# Practical Example: Disassembling a Boot Sequence

This walkthrough uses verified opcodes from the open21xx assembler
to demonstrate analysis of a typical ADSP-2191 initialization.

## Hex Dump (from examples/isa_test.bin)

    0x000 000000   NOP
    0x003 412340   AX0 = 0x1234
    0x006 456781   AX1 = 0x5678
    0x009 4AAAA4   AY0 = 0xAAAA
    0x00C 440002   MX0 = 0x4000
    0x00F 420006   MY0 = 0x2000
    0x012 501000   I0 = 0x0100
    0x015 502001   I1 = 0x0200
    0x018 303000   I4 = 0x0300

## Step-by-Step Analysis

### 1. NOP at Reset Vector (0x000000)

The processor starts at PM address 0x0000. A NOP here means the
real entry point follows immediately, or there is a JUMP to the
main code further ahead.

### 2. Register Initialization (Type 6: Dreg = Imm16)

    0x412340 -> AX0 = 0x1234
    Bit layout: 01.00.0001.00100.011.0100.0000
    Bits 23-20 = 0100 (Type 6), bits 3-0 = 0000 (AX0)
    Immediate value in bits 19-4 = 0x1234

### 3. DAG Setup (Type 7: Reg1/Reg2 = Imm16)

    0x501000 -> I0 = 0x0100
    Bits 23-20 = 0101 (Type 7, REG1), bits 3-0 = 0000 (I0)

    0x303000 -> I4 = 0x0300
    Bits 23-20 = 0011 (Type 7, REG2), bits 3-0 = 0000 (I4)

This is the classic DAG initialization pattern: set index registers
to buffer start addresses, then set modifier and length registers.

### 4. Compute Instructions (Type 9: ALU/MAC)

    0x22600F -> AR = AX0 + AY0
    Bits 23-21 = 001, 20-19 = 00 (Type 9)
    AMF = bits 17-13 = 10011 = X+Y
    XOP = bits 10-8 = 000 (AX0), YOP = bits 12-11 = 00 (AY0)
    COND = bits 3-0 = 1111 (TRUE = unconditional)

    0x20800F -> MR = MX0 * MY0 (SS)
    AMF = bits 17-13 = 00100 = X*Y (SS)

### 5. Jumps (Type 10 vs 10a)

Type 10 (conditional, 13-bit address):

    0x180010 -> IF EQ JUMP 0x0001
    Bits 23-20 = 0001, 19 = 1, 18 = 0 (Type 10)
    B = bit 17 = 0 (no delay slot)
    Address = bits 16-4, COND = bits 3-0 = 0000 (EQ)

Type 10a (unconditional, 16-bit address):

    0x1C0010 -> JUMP 0x0001
    Bits 23-18 = 000111 (Type 10a)
    Address = bits 17-4 + bits 1-0 as MSBs
    S = bit 2 (0=JUMP, 1=CALL), B = bit 3 (delayed branch)

## Patterns to Look For

- **FIR/IIR kernels**: Tight DO...UNTIL CE loops containing
  Type 1 multifunction instructions (MAC + dual memory read).
- **Initialization**: Sequences of Type 6/7 loads setting up
  DAG registers (I/M/L) before entering a processing loop.
- **Data tables in PM**: Regions that disassemble as nonsense
  are likely coefficient tables (24-bit PM data words).