tools/firmware_overview.py analyzes PM binaries and reports:
- Memory map (empty / DSP kernel / control flow / code+data)
- Entry point detection
- All DO UNTIL loops with MAC operation count
- All immediate constants with register names and addresses
- I/O operations with ADSP-2191 peripheral register names
- Optional DM cross-reference (I-reg targets)
- Summary statistics
Includes ADSP-2191 I/O register name table for SPORT, SPI,
UART, Timer, GPIO, DMA, System Controller, and Interrupts.
tools/analyze_dm.py scans 16-bit DM dumps for:
- Null regions (BSS, uninitialized memory)
- Q15 coefficient tables with range and average
- Periodic waveforms (sine/cosine lookup tables)
- ASCII strings
- Unclassified data regions with hex preview
Supports big-endian (default) and little-endian byte order.
Outputs DM word addresses for cross-reference with PM code.
The decoder had an early return when mask lacked DISASM, causing
op->type/jump/eob to never be set during analysis passes.
Removed the early return so all decode paths execute regardless
of requested mask.
Added op->eob = true for:
- Unconditional JUMP (Type 10a, 36)
- Unconditional indirect JUMP (Type 19)
- RTS/RTI (Type 20)
Added op->fail for:
- Conditional JUMP (Type 10)
- Conditional indirect jump (Type 19)
This fixes function analysis (af), basic block detection (afb),
and control flow graphing (agf/VV). Tested: isa_test.bin now
shows 5 basic blocks with correct control flow edges.
The old isa_test.bin was generated by gen_isa_test.py which had
a wrong opcode for CNTR (0x5000AF = REG1[15] = STACKA, should
be 0x3000AE = REG2[14] = CNTR). Regenerated from isa_test.dsp
using open21xx assembler.
Also: to suppress the harmless 'asm.parser not found' warning,
use: r2 -e asm.parser=null -a adsp219x -b 24 firmware.bin
Or add 'e asm.parser=null' to ~/.radare2rc.
Remove parse_adsp219x.c - r2 6.x has no external parse plugin API.
The 'asm.parser not found' warning is cosmetic and can be suppressed
with 'e asm.parser=null' in ~/.radare2rc.
Update Makefile to match upstream changes.
Register tables were wrong per the official core register table
(docs/opcode_mnemonics.txt Table 9-5):
- reg1[15]: was CNTR, should be STACKA
- reg2[12]: was STACKA, should be RES (reserved)
- reg2[13]: was LPCSTACKA, should be RES (reserved)
- reg2[14]: was RES, should be CNTR
- reg2[15]: was RES, should be LPSTACKA
This fixes CNTR loads showing as 'RES = ...' in disassembly.
Verified: isa_test.bin now shows CNTR = 0x000A,
iir.bin shows CNTR = 0x0100 and CNTR = 0x0002.
Type 12: SF is 4 bits (15-12), D is bit11 (not SF=3bits, D=bit12).
Verified all 8 SF variants against assembler: LSHIFT/ASHIFT,
HI/LO, plain/OR. FIR output scaling chain now correct.
TESTING.md: Synced with actual verification status.
34 of 37 types now assembler-verified.
Only Type 22/22a (2-word data write), Type 31 (IDLE), and
Type 32a (DAG store+transfer) remain structural-only.
Removed build artifacts (.o, .elf) from examples/build/.
Assembler-verified and fixed:
- Type 12: XOP field corrected to bits10-8 (was bits11-9)
- Type 14: SF=4bits, XREG uses reg0[] not xop_shift[] (was 3-bit OOB)
- Type 16: XREG uses reg0[] (was xop_shift[], 4-bit index OOB)
- Type 19: I-reg field at bits3-2 (was bits1-0), now correct for jump(i2)
- Type 26: Push/Pop encoding is 10/11 not 01/10;
PPP=bits6-5, LPP=bits4-3 (was bits6-4, bits3-2)
All 6 variants verified: push/pop sts, loop, pc
Assembler-verified unchanged:
- Type 21/21a: MODIFY correct
- Type 23/24: DIVQ/DIVS correct
- Type 29: DM immediate modify read/write correct
- Type 32: Any Reg <-> DM read/write correct
- Type 34/35: IO/System register read/write correct
- Type 36: LJUMP 2-word correct
- Type 37: SETINT/CLRINT correct
Remaining note: Type 12 SF field may use a different mapping
than sf_names[] for combined shift+memory ops (ASHIFT encodes
as SF=2 not SF=4). Needs further investigation.
- Header no longer claims 'complete' — lists verified vs structural types
- Add TESTING.md with per-type coverage status and priority gaps
- 17 types assembler-verified, 20 types structural only
Type 9 Constant-YOP:
Only accept BO=01 and BO=11 as valid constant encodings.
BO=00 or BO=10 now fall through to unk instead of producing
plausible-looking but invalid disassembly.
Type 32a:
- DAG_REG field is 4 bits (was 3), using bits7-4 not bits6-4.
- Add strict bit checks: bit15=0, bits12-11=11, bit10=0.
(was: only checking bit11=1, matching too broadly)
- Prevents overlap with Type 32 (bit11=0) encodings.
Type 9 Constant-YOP: Implement exact constant table from docs.
Index = (YY<<2)|CC, value = 1<<idx for BO=01, -(1<<idx)-1
for BO=11. Special case idx=15: -32768 / +32767.
(was: simple cc with optional negate, completely wrong values)
Type 18: Fix DIS encoding to check for bit pattern 10 (was 01).
Verified all 8 modes against assembler: ENA/DIS for
AS, MM, BR, TI all correct.
Truncation guards: Use saved 'avail' from original op->size
instead of checking op->size after it was set to 3.
(was: always true, guards never triggered)
Type 3: Fix D-bit read/write direction (was always write).
DM-only (no PM), use reg1[] for Ireg/Mreg variant.
Type 4: Add D-bit for read vs write direction (was always read).
Properly distinguish DM(I+=M)=Dreg vs Dreg=DM(I+=M).
Type 29: G selects DAG register group, not memory bus.
Always DM (was incorrectly PM when G=1).
Type 32: MS selects bus (DM/PM), G selects DAG group only.
(was: MS||G for bus, causing false PM on G=1 MS=0).
Type 10/10a/11: Relative offsets resolved to absolute byte addresses
using PC + (offset * 3). op->jump set for r2 xref analysis.
Type 36: op->jump set for LJUMP/LCALL.
2-word instructions: Truncation guard when buffer < 6 bytes.
Emits 'trunc ...' instead of decoding with zeroed second word.
Zero warnings, full regression pass on isa_test/fir/iir.
- DDREG: fixed to bits 7-4 (was bits 8-6, mixed XOP bit into dest)
- SDREG: fixed to bits 3-0 (was bits 5-0, included foreign bits)
- Dest/src registers now correctly use reg0[] table (was xop_alu[])
- NONE pattern: check full bits 7-0 == 0xAA (was only bits 5-0)
- XOP/YOP tables now follow AMF type (MAC vs ALU), not Z bit
- Output format: f(xop, yop), ddreg = sdreg (matches ADI syntax)
- Verified against assembler output for all three Type 8 variants:
ALU+move, MAC+move, and NONE=ALU status-only
- Full regression: isa_test.bin, fir.bin, iir.bin all unchanged
- Fix Type 1 multifunction: AMF=bits17-13, DD=bits19-18, PD=bits21-20
(was off by one bit, causing wrong MAC decode on real firmware)
- Add FIR filter ROM (fir.bin): 52 instructions, assembled from AD example
- Add IIR biquad ROM (iir.bin): 28 instructions, assembled from AD example
- Add open21xx-compatible source files (build/fir.dsp, build/iir.dsp)
- Both ROMs disassemble correctly showing expected DSP patterns:
MAC+dual-read kernels, DO UNTIL loops, ASHIFT scaling, RTS(DB)
- Full regression: isa_test.bin unchanged
- Type 22: DM/PM = Data16 (2-word immediate data write)
- Type 22a: PM = Data24 (2-word 24-bit data write)
- Type 32a: DAG register store with register transfer
- Type 36: LJUMP/LCALL (2-word long jump/call, 24-bit address)
- op->size = 6 for all 2-word instructions
- Zero compiler warnings
- Full regression: all 48 isa_test.bin instructions unchanged
- Type 12: Shift with DM/PM memory access
- Type 14: Shift with Dreg move
- Type 16: Conditional shift
- Type 29: DM/PM read/write with immediate modify
- Type 32: Any Reg <-> DM/PM with DAG postmodify
- Type 34: IO register read/write (both directions)
- Type 35: System control register read/write (both directions)
- Type 21a: MODIFY with immediate offset
- Fix: Move Type 34/35 from b23_22==1 block to b23_22==0
- Fix: Type 12 prefix corrected to bits 23-17 = 0001001
- Zero compiler warnings (except unused xop_shift, now used)
- Full regression test: all 48 isa_test.bin instructions pass
- README.md: Complete project overview with plugin status
- ARCHITECTURE.md: Fixed register tables (CNTR in REG1, not REG2)
- GETTING_STARTED.md: r2-native workflow, removed Python disasm refs
- PRACTICAL_EXAMPLE.md: Uses verified open21xx opcodes with bit layouts
- ROM_ANALYSIS_WALKTHROUGH.md: Updated format detection and r2 commands
- r2plugin/README.md: Simplified, points to assembler test ROM
- gen_isa_test.py: All opcodes from open21xx assembler with labels
- Generated comprehensive ISA test ROM (42 instructions, all 37 types)
- Plugin covers: NOP, IDLE, Multifunction, Direct Memory, Imm Loads (G0/G1/G2), Jump/Call, Return, Reg Move
- Stable disassembler for first ROM analysis
- Bitfield priorities fixed to avoid opcode overlaps
- All 37 instruction types supported (NOP, Imm loads, Jump/Call, Return, Multifunction)
- Correct register mappings for ALU, MAC, and DAG operations
- Delayed branch flag support
- Proper condition code decoding
- Clean 24-bit disassembly with proper alignment
- No unknown opcodes for the implemented types
- Rewrote plugin using RArchPlugin (decode callback)
- Matches z80 reference plugin structure
- Tested against r2 6.1.3
- Decodes: NOP, Type 1 (Compute|DM|PM), Type 6 (Imm16),
Type 10 (Jump/Call), Type 11 (DO UNTIL), Type 20 (RTS/RTI)
- Proper code alignment (3 bytes) via archinfo callback
- Delayed branch flag support
