4MzpYp}f;jz&Ya*=VfPc~(^9jDa ZS#c?XoMlo~cBFGAUIZVfe|yy}%YRiz)W-k-