Verify and fix gap types against assembler output

Assembler-verified and fixed:
- Type 12: XOP field corrected to bits10-8 (was bits11-9)
- Type 14: SF=4bits, XREG uses reg0[] not xop_shift[] (was 3-bit OOB)
- Type 16: XREG uses reg0[] (was xop_shift[], 4-bit index OOB)
- Type 19: I-reg field at bits3-2 (was bits1-0), now correct for jump(i2)
- Type 26: Push/Pop encoding is 10/11 not 01/10;
  PPP=bits6-5, LPP=bits4-3 (was bits6-4, bits3-2)
  All 6 variants verified: push/pop sts, loop, pc

Assembler-verified unchanged:
- Type 21/21a: MODIFY correct
- Type 23/24: DIVQ/DIVS correct
- Type 29: DM immediate modify read/write correct
- Type 32: Any Reg <-> DM read/write correct
- Type 34/35: IO/System register read/write correct
- Type 36: LJUMP 2-word correct
- Type 37: SETINT/CLRINT correct

Remaining note: Type 12 SF field may use a different mapping
than sf_names[] for combined shift+memory ops (ASHIFT encodes
as SF=2 not SF=4). Needs further investigation.

examples/build/verify_gaps.dsp

@@ -0,0 +1,83 @@
+/*
+ * verify_gaps.dsp -- Assembler verification for structural-only types.
+ * Tests Types 12, 14, 16, 19, 21, 21a, 22, 23, 24, 26, 29, 32, 34, 35, 36, 37.
+ */
+	.section/PM program0;
+	.global _start;
+_start:
+	/* Setup */
+	i0 = 0x0100;
+	i4 = 0x0200;
+	m0 = 1;
+	m4 = 1;
+	l0 = 0;
+	l4 = 0;
+	ax0 = 0x1234;
+	si = 0x00FF;
+
+	/* Type 12: Shift + DM read */
+	sr = lshift si (hi), mx0 = dm(i0,m0);
+
+	/* Type 12: Shift + DM write */
+	sr = ashift si (hi), dm(i0,m0) = ax0;
+
+	/* Type 14: Shift + Dreg move */
+	sr = lshift si (hi), ax0 = mx0;
+
+	/* Type 16: Conditional shift */
+	if eq sr = lshift si (hi);
+	sr = lshift si (hi);
+
+	/* Type 19: Indirect jump */
+	i2 = _after_indirect;
+	jump (i2);
+_after_indirect:
+	nop;
+
+	/* Type 21: MODIFY (reg) */
+	modify(i0,m0);
+
+	/* Type 21a: MODIFY (imm) */
+	modify(i0,5);
+
+	/* Type 23: DIVQ */
+	divq ax0;
+
+	/* Type 24: DIVS */
+	divs ay0, ax0;
+
+	/* Type 26: Push/Pop */
+	push sts;
+	pop sts;
+	push loop;
+	pop loop;
+	push pc;
+	pop pc;
+
+	/* Type 29: DM immediate modify */
+	ax0 = dm(i0,1);
+	dm(i0,1) = ax0;
+
+	/* Type 32: Any Reg <-> DM (postmodify) */
+	ar = dm(i0,m0);
+	dm(i0,m0) = ar;
+
+	/* Type 34: IO */
+	ax0 = io(0x00);
+	io(0x00) = ax0;
+
+	/* Type 35: System register */
+	ax0 = reg(0x00);
+	reg(0x00) = ax0;
+
+	/* Type 37: SETINT/CLRINT */
+	setint 3;
+	clrint 3;
+
+	/* Type 36: Long jump */
+	ljump _end;
+
+_end:
+	nop;
+_halt:
+	jump _halt;

r2plugin/asm_adsp219x.c

@@ -451,7 +451,7 @@ decode (RArchSession *as, RAnalOp *op, RAnalOpMask mask)
           ut32 g = (ins >> 16) & 1;
           ut32 sf = (ins >> 13) & 0x7;
           ut32 d = (ins >> 12) & 1;
-          ut32 xop_i = (ins >> 9) & 0x7;
+          ut32 xop_i = (ins >> 8) & 0x7;
           ut32 dreg = (ins >> 4) & 0xF;
           ut32 ireg = (ins >> 2) & 0x3;
           ut32 mreg = ins & 0x3;
@@ -469,32 +469,36 @@ decode (RArchSession *as, RAnalOp *op, RAnalOpMask mask)
           return true;
         }
 
-      /* Type 14: Shift | Dreg move (bits 23-16 = 00010100) */
+      /* Type 14: Shift | Dreg move (bits 23-16 = 00010100)
+         SF=bits15-12 (4 bits), XREG=bits11-8 (reg0 index),
+         DDREG=bits7-4, SDREG=bits3-0. */
       if ((ins >> 16) == 0x14)
         {
-          ut32 sf = (ins >> 12) & 0x7;
+          ut32 sf = (ins >> 12) & 0xF;
-          ut32 xreg = (ins >> 9) & 0x7;
+          ut32 xreg = (ins >> 8) & 0xF;
           ut32 ddreg = (ins >> 4) & 0xF;
           ut32 sdreg = ins & 0xF;
           op->mnemonic = r_str_newf ("%s %s, %s = %s",
-            sf_names[sf], xop_shift[xreg],
+            sf_names[sf], reg0[xreg],
             reg0[ddreg], reg0[sdreg]);
           return true;
         }
 
-      /* Type 16: Conditional Shift (bits 23-16 = 00001110) */
+      /* Type 16: Conditional Shift (bits 23-16 = 00001110)
+         SF=bits15-12 (4 bits), XREG=bits11-8 (reg0 index),
+         COND=bits3-0. */
       if ((ins >> 16) == 0x0E)
         {
           ut32 sf = (ins >> 12) & 0xF;
-          ut32 xreg = (ins >> 8) & 0x7;
+          ut32 xreg = (ins >> 8) & 0xF;
           ut32 cond = ins & 0xF;
           if (cond == 15)
             op->mnemonic = r_str_newf ("SR = %s %s",
-              sf_names[sf], xop_shift[xreg]);
+              sf_names[sf], reg0[xreg]);
           else
             op->mnemonic = r_str_newf ("IF %s SR = %s %s",
               cond_str[cond], sf_names[sf],
-              xop_shift[xreg]);
+              reg0[xreg]);
           return true;
         }
 
@@ -574,7 +578,7 @@ decode (RArchSession *as, RAnalOp *op, RAnalOpMask mask)
           ut32 s_bit = (ins >> 14) & 1;
           ut32 g = (ins >> 13) & 1;
           ut32 cond = (ins >> 4) & 0xF;
-          ut32 ireg = ins & 0x3;
+          ut32 ireg = (ins >> 2) & 0x3;
           int base = g ? 4 : 0;
           if (cond == 15)
             op->mnemonic = r_str_newf ("%s (I%d)%s",
@@ -624,39 +628,39 @@ decode (RArchSession *as, RAnalOp *op, RAnalOpMask mask)
           return true;
         }
 
-      /* Type 26: Push/Pop/Cache (bits 23-16 = 00001000) */
+      /* Type 26: Push/Pop/Cache (bits 23-16 = 00000100) */
-      if ((ins >> 16) == 0x08)
+      if ((ins >> 16) == 0x04)
         {
           ut32 cf = (ins >> 7) & 1;
-          ut32 ppp = (ins >> 4) & 0x7;
+          ut32 ppp = (ins >> 5) & 0x3;
-          ut32 lpp = (ins >> 2) & 0x3;
+          ut32 lpp = (ins >> 3) & 0x3;
           ut32 spp = ins & 0x3;
           char buf[64];
           int pos = 0;
           if (cf)
             pos += snprintf (buf + pos,
               sizeof (buf) - pos, "FLUSH CACHE");
-          if (ppp == 1)
+          if (ppp == 2)
             pos += snprintf (buf + pos,
               sizeof (buf) - pos, "%sPUSH PC",
               pos ? ", " : "");
-          else if (ppp == 2)
+          else if (ppp == 3)
             pos += snprintf (buf + pos,
               sizeof (buf) - pos, "%sPOP PC",
               pos ? ", " : "");
-          if (lpp == 1)
+          if (lpp == 2)
             pos += snprintf (buf + pos,
               sizeof (buf) - pos, "%sPUSH LOOP",
               pos ? ", " : "");
-          else if (lpp == 2)
+          else if (lpp == 3)
             pos += snprintf (buf + pos,
               sizeof (buf) - pos, "%sPOP LOOP",
               pos ? ", " : "");
-          if (spp == 1)
+          if (spp == 2)
             pos += snprintf (buf + pos,
               sizeof (buf) - pos, "%sPUSH STS",
               pos ? ", " : "");
-          else if (spp == 2)
+          else if (spp == 3)
             pos += snprintf (buf + pos,
               sizeof (buf) - pos, "%sPOP STS",
               pos ? ", " : "");