portugalfuturista/rizin
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

arch/tms320: rewrite C55x and C55x+ on a shared decode-IR engine

Browse source 
Replace the per-variant, table/token-driven disassembly and lifting for the
TMS320C55x and C55x+ DSPs with a single shared decode-IR layer, c55_ir, that
both variants drive through a C55ArchDesc descriptor. The shared engine
table-walks an instruction (c55_decode), formats it (c55_format), fills the
analysis op (c55_fill_analysis), and lifts to RzIL (c55_lift) arch-agnostically,
with the opcode tables, register files, operand extractors, and op-type/lift
mappings supplied per variant (c55x and c55x_plus).

Both test corpora decode and lift entirely through the shared engine: forcing
the shared-only decode path and, separately, the shared-only lift path each pass
the full suite -- 1288 tests including the three RzIL VM emulation tests, whose
decrypt loops execute every instruction through the shared IL. The legacy
decoder and lifter are retained only as a fallback for a complex long-tail (the
parallel dual-MAC group, dual-memory addsub/subadd, the absolute-k24 and dbl
multi-operand loads/stores, and the bit-field forms); the shared path is used
when it can decode an instruction and control falls through otherwise, so
behaviour is preserved at every step.

Several forms are extended beyond the old engine: the full C55x+ register file
(ac0-31, ar/xar0-15, CPU-gated in the profile and IL VM) so extended-register
forms lift where the legacy lifter bound only the low eight; pc-relative and
compare-and-branch control transfer; the bcc flag predicate; and the
single-data-memory bitwise and address-arithmetic forms (and/or #k16,Smem and
register-mode amar Smem,xar) decoded cleanly with RzIL rather than inherited from
the legacy tables.
This commit is contained in:
Anton Kochkov 2026-06-14 21:51:44 +00:00 committed by NOT XVilka
parent ab201a3843
commit 4b2ea610df
35 changed files with 11464 additions and 15201 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3316
librz/arch/isa/tms320/c55_ir.c Normal file
View file

File diff suppressed because it is too large Load diff

416
librz/arch/isa/tms320/c55_ir.h Normal file
View file

@ -0,0 +1,416 @@
// SPDX-FileCopyrightText: 2026 RizinOrg <info@rizin.re>
// SPDX-License-Identifier: LGPL-3.0-only
#ifndef RZ_TMS320_C55_IR_H
#define RZ_TMS320_C55_IR_H
#include <rz_types.h>
#include <rz_analysis.h> // RzAnalysisOp, RzAnalysisOpType, RzILOpEffect, RzILOpPure
#ifdef __cplusplus
extern "C" {
#endif
/**
* \file
* Shared decode IR for the TMS320 fixed-point DSP family (C54x / C55x / C55x+).
*
* Decoders run once and produce a \ref C55Insn; three pure consumers read it and
* never re-parse text: c55_format() (asm string), c55_fill_analysis()
* (RzAnalysisOp) and c55_lift() (RzIL). Everything generic (IR, decode engine,
* operand extractors, consumers, RzIL primitives) is shared; everything
* arch-specific (encoding, register set, mnemonic/op-type/lift tables, exotic
* addressing) sits behind one \ref C55ArchDesc. C55x and C55x+ differ only in
* encoding and share id/register/mnemonic tables; C54x supplies its own
* descriptor but reuses the engine, IR and primitives.
*
* An arch may skip the decode engine and fill \ref C55Insn from its own
* front-end while still using the consumers and primitives -- this is how a
* future C64x RzIL lifter would attach to capstone's existing C64x disassembler
* (C64x has disasm but no IL yet), so the decode-table fields of \ref C55ArchDesc
* are optional.
*/
/** Family member (so shared code can special-case where unavoidable). */
typedef enum {
C55_ARCH_C54X = 0, ///< TMS320C54x
C55_ARCH_C55X, ///< TMS320C55x
C55_ARCH_C55XPLUS, ///< TMS320C55x+
} C55Arch;
/** Register class; family-wide superset, each arch uses only its subset. */
typedef enum {
C55_RC_NONE = 0, ///< no register
C55_RC_AC, ///< accumulators: C54x A/B (0..1), C55x AC0..31 (40-bit)
C55_RC_AR, ///< 16-bit auxiliary regs ARn (C54x AR0..7; C55x low 16 of XARn)
C55_RC_XAR, ///< 23-bit extended aux regs XARn (C55x/C55x+)
C55_RC_T, ///< temp regs: C54x T (0); C55x T0..3
C55_RC_TRN, ///< transition register(s) (Viterbi)
C55_RC_CDP, ///< coefficient data pointer (CDP / XCDP)
C55_RC_SP, ///< stack pointer
C55_RC_DP, ///< data-page pointer (C54x DP; C55x DPH:DP)
C55_RC_BK, ///< circular-buffer size reg(s) (BK; BK03/BK47/BKC)
C55_RC_ARP, ///< aux-reg pointer (C54x indirect-mode selector)
C55_RC_ST, ///< status regs (C54x ST0/ST1/PMST; C55x ST0_55..ST3_55)
C55_RC_SPECIAL, ///< anything else addressed by name (PC, RPTC, BRC, ...)
C55_RC_TC, ///< test-control status bits TC1/TC2 (the btst destination)
} C55RegClass;
/** Accumulator sub-field selector. */
typedef enum {
C55_SUB_NONE = 0, ///< whole register
C55_SUB_LO, ///< .l, bits 15:0
C55_SUB_HI, ///< .h, bits 31:16
C55_SUB_GUARD, ///< .g, bits 39:32 (accumulator guard)
} C55SubReg;
/** Register reference, resolved to name/IL-var/width by C55ArchDesc::reg_info(). */
typedef struct {
C55RegClass cls; ///< register class
ut8 num; ///< index within the class (0 for singletons)
C55SubReg sub; ///< accumulator sub-field selector
} C55Reg;
/** Per-arch register descriptor returned by C55ArchDesc::reg_info(). */
typedef struct {
const char *name; ///< display name for the formatter ("ac0", "a", "xar15")
const char *il_var; ///< RzIL global-variable name for the lifter (often == name)
ut8 width; ///< IL bit-width (AR/T 16, XAR 23, AC 40, status 16, ...)
} C55RegInfo;
/**
* Data-memory addressing mode (family-wide superset).
*
* EA-boundary contract: the GENERIC modes (above the divider) have an effective
* address of base +/- {const | index | scaled index} in linear space and are
* computed by c55_generic_ea() from \ref C55MemModel alone, with no arch state.
* The ARCH-SPECIFIC modes need paging / BK / ARP / reverse-carry state and are
* delegated to C55ArchDesc::ea(). Keeping this divider fixed is what lets a later
* C54x (DP-direct / MMR / circular) attach without touching shipped C55 code.
*/
typedef enum {
C55_AM_NONE = 0, ///< not a memory operand
// generic: c55_generic_ea()
C55_AM_INDIRECT, ///< *arN
C55_AM_POSTINC, ///< *arN+
C55_AM_POSTDEC, ///< *arN-
C55_AM_PREINC, ///< *+arN
C55_AM_PREDEC, ///< *-arN
C55_AM_INDEXED, ///< *arN(short(#K)) / *sp(#K)
C55_AM_IDXREG, ///< *arN(tM)
C55_AM_POSTADD, ///< *(arN+tM)
C55_AM_POSTSUB, ///< *(arN-tM)
C55_AM_IDXSCALE, ///< *arN(tM<<#1)
C55_AM_ABSOLUTE, ///< *(#k) absolute address
C55_AM_CONST_IDX, ///< *arN(#K16) long const-index (2-byte extension, ARn unmodified)
C55_AM_CONST_IDX_PRE, ///< *+arN(#K16) long const-index with pre-modify (2-byte extension, ARn += K16)
C55_AM_ABS16, ///< abs16(#k16) data-page absolute: DPH:k16 (2-byte extension, k16 unsigned)
// arch-specific: C55ArchDesc::ea()
C55_AM_BITREV, ///< *(arN+t0b) reverse-carry (C54x *arN+0B)
C55_AM_XAR15, ///< *arN(xar15)
C55_AM_DIRECT, ///< C54x DP/SP-relative direct (@addr / addr)
C55_AM_MMR, ///< C54x memory-mapped register
C55_AM_CIRCULAR, ///< explicit circular via BK/ARP
C55_AM_BITREV_SUB, ///< *(arN-t0b) reverse-carry (the decrement bit-reverse form)
} C55AddrMode;
/** Parameters c55_generic_ea() needs; set per session, not baked in. */
typedef struct {
ut8 addr_unit_log2; ///< 0 = byte-addressed; 1 = word-pointer (EA = reg<<1, C55x)
ut8 ptr_width; ///< pointer-register width in bits (C54x AR 16, C55x XAR 23)
bool big_endian; ///< image endianness
const char *page_reg; ///< il_var of the data-page register for abs16 (DPH); NULL = page 0
} C55MemModel;
/** Operand kind; selects which of the fields below are meaningful. */
typedef enum {
C55_OP_NONE = 0, ///< unused slot
C55_OP_REG, ///< register (optional sub-field, optional shift wrapper)
C55_OP_IMM, ///< immediate (width + signedness, optional shift wrapper)
C55_OP_MEM, ///< data-memory operand (base + amode + index + disp + access)
C55_OP_COND, ///< condition: reg <relop> 0|imm|reg (bcc/xcc/cmp/btst)
C55_OP_INVALID, ///< operand the decoder cannot represent yet; forces legacy fallback
} C55OpKind;
/** Relational operator for \ref C55_OP_COND. */
typedef enum {
C55_REL_EQ, ///< ==
C55_REL_NE, ///< !=
C55_REL_LT, ///< <
C55_REL_LE, ///< <=
C55_REL_GT, ///< >
C55_REL_GE, ///< >=
} C55Relop;
/** A decoded operand. */
typedef struct {
C55OpKind kind; ///< discriminates which fields below apply
const char *raw; ///< if set, the operand renders as this verbatim string (the un-decoded "Baddr" bit-address placeholder of btstp); other fields ignored
C55Reg reg; ///< REG / MEM base / COND subject register
ut64 imm; ///< IMM value or COND compare-constant
bool imm_signed; ///< IMM / disp is signed
ut8 width; ///< IL width of the REG / IMM
C55AddrMode amode; ///< MEM: addressing mode
C55Reg index; ///< MEM: index register (Tm) for indexed / post-modify modes
st32 disp; ///< MEM: signed displacement (INDEXED / DIRECT)
ut64 abs_addr; ///< MEM: address for ABSOLUTE / MMR
ut8 access; ///< MEM: access width in bits (8/16/32 = byte/word/dbl)
bool uns; ///< MEM: uns() wrapper -> zero-extend on load
ut8 byte_sel; ///< MEM: 0 none, 1 high_byte(), 2 low_byte(), 3 byte() wrapper
int8_t shamt; ///< REG/IMM: shift amount (when not \ref sh_by_reg)
bool sh_left; ///< REG/IMM: shift left (else right)
bool sh_by_reg; ///< REG/IMM: shift amount is \ref index register, not \ref shamt
bool shamt_hex; ///< IMM: render the shift count as "<< 0x%X" (always, even 0) rather than "<< #%d"
bool neg_imm; ///< IMM: a negated-magnitude immediate, always rendered "-0x%X" (even -0); see opcode 0x3e
bool shl_join; ///< IMM: render joined to the previous operand by " << " (the "ACx << #SHIFTW" syntax) rather than ", "
bool qual_join; ///< render joined to the previous operand by " || " (the b/call ACx "|| local()/|| far()" parallel qualifiers) rather than ", "
C55Reg sh_mem_reg; ///< MEM: a register shift count Tx rendered as " << Tx" after the operand (the "Smem << Tx" forms), distinct from \ref index
bool sh_mem_reg_set; ///< MEM: \ref sh_mem_reg is present
bool mem_round; ///< MEM: render the whole memory operand wrapped in rnd(...) (the "mov rnd(Smem << Tx), ACx" rounding forms)
ut8 wrap_half; ///< REG: 1 -> hi(...), 2 -> lo(...) wrapper around the (shifted) accumulator (the 0xb4 "mov hi(ACx << Tx), Smem" store forms)
bool wrap_round; ///< REG: render the (shifted) accumulator wrapped in rnd(...)
bool wrap_uns; ///< REG: render the (shifted) accumulator wrapped in uns(...)
bool dbl; ///< REG: rendered dbl(...) (full accumulator / pointer push-pop)
bool dual_wrap; ///< MEM: render the memory operand wrapped in dual(...) (the subadd dual-access form)
bool addr; ///< IMM: rendered as a 24-bit address (#0x%06x), e.g. branch/call fields
bool is_bit; ///< IMM: a bit number rendered with the '@#' prefix (the btst/bclr/bset/bnot/btstp bit operand)
bool hash_dec; ///< IMM: rendered as a signed decimal with a '#' prefix (#1 / #-1), e.g. the sftl fixed-shift literal
bool reltarget; ///< IMM: a pc-relative branch offset used for target computation but rendered as a plain immediate (not a 24-bit address)
bool reltarget_unsigned; ///< IMM: a \ref reltarget whose offset is non-negative, so it is not sign-extended before being added to pc
bool abs_target; ///< IMM: an absolute branch target (the operand value is the target, not a pc-relative displacement)
C55Relop relop; ///< COND: relational operator
bool cmp_to_reg; ///< COND: compare to \ref index register rather than \ref imm
bool cond_is_flag; ///< COND: a status-bit flag expression rather than reg <relop> 0
ut8 cond_flag; ///< COND: status-flag id (when \ref cond_is_flag)
bool cmp_imm; ///< COND: compare to an explicit immediate (#0x..) vs literal #0
bool cmp_mem; ///< COND: the left-hand side is a memory operand (cmp Smem <rel> #k)
bool elide_if_eq_prev; ///< REG: omit this operand (and its separator) when it equals the immediately preceding operand (mpyk/mack ACy defaulting to ACx)
} C55Operand;
/// Max operands: amar carries 3 memory operands (+dst); dmaxdiff/maxdiff reach 5.
#define C55_MAX_OPS 6
/// Sentinel abs_addr value meaning "the absolute address is a trailing extension
/// to be filled by the decoder" (out of the 24-bit program-address range).
#define C55_ABS_EXT 0xffffffffffffffffULL
/**
* Lift operation for instructions whose RzAnalysis op type does not determine
* their RzIL semantics. For example neg maps to RZ_ANALYSIS_OP_TYPE_SUB (there
* is no dedicated NEG op type), so the lifter cannot tell it apart from a real
* sub by the op type alone; the decode table sets this field to select the
* lift explicitly. C55_LOP_NONE (the default) means the lifter dispatches on
* the op type as usual.
*/
typedef enum {
C55_LOP_NONE = 0,
C55_LOP_NEG, ///< dst = -src
C55_LOP_MAX, ///< dst = (src > dst) ? src : dst
C55_LOP_MIN, ///< dst = (src < dst) ? src : dst
C55_LOP_ABS, ///< dst = (src < 0) ? -src : src
C55_LOP_MAC, ///< dst += product (multiply-accumulate, on the MUL path)
C55_LOP_MAS, ///< dst -= product (multiply-subtract, on the MUL path)
C55_LOP_FIRSADD, ///< FIR symmetric: ACy += ACx.h*Cmem :: ACx = (Xmem<<16)+(Ymem<<16)
C55_LOP_FIRSSUB, ///< FIR antisymmetric: ACy += ACx.h*Cmem :: ACx = (Xmem<<16)-(Ymem<<16)
C55_LOP_SQDST, ///< square distance: ACy += ACx.h*ACx.h :: ACx = (Xmem<<16)-(Ymem<<16)
C55_LOP_ABDST, ///< absolute distance: ACy += |ACx.h| :: ACx = (Xmem<<16)-(Ymem<<16)
C55_LOP_LMS, ///< least mean square: ACy += Xmem*Ymem :: ACx = round(ACx + (Xmem<<16))
C55_LOP_ROUND, ///< dst = round(src) -- (src + 0x8000) with the low word cleared
C55_LOP_SAT, ///< dst = saturate(src) to the 32-bit signed range
C55_LOP_ADDV, ///< dst = dst + |src(32-16)| (addition with absolute value)
C55_LOP_SFTL, ///< dst = sftl(src, Tx): logical shift, right by -Tx when Tx<0 else left by Tx
C55_LOP_SFTS, ///< dst = sfts(src, Tx): arithmetic right shift (sign-fill) / logical left
C55_LOP_ANDSHL, ///< dst = dst & (src << #SHIFTW)
C55_LOP_ORSHL, ///< dst = dst | (src << #SHIFTW)
C55_LOP_XORSHL, ///< dst = dst ^ (src << #SHIFTW)
C55_LOP_ADDSHL, ///< dst = dst + (src << #SHIFTW)
C55_LOP_SUBSHL, ///< dst = dst - (src << #SHIFTW)
C55_LOP_MOVSHL, ///< dst = (src << #SHIFTW): load a shifted immediate (mov #k16 << #sh)
C55_LOP_ANDMEM, ///< ACy = ACx & sx(Smem)
C55_LOP_ORMEM, ///< ACy = ACx | sx(Smem)
C55_LOP_XORMEM, ///< ACy = ACx ^ sx(Smem)
C55_LOP_BITCLR, ///< STx = STx & ~(1 << #k4): clear a status-register bit (bclr)
C55_LOP_BITSET, ///< STx = STx | (1 << #k4): set a status-register bit (bset)
C55_LOP_STBITCLR, ///< st0_55 = ite(0, st0_55 | (1<<bit), st0_55 & ~(1<<bit)): clear an st0_55 named bit
C55_LOP_STBITSET, ///< st0_55 = ite(1, st0_55 | (1<<bit), st0_55 & ~(1<<bit)): set an st0_55 named bit
C55_LOP_AMOV, ///< dst = zero-extend(#k16): load a 16-bit constant/address (amov)
C55_LOP_CMP, ///< TCz = (SRC <relop> DST): register compare writing a status TC bit
C55_LOP_CMPAND, ///< TCz = (SRC <relop> DST) && TCx
C55_LOP_CMPOR, ///< TCz = (SRC <relop> DST) || TCx
C55_LOP_AREG_MOV, ///< dst = cast(dst, src): register move with width conversion (amov ACx,ACy)
C55_LOP_AREG_SUB, ///< dst = dst - cast(dst, src): register address subtract (asub ACx,ACy)
C55_LOP_AREG_ADD, ///< dst = dst + cast(dst, src): register/immediate address add (aadd #k,reg)
C55_LOP_AREG_AND, ///< dst = dst & cast(dst, src): A-unit register and (and src, dst)
C55_LOP_AREG_OR, ///< dst = dst | cast(dst, src): A-unit register or (or src, dst)
C55_LOP_AREG_XOR, ///< dst = dst ^ cast(dst, src): A-unit register xor (xor src, dst)
C55_LOP_NOP, ///< no data effect: lift to nop (repeat/loop control etc.)
C55_LOP_MOVMEM, ///< storew(Ymem, loadw(Xmem)): dual-memory move (Xmem=src, Ymem=dst); dbl operands move a 32-bit word
C55_LOP_DUALADD, ///< ACx = sx(Xmem) + sx(Ymem): dual-memory add into an accumulator
C55_LOP_DUALSUB, ///< ACx = sx(Xmem) - sx(Ymem): dual-memory subtract into an accumulator
C55_LOP_OPAQUE, ///< decode + analyse only; data effect not modelled (no IL)
C55_LOP_ROL, ///< ACy = rotate-left(ACx) by one through a status bit (carry/tc2)
C55_LOP_ROR, ///< ACy = rotate-right(ACx) by one through a status bit (carry/tc2)
C55_LOP_MPYK, ///< ACy = #k * ACx: multiply accumulator low word by a signed constant (mpyk/mpykr)
C55_LOP_MACK, ///< ACy = ACx + #k * Tx: multiply-accumulate a signed constant by a Tx coefficient (mack/mackr)
C55_LOP_ADDK, ///< dst = ACx + zero-extend(#k16): immediate add (opcode 0x7b)
C55_LOP_SUBK, ///< dst = ACx - zero-extend(#k16): immediate subtract (opcode 0x7c)
C55_LOP_ANDK, ///< dst = ACx & zero-extend(#k16): immediate and (opcode 0x7d)
C55_LOP_ORK, ///< dst = ACx | zero-extend(#k16): immediate or (opcode 0x7e)
C55_LOP_XORK, ///< dst = ACx ^ zero-extend(#k16): immediate xor (opcode 0x7f)
} C55LiftOp;
/** A fully decoded instruction: the single hand-off from decode to the consumers. */
typedef struct {
C55Arch arch; ///< producing family member
ut16 id; ///< arch-local instruction id (TMS320C5{4,5}_INS_*); opaque to shared code
C55LiftOp lop; ///< explicit lift op (C55_LOP_NONE => dispatch on the op type)
ut8 size; ///< instruction length in bytes
C55Operand ops[C55_MAX_OPS]; ///< operands, in assembly order
ut8 n_ops; ///< number of valid entries in \ref ops
bool round; ///< rounding variant (r)
bool fract; ///< fractional-mode variant (f), rendered before the 'r' suffix (mpyk -> mpykf -> mpykfr)
bool m40; ///< M40 / 40-bit mode (40)
bool saturate; ///< saturating variant ((saturate / sat)
bool side_load; ///< memory-MAC side-load: also load Smem into T3 ([T3 = ]Smem)
bool square; ///< squaring multiply: the (memory) multiplicand is multiplied by itself
bool parallel; ///< has a "||" parallel companion slot
bool dual; ///< "::" paired form (dual MAC: two parallel sub-ops sharing Cmem)
C55LiftOp lop2; ///< dual: lift op of the second sub-MAC (sub1 uses \ref lop)
bool amar1; ///< dual: sub1 is an "amar" address-modify (no product)
bool shift1; ///< dual: sub1 accumulates with the accumulator shifted right 16 (">> #16")
bool shift2; ///< dual: sub2 accumulates with the accumulator shifted right 16 (">> #16")
bool shift16; ///< single MAC: the accumulator term is shifted right 16 before the product (macm ... ACx >> #16)
bool mac_mov; ///< MAC :: parallel load: a Tx-coefficient MAC (ops[0..2]) with a parallel "mov Ymem << #16, ACy" (ops[3..4])
bool mant_nexp; ///< "mant ACa, ACb :: nexp ACa, ACc": ops [0]=ACa [1]=ACb [2]=ACc, ACa shared by both halves
bool mac_store; ///< C55x 0x87 parallel dual-MAC store: "MN Xmem, Tx, ACy :: mov hi(ACx << t2), Ymem" and the add/sub/mov << #16 variants
bool diff_pair; ///< max/min-diff form: ops [0..3]=ACc,ACd,ACa,ACb [4]=trn; the trn is wrapped in pair() (the non-d variants)
bool diff_form; ///< max/min/dmax/dmin-diff "ACc, ACd, ACa, ACb, [pair(]trn[)]" rendering
bool uns_all; ///< whole-operation unsigned (mnemonic 'u' suffix, e.g. mpymu): operands multiplied unsigned, no per-operand uns() wrapper rendered
bool both; ///< register-pair stack op (popboth / pshboth): pushed/popped as a pair, left unlifted by the shared push/pop lifter
bool xcc_guard; ///< xccpart conditional-execute guard: in a "||" parallel pair the *other* sub-instruction executes only when this one's condition holds
bool quad; ///< swap4: exchange four consecutive register pairs (the XCHG lifter emits four XOR-swaps)
bool has_branch; ///< \ref branch_target is valid
ut64 branch_target; ///< absolute target for B/BC/CALL/RPTB/... (precomputed)
st32 stack_delta; ///< net SP change for psh/pop/aadd sp / frame ops
bool cond_exec; ///< carried a conditional-execution prefix (C55x+ 0x2e/0x2f if(!TC1)/if(TC1)); rendered/lifted transparently, as the legacy decoder does
bool parallel_pair; ///< a "||" parallel pair of two independent sub-instructions (C55x+ 0x3N prefix): the two sub-instructions are re-decoded on demand from \ref par_bytes
ut8 par_bytes[16]; ///< raw instruction bytes (parallel pair only), so the two sub-instructions can be re-decoded by the format / lift / analysis consumers
ut8 par_off1; ///< byte offset of the first sub-instruction within \ref par_bytes
ut8 par_off2; ///< byte offset of the second sub-instruction within \ref par_bytes
bool par_swap; ///< render / sequence the second sub-instruction before the first (the legacy hash 0xF0/0xF1 ordering)
} C55Insn;
struct c55_arch_desc_t;
struct c55_op_desc_t;
/**
* Shared operand extractor: fills one \ref C55Operand from the instruction bits.
* \param a arch descriptor (for reg_info / memory model)
* \param bits whole instruction, packed MSB-first into a word (up to 8 bytes)
* \param d the operand slot being decoded (its \ref C55OpDesc.lo / .width / .param)
* \param out operand to fill
*/
typedef void (*C55Extract)(const struct c55_arch_desc_t *a, ut64 bits, const struct c55_op_desc_t *d, C55Operand *out);
/** One operand slot in a \ref C55InsnDef: which bits feed which extractor. */
typedef struct c55_op_desc_t {
ut8 lo; ///< bitfield start (LSB index within the packed instruction word)
ut8 width; ///< bitfield width
C55Extract fn; ///< shared extractor to run
ut8 param; ///< class selector / scale / width hint passed to \ref fn
} C55OpDesc;
/** One row of a per-arch instruction table (data only; the engine is shared). */
typedef struct {
ut32 mask; ///< opcode discriminator mask over the leading byte(s)
ut32 match; ///< required value under \ref mask
ut16 id; ///< arch-local instruction id
C55LiftOp lop; ///< explicit lift op copied to \ref C55Insn.lop (0 => dispatch on op type)
ut8 len; ///< fixed length in bytes, or 0 => C55ArchDesc::insn_len()
C55OpDesc ops[C55_MAX_OPS]; ///< operand slots
ut32 mods; ///< variant-flag bit positions, packed as 5-bit (position+1, 0=absent) fields: rounding in bits 0-4, side-load (T3=) in 5-9, M40 in 10-14, fractional (f) in 15-19
ut8 alt_bit; ///< sub-discriminator bit position (in the full packed bits, LSB-counted) + 1, or 0 if absent: when that bit is set the decode uses \ref alt_id / \ref alt_lop instead of \ref id / \ref lop (for variants whose selector lies beyond the 4-byte match head)
ut16 alt_id; ///< instruction id when \ref alt_bit fires
C55LiftOp alt_lop; ///< lift op when \ref alt_bit fires
bool no_parallel; ///< suppress the parallel-bit derivation (bit 0 of the leading byte is an operand/opcode field here, not the parallel marker)
bool square; ///< squaring multiply: the (memory) multiplicand is multiplied by itself (sqrm / sqam / sqsm)
bool dual; ///< dual "::" MAC: operands filled by C55ArchDesc::fill_dual, not the ops[] extractors
C55LiftOp lop2; ///< dual: lift op of the second sub-MAC (sub1 uses \ref lop)
bool amar1; ///< dual: sub1 is an "amar" address-modify (no product, no Cmem/dst)
bool shift1; ///< dual: sub1 accumulates with the accumulator shifted right 16 (">> #16")
bool shift2; ///< dual: sub2 accumulates with the accumulator shifted right 16 (">> #16")
bool shift16; ///< single MAC: the accumulator term is shifted right 16 before the product (macm ... ACx >> #16)
bool mac_mov; ///< MAC :: parallel load form (macm/masm Xmem, Tx, ACx :: mov Ymem << #16, ACy)
bool mant_nexp; ///< "mant ACa, ACb :: nexp ACa, ACc" dual form (copied to \ref C55Insn.mant_nexp)
bool mac_store; ///< C55x 0x87 parallel dual-MAC store form (copied to \ref C55Insn.mac_store)
bool diff_pair; ///< max/min-diff: the trn operand is wrapped in pair() (copied to \ref C55Insn.diff_pair)
bool diff_form; ///< max/min/dmax/dmin-diff rendering (copied to \ref C55Insn.diff_form)
bool uns_all; ///< whole-operation unsigned (mpymu): 'u' mnemonic suffix; multiplicand operands carry uns
bool side_load; ///< memory-MAC side-load: also load Smem into T3 ([T3 = ]Smem), copied to \ref C55Insn.side_load
bool both; ///< register-pair stack op (popboth / pshboth): copied to \ref C55Insn.both; the shared push/pop lifter leaves it unlifted
bool xcc_guard; ///< xccpart parallel-slot guard form (copied to \ref C55Insn.xcc_guard)
bool quad; ///< swap4: copied to \ref C55Insn.quad; the XCHG lifter exchanges four consecutive register pairs
} C55InsnDef;
/**
* The arch extension point. Adding C54x = providing one of these; C55x/C55x+
* each provide one but share id/register/mnemonic tables. The decode fields
* (\ref table .. \ref insn_len) are optional: an arch may instead fill
* \ref C55Insn from its own front-end (e.g. capstone for a future C64x lifter)
* and still use the consumers and primitives.
*/
typedef struct c55_arch_desc_t {
C55Arch arch; ///< family member
const char *cpu_name; ///< "c54x" / "c55x" / "c55x+"
const C55InsnDef *table; ///< instruction table (NULL if decoded externally)
size_t table_len; ///< number of rows in \ref table
ut8 (*insn_len)(const ut8 *buf, int len); ///< variable-length decode helper
const C55RegInfo *(*reg_info)(C55RegClass cls, ut8 num, C55SubReg sub); ///< register resolver
const char *(*mnemonic)(ut16 id); ///< id -> mnemonic; NULL if disasm is external
ut32 (*op_type)(ut16 id); ///< id -> RZ_ANALYSIS_OP_TYPE_* (the type of RzAnalysisOp::type)
RzILOpEffect *(*lift)(const C55Insn *insn, ut64 pc); ///< id -> RzIL (per-arch dispatch)
C55MemModel mem; ///< memory model for c55_generic_ea()
RzILOpPure *(*ea)(const struct c55_arch_desc_t *a, const C55Operand *m); ///< arch-specific EA; NULL => generic only
/// Dual "::" MAC operand filler: for a row with C55InsnDef::dual set, fills the
/// canonical 6-slot layout (Xmem, Cmem-x, ACx, Ymem, Cmem-y, ACy) plus the dual
/// sub-op metadata on \ref C55Insn, returning false (-> legacy) on an
/// unrepresentable mode. NULL => the arch has no dual forms.
bool (*fill_dual)(const struct c55_arch_desc_t *a, ut64 bits, const C55InsnDef *def, C55Insn *out);
bool cond_exec_prefix; ///< the arch has the 0x2e/0x2f conditional-execution prefix (C55x+); a leading 0x2e/0x2f is consumed and the following instruction decoded transparently
bool parallel_prefix; ///< the arch has the 0x3N parallel-pair prefix (C55x+): a leading byte in 0x30-0x3F introduces two independent sub-instructions joined by " || ", the low nibble giving the total byte length
} C55ArchDesc;
// shared API: one decode, three pure consumers
bool c55_decode(const C55ArchDesc *a, const ut8 *buf, int len, C55Insn *out);
char *c55_format(const C55ArchDesc *a, const C55Insn *insn); // caller frees
void c55_fill_analysis(const C55ArchDesc *a, const C55Insn *insn, RzAnalysisOp *op);
RzILOpEffect *c55_lift(const C55ArchDesc *a, const C55Insn *insn, ut64 pc);
// shared operand extractors referenced by the per-arch tables
void c55_x_reg(const C55ArchDesc *a, ut64 bits, const C55OpDesc *d, C55Operand *out);
void c55_x_mem(const C55ArchDesc *a, ut64 bits, const C55OpDesc *d, C55Operand *out);
void c55_x_imm(const C55ArchDesc *a, ut64 bits, const C55OpDesc *d, C55Operand *out);
void c55_x_cond(const C55ArchDesc *a, ut64 bits, const C55OpDesc *d, C55Operand *out);
// shared RzIL primitives used by each arch's ::lift; c55_generic_ea() serves only
// the generic addressing modes (the EA-boundary contract on C55AddrMode).
RzILOpPure *c55_generic_ea(const C55ArchDesc *a, const C55Operand *m);
RzILOpPure *c55_read(const C55ArchDesc *a, const C55Operand *op);
RzILOpEffect *c55_write(const C55ArchDesc *a, const C55Operand *dst, RzILOpPure *val);
RzILOpEffect *c55_post_effect(const C55ArchDesc *a, const C55Operand *m);
#ifdef __cplusplus
}
#endif
#endif /* RZ_TMS320_C55_IR_H */

3338
librz/arch/isa/tms320/c55x/c55x_analysis.c
View file

File diff suppressed because it is too large Load diff

4
librz/arch/isa/tms320/c55x/c55x_analysis.h
View file

@ -7,6 +7,10 @@
#define ANALYSIS_C55X_H
#include <rz_analysis.h>
#include <tms320/c55_ir.h>
/// The TMS320C55x arch descriptor: drives the shared c55_ir engine/consumers.
extern const C55ArchDesc c55x_arch_desc;
int tms320_c55x_op_byte(RzAnalysis *analysis, RzAnalysisOp *op, ut64 addr,
const ut8 *buf, int len, RzAnalysisOpMask mask);

4120
librz/arch/isa/tms320/c55x/table.h
View file

File diff suppressed because it is too large Load diff

53
librz/arch/isa/tms320/c55x_plus/c55plus.c
View file

@ -1,53 +0,0 @@
// SPDX-FileCopyrightText: 2013 th0rpe <josediazfer@yahoo.es>
// SPDX-FileCopyrightText: 2026 RizinOrg <info@rizin.re>
// SPDX-License-Identifier: LGPL-3.0-only
/**
* \file c55plus.c
*
* TMS320C55x+ disassembler glue layer.
*
* This is the entry point called from tms320_dasm() when asm.cpu is
* "c55x+". It hands the input bytes to the th0rpe c55plus_decode()
* walker, lower-cases the resulting mnemonic to match rizin's house
* style, and writes it into the caller's tms320_dasm_t.
*
* The decode walker is a global-state machine using extern ins_buff /
* ins_buff_len pointers -- keep this glue thin so the global setup
* stays in one place.
*/
#include <rz_types.h>
#include <rz_lib.h>
#include <rz_asm.h>
#include <rz_util/rz_str.h>
#define USE_DECODE
#include "decode.h"
#include "../tms320_dasm.h"
extern ut8 *ins_buff;
extern ut32 ins_buff_len;
extern char *c55plus_decode(ut32 ins_pos, ut32 *next_ins_pos);
int c55x_plus_disassemble(tms320_dasm_t *dasm, const ut8 *buf, int len) {
ut32 next_ins_pos = 0;
ins_buff = (ut8 *)buf;
ins_buff_len = (ut32)len;
char *ins_decoded = c55plus_decode(0, &next_ins_pos);
dasm->length = next_ins_pos;
if (!ins_decoded) {
return 0;
}
/* Walker emits mixed-case mnemonics (e.g. "MOV", "AC0"); rizin
* convention is all-lowercase. */
rz_str_case(ins_decoded, false);
snprintf(dasm->syntax, sizeof(dasm->syntax), "%s", ins_decoded);
free(ins_decoded);
return next_ins_pos;
}

17
librz/arch/isa/tms320/c55x_plus/c55plus.h
View file

@ -1,17 +0,0 @@
// SPDX-FileCopyrightText: 2013-2021 th0rpe <josediazfer@yahoo.es>
// SPDX-License-Identifier: LGPL-3.0-only
#ifndef C55PLUS_H
#define C55PLUS_H
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <rz_types.h>
#include <rz_lib.h>
#include "../tms320_dasm.h"
extern int c55x_plus_disassemble(tms320_dasm_t *dasm, const ut8 *buf, int len);
#endif

868
librz/arch/isa/tms320/c55x_plus/c55plus_analysis.c
View file

@ -3,879 +3,41 @@
// SPDX-FileCopyrightText: 2026 RizinOrg <info@rizin.re>
// SPDX-License-Identifier: LGPL-3.0-only
#include <string.h>
#include <rz_types.h>
#include <rz_endian.h>
#include <rz_analysis.h>
#include "c55plus_analysis.h"
#include "c55plus.h"
#include "ins.h"
#include "../tms320c55x_insn.h"
#include "../tms320_dasm.h"
#include "c55plus_arch.h"
#include "../c55_ir.h"
/**
* \file c55plus_analysis.c
*
* TMS320C55x+ analysis: classify opcodes, resolve branch targets, set
* basic-block fallthrough, fill in src/dst/val and stack effects.
*
* Pure byte-level dispatch -- no mnemonic-string matching. Each
* recognised opcode is dispatched on its leading byte (or leading byte
* + a small subset of the second byte where the prefix family is
* shared by multiple instructions).
*
* The encoding map below was extracted from SWPU104 chapter 6 (Dec
* 2006 'Algebraic Instruction Set' reference) and SWPU086 chapter 4
* (May 2005 'CPU Reference Guide', Preliminary), then cross-validated
* against TI dis55.exe v4.3.6 (CCSv5 c55x_plus SDK, Feb 2010) on the
* testbins#289 c55xp corpus.
*
* Branch and control-flow encodings:
*
* 0x00 .. NOP / IDLE / RETI / to_word sec.6.5.11, sec.6.5.20, sec.6.5.16
* 0x02 b1 B/CALL ACx (indirect register) sec.6.5.2, sec.6.5.6
* 0x03 b1 INTR #k4 / TRAP #k4 sec.6.5.13, sec.6.5.19
* 0x04 / 0x06 XCC predicated execute sec.6.5.9
* 0x05 / 0x07 XCCPART sec.6.5.9
* 0x08 RETCC sec.6.5.17
* 0x20 NOP (1 byte) sec.6.5.11
* 0x21 RET (1 byte) sec.6.5.16
* 0x68 hh ll B short-relative sec.6.5.2
* 0x69 hh ll CALL short-relative sec.6.5.6
* 0x6A ss dst BCC short-relative (8-bit) sec.6.5.1
* 0x6C / 0x6D RPT / RPTCC sec.6.5.14
* 0x6E / 0x6F RPTBLOCAL / RPTB sec.6.5.14
* 0x9A hh ll d BCC long-relative (16-bit) sec.6.5.1
* 0x9B hh ll d CALLCC long-relative sec.6.5.5
* 0x9C hh ll d B long-absolute (24-bit) sec.6.5.2
* 0x9D hh ll d CALL long-absolute sec.6.5.6
* 0x9E / 0x9F B / CALL with far() prefix sec.6.5.2, sec.6.5.6
* 0xD8 ... BCC far-absolute (5-byte) sec.6.5.1
* 0xD9 ... CALLCC far-absolute sec.6.5.5
* 0xDA / 0xDB BCC / BCCU short-form sec.6.5.1
* 0xDC / 0xDD BCC / BCCU sec.6.5.1
* 0xDE / 0xDF BCC / BCCU sec.6.5.1
*
* Stack-affecting:
*
* 0x0D PSHBOTH ACx (2 words) sec.6.7.6
* 0x0E PSH dbl(ACx) (2 words) sec.6.7
* 0x0F POP dbl(ACx) (2 words)
* 0x61 PSH dbl(mem) (2 words)
* 0x70 PSH dual-register (2 words)
* 0x71 POP dual-register
* 0x94 PSH ACx, mem (2 words)
*
* Byte-order note: C55x+ branch displacements and absolute targets are
* stored MSB-first within the instruction stream even though the
* surrounding processor is little-endian -- see SWPU104 sec.3.5. We use
* rz_read_at_be16() / rz_read_at_be24() from rz_endian.h to extract
* them unambiguously without unaligned-int dereference.
* TMS320C55x+ analysis. The instruction is decoded once by the shared
* decode-IR engine (c55_ir), and the analysis op -- type, branch targets,
* basic-block fall-through, src/dst/val, stack effects and instruction id --
* together with the RzIL lift are both derived from that single decoded
* C55Insn. Anything the engine does not decode is reported as illegal.
*/
/* Helper: sign-extend an n-bit value (for short conditional branch
* relative displacements, which are 8-bit signed in some encodings
* and 16-bit signed in others). */
static inline st32 sign_extend(ut32 v, ut32 bits) {
const ut32 mask = (1u << bits) - 1;
v &= mask;
if (v & (1u << (bits - 1))) {
return (st32)(v | ~mask);
}
return (st32)v;
}
/* Set conditional-jump fields: type=cjmp, jump=target, fail=fallthrough. */
static inline void set_cjmp(RzAnalysisOp *op, ut64 addr, ut64 target) {
op->type = RZ_ANALYSIS_OP_TYPE_CJMP;
op->jump = target;
op->fail = addr + op->size;
op->direction = RZ_ANALYSIS_OP_DIR_EXEC;
}
/* Set conditional-call fields: type=ccall, jump=target, fail=fallthrough. */
static inline void set_ccall(RzAnalysisOp *op, ut64 addr, ut64 target) {
op->type = RZ_ANALYSIS_OP_TYPE_CCALL;
op->jump = target;
op->fail = addr + op->size;
op->stackop = RZ_ANALYSIS_STACK_INC;
op->stackptr = 2;
op->direction = RZ_ANALYSIS_OP_DIR_EXEC;
}
/* Set unconditional-call fields: type=call, jump=target. */
static inline void set_call(RzAnalysisOp *op, ut64 target) {
op->type = RZ_ANALYSIS_OP_TYPE_CALL;
op->jump = target;
op->stackop = RZ_ANALYSIS_STACK_INC;
op->stackptr = 2;
op->direction = RZ_ANALYSIS_OP_DIR_EXEC;
}
/* Set unconditional-jump fields. */
static inline void set_jmp(RzAnalysisOp *op, ut64 target) {
op->type = RZ_ANALYSIS_OP_TYPE_JMP;
op->jump = target;
op->direction = RZ_ANALYSIS_OP_DIR_EXEC;
}
/* Mark an instruction as a return, with stack accounting. */
static inline void set_ret(RzAnalysisOp *op) {
op->type = RZ_ANALYSIS_OP_TYPE_RET;
op->eob = true;
op->stackop = RZ_ANALYSIS_STACK_INC;
op->stackptr = -2;
}
/* Conditional return -- like RET but doesn't end the basic block
* (fallthrough is possible if the condition is false). */
static inline void set_cret(RzAnalysisOp *op) {
op->type = RZ_ANALYSIS_OP_TYPE_CRET;
op->fail = op->addr + op->size;
op->stackop = RZ_ANALYSIS_STACK_INC;
op->stackptr = -2;
}
/* Stack push: write+decrement. Track the byte delta. */
static inline void set_push(RzAnalysisOp *op, int delta) {
op->type = RZ_ANALYSIS_OP_TYPE_PUSH;
op->stackop = RZ_ANALYSIS_STACK_INC;
op->stackptr = delta;
}
/* Stack pop: read+increment. Track the byte delta. */
static inline void set_pop(RzAnalysisOp *op, int delta) {
op->type = RZ_ANALYSIS_OP_TYPE_POP;
op->stackop = RZ_ANALYSIS_STACK_INC;
op->stackptr = delta;
}
/* Record an immediate value (for "mov #k, dst" / "add #k, dst" etc.). */
static inline void set_imm(RzAnalysisOp *op, st64 val) {
op->val = (ut64)val;
}
/* Record a memory access width (in bytes: 1, 2, or 4) for loads and
* stores whose effective address is computed at runtime. */
static inline void set_mem_width(RzAnalysisOp *op, int width) {
op->refptr = width;
op->ptrsize = width;
}
/* Set op->reg (destination register name) for instructions whose
* destination register is encoded statically in the leading byte(s).
* The string is borrowed and must point to static storage. */
static inline void set_dst_reg(RzAnalysisOp *op, const char *name) {
op->reg = name;
}
/* Set op->ireg (register used for indirect memory computation) for
* register-indirect loads, stores, branches and calls (e.g. B ACx,
* CALL ACx). The string is borrowed and must point to static storage. */
static inline void set_ireg(RzAnalysisOp *op, const char *name) {
op->ireg = name;
}
/* Set op->direction so higher-level analysis knows whether the op
* reads from memory (LOAD-style), writes to memory (STORE-style),
* jumps (EXEC), or just references an address (REF). */
static inline void set_dir(RzAnalysisOp *op, RzAnalysisOpDirection dir) {
op->direction = dir;
}
/* Set op->disp (displacement) for memory references that compute
* their effective address as `base_register + disp`. */
static inline void set_disp(RzAnalysisOp *op, st64 disp) {
op->disp = (ut64)disp;
}
/* ACx selector tables -- index 0..3 corresponds to AC0..AC3. */
static const char *const c55xp_acc_names[4] = { "ac0", "ac1", "ac2", "ac3" };
int tms320_c55x_plus_op(RzAnalysis *analysis, RzAnalysisOp *op, ut64 addr,
const ut8 *buf, int len, RzAnalysisOpMask mask) {
if (!op || !buf || len < 1) {
return 0;
}
const ut32 base_len = get_ins_len(buf[0]);
if (base_len == 0 || (int)base_len > len) {
return 0;
}
/* base_len is derived from the leading byte alone and so under-counts
* the instructions that carry a variable k16/k24 offset operand in a
* Smem field (e.g. "MOV *ARn(#K16), ACx"). Ask the disassembler for the
* true length, which folds in those extra operand bytes; fall back to
* the leading-byte length if the decode fails. */
ut32 ins_len = base_len;
tms320_dasm_t dasm = { 0 };
int dlen = c55x_plus_disassemble(&dasm, buf, len);
if (dlen > 0 && dlen <= len && (ut32)dlen >= base_len) {
ins_len = (ut32)dlen;
}
op->addr = addr;
op->size = ins_len;
op->type = RZ_ANALYSIS_OP_TYPE_NULL;
/* Surface the named instruction ID (Capstone-style op->id), resolved
* from the C55x+ token decoder's decoded mnemonic. The type-level
* dispatch below stays byte-driven because C55x+ packs many distinct
* instructions behind each leading byte (disambiguated by operand
* bits the analyzer already inspects); the ID gives consumers the
* exact mnemonic without re-deriving it. */
op->id = tms320c55x_plus_insn_id_decode(buf, len);
switch (buf[0]) {
/* ---- 0x00 family: NOP_16 / IDLE / RETI / to_word --------------- */
case 0x00:
if (ins_len < 2) {
op->type = RZ_ANALYSIS_OP_TYPE_NOP;
break;
C55Insn ci;
if (c55_decode(&c55plus_arch_desc, buf, len, &ci)) {
c55_fill_analysis(&c55plus_arch_desc, &ci, op);
if (mask & RZ_ANALYSIS_OP_MASK_IL) {
op->il_op = c55_lift(&c55plus_arch_desc, &ci, op->addr);
}
switch (buf[1]) {
case 0x20: /* IDLE */
op->type = RZ_ANALYSIS_OP_TYPE_NOP;
op->family = RZ_ANALYSIS_OP_FAMILY_CPU;
break;
case 0xc0: /* RETI */
set_ret(op);
set_dst_reg(op, "sp");
break;
default:
op->type = RZ_ANALYSIS_OP_TYPE_NOP;
break;
}
break;
/* ---- 0x01 family: rptsub --------------------------------------- */
case 0x01:
op->type = RZ_ANALYSIS_OP_TYPE_REP;
break;
/* ---- 0x02 family: B/CALL ACx indirect; both eob -----------------*/
case 0x02: {
if (ins_len < 2) {
break;
}
/* Bit 7 of the second byte selects CALL (=1) vs B (=0).
* The low 2 bits of buf[1] select ACx (0..3). */
const bool is_call = (buf[1] & 0x80) != 0;
const ut8 ac_idx = buf[1] & 0x03;
if (is_call) {
op->type = RZ_ANALYSIS_OP_TYPE_UCALL;
op->stackop = RZ_ANALYSIS_STACK_INC;
op->stackptr = 2;
set_dir(op, RZ_ANALYSIS_OP_DIR_EXEC);
} else {
op->type = RZ_ANALYSIS_OP_TYPE_UJMP;
op->eob = true;
set_dir(op, RZ_ANALYSIS_OP_DIR_EXEC);
}
set_ireg(op, c55xp_acc_names[ac_idx]);
op->fail = addr + ins_len;
break;
}
/* ---- 0x03 family: INTR / TRAP / SWAP / SIM_TRIG ---------------
* Differentiated by buf[1] high nibble:
* 0x0?,0x1?,0x2?,0x3? -> intr #k5 (SWPU104 6.5.13)
* 0x4?,0x5? -> trap #k5 (SWPU104 6.5.19)
* 0x8?,0x9?,0xa?,0xb? -> swap regs (SWPU104 6.7.x)
* 0xc?..0xf? -> sim_trig (C55x+ silicon variant)
*/
case 0x03:
if (ins_len < 2) {
break;
}
switch (buf[1] & 0xc0) {
case 0x00: /* intr #k5 */
op->type = RZ_ANALYSIS_OP_TYPE_SWI;
set_imm(op, buf[1] & 0x1f);
op->family = RZ_ANALYSIS_OP_FAMILY_CPU;
break;
case 0x40: /* trap #k5 */
op->type = RZ_ANALYSIS_OP_TYPE_TRAP;
set_imm(op, buf[1] & 0x1f);
op->family = RZ_ANALYSIS_OP_FAMILY_CPU;
break;
case 0x80: /* swap */
op->type = RZ_ANALYSIS_OP_TYPE_XCHG;
break;
case 0xc0: /* sim_trig - simulator trigger (C55x+ variant) */
op->type = RZ_ANALYSIS_OP_TYPE_TRAP;
op->family = RZ_ANALYSIS_OP_FAMILY_CPU;
break;
}
break;
/* ---- 0x04 / 0x06: XCC (predicated execute) --------------------- */
case 0x04:
case 0x06:
op->type = RZ_ANALYSIS_OP_TYPE_CMP;
op->family = RZ_ANALYSIS_OP_FAMILY_CPU;
break;
/* ---- 0x05 / 0x07: XCCPART -------------------------------------- */
case 0x05:
case 0x07:
op->type = RZ_ANALYSIS_OP_TYPE_CMP;
op->family = RZ_ANALYSIS_OP_FAMILY_CPU;
break;
/* ---- 0x08: RETCC (conditional ret) ----------------------------- */
case 0x08:
set_cret(op);
set_dst_reg(op, "sp");
break;
/* ---- 0x0A: BCLR/BSET status-register-bit ---------------------- */
case 0x0a:
/* Modifies a status-reg bit -- surface as MOV (the closest fit
* in the rizin optype set; the immediate-side bit pattern is
* not extracted here). */
op->type = RZ_ANALYSIS_OP_TYPE_MOV;
break;
/* ---- 0x0C: AADD addr-add ------------------------------------- */
case 0x0c:
/* AADD K8, SP -- prologue/epilogue frame adjustment.
*
* Semantic: SP = SP + K8 (signed). rizin's convention is
* that op->stackptr is the amount by which SP *decreases*,
* so for AADD that is -K8. See c55x_analysis.c 0x4e and
* rz_analysis_op_apply_sp_effect() in librz/arch/op.c. */
op->type = RZ_ANALYSIS_OP_TYPE_ADD;
if (ins_len >= 2) {
const st8 k8 = (st8)buf[1];
set_imm(op, k8);
set_dst_reg(op, "sp");
set_disp(op, k8);
op->stackop = RZ_ANALYSIS_STACK_INC;
op->stackptr = -k8;
}
break;
/* ---- 0x0D: PSHBOTH ------------------------------------------- */
case 0x0d:
op->type = RZ_ANALYSIS_OP_TYPE_UPUSH;
op->stackop = RZ_ANALYSIS_STACK_INC;
op->stackptr = 2;
set_dst_reg(op, "sp");
set_dir(op, RZ_ANALYSIS_OP_DIR_WRITE);
break;
/* ---- 0x0E / 0x0F: PSH/POP dbl -------------------------------- */
case 0x0e:
set_push(op, 2);
set_dst_reg(op, "sp");
set_dir(op, RZ_ANALYSIS_OP_DIR_WRITE);
break;
case 0x0f:
set_pop(op, -2);
set_dst_reg(op, "sp");
set_dir(op, RZ_ANALYSIS_OP_DIR_READ);
break;
/* ---- 0x20: NOP ----------------------------------------------- */
case 0x20:
op->type = RZ_ANALYSIS_OP_TYPE_NOP;
break;
/* ---- 0x21: RET ----------------------------------------------- */
case 0x21:
set_ret(op);
set_dst_reg(op, "sp");
break;
/* ---- 0x24-0x26: PSH variants --------------------------------- */
case 0x24:
case 0x25:
case 0x26:
set_push(op, 1);
set_dst_reg(op, "sp");
set_dir(op, RZ_ANALYSIS_OP_DIR_WRITE);
break;
/* ---- 0x27: CIRC -- circular addressing helper ---------------- */
case 0x27:
op->type = RZ_ANALYSIS_OP_TYPE_MOV;
break;
/* ---- 0x60: DELAY -- memory-delay move (TI SWPU104 sec.6.7.1,
* "Memory Delay", grouped under Move Operations). delay(Smem)
* copies the word at Smem to the next-higher address Smem+1 (a
* one-word memory-to-memory data shift used to build delay lines
* in filters): one data read, one data write. It is a data MOV,
* not a CPU/system-control op, so no FAMILY_CPU. -------------- */
case 0x60:
op->type = RZ_ANALYSIS_OP_TYPE_MOV;
set_mem_width(op, 2);
set_dir(op, RZ_ANALYSIS_OP_DIR_WRITE);
break;
/* ---- 0x61: PSH dbl(mem) -------------------------------------- */
case 0x61:
set_push(op, 2);
set_dst_reg(op, "sp");
set_dir(op, RZ_ANALYSIS_OP_DIR_WRITE);
break;
/* ---- 0x68: B short-relative (16-bit) ------------------------- */
case 0x68:
if (ins_len >= 3) {
const ut32 disp = rz_read_at_be16(buf, 1);
set_jmp(op, addr + 3 + sign_extend(disp, 16));
op->eob = true;
}
break;
/* ---- 0x69: CALL short-relative ------------------------------- */
case 0x69:
if (ins_len >= 3) {
const ut32 disp = rz_read_at_be16(buf, 1);
set_call(op, addr + 3 + sign_extend(disp, 16));
op->fail = addr + ins_len;
}
break;
/* ---- 0x6A: BCC short-relative -------------------------------- */
case 0x6a:
if (ins_len >= 3) {
/* 6A ss dst -- ss is 8-bit signed displacement. */
set_cjmp(op, addr, addr + 3 + sign_extend(buf[1], 8));
}
break;
/* ---- 0x6C: RPT ----------------------------------------------- */
case 0x6c:
op->type = RZ_ANALYSIS_OP_TYPE_REP;
break;
/* ---- 0x6D: RPTCC --------------------------------------------- */
case 0x6d:
op->type = RZ_ANALYSIS_OP_TYPE_REP;
op->fail = addr + ins_len;
break;
/* ---- 0x6E/0x6F: RPTBLOCAL / RPTB ----------------------------- */
case 0x6e:
case 0x6f:
op->type = RZ_ANALYSIS_OP_TYPE_REP;
break;
/* ---- 0x70/0x71: PSH/POP dual-register ------------------------ */
case 0x70:
set_push(op, 2);
set_dst_reg(op, "sp");
set_dir(op, RZ_ANALYSIS_OP_DIR_WRITE);
break;
case 0x71:
set_pop(op, -2);
set_dst_reg(op, "sp");
set_dir(op, RZ_ANALYSIS_OP_DIR_READ);
break;
/* ---- 0x72: ASUB addr-sub ------------------------------------- */
case 0x72:
op->type = RZ_ANALYSIS_OP_TYPE_SUB;
break;
/* ---- 0x74-0x76: ADD/AND/{ABS/NEG/MAX/MIN} -------------------- */
case 0x74:
/* ADD smem,ACx -- but bit 7 of buf[2] flips ADD <-> SUB
* for one of the addressing-mode subforms. */
if (ins_len >= 3 && (buf[2] & 0x80)) {
op->type = RZ_ANALYSIS_OP_TYPE_SUB;
} else {
op->type = RZ_ANALYSIS_OP_TYPE_ADD;
}
break;
case 0x75: op->type = RZ_ANALYSIS_OP_TYPE_AND; break;
case 0x76:
/* 0x76 family -- unary arithmetic on accumulators. The two
* MSB-of-byte bits select the subfamily:
*
* buf[1] & 0x80 == 0: ABS (buf[2]&0x80==0) or NEG (==1)
* buf[1] & 0x80 == 1: MAX (buf[2]&0x80==0) or MIN (==1)
*
* ABS has no clean rizin optype (the RZ_ANALYSIS_OP_TYPE_ABS
* code 44 is missing from the optypes table -- renders as
* 'undefined') so we leave it at NULL. */
if (ins_len >= 3) {
const ut8 b1_top = buf[1] & 0x80;
const ut8 b2_top = buf[2] & 0x80;
if (b1_top) {
op->type = RZ_ANALYSIS_OP_TYPE_CMP; /* MAX/MIN */
(void)b2_top;
} else if (b2_top) {
op->type = RZ_ANALYSIS_OP_TYPE_SUB; /* NEG */
} else {
/* ABS -- see comment above */
op->type = RZ_ANALYSIS_OP_TYPE_NULL;
}
}
break;
/* ---- 0x77: MOV ----------------------------------------------- */
case 0x77:
op->type = RZ_ANALYSIS_OP_TYPE_MOV;
break;
/* ---- 0x79: ROUND --------------------------------------------- */
case 0x79:
op->type = RZ_ANALYSIS_OP_TYPE_MOV;
break;
/* ---- 0x7B: Ra = Ra +/- k4 | Ra <</>> #1 | Ra = k4 -------------
* Per TI SWPU104 Table 7-2 (opcode 01111011):
* byte1 bit7 (0x80) set -> LD (Ra = k4) -> MOV
* byte1 bit7 (0x80) clear -> arithmetic/shift on Ra, where
* byte2 bit4 (0x10) set -> shift by 1 (SFTA) -> SHL
* byte2 bit4 (0x10) clr -> add/sub k4, with
* byte2 bit7 (0x80) set -> SUB else ADD
* The k4 immediate is the low nibble of byte2. */
case 0x7b:
if (ins_len >= 3) {
if (buf[1] & 0x80) {
/* LD Ra, #k4 -- load immediate */
op->type = RZ_ANALYSIS_OP_TYPE_MOV;
set_imm(op, buf[2] & 0x0f);
} else if (buf[2] & 0x10) {
/* SFTA Ra, #1 -- arithmetic shift by one */
op->type = (buf[2] & 0x80) ? RZ_ANALYSIS_OP_TYPE_SHR : RZ_ANALYSIS_OP_TYPE_SHL;
} else if (buf[2] & 0x80) {
/* SUB Ra, #k4 */
op->type = RZ_ANALYSIS_OP_TYPE_SUB;
set_imm(op, buf[2] & 0x0f);
} else {
/* ADD Ra, #k4 */
op->type = RZ_ANALYSIS_OP_TYPE_ADD;
set_imm(op, buf[2] & 0x0f);
}
} else {
op->type = RZ_ANALYSIS_OP_TYPE_MOV;
}
break;
/* ---- 0x80/0x81/0x82: ADD/SUB long-imm ------------------------ */
case 0x80: op->type = RZ_ANALYSIS_OP_TYPE_ADD; break;
case 0x81:
case 0x82: op->type = RZ_ANALYSIS_OP_TYPE_SUB; break;
/* ---- 0x84/0x85/0x86: AND/OR/XOR ------------------------------ */
case 0x84: op->type = RZ_ANALYSIS_OP_TYPE_AND; break;
case 0x85: op->type = RZ_ANALYSIS_OP_TYPE_OR; break;
case 0x86: op->type = RZ_ANALYSIS_OP_TYPE_XOR; break;
/* ---- 0x89: BCLR --------------------------------------------- */
case 0x89:
op->type = RZ_ANALYSIS_OP_TYPE_MOV;
break;
/* ---- 0x8D / 0x8E: ADD smem,ACx ------------------------------ */
case 0x8d:
case 0x8e:
op->type = RZ_ANALYSIS_OP_TYPE_ADD;
break;
/* ---- 0x90/0x91/0x92/0x93/0x94: various ----------------------- */
case 0x90: op->type = RZ_ANALYSIS_OP_TYPE_ADD; break;
case 0x91: op->type = RZ_ANALYSIS_OP_TYPE_AND; break; /* btstclr */
case 0x92:
case 0x93: op->type = RZ_ANALYSIS_OP_TYPE_MUL; break; /* sqrm */
case 0x94:
set_push(op, 2);
set_dst_reg(op, "sp");
set_dir(op, RZ_ANALYSIS_OP_DIR_WRITE);
break;
/* ---- 0x9A: BCC long-relative (16-bit) ------------------------ */
case 0x9a:
if (ins_len >= 4) {
const ut32 disp = rz_read_at_be16(buf, 1);
set_cjmp(op, addr, addr + ins_len + sign_extend(disp, 16));
}
break;
/* ---- 0x9B: CALLCC long-relative ------------------------------ */
case 0x9b:
if (ins_len >= 4) {
const ut32 disp = rz_read_at_be16(buf, 1);
set_ccall(op, addr, addr + ins_len + sign_extend(disp, 16));
}
break;
/* ---- 0x9C: B long-absolute (24-bit) -------------------------- */
case 0x9c:
if (ins_len >= 4) {
set_jmp(op, rz_read_at_be24(buf, 1));
op->eob = true;
}
break;
/* ---- 0x9D: CALL long-absolute -------------------------------- */
case 0x9d:
if (ins_len >= 4) {
set_call(op, rz_read_at_be24(buf, 1));
op->fail = addr + ins_len;
}
break;
/* ---- 0x9E / 0x9F: B / CALL with far() prefix ----------------- */
case 0x9e:
if (ins_len >= 4) {
set_jmp(op, rz_read_at_be24(buf, 1));
op->eob = true;
}
break;
case 0x9f:
if (ins_len >= 4) {
set_call(op, rz_read_at_be24(buf, 1));
op->fail = addr + ins_len;
}
break;
/* ---- 0xA1/0xA4/0xA6/0xA7/0xA8: arith & compare --------------- */
case 0xa1: op->type = RZ_ANALYSIS_OP_TYPE_ADD; break;
case 0xa4: op->type = RZ_ANALYSIS_OP_TYPE_CMP; break;
case 0xa6:
case 0xa7: op->type = RZ_ANALYSIS_OP_TYPE_SHL; break; /* SFTS/SFTL */
case 0xa8: op->type = RZ_ANALYSIS_OP_TYPE_ROL; break;
case 0xa9: op->type = RZ_ANALYSIS_OP_TYPE_MOV; break; /* EXP */
case 0xaa:
case 0xab: op->type = RZ_ANALYSIS_OP_TYPE_MUL; break;
case 0xae:
op->type = RZ_ANALYSIS_OP_TYPE_SUB;
break;
/* ---- 0xB0: BCC short-form (3-byte conditional jump) ---------- */
case 0xb0:
if (ins_len >= 4) {
const ut32 disp = rz_read_at_be16(buf, 2);
set_cjmp(op, addr, addr + ins_len + sign_extend(disp, 16));
}
break;
case 0xb1:
op->type = RZ_ANALYSIS_OP_TYPE_ADD;
break;
case 0xb2:
op->type = RZ_ANALYSIS_OP_TYPE_CMP;
break;
case 0xb3:
op->type = RZ_ANALYSIS_OP_TYPE_ADD;
break;
/* ---- 0xB8/0xB9/0xBA/0xBB: MAC/MPY families ------------------- */
case 0xb8:
case 0xb9:
case 0xba:
case 0xbb: op->type = RZ_ANALYSIS_OP_TYPE_MUL; break;
case 0xbc:
op->type = RZ_ANALYSIS_OP_TYPE_MOV;
break; /* BFXTR */
/* ---- 0xC1/0xC3/0xC5: AND/OR/XOR long-imm ---------------------
* For 0xC5 specifically, bit 7 of buf[1] selects XOR (=1);
* if not XOR, bit 7 of buf[2] picks OR (=1) over AND (=0). The
* 0xC1 and 0xC3 slots are AND / OR variants for different
* addressing forms (mem vs ACx) -- they have only one operation. */
case 0xc1: op->type = RZ_ANALYSIS_OP_TYPE_AND; break;
case 0xc3: op->type = RZ_ANALYSIS_OP_TYPE_OR; break;
case 0xc5:
if (ins_len >= 3 && (buf[1] & 0x80)) {
op->type = RZ_ANALYSIS_OP_TYPE_XOR;
} else if (ins_len >= 3 && (buf[2] & 0x80)) {
op->type = RZ_ANALYSIS_OP_TYPE_OR;
} else {
op->type = RZ_ANALYSIS_OP_TYPE_AND;
}
break;
case 0xc6: op->type = RZ_ANALYSIS_OP_TYPE_MOV; break; /* BFXTR / BFXPA - bit-field extract / pack */
case 0xc7: op->type = RZ_ANALYSIS_OP_TYPE_MUL; break; /* MPYK */
case 0xc8:
case 0xc9:
case 0xca:
case 0xcb: op->type = RZ_ANALYSIS_OP_TYPE_MUL; break;
case 0xce: op->type = RZ_ANALYSIS_OP_TYPE_MUL; break; /* SQDST */
case 0xd1:
op->type = RZ_ANALYSIS_OP_TYPE_MOV;
break; /* COPY */
/* ---- 0xD2: mar(XDAa op k24) -- modify extended address register.
* Per TI SWPU104 Table 7-2 (opcode 11010010), byte1 bits 6-5 select
* 00 -> mar(XDAa - k24) (ASUB)
* 01 -> mar(XDAa + k24) (AMOV/AADD with +)
* 10 -> mar(XDAa = k24) (AMOV load)
* All are address-register arithmetic/loads, classified LEA (the
* same family as 0x14 AADD and 0x77 AMOV). The earlier code typed
* this SUB, which mis-classified the load and add forms. */
case 0xd2: op->type = RZ_ANALYSIS_OP_TYPE_LEA; break;
case 0xd4:
op->type = RZ_ANALYSIS_OP_TYPE_CMP;
break; /* MAXDIFF */
/* ---- 0xD8: BCC far-absolute (5-byte) ------------------------- */
case 0xd8:
if (ins_len >= 5) {
set_cjmp(op, addr, rz_read_at_be24(buf, 1));
}
break;
/* ---- 0xD9: CALLCC far-absolute (5-byte) ---------------------- */
case 0xd9:
if (ins_len >= 5) {
set_ccall(op, addr, rz_read_at_be24(buf, 1));
}
break;
/* ---- 0xDA-0xDF: BCC/BCCU register-compare conditional ------- */
case 0xda:
case 0xdb:
case 0xdc:
case 0xdd:
case 0xde:
case 0xdf:
/* 5-byte form: DA/DB ARx cmp RRx ll hh dd (16-bit signed disp).
* The target is encoded as a relative 16-bit displacement
* at bytes 3..4 in BE byte order. */
if (ins_len >= 5) {
const ut32 disp = rz_read_at_be16(buf, 3);
set_cjmp(op, addr, addr + ins_len + sign_extend(disp, 16));
}
break;
/* ---- 0xE0/0xE1/0xE2/0xE3/0xE8/0xE9/0xEC/0xED: MAC/MPY parallel */
case 0xe0:
case 0xe1:
case 0xe2:
case 0xe3:
case 0xe8:
case 0xe9:
case 0xec:
case 0xed: op->type = RZ_ANALYSIS_OP_TYPE_MUL; break;
case 0xea:
case 0xeb: op->type = RZ_ANALYSIS_OP_TYPE_LEA; break; /* AMAR parallel */
case 0xee: op->type = RZ_ANALYSIS_OP_TYPE_MUL; break; /* MPYK */
default:
/* MOV-family bytes 0x48-0x4F (mov #imm, mem) - common in
* real firmware, classified as MOV here. */
if (buf[0] >= 0x48 && buf[0] <= 0x4f) {
op->type = RZ_ANALYSIS_OP_TYPE_MOV;
break;
}
/* Memory<->register MOV cluster, byte 0x50-0x5F. Per the
* SWPU104 encoding map: 0x50 (mem <- ARx high), 0x51-0x53
* (mem <- ACx parts), 0x54-0x57 (COPY), 0x58 (mem -> ACx),
* 0x59 (mem<<16 -> ACx), 0x5A/0x5B (mem -> ACx halves),
* 0x5C (40-bit dbl mov), 0x5D (ACx >> 1 -> dbl mem). All
* MOV-family for analysis purposes; the 0x5C / 0x5D dbl
* forms access 4 bytes, the rest 2. */
if (buf[0] >= 0x50 && buf[0] <= 0x5f) {
op->type = RZ_ANALYSIS_OP_TYPE_MOV;
set_mem_width(op, (buf[0] == 0x5c || buf[0] == 0x5d) ? 4 : 2);
break;
}
/* AMAR family - address-modifying instructions (LEA-like). */
if (buf[0] == 0x62 || buf[0] == 0x63) {
op->type = RZ_ANALYSIS_OP_TYPE_LEA;
break;
}
/* MOV-family bytes 0x88, 0x8A: ACx <-> mem variants. */
if (buf[0] == 0x88 || buf[0] == 0x8a) {
op->type = RZ_ANALYSIS_OP_TYPE_MOV;
break;
}
/* 0x8C: ADD with carry, mem -> ACx. */
if (buf[0] == 0x8c) {
op->type = RZ_ANALYSIS_OP_TYPE_ADD;
break;
}
/* 0x97: dual-mem MOV. */
if (buf[0] == 0x97) {
op->type = RZ_ANALYSIS_OP_TYPE_MOV;
break;
}
/* 0xA0, 0xAC, 0xAD: MOV with parallel dual addressing or
* MOV #imm,ACx (long form). */
if (buf[0] == 0xa0 || buf[0] == 0xac || buf[0] == 0xad) {
op->type = RZ_ANALYSIS_OP_TYPE_MOV;
break;
}
/* 0xB4, 0xB5: MOV with rounding / shift. */
if (buf[0] == 0xb4 || buf[0] == 0xb5) {
op->type = RZ_ANALYSIS_OP_TYPE_MOV;
break;
}
/* 0xB6, 0xB7: ADD with shift (T-register or immediate). */
if (buf[0] == 0xb6 || buf[0] == 0xb7) {
op->type = RZ_ANALYSIS_OP_TYPE_ADD;
break;
}
/* 0xC0, 0xC2, 0xC4: ADD #k16 with optional shift. */
if (buf[0] == 0xc0 || buf[0] == 0xc2 || buf[0] == 0xc4) {
op->type = RZ_ANALYSIS_OP_TYPE_ADD;
break;
}
/* 0xCC: dual-instruction packed encoding (ADD :: MOV). The
* primary operation that affects control flow / data flow
* is the ADD, so classify as ADD. */
if (buf[0] == 0xcc) {
op->type = RZ_ANALYSIS_OP_TYPE_ADD;
break;
}
/* 0xD0: MOV ACx, dbl(*(#abs24)) -- 4-byte (dbl) memory move. */
if (buf[0] == 0xd0) {
op->type = RZ_ANALYSIS_OP_TYPE_MOV;
set_mem_width(op, 4);
break;
}
/* 0x2E, 0x2F: XCCPART predicated execute. */
if (buf[0] == 0x2e || buf[0] == 0x2f) {
op->type = RZ_ANALYSIS_OP_TYPE_CMP;
op->family = RZ_ANALYSIS_OP_FAMILY_CPU;
break;
}
/* 0x0B (ecopr__), 0x23 (estop_byte): pseudo opcodes
* specific to this C55x+ silicon variant. Used as emulation /
* coprocessor traps; classify as TRAP. */
if (buf[0] == 0x0b || buf[0] == 0x23) {
op->type = RZ_ANALYSIS_OP_TYPE_TRAP;
op->family = RZ_ANALYSIS_OP_FAMILY_CPU;
break;
}
/* Anything we have not catalogued: leave op->type at its
* default (NULL). We intentionally do NOT mark unknown
* leading bytes as ILL: many bytes in the 0x10..0x1f and
* 0x30..0x3f ranges are valid parallel-instruction prefixes
* (0x39 = MACK, etc.) that decode to multi-instruction
* forms only when paired with the right following bytes.
* Flagging them as ILL would mislead the basic-block
* walker and the colorizer, which treats ILL as
* "definitely-invalid" and renders the opcode in bold
* red. Leaving as NULL lets the disassembler's own
* "invalid" rendering speak for itself per-instruction. */
break;
}
/* The byte-level switch above handles control flow (targets, fail
* paths), stack deltas and operand fields, but it cannot always tell
* apart instructions that share a leading byte but differ by operand
* bits (e.g. ADD vs SUB, AND vs OR vs XOR, AMOV vs ASUB, PSH vs POP).
* The decoder already resolved the exact mnemonic, so for the
* arithmetic / logical / move / multiply / stack families take the
* authoritative type from the instruction id. Control flow, repeats,
* XCC and the like map to NULL here and keep the type the byte switch
* assigned. Stack-effect bookkeeping (stackop/stackptr) set above is
* preserved. */
const int id_type = tms320c55x_insn_optype((TMS320C55InsID)op->id);
if (id_type != RZ_ANALYSIS_OP_TYPE_NULL) {
op->type = id_type;
}
if (mask & RZ_ANALYSIS_OP_MASK_IL) {
op->il_op = tms320_c55x_plus_il_lift(op, dasm.syntax);
return op->size;
}
op->type = RZ_ANALYSIS_OP_TYPE_ILL;
op->size = 1;
return op->size;
}

2
librz/arch/isa/tms320/c55x_plus/c55plus_analysis.h
View file

@ -11,7 +11,5 @@ int tms320_c55x_plus_op(RzAnalysis *analysis, RzAnalysisOp *op, ut64 addr,
const ut8 *buf, int len, RzAnalysisOpMask mask);
RZ_IPI RzAnalysisILConfig *tms320_c55x_plus_il_config(RZ_NONNULL RzAnalysis *analysis);
RZ_IPI RzAnalysisLiftedILOp tms320_c55x_plus_il_lift(RZ_NONNULL RzAnalysisOp *op, const char *syntax);
RZ_IPI RzAnalysisLiftedILOp tms320_c55x_il_lift(RZ_NONNULL RzAnalysisOp *op, const char *syntax);
#endif /* ANALYSIS_C55_PLUS_H */

3778
librz/arch/isa/tms320/c55x_plus/c55plus_arch.c Normal file
View file

File diff suppressed because it is too large Load diff

12
librz/arch/isa/tms320/c55x_plus/c55plus_arch.h Normal file
View file

@ -0,0 +1,12 @@
// SPDX-FileCopyrightText: 2026 RizinOrg <info@rizin.re>
// SPDX-License-Identifier: LGPL-3.0-only
#ifndef RZ_TMS320_C55PLUS_ARCH_H
#define RZ_TMS320_C55PLUS_ARCH_H
#include <tms320/c55_ir.h>
/// The TMS320C55x+ arch descriptor: drives the shared c55_ir engine/consumers.
extern const C55ArchDesc c55plus_arch_desc;
#endif /* RZ_TMS320_C55PLUS_ARCH_H */

870
librz/arch/isa/tms320/c55x_plus/c55plus_decode.c
View file

@ -1,870 +0,0 @@
// SPDX-FileCopyrightText: 2013-2021 th0rpe <josediazfer@yahoo.es>
// SPDX-License-Identifier: LGPL-3.0-only
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <rz_types.h>
#include <rz_util.h>
#include "ins.h"
#include "decode.h"
#include "hashtable.h"
#include "decode_funcs.h"
extern char *ins_str[];
extern ut32 ins_buff_len;
static ut32 get_q_bits(ut32 val, char *ins, ut32 ins_len, int *err_code) {
ut32 res = 0;
if (!rz_str_ncasecmp(ins, "q_MMAP", 6)) {
res = val & 1;
} else if (!rz_str_ncasecmp(ins, "q_LOCK", 6)) {
res = val & 1;
} else if (!rz_str_ncasecmp(ins, "q_LINR", 6)) {
res = (val >> 2) & 1;
} else if (!rz_str_ncasecmp(ins, "q_CIRC", 6)) {
res = (val >> 3) & 1;
} else if (!rz_str_ncasecmp(ins, "q_PORT_READ", 11)) {
res = (val >> 4) & 1;
} else if (!rz_str_ncasecmp(ins, "q_PORT_WRITE", 12)) {
res = (val >> 5) & 1;
} else if (!rz_str_ncasecmp(ins, "q_XPORT_READ", 12)) {
res = (val >> 6) & 1;
} else if (!rz_str_ncasecmp(ins, "q_XPORT_WRITE", 13)) {
res = (val >> 7) & 1;
} else if (!rz_str_ncasecmp(ins, "q_SAT", 5)) {
res = (val >> 8) & 1;
} else if (!rz_str_ncasecmp(ins, "q_XC0", 5)) {
res = (val >> 9) & 1;
} else if (!rz_str_ncasecmp(ins, "q_XC1", 5)) {
res = (val >> 10) & 1;
} else {
/* INVALID CONDITION */
fprintf(stderr, "Invalid token %s\n", ins);
*err_code = -1;
}
return res;
}
/*
a2 = 0x223;
0x800 = valor que se crea en sub_40BAE0<) con and 0xfffff800
*/
static ut32 get_ins_bits(ut32 hash_code, ut32 ins_pos, char *ins,
ut32 ins_len, ut32 magic_value, int *err_code) {
ut32 res = 0;
ut8 op_b;
ut32 len, x, i;
char *op_str, *aux;
if (ins[0] == 'q') {
return get_q_bits(magic_value, ins, ins_len, err_code);
}
op_str = ins_str[1 + hash_code * 4];
// printf("OPSTR => %s %d\n", ins, ins_len);
x = 0;
for (i = 0; i < ins_len; i++) {
aux = strchr(&op_str[x], ins[i]);
if (!aux) {
aux = strchr(op_str, ins[i]);
if (!aux) {
fprintf(stderr, "Invalid token %s\n", ins);
*err_code = -1;
return 0;
}
}
len = (unsigned int)(aux - op_str);
// printf("INS_POS: %d POS: %d\n", ins_pos, len / 8);
op_b = get_ins_part(ins_pos + len / 8, 1);
// printf("OPP: %x\n", op_b);
x = len + 1;
res = (res * 2) | ((op_b >> ((1023 - len) % 8)) & 1);
if (!op_str[x]) {
x = 0;
}
}
return res;
}
static bool check_arg(ut32 ins_bits, int *err_code) {
bool res = false;
if ((ins_bits <= 31) | (ins_bits >= 128 && ins_bits < 160)) {
res = true;
} else if (ins_bits >= 32 && ins_bits <= 252) {
res = false;
} else {
fprintf(stderr, "Invalid arg: %u\n", ins_bits);
*err_code = -1;
}
return res;
}
static char *decode_regis(char *reg_arg, st32 hash_code, ut32 ins_bits,
ut32 *ret_ins_bits, int *err_code) {
char reg_type;
char *res;
reg_type = *reg_arg;
res = NULL;
// printf("REG_TYPE %d %d\n", reg_type, ins_bits);
switch (reg_type) {
case 33:
res = get_reg_name_1((ins_bits >> 1) |
((ins_bits & 1) << 6));
break;
case 100:
if (rz_str_ncasecmp(reg_arg, "d(ALLx", 6)) {
fprintf(stderr, "invalid register! %s\n", reg_arg);
*err_code = -1;
return NULL;
}
res = (check_arg(ins_bits, err_code) != 0 && *err_code == 0) ? rz_str_dup("dbl(") : NULL;
if (*err_code < 0) {
return NULL;
}
break;
case 41:
if (rz_str_ncasecmp(reg_arg, ")ALLx", 5)) {
fprintf(stderr, "invalid register! %s\n", reg_arg);
*err_code = -1;
return NULL;
}
res = (check_arg(ins_bits, err_code) && *err_code == 0) ? rz_str_dup(")") : NULL;
if (*err_code < 0) {
return NULL;
}
break;
case 65:
if (!rz_str_ncasecmp(reg_arg, "ACLH", 4)) {
res = get_reg_name_1(ins_bits + 64);
} else if (!rz_str_ncasecmp(reg_arg, "ACxP", 4)) {
res = get_reg_name_1(ins_bits + 1);
} else if (!rz_str_ncasecmp(reg_arg, "ACx", 3) ||
!rz_str_ncasecmp(reg_arg, "ADR", 3) ||
!rz_str_ncasecmp(reg_arg, "ALL", 3) /* 430ADC */
) {
res = get_reg_name_1(ins_bits);
}
if (hash_code == 0xDF || hash_code == 0xE0) {
*ret_ins_bits = ins_bits;
}
break;
case 68:
res = get_reg_name_1(ins_bits + 32);
break;
case 77:
if (!rz_str_ncasecmp(reg_arg, "MA", 2) || !rz_str_ncasecmp(reg_arg, "MR", 2)) {
res = get_reg_name_1(ins_bits);
} else {
res = get_reg_name_2(ins_bits);
}
break;
case 83:
res = get_reg_name_1(ins_bits);
break;
case 82:
if (!rz_str_ncasecmp(reg_arg, "RA", 2) || !rz_str_ncasecmp(reg_arg, "RL", 2)) {
res = get_reg_name_1(ins_bits);
} else if (!rz_str_ncasecmp(reg_arg, "RLP", 3) || !rz_str_ncasecmp(reg_arg, "RxP", 3)) {
res = get_reg_name_1(ins_bits + 1);
} else if (!rz_str_ncasecmp(reg_arg, "RX", 2)) {
res = get_reg_name_1(ins_bits);
} else {
res = get_reg_name_2(ins_bits);
}
break;
case 84:
res = get_reg_name_1(ins_bits + 48);
break;
case 87:
if (!rz_str_ncasecmp(reg_arg, "WD", 2)) {
res = get_reg_name_2(ins_bits);
} else if (!rz_str_ncasecmp(reg_arg, "WA", 2)) {
res = get_reg_name_1(ins_bits);
} else {
res = NULL;
}
break;
case 88:
if (!rz_str_ncasecmp(reg_arg, "XR", 2)) {
res = get_reg_name_3(ins_bits);
} else if (!rz_str_ncasecmp(reg_arg, "XD", 2)) {
res = get_reg_name_2(ins_bits + 32);
} else {
res = NULL;
}
break;
default:
res = NULL;
break;
}
return res;
}
static char *decode_ins(st32 hash_code, ut32 ins_pos, ut32 ins_off, ut32 *ins_len_dec,
ut32 *reg_len_dec, ut32 *ret_ins_bits, ut32 magic_value, ut8 two_ins, int *err_code) {
ut32 ins_len;
char *ins, *pos;
char token_aux[80];
ut32 i, len;
char *reg = NULL;
char *res_decode = NULL;
char *aux = NULL;
// get instruction length
ins_len = get_ins_len(get_ins_part(ins_pos + ins_off, 1));
// get pseudo instruction
ins = ins_str[1 + 2 + hash_code * 4];
if (!ins /*|| ins_str[4 * hash_code] == 0*/) {
fprintf(stderr, "Invalid instruction hash %x\n", hash_code);
*err_code = -1;
return NULL;
}
*reg_len_dec = 0;
if (hash_code == 0x19C) {
ut32 tok_reg_len = 0;
res_decode = get_token_decoded(hash_code, "MMMMxxxxmm", 10, NULL, ret_ins_bits,
&tok_reg_len, magic_value, ins_pos + ins_off, ins_len, two_ins, err_code);
if (*err_code < 0) {
return NULL;
}
*reg_len_dec += tok_reg_len;
}
pos = ins;
// instruction length
*ins_len_dec = ins_len;
while (*pos) {
if (*pos == '`') {
pos++;
aux = strchr(pos, '`');
if (!aux || pos == aux) {
fprintf(stderr, "Invalid instruction %s\n", ins);
free(res_decode);
*err_code = -1;
return NULL;
}
len = (ut32)(size_t)(aux - pos);
if (len >= 80) {
fprintf(stderr, "Invalid length token %d\n", len);
free(res_decode);
*err_code = -1;
return NULL;
}
memcpy(token_aux, pos, len);
token_aux[len] = '\0';
pos = aux;
reg = NULL;
for (i = 0; i < len; i++) {
if (token_aux[i] == ',') {
len = (unsigned int)(size_t)(&token_aux[i] - token_aux);
reg = &token_aux[i + 1];
break;
}
}
ut32 tok_reg_len = 0;
aux = get_token_decoded(hash_code, token_aux, len, reg, ret_ins_bits,
&tok_reg_len, magic_value, ins_pos + ins_off, ins_len, two_ins, err_code);
if (*err_code < 0) {
return NULL;
}
/* get_token_decoded resets its ret_reg_len output to 0 on every
* call, so a later token would otherwise clobber the extra-byte
* count reported by an earlier offset operand (e.g. the
* MMMMxxxxmm Smem token in COPY/MOV, which is followed by more
* register tokens). Accumulate instead. */
*reg_len_dec += tok_reg_len;
res_decode = rz_str_append_owned(res_decode, aux);
} else {
token_aux[0] = *pos;
token_aux[1] = '\0';
res_decode = rz_str_append(res_decode, token_aux);
}
pos++;
}
return res_decode;
}
static bool is_hash(st32 hash_code) {
bool ret;
switch (hash_code) {
case 0xE8:
case 0xE9:
case 0xEA:
case 0xEC:
case 0x1A8:
case 0x1DC:
case 0x1E1:
case 0x1E2:
case 0x1E3:
case 0x1E4:
ret = 1;
break;
default:
ret = 0;
}
return ret;
}
void set_magic_value(ut32 *magic_value, st32 hash_code, int *err_code) {
switch (hash_code) {
case 232:
*magic_value |= 1;
break;
case 424:
*magic_value |= 2;
break;
case 236:
*magic_value |= 4;
break;
case 233:
*magic_value |= 0x10;
break;
case 234:
*magic_value |= 0x20;
break;
case 483:
*magic_value |= 0x40;
break;
case 484:
*magic_value |= 0x80;
break;
case 476:
*magic_value |= 0x100;
break;
case 481:
*magic_value |= 0x200;
break;
case 482:
*magic_value |= 0x400;
break;
default:
fprintf(stderr, "invalid hash code 0x%x for magic value 0x%x\n", hash_code, *magic_value);
*err_code = -1;
}
}
static char *do_decode(ut32 ins_off, ut32 ins_pos, ut32 two_ins, ut32 *next_ins_pos,
st32 *ins_hash_code, int *err_code) {
st32 hash_code, hash_aux;
ut32 reg_len_dec, ins_len_dec, ret_ins_bits;
char *ins_res = NULL, *ins_aux = NULL;
ut32 magic_value = 0x800;
*next_ins_pos = 0;
reg_len_dec = 0;
ret_ins_bits = 0;
ins_len_dec = 0;
hash_code = get_hash_code(ins_pos + ins_off);
if (is_hash(hash_code)) {
hash_aux = hash_code;
ins_off++;
set_magic_value(&magic_value, hash_code, err_code);
if (*err_code < 0) {
return NULL;
}
hash_code = get_hash_code(ins_pos + ins_off);
*next_ins_pos = 1;
} else {
hash_aux = 0x223;
}
if (ins_hash_code != NULL) {
*ins_hash_code = hash_code;
}
if (hash_aux == 0x1E1 || hash_aux == 0x1E2) {
ins_aux = decode_ins(hash_aux, ins_pos, ins_off, &ins_len_dec, &reg_len_dec,
&ret_ins_bits, magic_value, two_ins, err_code);
if (*err_code < 0) {
return NULL;
}
ins_aux = rz_str_append(ins_aux, " ");
}
if (hash_code == 0x223) {
char hex_buf[8];
ins_res = rz_str_append(ins_aux, ".byte 0x");
ins_res = rz_str_append(ins_res, rz_strf(hex_buf, "%02x", get_ins_part(ins_pos, 1) & 0xff));
*next_ins_pos = *next_ins_pos + 1;
} else {
free(ins_aux);
ins_aux = decode_ins(hash_code, ins_pos, ins_off, &ins_len_dec,
&reg_len_dec, &ret_ins_bits, magic_value, two_ins, err_code);
if (*err_code < 0) {
free(ins_aux);
return NULL;
}
ins_res = rz_str_append_owned(ins_aux, ins_res);
/* ins_len_dec is the base encoding length; reg_len_dec carries the
* extra bytes consumed by a k16/k24 offset operand (Smem modes
* *arN(#K16) / *arN(#K24) / *abs16 / *(#K24)). These must be added
* or the decoder under-reports the size and the following bytes are
* re-decoded as a spurious extra instruction. */
*next_ins_pos += ins_len_dec + reg_len_dec;
}
return ins_res;
}
char *c55plus_decode(ut32 ins_pos, ut32 *next_ins_pos) {
ut8 opcode, two_ins = 0;
ut32 next_ins1_pos, next_ins2_pos;
st32 hash_code;
char *ins1, *ins2, *aux, *ins_res;
int err_code;
if (ins_pos >= ins_buff_len) {
return NULL;
}
ins_res = NULL;
err_code = 0;
opcode = get_ins_part(ins_pos, 1);
if ((opcode & 0xF0) == 0x30) {
two_ins = opcode & 0x0F;
if (two_ins < 4) {
two_ins += 0xF;
}
} else {
two_ins = 0;
}
// two instruction execution?
if (two_ins) {
ins1 = do_decode(1, ins_pos, two_ins, &next_ins1_pos, &hash_code, &err_code);
if (err_code < 0) {
free(ins1);
return NULL;
}
ins2 = do_decode(next_ins1_pos + 1, ins_pos, two_ins, &next_ins2_pos, NULL, &err_code);
if (err_code < 0) {
free(ins1);
free(ins2);
return NULL;
}
*next_ins_pos = next_ins2_pos;
if (hash_code == 0xF0 || hash_code == 0xF1) {
aux = rz_str_append(ins2, " || ");
ins_res = rz_str_append_owned(aux, ins1);
} else {
aux = rz_str_append(ins1, " || ");
ins_res = rz_str_append_owned(aux, ins2);
}
*next_ins_pos = next_ins1_pos + next_ins2_pos + 1;
if (*next_ins_pos != two_ins) {
// ins_res = strcat_dup(ins_res, " P-tag problem", 1);
err_code = -1;
free(ins_res);
return NULL;
}
} else {
ins_res = do_decode(0, ins_pos, two_ins, &next_ins1_pos, &hash_code, &err_code);
if (err_code < 0) {
free(ins_res);
return NULL;
}
*next_ins_pos = next_ins1_pos;
}
return ins_res;
}
static bool is_linear_circular(ut32 ins_bits) {
ut8 op, op2, op3;
op = (ins_bits >> 6) | 16 * (ins_bits & 3);
op2 = (ins_bits >> 2) & 0xF;
op3 = op2 & 0xF;
return (op == 26 || op == 30 || (op3 > 7 && op3 != 15));
}
static char *get_token_decoded(st32 hash_code, char *ins_token, ut32 ins_token_len,
char *reg_arg, ut32 *ret_ins_bits, ut32 *ret_reg_len, ut32 magic_value,
ut32 ins_pos, ut32 ins_len, ut8 two_ins, int *err_code) {
ut32 tok_op, ins_bits;
char *res = NULL;
char *aux = NULL;
ut32 ret_len = 0, flag;
*ret_ins_bits = 0;
*ret_reg_len = 0;
ins_bits = get_ins_bits(hash_code, ins_pos, ins_token, ins_token_len, magic_value, err_code);
if (*err_code < 0) {
return NULL;
}
tok_op = *ins_token - 0x23;
switch (tok_op) {
case 30:
case 31:
case 32:
case 33:
case 43:
case 62:
case 63:
case 64:
case 65:
if (!reg_arg || *reg_arg == '\0') {
res = rz_str_dup("<register>");
goto ret_decode;
}
res = decode_regis(reg_arg, hash_code, ins_bits, ret_ins_bits, err_code);
if (*err_code < 0) {
return NULL;
}
break;
case 35: res = ins_bits ? rz_str_dup(" || far()") : NULL; break;
case 36: res = ins_bits ? rz_str_dup(" || local()") : NULL; break;
case 37: res = get_opers(ins_bits); break;
case 38:
res = ins_bits ? "lo" : "hi";
res = rz_str_dup(res);
break;
case 39: res = get_cmp_op(ins_bits); break;
case 40:
case 48:
res = rz_str_newf("#0x%x", (ins_bits << (32 - ins_token_len) >> (32 - ins_token_len)));
break;
case 70:
case 72:
case 80:
if (reg_arg) {
if (*reg_arg == '!') {
res = get_reg_pair(ins_bits);
break;
} else if (!rz_str_ncasecmp(reg_arg, "ST", 2)) {
res = get_status_regs_and_bits(reg_arg, ins_bits);
break;
}
}
if (hash_code == 0xDF || hash_code == 0xE0) {
*ret_ins_bits = ins_bits;
}
if (!reg_arg || *reg_arg != '-') {
res = rz_str_newf("#0x%lx", (long unsigned int)ins_bits);
} else {
res = rz_str_newf("-#0x%lx", (long unsigned int)ins_bits);
}
if (!reg_arg || *reg_arg != 'm') {
break;
}
res = rz_str_append(res, ")");
res = rz_str_prepend(res, "*(");
if (magic_value & 0xC0) {
res = rz_str_append(res, ")");
res = rz_str_prepend(res, "volatile(");
} else if (magic_value & 0x30) {
res = rz_str_append(res, ")");
res = rz_str_prepend(res, "port(");
}
break;
case 41:
case 73:
if (reg_arg && *reg_arg == 'L') {
ins_bits = ins_bits << (32 - ins_token_len) >> (32 - ins_token_len);
}
if (reg_arg && *reg_arg == 'i') {
res = rz_str_dup("");
} else {
res = rz_str_newf("#0x%06lx", (long unsigned int)ins_bits);
}
break;
case 42:
flag = 0;
if (reg_arg && *reg_arg == '3') {
flag = ins_bits & 1;
ins_bits = ins_bits >> 1;
reg_arg++;
}
if (magic_value & 1) {
aux = get_sim_reg(reg_arg, ins_bits);
} else if (reg_arg) {
switch (*reg_arg) {
case 'b':
case 'd':
reg_arg++;
break;
case '!':
// strncpy(buff_aux, reg_arg + 1, 8);
reg_arg += 10;
// ins_bits2 = get_ins_bits(hash_code, ins_pos, buff_aux, 8);
break;
}
aux = get_AR_regs_class2(ins_bits, &ret_len, ins_len + ins_pos, 1);
}
if (magic_value & 1) {
aux = rz_str_append(aux, ")");
aux = rz_str_prepend(aux, "mmap(");
} else if ((magic_value & 4) && is_linear_circular(ins_bits)) {
aux = rz_str_append(aux, ")");
aux = rz_str_prepend(aux, "linear(");
} else if ((magic_value & 8) && is_linear_circular(ins_bits)) {
aux = rz_str_append(aux, ")");
aux = rz_str_prepend(aux, "circular(");
} else if (magic_value & 2) {
aux = rz_str_append(aux, ")");
aux = rz_str_prepend(aux, "lock(");
} else if (reg_arg) {
if (((magic_value & 0x10) && strchr(reg_arg, 'r')) ||
((magic_value & 0x20) && strchr(reg_arg, 'w'))) {
aux = rz_str_append(aux, ")");
aux = rz_str_prepend(aux, "port(");
} else if (
((magic_value & 0x40) && strchr(reg_arg, 'r')) ||
((magic_value & 0x80000000) && strchr(reg_arg, 'w'))) {
aux = rz_str_append(aux, ")");
aux = rz_str_prepend(aux, "volatile(");
}
}
if (flag) {
res = rz_str_prepend(aux, "t3 = ");
} else {
res = aux;
*ret_reg_len = ret_len;
}
break;
case 79:
res = get_trans_reg(ins_bits);
if (!res) {
*err_code = -1;
}
break;
case 49:
if (reg_arg) {
if (*reg_arg == '1') {
res = get_tc2_tc1(ins_bits >> 1);
} else if (*reg_arg == '2') {
res = get_tc2_tc1(ins_bits & 1);
}
} else {
res = get_tc2_tc1(ins_bits);
}
if (!res) {
*err_code = -1;
return NULL;
}
break;
case 51:
/* V / VV template field -- Carry or TC2 (see decode_funcs.c
* get_tc2_or_carry comment). With a 'VV,1' suffix the high
* bit of the 2-bit field is consumed; with 'VV,2' the low bit.
* With no suffix the whole field is consumed. ROL/ROR use the
* paired (VV,1 ; VV,2) form. */
if (reg_arg) {
if (*reg_arg == '1') {
res = get_tc2_or_carry(ins_bits >> 1);
} else if (*reg_arg == '2') {
res = get_tc2_or_carry(ins_bits & 1);
}
} else {
res = get_tc2_or_carry(ins_bits);
}
if (!res) {
*err_code = -1;
return NULL;
}
break;
case 52:
if (ins_bits == 0) {
break;
}
if (reg_arg) {
if (*reg_arg == 'H') {
res = "hi(";
} else if (*reg_arg == 'L') {
res = "lo(";
} else if (*reg_arg == 'd') {
res = "dbl(";
} else if (*reg_arg == ')') {
res = ")";
} else {
res = "<W>";
}
} else {
res = "<W !flags>";
}
res = rz_str_dup(res);
break;
case 53:
case 54:
case 55:
flag = 0;
if (reg_arg && *reg_arg == '3') {
flag = ins_bits & 1;
ins_bits = ins_bits >> 1;
reg_arg++;
}
aux = get_AR_regs_class1(ins_bits);
tok_op = ins_bits & 0xF;
if (magic_value & 4) {
if (tok_op <= 7 || tok_op == 0xF) {
aux = rz_str_append(aux, ")");
aux = rz_str_prepend(aux, "linear(");
}
} else if (magic_value & 8) {
if (tok_op <= 7 || tok_op == 0xF) {
aux = rz_str_append(aux, ")");
aux = rz_str_prepend(aux, "circular(");
}
} else if (magic_value & 2) {
aux = rz_str_append(aux, ")");
aux = rz_str_prepend(aux, "lock(");
} else if (reg_arg) {
if (
((magic_value & 0x10) && *ins_token == 'X' && strchr(reg_arg, 'r')) ||
((magic_value & 0x20) && *ins_token == 'Y' && strchr(reg_arg, 'w'))) {
aux = rz_str_append(aux, ")");
aux = rz_str_prepend(aux, "port(");
} else if (
((magic_value & 0x40) && *ins_token == 'X' && strchr(reg_arg, 'r')) ||
((magic_value & 0x80000000) && *ins_token == 'Y' && strchr(reg_arg, 'w'))
) {
aux = rz_str_append(aux, ")");
aux = rz_str_prepend(aux, "volatile(");
}
}
res = flag ? rz_str_prepend(aux, "t3 = ") : aux;
break;
case 0:
case 1:
if (!ins_bits) {
break;
}
if (!reg_arg) {
res = "U";
} else {
if (*reg_arg == '(') {
res = "uns(";
} else if (*reg_arg == ')') {
res = ")";
} else {
res = "<$/#>";
}
}
res = rz_str_dup(res);
break;
case 2:
if (!ins_bits) {
break;
}
if (!reg_arg) {
res = "R";
} else {
if (*reg_arg == '(') {
res = "rnd(";
} else if (*reg_arg == ')') {
res = ")";
} else {
res = "<%>";
}
}
res = rz_str_dup(res);
break;
case 12:
if (!ins_bits) {
break;
}
if (!reg_arg) {
res = "F";
} else {
if (*reg_arg == '(') {
res = "frct(";
} else if (*reg_arg == ')') {
res = ")";
} else if (*reg_arg == 'a') {
res = "<%>";
} else {
res = "</>";
}
}
res = rz_str_dup(res);
break;
case 29:
if (!ins_bits) {
break;
}
if (!reg_arg) {
res = "saturate";
} else {
if (*reg_arg == '(') {
res = "saturate(";
} else if (*reg_arg == ')') {
res = ")";
} else {
res = "<saturate>";
}
}
res = rz_str_dup(res);
break;
case 16:
res = (ins_bits != 0) ? rz_str_dup("t3 = ") : NULL;
break;
case 17:
if (!ins_bits) {
break;
}
if (!reg_arg) {
res = "40";
} else {
if (*reg_arg == '(') {
res = "m40(";
} else if (*reg_arg == ')') {
res = ")";
} else {
res = "<4>";
}
}
res = rz_str_dup(res);
break;
case 78:
if (!rz_str_ncasecmp(ins_token, "q_SAT", 5)) {
res = ins_bits ? "s" : NULL;
} else if (!rz_str_ncasecmp(ins_token, "q_CIRC", 6)) {
res = ins_bits ? ".cr" : NULL;
} else if (!rz_str_ncasecmp(ins_token, "q_LINR", 6)) {
res = ins_bits ? ".lr" : NULL;
} else {
fprintf(stderr, "Invalid instruction %s\n!", ins_token);
*err_code = -1;
return NULL;
}
if (res != NULL) {
res = rz_str_dup(res);
}
break;
}
ret_decode:
return res;
}

2873
librz/arch/isa/tms320/c55x_plus/c55plus_il.c
View file

File diff suppressed because it is too large Load diff

54
librz/arch/isa/tms320/c55x_plus/c55plus_il_config.c Normal file
View file

@ -0,0 +1,54 @@
// SPDX-FileCopyrightText: 2026 RizinOrg <info@rizin.re>
// SPDX-License-Identifier: LGPL-3.0-only
#include <rz_analysis.h>
#include "c55plus_analysis.h"
// IL-VM register bindings for the TMS320C55x and C55x+ cores. The lifter emits
// SET/VAR ops that name these registers; the binding list tells the RzIL VM
// which variables to materialise. C55x+ extends the C55x file with the high
// accumulators (ac8-31) and the high address registers (ar8-15 / xar8-15).
static const char *c55x_il_regs[] = {
"ac0", "ac1", "ac2", "ac3", "ac4", "ac5", "ac6", "ac7",
"ar0", "ar1", "ar2", "ar3", "ar4", "ar5", "ar6", "ar7",
"xar0", "xar1", "xar2", "xar3", "xar4", "xar5", "xar6", "xar7",
"t0", "t1", "t2", "t3",
"sp", "ssp", "dp", "dph", "sph", "pdp", "pc",
"cdp", "cdph", "xcdp", "csr", "rptc",
"brc0", "brc1", "brs1", "trn0", "trn1",
"bk03", "bk47", "bkc",
"bsa01", "bsa23", "bsa45", "bsa67", "bsac",
"st0_55", "st1_55", "st2_55", "st3_55",
NULL
};
static const char *c55x_plus_il_regs[] = {
"ac0", "ac1", "ac2", "ac3", "ac4", "ac5", "ac6", "ac7",
"ac8", "ac9", "ac10", "ac11", "ac12", "ac13", "ac14", "ac15",
"ac16", "ac17", "ac18", "ac19", "ac20", "ac21", "ac22", "ac23",
"ac24", "ac25", "ac26", "ac27", "ac28", "ac29", "ac30", "ac31",
"ar0", "ar1", "ar2", "ar3", "ar4", "ar5", "ar6", "ar7",
"ar8", "ar9", "ar10", "ar11", "ar12", "ar13", "ar14", "ar15",
"xar0", "xar1", "xar2", "xar3", "xar4", "xar5", "xar6", "xar7",
"xar8", "xar9", "xar10", "xar11", "xar12", "xar13", "xar14", "xar15",
"t0", "t1", "t2", "t3",
"sp", "ssp", "dp", "dph", "sph", "pdp", "pc",
"cdp", "cdph", "xcdp", "csr", "rptc",
"brc0", "brc1", "brs1", "trn0", "trn1",
"bk03", "bk47", "bkc",
"bsa01", "bsa23", "bsa45", "bsa67", "bsac",
"st0_55", "st1_55", "st2_55", "st3_55",
NULL
};
RZ_IPI RzAnalysisILConfig *tms320_c55x_plus_il_config(RZ_NONNULL RzAnalysis *analysis) {
rz_return_val_if_fail(analysis, NULL);
RzAnalysisILConfig *cfg = rz_analysis_il_config_new(24, false, 24);
if (!cfg) {
return NULL;
}
const char *cpu = rz_analysis_get_cpu(analysis);
bool plus = cpu && rz_str_casecmp(cpu, "c55x+") == 0;
cfg->reg_bindings = plus ? c55x_plus_il_regs : c55x_il_regs;
return cfg;
}

29
librz/arch/isa/tms320/c55x_plus/decode.h
View file

@ -1,29 +0,0 @@
// SPDX-FileCopyrightText: 2013-2021 th0rpe <josediazfer@yahoo.es>
// SPDX-License-Identifier: LGPL-3.0-only
#ifndef DECODE_H
#define DECODE_H
#include <rz_types.h>
char *decode(ut32 ins_pos, ut32 *next_ins_pos);
#ifndef USE_DECODE
static bool is_linear_circular(ut32 ins_bits);
static bool is_hash(st32 hash_code);
static bool check_arg(ut32 ins_bits, int *err_code);
static ut32 get_ins_bits(ut32 hash_code, ut32 ins_pos, char *ins, ut32 ins_len, ut32 magic_value, int *err_code);
static ut32 get_q_bits(ut32 val, char *ins, ut32 ins_len, int *err_code);
static char *do_decode(ut32 ins_off, ut32 ins_pos, ut32 two_ins, ut32 *next_ins_pos, st32 *ins_hash_code, int *err_code);
static char *decode_ins(st32 hash_code, ut32 ins_pos, ut32 ins_off, ut32 *ins_len_dec, ut32 *reg_len_dec, ut32 *ret_ins_bits, ut32 magic_value, ut8 two_ins, int *err_code);
static char *decode_regis(char *reg_arg, st32 hash_code, ut32 ins_bits, ut32 *ret_ins_bits, int *err_code);
static char *get_token_decoded(st32 hash_code, char *ins_token, ut32 ins_token_len, char *reg_arg, ut32 *ret_ins_bits, ut32 *ret_reg_len, ut32 magic_value, ut32 ins_pos, ut32 ins_len, ut8 two_ins, int *err_code);
#endif
#endif

1025
librz/arch/isa/tms320/c55x_plus/decode_funcs.c
View file

File diff suppressed because it is too large Load diff

24
librz/arch/isa/tms320/c55x_plus/decode_funcs.h
View file

@ -1,24 +0,0 @@
// SPDX-FileCopyrightText: 2013-2021 th0rpe <josediazfer@yahoo.es>
// SPDX-License-Identifier: LGPL-3.0-only
#ifndef DECODE_FUNCS_H
#define DECODE_FUNCS_H
#include <rz_types.h>
char *get_tc2_tc1(ut32 ins_bits);
char *get_tc2_or_carry(ut32 ins_bits);
char *get_trans_reg(ut32 ins_bits);
char *get_AR_regs_class1(ut32 ins_bits);
char *get_AR_regs_class2(ut32 ins_bits, ut32 *ret_len, ut32 ins_pos, ut32 idx);
char *get_reg_pair(ut32 idx);
char *get_reg_name_3(ut32 idx);
char *get_reg_name_2(ut32 idx);
char *get_reg_name_1(ut32 idx);
char *get_status_regs_and_bits(char *reg_arg, ut32 reg_bit);
char *get_reg_name_4(ut32 idx);
char *get_opers(ut8 oper_byte);
char *get_cmp_op(ut32 idx);
char *get_sim_reg(char *reg_arg, ut32 ins_bits);
#endif

2838
librz/arch/isa/tms320/c55x_plus/hashtable.c
View file

File diff suppressed because it is too large Load diff

9
librz/arch/isa/tms320/c55x_plus/hashtable.h
View file

@ -1,9 +0,0 @@
// SPDX-FileCopyrightText: 2013-2021 th0rpe <josediazfer@yahoo.es>
// SPDX-License-Identifier: LGPL-3.0-only
#ifndef HASHTABLE_H
#define HASHTABLE_H
st32 get_hash_code(ut32 ins_pos);
#endif

96
librz/arch/isa/tms320/c55x_plus/hashvector.c
View file

@ -1,96 +0,0 @@
// SPDX-FileCopyrightText: 2013-2015 th0rpe <josediazfer@yahoo.es>
// SPDX-License-Identifier: LGPL-3.0-only
/* this .c is included , not compiled */
#include "hashvector.h"
extern st32 get_hashfunc_01(st32 A1, st32 A2);
extern st32 get_hashfunc_02(st32 A1, st32 A2);
extern st32 get_hashfunc_03(st32 A1, st32 A2);
extern st32 get_hashfunc_04(st32 A1, st32 A2);
extern st32 get_hashfunc_05(st32 A1, st32 A2);
extern st32 get_hashfunc_06(st32 A1, st32 A2);
extern st32 get_hashfunc_07(st32 A1, st32 A2);
extern st32 get_hashfunc_08(st32 A1, st32 A2);
extern st32 get_hashfunc_09(st32 A1, st32 A2);
extern st32 get_hashfunc_10(st32 A1, st32 A2);
extern st32 get_hashfunc_11(st32 A1, st32 A2);
extern st32 get_hashfunc_12(st32 A1, st32 A2);
extern st32 get_hashfunc_13(st32 A1, st32 A2);
extern st32 get_hashfunc_14(st32 A1, st32 A2);
extern st32 get_hashfunc_15(st32 A1, st32 A2);
extern st32 get_hashfunc_16(st32 A1, st32 A2);
extern st32 get_hashfunc_17(st32 A1, st32 A2);
extern st32 get_hashfunc_18(st32 A1, st32 A2);
extern st32 get_hashfunc_19(st32 A1, st32 A2);
extern st32 get_hashfunc_20(st32 A1, st32 A2);
extern st32 get_hashfunc_21(st32 A1, st32 A2);
extern st32 get_hashfunc_22(st32 A1, st32 A2);
extern st32 get_hashfunc_23(st32 A1, st32 A2);
extern st32 get_hashfunc_24(st32 A1, st32 A2);
extern st32 get_hashfunc_25(st32 A1, st32 A2);
extern st32 get_hashfunc_26(st32 A1, st32 A2);
extern st32 get_hashfunc_27(st32 A1, st32 A2);
extern st32 get_hashfunc_28(st32 A1, st32 A2);
extern st32 get_hashfunc_29(st32 A1, st32 A2);
extern st32 get_hashfunc_30(st32 A1, st32 A2);
extern st32 get_hashfunc_31(st32 A1, st32 A2);
extern st32 get_hashfunc_32(st32 A1, st32 A2);
extern st32 get_hashfunc_33(st32 A1, st32 A2);
extern st32 get_hashfunc_34(st32 A1, st32 A2);
extern st32 get_hashfunc_35(st32 A1, st32 A2);
extern st32 get_hashfunc_36(st32 A1, st32 A2);
extern st32 get_hashfunc_37(st32 A1, st32 A2);
extern st32 get_hashfunc_38(st32 A1, st32 A2);
extern st32 get_hashfunc_39(st32 A1, st32 A2);
extern st32 get_hashfunc_40(st32 A1, st32 A2);
extern st32 get_hashfunc_41(st32 A1, st32 A2);
extern st32 get_hashfunc_42(st32 A1, st32 A2);
extern st32 get_hashfunc_43(st32 A1, st32 A2);
extern st32 get_hashfunc_44(st32 A1, st32 A2);
extern st32 get_hashfunc_45(st32 A1, st32 A2);
extern st32 get_hashfunc_46(st32 A1, st32 A2);
extern st32 get_hashfunc_47(st32 A1, st32 A2);
extern st32 get_hashfunc_48(st32 A1, st32 A2);
extern st32 get_hashfunc_49(st32 A1, st32 A2);
extern st32 get_hashfunc_50(st32 A1, st32 A2);
extern st32 get_hashfunc_51(st32 A1, st32 A2);
extern st32 get_hashfunc_52(st32 A1, st32 A2);
extern st32 get_hashfunc_53(st32 A1, st32 A2);
extern st32 get_hashfunc_54(st32 A1, st32 A2);
extern st32 get_hashfunc_55(st32 A1, st32 A2);
extern st32 get_hashfunc_56(st32 A1, st32 A2);
extern st32 get_hashfunc_57(st32 A1, st32 A2);
extern st32 get_hashfunc_58(st32 A1, st32 A2);
extern st32 get_hashfunc_59(st32 A1, st32 A2);
extern st32 get_hashfunc_60(st32 A1, st32 A2);
extern st32 get_hashfunc_61(st32 A1, st32 A2);
extern st32 get_hashfunc_62(st32 A1, st32 A2);
extern st32 get_hashfunc_63(st32 A1, st32 A2);
extern st32 get_hashfunc_64(st32 A1, st32 A2);
extern st32 get_hashfunc_65(st32 A1, st32 A2);
extern st32 get_hashfunc_66(st32 A1, st32 A2);
extern st32 get_hashfunc_67(st32 A1, st32 A2);
extern st32 get_hashfunc_68(st32 A1, st32 A2);
extern st32 get_hashfunc_69(st32 A1, st32 A2);
extern st32 get_hashfunc_70(st32 A1, st32 A2);
extern st32 get_hashfunc_71(st32 A1, st32 A2);
extern st32 get_hashfunc_72(st32 A1, st32 A2);
extern st32 get_hashfunc_73(st32 A1, st32 A2);
extern st32 get_hashfunc_74(st32 A1, st32 A2);
extern st32 get_hashfunc_75(st32 A1, st32 A2);
extern st32 get_hashfunc_76(st32 A1, st32 A2);
extern st32 get_hashfunc_77(st32 A1, st32 A2);
extern st32 get_hashfunc_78(st32 A1, st32 A2);
extern st32 get_hashfunc_79(st32 A1, st32 A2);
extern st32 get_hashfunc_80(st32 A1, st32 A2);
extern st32 get_hashfunc_81(st32 A1, st32 A2);
extern st32 get_hashfunc_82(st32 A1, st32 A2);
extern st32 get_hashfunc_83(st32 A1, st32 A2);
extern st32 get_hashfunc_84(st32 A1, st32 A2);
extern st32 get_hashfunc_85(st32 A1, st32 A2);
extern st32 get_hashfunc_86(st32 A1, st32 A2);
extern st32 get_hashfunc_87(st32 A1, st32 A2);
extern st32 get_hashfunc_88(st32 A1, st32 A2);
extern st32 get_hashfunc_89(st32 A1, st32 A2);
extern st32 get_hashfunc_90(st32 A1, st32 A2);
extern st32 get_hashfunc_91(st32 A1, st32 A2);

14
librz/arch/isa/tms320/c55x_plus/hashvector.h
View file

@ -1,14 +0,0 @@
// SPDX-FileCopyrightText: 2013-2021 th0rpe <josediazfer@yahoo.es>
// SPDX-License-Identifier: LGPL-3.0-only
#ifndef HASHVECTOR_H
#define HASHVECTOR_H
#include <rz_types.h>
typedef struct {
st32 code;
st32 (*hash_func)(st32 A1, st32 A2);
} HASHCODE_ENTRY_T;
#endif

46
librz/arch/isa/tms320/c55x_plus/utils.c
View file

@ -1,46 +0,0 @@
// SPDX-FileCopyrightText: 2013 th0rpe <josediazfer@yahoo.es>
// SPDX-License-Identifier: LGPL-3.0-only
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include "utils.h"
static char hex_str[] = "01234567890abcdef";
// TODO: Add in a Coverity modelling file
char *strcat_dup(char *s1, char *s2, st32 n_free) {
char *res;
ut32 len_s1 = s1 ? strlen(s1) : 0;
ut32 len_s2 = s2 ? strlen(s2) : 0;
if (!(res = (char *)malloc(len_s1 + len_s2 + 1))) {
return NULL;
}
if (len_s1 > 0) {
memcpy(res, s1, len_s1);
}
if (len_s2 > 0) {
memcpy(res + len_s1, s2, len_s2);
}
res[len_s1 + len_s2] = '\0';
if (n_free == 1) {
RZ_FREE(s1);
} else if (n_free == 2) {
RZ_FREE(s2);
} else if (n_free == 3) {
RZ_FREE(s1);
RZ_FREE(s2);
}
return res;
}
char *get_hex_str(ut32 hex_num) {
char aux[3];
aux[2] = '\0';
aux[1] = hex_str[hex_num & 0xF];
aux[0] = hex_str[(hex_num >> 4) & 0xF];
return rz_str_dup(aux);
}

14
librz/arch/isa/tms320/c55x_plus/utils.h
View file

@ -1,14 +0,0 @@
// SPDX-FileCopyrightText: 2013-2021 th0rpe <josediazfer@yahoo.es>
// SPDX-License-Identifier: LGPL-3.0-only
#ifndef UUTILS_H
#define UUTILS_H
#include <rz_types.h>
#include <rz_util.h>
#define C55PLUS_DEBUG 0
char *strcat_dup(char *s1, char *s2, st32 n_free);
char *get_hex_str(ut32 hex_num);
#endif

1284
librz/arch/isa/tms320/tms320_dasm.c
View file

File diff suppressed because it is too large Load diff

269
librz/arch/isa/tms320/tms320_dasm.h
View file

@ -1,269 +0,0 @@
// SPDX-FileCopyrightText: 2014 Ilya V. Matveychikov <i.matveychikov@milabs.ru>
// SPDX-License-Identifier: LGPL-3.0-only
#ifndef __TMS320_DASM_H__
#define __TMS320_DASM_H__
#define IDA_COMPATIBLE_MODE 1
/* forward declarations */
struct tms320_instruction;
typedef struct tms320_instruction insn_item_t;
struct tms320_instruction_mask;
typedef struct tms320_instruction_mask insn_mask_t;
struct tms320_instruction_flag;
typedef struct tms320_instruction_flag insn_flag_t;
struct tms320_instruction_head;
typedef struct tms320_instruction_head insn_head_t;
typedef enum {
TMS320_FLAG_E = 0x10,
TMS320_FLAG_R,
TMS320_FLAG_U,
TMS320_FLAG_u,
TMS320_FLAG_g,
TMS320_FLAG_r,
TMS320_FLAG_t,
TMS320_FLAG_uu,
TMS320_FLAG_mm,
TMS320_FLAG_cc,
TMS320_FLAG_tt,
TMS320_FLAG_vv,
TMS320_FLAG_ss,
TMS320_FLAG_dd,
TMS320_FLAG_SS,
TMS320_FLAG_DD,
TMS320_FLAG_k3,
TMS320_FLAG_k4,
TMS320_FLAG_k5,
TMS320_FLAG_k6,
TMS320_FLAG_k8,
TMS320_FLAG_k12,
TMS320_FLAG_k16,
TMS320_FLAG_K8,
TMS320_FLAG_K16,
TMS320_FLAG_l1,
TMS320_FLAG_l3,
TMS320_FLAG_l7,
TMS320_FLAG_l16,
TMS320_FLAG_L7,
TMS320_FLAG_L8,
TMS320_FLAG_L16,
TMS320_FLAG_P8,
TMS320_FLAG_P24,
TMS320_FLAG_D16,
TMS320_FLAG_SHFT,
TMS320_FLAG_SHIFTW,
TMS320_FLAG_CCCCCCC,
TMS320_FLAG_AAAAAAAI,
TMS320_FLAG_FSSS,
TMS320_FLAG_FDDD,
TMS320_FLAG_XSSS,
TMS320_FLAG_XDDD,
TMS320_FLAG_XACS,
TMS320_FLAG_XACD,
TMS320_FLAG_XXX,
TMS320_FLAG_MMM,
TMS320_FLAG_Y,
TMS320_FLAG_YY,
} insn_flag_e;
struct tms320_instruction {
#define i_list_last(x) !(((x)->i_list || (x)->m_list || (x)->f_list || (x)->syntax))
insn_item_t *i_list;
insn_mask_t *m_list;
insn_flag_t *f_list;
char *syntax;
};
struct tms320_instruction_mask {
#define m_list_last(x) !(((x)->f || (x)->n || (x)->v))
ut8 f, n, v; /* from, number, value */
};
struct tms320_instruction_flag {
#define f_list_last(x) !(((x)->f || (x)->v))
ut8 f, v; /* from, value */
};
struct tms320_instruction_head {
ut8 byte;
ut8 size;
ut16 id; ///< TMS320C55InsID for this leading-byte entry (0 = unset/invalid)
insn_item_t insn;
};
/*
* TMS320 dasm instance
*/
typedef struct {
insn_head_t *head;
insn_item_t *insn;
union {
ut8 opcode;
ut8 stream[8];
};
ut64 opcode64; ///< same as rz_read_le64(stream)
#define TMS320_S_INVAL 0x01
ut8 status;
ut8 length;
ut16 insn_id; ///< TMS320C55InsID of the decoded instruction (0 if unknown)
char syntax[1024];
#define def_field(name, size) \
unsigned int bf_##name##_valid : 1; \
unsigned int bf_##name##_value : size
struct {
def_field(E, 1);
def_field(R, 1);
def_field(U, 1);
def_field(u, 1);
def_field(g, 1);
def_field(r, 1);
def_field(t, 1);
def_field(k3, 3);
def_field(k4, 4);
def_field(k5, 5);
def_field(k6, 6);
def_field(k8, 8);
def_field(k12, 12);
def_field(k16, 16);
def_field(l1, 1);
def_field(l3, 3);
def_field(l7, 7);
def_field(l16, 16);
def_field(K8, 8);
def_field(K16, 16);
def_field(L7, 7);
def_field(L8, 8);
def_field(L16, 16);
def_field(P8, 8);
def_field(P24, 24);
def_field(D16, 16);
def_field(SHFT, 4);
def_field(SHIFTW, 6);
def_field(ss, 2);
def_field(dd, 2);
def_field(uu, 2);
def_field(cc, 2);
def_field(mm, 2);
def_field(vv, 2);
def_field(tt, 2);
def_field(FSSS, 4);
def_field(FDDD, 4);
def_field(XSSS, 4);
def_field(XDDD, 4);
def_field(XACS, 4);
def_field(XACD, 4);
def_field(CCCCCCC, 7);
def_field(AAAAAAAI, 8);
def_field(SS, 2);
def_field(SS2, 2);
def_field(DD, 2);
def_field(DD2, 2);
// aggregates
def_field(Xmem_mmm, 3);
def_field(Xmem_reg, 3);
def_field(Ymem_mmm, 3);
def_field(Ymem_reg, 3);
// qualifiers
def_field(q_lr, 1);
def_field(q_cr, 1);
} f;
HtUP *map;
#define TMS320_F_CPU_C54X 0x0000001
#define TMS320_F_CPU_C55X 0x0000002
#define TMS320_F_CPU_C55X_PLUS 0x0000003
#define TMS320_F_CPU_MASK 0x00000FF
ut32 features;
#define tms320_f_get_cpu(d) ((d)->features & TMS320_F_CPU_MASK)
#define tms320_f_set_cpu(d, v) ((d)->features = ((d)->features & ~TMS320_F_CPU_MASK) | (v))
} tms320_dasm_t;
#define field_valid(d, name) \
(d)->f.bf_##name##_valid
#define field_value(d, name) \
(d)->f.bf_##name##_value
#ifdef _MSC_VER
#define set_field_value(d, name, value) \
{ \
field_valid(d, name) = 1; \
field_value(d, name) = value; \
}
#else
#define set_field_value(d, name, value) \
({ \
field_valid(d, name) = 1; \
field_value(d, name) = value; \
})
#endif
#define LIST_END \
{ 0 }
#define INSN_MASK(af, an, av) \
{ .f = af, .n = an, .v = av }
#define INSN_FLAG(af, av) \
{ .f = af, .v = TMS320_FLAG_##av }
#define INSN_SYNTAX(...) (char *)#__VA_ARGS__
extern int tms320_dasm(tms320_dasm_t *, const ut8 *, int);
/** Disassemble a byte sequence as plain C55x and return the decoded syntax
* string (owned by a cached static dasm instance; valid until the next call).
* Used by the analysis layer to feed the (syntax-based) RzIL lifter. */
extern const char *tms320c55x_insn_syntax_decode(const ut8 *, int);
/** Resolve the C55x instruction ID for a byte sequence by disassembling
* it and mapping the decoded mnemonic to a TMS320C55InsID. Honours the
* per-instruction operand masks (so multi-form leading bytes resolve to
* the mnemonic actually decoded). Returns 0 when the bytes don't decode
* to a known instruction. */
extern ut16 tms320c55x_insn_id_decode(const ut8 *buf, int len);
/** C55x+ counterpart of tms320c55x_insn_id_decode(). Resolves the
* TMS320C55InsID by running the C55x+ token decoder over the bytes. */
extern ut16 tms320c55x_plus_insn_id_decode(const ut8 *buf, int len);
extern int tms320_dasm_init(tms320_dasm_t *);
extern int tms320_dasm_fini(tms320_dasm_t *);
#endif /* __TMS320_DASM_H__ */

8
librz/arch/isa/tms320/tms320c55x_insn.c
View file

@ -14,6 +14,8 @@ static const char *const tms320c55x_insn_names[] = {
[TMS320C55_INS_ABDST] = "abdst",
[TMS320C55_INS_ABS] = "abs",
[TMS320C55_INS_ADD] = "add",
[TMS320C55_INS_ADDV] = "addv",
[TMS320C55_INS_ADDRV] = "addrv",
[TMS320C55_INS_ADDSUB] = "addsub",
[TMS320C55_INS_ADDSUB2CC] = "addsub2cc",
[TMS320C55_INS_ADDSUBCC] = "addsubcc",
@ -41,6 +43,9 @@ static const char *const tms320c55x_insn_names[] = {
[TMS320C55_INS_CMP] = "cmp",
[TMS320C55_INS_CMPAND] = "cmpand",
[TMS320C55_INS_CMPOR] = "cmpor",
[TMS320C55_INS_COPY] = "copy",
[TMS320C55_INS_SWAPP] = "swapp",
[TMS320C55_INS_SWAP4] = "swap4",
[TMS320C55_INS_DELAY] = "delay",
[TMS320C55_INS_DMAXDIFF] = "dmaxdiff",
[TMS320C55_INS_DMINDIFF] = "dmindiff",
@ -69,6 +74,9 @@ static const char *const tms320c55x_insn_names[] = {
[TMS320C55_INS_MPYMK] = "mpymk",
[TMS320C55_INS_NEG] = "neg",
[TMS320C55_INS_NOP] = "nop",
[TMS320C55_INS_NOP_16] = "nop_16",
[TMS320C55_INS_ESTOP] = "estop",
[TMS320C55_INS_ECOPR] = "ecopr",
[TMS320C55_INS_NOT] = "not",
[TMS320C55_INS_OR] = "or",
[TMS320C55_INS_POP] = "pop",

10
librz/arch/isa/tms320/tms320c55x_insn.h
View file

@ -32,6 +32,8 @@ typedef enum {
TMS320C55_INS_ABDST,
TMS320C55_INS_ABS,
TMS320C55_INS_ADD,
TMS320C55_INS_ADDV,
TMS320C55_INS_ADDRV,
TMS320C55_INS_ADDSUB,
TMS320C55_INS_ADDSUB2CC,
TMS320C55_INS_ADDSUBCC,
@ -127,6 +129,14 @@ typedef enum {
TMS320C55_INS_XCC,
TMS320C55_INS_XCCPART,
TMS320C55_INS_XOR,
// Appended at the end to keep the numeric ids of the entries above stable
// (op->id values are asserted by the analysis tests).
TMS320C55_INS_COPY,
TMS320C55_INS_SWAPP,
TMS320C55_INS_SWAP4,
TMS320C55_INS_NOP_16,
TMS320C55_INS_ESTOP,
TMS320C55_INS_ECOPR,
} TMS320C55InsID;
/** Human-readable mnemonic for a TMS320C55InsID (never NULL). */

10
librz/arch/meson.build
View file

@ -318,17 +318,13 @@ arch_isa_sources = [
'isa/sparc/sparc_il.c',
'isa/sparc/sparc_il_ops.c',
'isa/spc700/spc700dis.c',
'isa/tms320/c55_ir.c',
'isa/tms320/c55x_plus/c55plus_arch.c',
'isa/tms320/c55x/c55x_analysis.c',
'isa/tms320/c55x_plus/c55plus.c',
'isa/tms320/c55x_plus/c55plus_analysis.c',
'isa/tms320/c55x_plus/c55plus_il.c',
'isa/tms320/c55x_plus/c55plus_decode.c',
'isa/tms320/c55x_plus/decode_funcs.c',
'isa/tms320/c55x_plus/hashtable.c',
'isa/tms320/c55x_plus/hashvector.c',
'isa/tms320/c55x_plus/c55plus_il_config.c',
'isa/tms320/c55x_plus/ins.c',
'isa/tms320/c64x/c64x.c',
'isa/tms320/tms320_dasm.c',
'isa/tms320/tms320c55x_insn.c',
'isa/v810/v810_disas.c',
'isa/v810/v810_il.c',

51
librz/arch/p/analysis/analysis_tms320.c
View file

@ -5,7 +5,6 @@
#include <rz_analysis.h>
#include <rz_search.h>
#include <tms320/tms320_dasm.h>
#include <tms320/c55x/c55x_analysis.h>
#include <tms320/c55x_plus/c55plus_analysis.h>
@ -290,6 +289,56 @@ static char *get_reg_profile(RZ_BORROW RzAnalysis *a) {
;
}
// C55x+ (Ryujin) has 32 accumulators and 16 (extended) auxiliary registers,
// vs the 8/8 of the base C55x profile above. Append the extra ac8-31,
// ar8-15 and xar8-15 so the shared lifter's IL variables for them resolve
// (the byte offsets continue past ac7 at 684; C55x never references these).
const char *cpu = rz_analysis_get_cpu(a);
if (cpu && rz_str_casecmp(cpu, "c55x+") == 0) {
static const char *ext =
"ctr ac8 .40 684 0 # Accumulator 8\n"
"ctr ac9 .40 689 0 # Accumulator 9\n"
"ctr ac10 .40 694 0 # Accumulator 10\n"
"ctr ac11 .40 699 0 # Accumulator 11\n"
"ctr ac12 .40 704 0 # Accumulator 12\n"
"ctr ac13 .40 709 0 # Accumulator 13\n"
"ctr ac14 .40 714 0 # Accumulator 14\n"
"ctr ac15 .40 719 0 # Accumulator 15\n"
"ctr ac16 .40 724 0 # Accumulator 16\n"
"ctr ac17 .40 729 0 # Accumulator 17\n"
"ctr ac18 .40 734 0 # Accumulator 18\n"
"ctr ac19 .40 739 0 # Accumulator 19\n"
"ctr ac20 .40 744 0 # Accumulator 20\n"
"ctr ac21 .40 749 0 # Accumulator 21\n"
"ctr ac22 .40 754 0 # Accumulator 22\n"
"ctr ac23 .40 759 0 # Accumulator 23\n"
"ctr ac24 .40 764 0 # Accumulator 24\n"
"ctr ac25 .40 769 0 # Accumulator 25\n"
"ctr ac26 .40 774 0 # Accumulator 26\n"
"ctr ac27 .40 779 0 # Accumulator 27\n"
"ctr ac28 .40 784 0 # Accumulator 28\n"
"ctr ac29 .40 789 0 # Accumulator 29\n"
"ctr ac30 .40 794 0 # Accumulator 30\n"
"ctr ac31 .40 799 0 # Accumulator 31\n"
"gpr ar8 .16 804 0 # Auxiliary register 8\n"
"gpr ar9 .16 806 0 # Auxiliary register 9\n"
"gpr ar10 .16 808 0 # Auxiliary register 10\n"
"gpr ar11 .16 810 0 # Auxiliary register 11\n"
"gpr ar12 .16 812 0 # Auxiliary register 12\n"
"gpr ar13 .16 814 0 # Auxiliary register 13\n"
"gpr ar14 .16 816 0 # Auxiliary register 14\n"
"gpr ar15 .16 818 0 # Auxiliary register 15\n"
"gpr xar8 .23 820 0 # Extended auxiliary register 8\n"
"gpr xar9 .23 823 0 # Extended auxiliary register 9\n"
"gpr xar10 .23 826 0 # Extended auxiliary register 10\n"
"gpr xar11 .23 829 0 # Extended auxiliary register 11\n"
"gpr xar12 .23 832 0 # Extended auxiliary register 12\n"
"gpr xar13 .23 835 0 # Extended auxiliary register 13\n"
"gpr xar14 .23 838 0 # Extended auxiliary register 14\n"
"gpr xar15 .23 841 0 # Extended auxiliary register 15\n";
return rz_str_newf("%s%s", p, ext);
}
return rz_str_dup(p);
}

41
librz/arch/p/asm/asm_tms320.c
View file

@ -5,31 +5,43 @@
#include <rz_lib.h>
#include <rz_asm.h>
#include "asm_private.h"
#include <tms320/tms320_dasm.h>
#include <tms320/c55x_plus/c55plus_arch.h>
#include <tms320/c55x/c55x_analysis.h>
#include <tms320/c64x/c64x.h>
typedef struct tms_cs_context_t {
void *c64x;
tms320_dasm_t engine;
} TmsContext;
static int tms320_disassemble(const RzAsm *a, RzAsmOp *op, const ut8 *buf, int len) {
TmsContext *ctx = (TmsContext *)a->plugin_data;
if (a->cpu && rz_str_casecmp(a->cpu, "c54x") == 0) {
tms320_f_set_cpu(&ctx->engine, TMS320_F_CPU_C54X);
} else if (a->cpu && rz_str_casecmp(a->cpu, "c55x+") == 0) {
tms320_f_set_cpu(&ctx->engine, TMS320_F_CPU_C55X_PLUS);
} else if (a->cpu && rz_str_casecmp(a->cpu, "c55x") == 0) {
tms320_f_set_cpu(&ctx->engine, TMS320_F_CPU_C55X);
} else if (a->cpu && !rz_str_casecmp(a->cpu, "c64x")) {
if (a->cpu && !rz_str_casecmp(a->cpu, "c64x")) {
return tms320_c64x_disassemble(a, op, buf, len, ctx->c64x);
} else {
}
// C55x / C55x+ are decoded by the shared decode-IR engine. C54x has no
// instruction decoder yet, so it reports invalid; any other cpu is unknown.
const C55ArchDesc *desc = NULL;
if (a->cpu && !rz_str_casecmp(a->cpu, "c55x+")) {
desc = &c55plus_arch_desc;
} else if (a->cpu && !rz_str_casecmp(a->cpu, "c55x")) {
desc = &c55x_arch_desc;
} else if (!a->cpu || rz_str_casecmp(a->cpu, "c54x")) {
rz_asm_op_set_asm(op, "unknown asm.cpu");
return op->size = -1;
}
op->size = tms320_dasm(&ctx->engine, buf, len);
rz_asm_op_set_asm(op, ctx->engine.syntax);
return op->size;
if (desc) {
C55Insn insn;
if (c55_decode(desc, buf, len, &insn)) {
char *s = c55_format(desc, &insn);
if (s) {
rz_asm_op_set_asm(op, s);
free(s);
return op->size = insn.size;
}
}
}
rz_asm_op_set_asm(op, "invalid");
return op->size = 1;
}
static bool tms320_init(void **user) {
@ -37,9 +49,7 @@ static bool tms320_init(void **user) {
if (!ctx) {
return false;
}
ctx->c64x = tms320_c64x_new();
tms320_dasm_init(&ctx->engine);
*user = ctx;
return true;
}
@ -48,7 +58,6 @@ static bool tms320_fini(void *user) {
rz_return_val_if_fail(user, false);
TmsContext *ctx = (TmsContext *)user;
tms320_c64x_free(ctx->c64x);
tms320_dasm_fini(&ctx->engine);
free(ctx);
return true;
}

34
test/db/analysis/tms320.c55x+_32
View file

@ -242,7 +242,7 @@ type: mul
type: mul
type: push
type: pop
type: upush
type: push
type: lea
type: lea
type: null
@ -255,11 +255,11 @@ type: swi
type: trap
type: mov
type: mov
type: null
type: ill
type: cjmp
jump: 0x00000008
fail: 0x00000003
type: xchg
type: ill
type: trap
family: cpu
type: trap
@ -271,13 +271,13 @@ type: add
type: add
type: add
type: mov
type: cmp
type: ill
type: trap
family: cpu
type: trap
family: cpu
type: mov
type: xchg
type: ill
type: ill
type: trap
family: cpu
type: trap
@ -289,12 +289,12 @@ type: add
type: add
type: add
type: mov
type: cmp
type: ill
type: trap
family: cpu
type: trap
family: cpu
type: mov
type: ill
EOF
RUN
@ -471,7 +471,7 @@ family: cpu
type: cret
reg: sp
stackptr: -2
type: upush
type: push
reg: sp
direction: write
stackptr: 2
@ -517,8 +517,8 @@ CMDS=<<EOF
e asm.arch=tms320
e analysis.cpu=c55x+
# op->id carries the named TMS320C55InsID resolved by the C55x+ token
# decoder (positions in tms320_insn.h): AADD=1, INTR=39, NOP=59, POP=62,
# PSH=64, RET=67, RETI=69, TRAP=96.
# decoder (positions in tms320_insn.h): AADD=3, INTR=41, NOP=61, POP=64,
# PSH=66, RET=69, RETI=71, TRAP=98.
wx 21 @ 0
ao 1 @ 0~id
wx 0e00 @ 0
@ -537,13 +537,13 @@ wx 0c10 @ 0
ao 1 @ 0~id
EOF
EXPECT=<<EOF
id: 67
id: 64
id: 62
id: 39
id: 96
id: 69
id: 59
id: 66
id: 64
id: 41
id: 98
id: 71
id: 61
id: 1
EOF
RUN

117
test/db/analysis/tms320.c55x_32
View file

@ -333,7 +333,7 @@ type: jmp
type: call
type: ujmp
type: ucall
type: ucall
type: ill
type: mov
type: mov
type: mov
@ -446,7 +446,7 @@ EOF
EXPECT=<<EOF
arch tms320
cpu c55x
15
16
int main(int argc);
arg int argc @ ar4
7
@ -474,7 +474,7 @@ afi @ dbg.main~^args
EOF
EXPECT=<<EOF
cpu c55x
15
16
int main(int argc);
arg int argc @ ar4
7
@ -496,7 +496,7 @@ afi @ dbg.main~^args
EOF
EXPECT=<<EOF
cpu c55x
15
16
int main(int argc);
arg int argc @ ar4
7
@ -520,7 +520,7 @@ afi @ sym._main~^call-refs
EOF
EXPECT=<<EOF
cpu c55x
15
16
int main(int argc, char **argv, char **envp);
0
8
@ -564,7 +564,7 @@ afi @ sym._main~^stackframe:0
EOF
EXPECT=<<EOF
cpu c55x
15
16
int main(int argc, char **argv, char **envp);
0
stackframe: 11
@ -675,8 +675,9 @@ NAME=c55x analysis: stackframe tracking propagates to afi (high-level summariser
FILE=bins/tms320/emulateme_nostd.ccsv5.c55x.ticoff2.dbg.coff
ARGS=-A
CMDS=<<EOF
# Each function with a prologue should have a non-zero stackframe.
# This verifies the analyzer's stackop/stackptr fields are reaching afi.
# dbg.main has a prologue (AADD K8, SP) so its stackframe is non-zero; the
# leaf helpers below carry no stack frame and correctly report 0. This
# verifies the analyzer's stackop/stackptr fields are reaching afi.
afi @ dbg.main~^stackframe:0
afi @ sym._decrypt~^stackframe:0
afi @ sym._c_strlen~^stackframe:0
@ -689,7 +690,7 @@ EOF
EXPECT=<<EOF
stackframe: 11
stackframe: 0
stackframe: 2
stackframe: 0
stackframe: 0
args: 1
locals: 0
@ -702,8 +703,8 @@ e asm.arch=tms320
e analysis.cpu=c55x
# The disassembler tags each instruction with a named TMS320C55InsID, which
# the analyzer surfaces on op->id (Capstone-style). These values are the
# positions in the TMS320C55_INS_* enum (see tms320_insn.h): B=12, CALL=26,
# RET=67, NOP=59, PSH=64, POP=62, AND=10, MOV=53, INTR=39, TRAP=96.
# positions in the TMS320C55_INS_* enum (see tms320_insn.h): B=14, CALL=28,
# RET=69, NOP=61, PSH=66, POP=64, AND=12, MOV=55, INTR=41, TRAP=98.
wx 060020 @ 0
ao 1 @ 0~id
wx 080020 @ 0
@ -726,16 +727,16 @@ wx 958f @ 0
ao 1 @ 0~id
EOF
EXPECT=<<EOF
id: 12
id: 26
id: 67
id: 59
id: 14
id: 28
id: 69
id: 61
id: 66
id: 64
id: 62
id: 10
id: 53
id: 39
id: 96
id: 12
id: 55
id: 41
id: 98
EOF
RUN
@ -800,14 +801,14 @@ EXPECT=<<EOF
| 0x00000139 mov t0, ac0
| 0x0000013b bfxtr 0x00F0, ac0, ar2
| 0x0000013f and 0x0F, ac0, ar1
| 0x00000142 amar *(0x20536D), xar3
| 0x00000142 amar *(0x000608), xar3
| 0x00000148 and 0xFFFF, ar2, ac1
| 0x0000014c mov dbl(*(0x64626C)), xar2
| 0x0000014c mov dbl(*(0x008000)), xar2
| 0x00000152 mov xar3, ac0
| 0x00000154 add ac1, ac0
| 0x00000156 mov xar2, ac1
| 0x00000158 mov ac0, xar2
| 0x0000015a add dbl(*(0x64626C)), ac1
| 0x0000015a add dbl(*(0x008002)), ac1
| 0x00000160 mov ac1, xar4
| 0x00000162 mov *ar2, *ar4
| 0x00000165 mov xar3, ac0
@ -815,14 +816,14 @@ EXPECT=<<EOF
| 0x0000016b add ac1, ac0
| 0x0000016d mov ac0, xar3
| 0x0000016f mov *ar3, ar1
| 0x00000171 mov dbl(*(0x64626C)), xar3
| 0x00000171 mov dbl(*(0x008000)), xar3
| 0x00000177 mov xar3, ac0
| 0x00000179 add dbl(*(0x64626C)), ac0
| 0x00000179 add dbl(*(0x008002)), ac0
| 0x0000017f mov ac0, xar3
| 0x00000181 mov ar1, *(ar3 + t1)
| 0x00000183 mov dbl(*(0x64626C)), ac0
| 0x00000183 mov dbl(*(0x008002)), ac0
| 0x00000189 add 0x2, ac0
| 0x0000018b mov ac0, dbl(*(0x616330))
| 0x0000018b mov ac0, dbl(*(0x008002))
\ 0x00000191 ret
EOF
RUN
@ -850,16 +851,16 @@ EXPECT=<<EOF
| | ;-- $C$DW$L$_uart_write_text$2$B:
| | ;-- $C$L1:
| .--> 0x00000108 mov xar0, ac3
| :| 0x0000010a mov dbl(*(0x64626C)), xar3
| :| 0x0000010a mov dbl(*(0x008000)), xar3
| :| 0x00000110 add ac1, ac3
| :| 0x00000112 mov ac3, xar2
| :| 0x00000114 mov xar3, ac2
| :| 0x00000116 add dbl(*(0x64626C)), ac2
| :| 0x00000116 add dbl(*(0x008002)), ac2
| :| 0x0000011c mov ac2, xar3
| :| 0x0000011e mov *ar2, *ar3
| :| 0x00000121 mov dbl(*(0x64626C)), ac2
| :| 0x00000121 mov dbl(*(0x008002)), ac2
| :| 0x00000127 add 0x1, ac2
| :| 0x00000129 mov ac2, dbl(*(0x616332))
| :| 0x00000129 mov ac2, dbl(*(0x008002))
| :| 0x0000012f add 0x1, ac1
| :| 0x00000131 cmpu ac1 < ac0, tc1
| `==< 0x00000134 bcc 0xD1, tc1
@ -868,3 +869,57 @@ EXPECT=<<EOF
\ `-> 0x00000137 ret
EOF
RUN
NAME=c55x analysis: flag-condition branch targets
FILE=malloc://64
CMDS=<<EOF
e asm.arch=tms320
e analysis.cpu=c55x
wx 6d642000 @ 0
ao 1 @ 0~^type
ao 1 @ 0~^jump
ao 1 @ 0~^fail
wx 6e642000 @ 0
ao 1 @ 0~^type
ao 1 @ 0~^jump
ao 1 @ 0~^stackptr
EOF
EXPECT=<<EOF
type: cjmp
jump: 0x00002004
fail: 0x00000004
type: ccall
jump: 0x00002004
stackptr: 2
EOF
RUN
NAME=c55x analysis: psh/pop Smem stack effect (single / double word)
FILE==
CMDS=<<EOF
e asm.arch=tms320
e analysis.cpu=c55x
wx b501 @ 0
ao 1 @ 0~^type
ao 1 @ 0~^stackptr
wx bb01 @ 0
ao 1 @ 0~^type
ao 1 @ 0~^stackptr
wx b701 @ 0
ao 1 @ 0~^type
ao 1 @ 0~^stackptr
wx b801 @ 0
ao 1 @ 0~^type
ao 1 @ 0~^stackptr
EOF
EXPECT=<<EOF
type: push
stackptr: 1
type: pop
stackptr: -1
type: push
stackptr: 2
type: pop
stackptr: -2
EOF
RUN

266
test/db/asm/tms320_c55x+_32
View file

@ -1,18 +1,50 @@
d "add t1, ac1" 740131 0x0 (set ac1 (+ (var ac1) (cast 40 (msb (var t1)) (var t1))))
d "add #0x1 << #0xe, ac1, ac1" c261410001 0x0 (set ac1 (+ (var ac1) (<< (bv 40 0x1) (bv 8 0xe) false)))
d "sub #0x1405 << #0x7, ac0, ac0" c220e01405 0x0 (set ac0 (- (var ac0) (<< (bv 40 0x1405) (bv 8 0x7) false)))
d "sub #0xa41 << #0x5, ac0, ac0" c220a00a41 0x0 (set ac0 (- (var ac0) (<< (bv 40 0xa41) (bv 8 0x5) false)))
d "add #0x1405 << #0x0, ac0, ac0" c200001405 0x0 (set ac0 (+ (var ac0) (<< (bv 40 0x1405) (bv 8 0x0) false)))
d "mov #0x100 << #0xf, ac1" c2e1e00100 0x0 (set ac1 (bv 40 0x800000))
d "mov #0xff00 << #0xf, ac1" c2e1e0ff00 0x0 (set ac1 (bv 40 0xffff800000))
d "mov #0x100 << #0x0, ac0" c280000100 0x0 (set ac0 (bv 40 0x100))
d "rptb #0x00000d" 6f000d 0x0 nop
d "rptb #0x00ff0d" 6fff0d 0x0 nop
d "rptb #0x000001" 6f0001 0x0 nop
d "amar *ar2+, *ar4+, *ar15" ea928014c03f
d "amar *ar2+" 621200 0x0 (set xar2 (+ (var xar2) (bv 23 0x1)))
d "amar *ar2-" 620200 0x0 (set xar2 (- (var xar2) (bv 23 0x1)))
d "amar *sp(#0x2), xar0" 6382c0 0x0 (set xar0 (cast 23 false (+ (cast 24 false (var sp)) (bv 24 0x2))))
d "amar *sp(#0x4), xar0" 6384c0 0x0 (set xar0 (cast 23 false (+ (cast 24 false (var sp)) (bv 24 0x4))))
d "amar *sp(#0x2), xar8" 6382c8 0x0 (set xar8 (cast 23 false (+ (cast 24 false (var sp)) (bv 24 0x2))))
d "amar *ar5(#4), xar0" 6385400004 0x0 (set xar0 (cast 23 false (+ (cast 24 false (var xar5)) (bv 24 0x4))))
d "amar *ar5(#65535), xar0" 638540ffff 0x0 (set xar0 (cast 23 false (+ (cast 24 false (var xar5)) (bv 24 0xffffff))))
d "amar *ar0(#10), xar1" 638041000a 0x0 (set xar1 (cast 23 false (+ (cast 24 false (var xar0)) (bv 24 0xa))))
d "aadd xar0, xar7" 7227a0 0x0 (set xar7 (+ (var xar7) (var xar0)))
d "amov xar0, xar7" 72a720 0x0 (set xar7 (var xar0))
d "asub xar0, xar7" 722720 0x0 (set xar7 (- (var xar7) (var xar0)))
d "asub #0xb, xar1" ae21000b 0x0 (set xar1 (- (var xar1) (bv 23 0xb)))
d "b #0x000747" 680747 0x0 (jmp (bv 24 0x74a))
d "b #0x00000d" 68000d 0x0 (jmp (bv 24 0x10))
d "bclr st0_acov0, st0_55" 0a0a 0x0 (set st0_55 (ite false (| (var st0_55) (bv 16 0x400)) (& (var st0_55) (bv 16 0xfbff))))
d "cmp t2 == t3, tc1" a4323300 0x0 (set st0_55 (ite (== (var t2) (var t3)) (| (var st0_55) (bv 16 0x2000)) (& (var st0_55) (bv 16 0xdfff))))
d "cmp ac0 >= ac5, tc1" a400050c 0x0 (set st0_55 (ite (! (&& (sle (var ac0) (var ac5)) (! (== (var ac0) (var ac5))))) (| (var st0_55) (bv 16 0x2000)) (& (var st0_55) (bv 16 0xdfff))))
d "cmp ac0 == ac1, tc2" a4000101 0x0 (set st0_55 (ite (== (var ac0) (var ac1)) (| (var st0_55) (bv 16 0x1000)) (& (var st0_55) (bv 16 0xefff))))
d "cmp ac0 < ac1, tc1" a4000108 0x0 (set st0_55 (ite (&& (sle (var ac0) (var ac1)) (! (== (var ac0) (var ac1)))) (| (var st0_55) (bv 16 0x2000)) (& (var st0_55) (bv 16 0xdfff))))
d "cmpu ac0.l != ac0.h, tc1" a4604024 0x0 (set st0_55 (ite (! (== (cast 16 false (var ac0)) (cast 16 false (>> (var ac0) (bv 8 0x10) false)))) (| (var st0_55) (bv 16 0x2000)) (& (var st0_55) (bv 16 0xdfff))))
d "cmp ac0.h != ac1.l, tc1" a4406104 0x0 (set st0_55 (ite (! (== (cast 16 false (>> (var ac0) (bv 8 0x10) false)) (cast 16 false (var ac1)))) (| (var st0_55) (bv 16 0x2000)) (& (var st0_55) (bv 16 0xdfff))))
d "macm *ar2, *ar4, ac0, ac0" c832803400 0x0 (set ac0 (+ (var ac0) (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar2)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar2)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar4)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar4)) (bv 24 0x2)))))))
d "mov *ar0+ << t2, ac0" b410004032
d "mov uns(*ar0+) << t2, ac0" b410006032
d "mov rnd(*ar0+ << t2), ac0" b410204032
d "mov *ar0+ << ssp, ac0" b410004034
d "mov ac0.l, *ar2 || mov *ar1+ << t3, ac1" 395102a0b411014033
d "mov ac0.l, *ar2 || mov *(ar1+t0b) << t3, ac1" 395102a0b411414033
d "mov t0, ac0" 770030 0x0 (set ac0 (cast 40 (msb (var t0)) (var t0)))
d "mpym *ar2, *ar4, ac0" c832003400 0x0 (set ac0 (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar2)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar2)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar4)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar4)) (bv 24 0x2))))))
d "mpym40 uns(*ar2), *ar4, ac0" c832603400
d "mpymf *ar2, uns(*ar4), ac0" c8320034a0
d "sub ac1, ac0" 740081 0x0 (set ac0 (- (var ac0) (var ac1)))
d "pop t2, t3" 713233 0x0 (seq (set t2 (loadw 0 16 (* (cast 24 false (var sp)) (bv 24 0x2)))) (set sp (+ (var sp) (bv 16 0x1))) (set t3 (loadw 0 16 (* (cast 24 false (var sp)) (bv 24 0x2)))) (set sp (+ (var sp) (bv 16 0x1))))
d "psh t2, t3" 703233 0x0 (seq (set sp (- (var sp) (bv 16 0x1))) (storew 0 (* (cast 24 false (var sp)) (bv 24 0x2)) (var t2)) (set sp (- (var sp) (bv 16 0x1))) (storew 0 (* (cast 24 false (var sp)) (bv 24 0x2)) (var t3)))
d "pop mmap(@st1_55)" 2461e508 0x0 (seq (set st1_55 (loadw 0 16 (* (cast 24 false (var sp)) (bv 24 0x2)))) (set sp (+ (var sp) (bv 16 0x1))))
d "psh mmap(@st0_55)" 2461e400 0x0 (seq (set sp (- (var sp) (bv 16 0x1))) (storew 0 (* (cast 24 false (var sp)) (bv 24 0x2)) (var st0_55)))
d "pshboth xar5" 0d25
@ -36,18 +68,34 @@ d "sub #0x1, ac0" 7b0081 0x0 (set ac0 (- (var ac0) (bv 40 0x1)))
d "sub ar0, ac0" 7400a0 0x0 (set ac0 (- (var ac0) (cast 40 (msb (var ar0)) (var ar0))))
d "sub ac1, ac0" 740081 0x0 (set ac0 (- (var ac0) (var ac1)))
d "mov #0x42, ac0" ac000042 0x0 (set ac0 (bv 40 0x42))
d "add #0x5, ac0" 7b0005 0x0 (set ac0 (+ (var ac0) (bv 40 0x5)))
d "sub #0x5, ac0" 7b0085 0x0 (set ac0 (- (var ac0) (bv 40 0x5)))
d "mov #0x5, ac0" 7b8005 0x0 (set ac0 (bv 40 0x5))
d "mov -#0x5, ac0" 7b8085
d "mov #0x1, ac0.h" 7bc001 0x0 (set ac0 (| (& (var ac0) (bv 40 0xff0000ffff)) (<< (cast 40 false (bv 16 0x1)) (bv 6 0x10) false)))
d "mov #0x1, ac0.l" 7be001 0x0 (set ac0 (| (& (var ac0) (bv 40 0xffffff0000)) (cast 40 false (bv 16 0x1))))
d "mov #0x64, ac0.h" ac400064 0x0 (set ac0 (| (& (var ac0) (bv 40 0xff0000ffff)) (<< (cast 40 false (bv 16 0x64)) (bv 6 0x10) false)))
d "mov ar0, ar1" 772120 0x0 (set ar1 (var ar0))
d "mov ar2, ar3" 772322 0x0 (set ar3 (var ar2))
d "nop" 20 0x0 nop
d "and #0xff, ac0, ac0" c5000000ff 0x0 (set ac0 (& (var ac0) (bv 40 0xff)))
d "and #0x100, ac1.l, ac0.l" c560610100 0x0 (set ac0 (| (& (var ac0) (bv 40 0xffffff0000)) (cast 40 false (& (cast 16 false (var ac1)) (bv 16 0x100)))))
d "and #0x100, ac1, ac0.h" c540010100 0x0 (set ac0 (| (& (var ac0) (bv 40 0xff0000ffff)) (<< (cast 40 false (& (cast 16 false (var ac1)) (bv 16 0x100))) (bv 8 0x10) false)))
d "and #0x100, ac1.h, ac0.l" c560410100 0x0 (set ac0 (| (& (var ac0) (bv 40 0xffffff0000)) (cast 40 false (& (cast 16 false (>> (var ac1) (bv 8 0x10) false)) (bv 16 0x100)))))
d "or #0xf, ac1, ac1" c50181000f 0x0 (set ac1 (| (var ac1) (bv 40 0xf)))
d "xor #0xaa, ac2, ac2" c5820200aa 0x0 (set ac2 (^ (var ac2) (bv 40 0xaa)))
d "and ac0, ac1" 750100 0x0 (set ac1 (& (var ac1) (var ac0)))
d "or ac0, ac2" 750280 0x0 (set ac2 (| (var ac2) (var ac0)))
d "xor ac0, ac3" 758300 0x0 (set ac3 (^ (var ac3) (var ac0)))
d "sub ac1 << #0x1, ac0" a7008101 0x0 (set ac0 (- (var ac0) (<< (var ac1) (bv 8 0x1) false)))
d "and ac1 << #0x1, ac0" a7000181 0x0 (set ac0 (& (var ac0) (<< (var ac1) (bv 8 0x1) false)))
d "xor ac1 << #0x1, ac0" a7800181 0x0 (set ac0 (^ (var ac0) (<< (var ac1) (bv 8 0x1) false)))
d "sfts ac1, t3, ac1" a6818133 0x0 (set ac1 (ite (&& (sle (var t3) (bv 16 0x0)) (! (== (var t3) (bv 16 0x0)))) (>> (var ac1) (- (bv 16 0x0) (var t3)) (msb (var ac1))) (<< (var ac1) (var t3) false)))
d "sfts ac5, #0x0, ac0" a7808500 0x0 (set ac0 (var ac5))
d "sfts ac5, #0x30, ac0" a7808530 0x0 (set ac0 (>> (var ac5) (bv 6 0x10) (msb (var ac5))))
d "sftl ac1, #0xf, ac1" a781010f 0x0 (set ac1 (<< (var ac1) (bv 6 0xf) false))
d "sftl ac1, #0x3f, ac1" a781013f 0x0 (set ac1 (>> (var ac1) (bv 6 0x1) false))
d "bclr st0_acov0, st0_55" 0a0a 0x0 (set st0_55 (ite false (| (var st0_55) (bv 16 0x400)) (& (var st0_55) (bv 16 0xfbff))))
d "xor #0x1, ar3, ar3" c5a3230001 0x0 (set ar3 (^ (var ar3) (bv 16 0x1)))
d "and ac1, ac0" 750001 0x0 (set ac0 (& (var ac0) (var ac1)))
@ -58,6 +106,9 @@ d "sftl ac0, #0x4, ac0" a7800004 0x0 (set ac0 (<< (var ac0) (bv 6 0x4) false))
d "b #0x00002d" 68002d 0x0 (jmp (bv 24 0x30))
d "call #0x000028" 690028 0x0 (jmp (bv 24 0x2b))
d "call #0x61499a" 9d61499a 0x0 (jmp (bv 24 0x61499a))
d "call #0x000040" 9d000040 0x0 (jmp (bv 24 0x40))
d "call #0xffffff" 9dffffff 0x0 (jmp (bv 24 0xffffff))
d "bcc #0x000023, ac0 != #0" 6a2320 0x0 (branch (! (== (var ac0) (bv 40 0x0))) (jmp (bv 24 0x26)) nop)
d "bcc #0x00001f, ac0 == #0" 6a1f00 0x0 (branch (== (var ac0) (bv 40 0x0)) (jmp (bv 24 0x22)) nop)
d "bcc #0x00001c, ac1 != #0" 6a1c21 0x0 (branch (! (== (var ac1) (bv 40 0x0))) (jmp (bv 24 0x1f)) nop)
@ -65,18 +116,23 @@ d "bcc #0x000019, t0 < #0" 6a1948 0x0 (branch (&& (sle (var t0) (bv 16 0x0)) (!
d "bcc #0x000016, ar0 > #0" 6a1690 0x0 (branch (! (sle (var ar0) (bv 16 0x0))) (jmp (bv 24 0x19)) nop)
d "bccu #0x000010, ar0 < ar1" dba0210010 0x0 (branch (&& (ule (var ar0) (var ar1)) (! (== (var ar0) (var ar1)))) (jmp (bv 24 0x15)) nop)
d "bccu #0x00000b, ar2 < ar3" dba223000b 0x0 (branch (&& (ule (var ar2) (var ar3)) (! (== (var ar2) (var ar3)))) (jmp (bv 24 0x10)) nop)
d "bccu #0x000021, ac0.h == ac1.l" db40610021 0x0 (branch (== (cast 16 false (>> (var ac0) (bv 8 0x10) false)) (cast 16 false (var ac1))) (jmp (bv 24 0x26)) nop)
d "bcc #0x00002f, ac8 != ac4" da0884002f 0x0 (branch (! (== (var ac8) (var ac4))) (jmp (bv 24 0x34)) nop)
d "bcc #0x000005, ac0 == #0" 6a0500 0x0 (branch (== (var ac0) (bv 40 0x0)) (jmp (bv 24 0x8)) nop)
d "bcc #0x00041d, ac6.l == #0x1" dc6601041d 0x0 (branch (== (cast 16 false (var ac6)) (bv 16 0x1)) (jmp (bv 24 0x422)) nop)
d "bcc #0x000713, ac0.h == #0x1" dc40010713 0x0 (branch (== (cast 16 false (>> (var ac0) (bv 8 0x10) false)) (bv 16 0x1)) (jmp (bv 24 0x718)) nop)
d "bcc #0x00106e, ac5 >= #0x7" dc8587106e 0x0 (branch (! (&& (sle (var ac5) (bv 40 0x7)) (! (== (var ac5) (bv 40 0x7))))) (jmp (bv 24 0x1073)) nop)
d "bccu #0x00000e, ac0.h == #0x1" dd4001000e 0x0 (branch (== (cast 16 false (>> (var ac0) (bv 8 0x10) false)) (bv 16 0x1)) (jmp (bv 24 0x13)) nop)
d "bccu #0x00003b, ac5.l < #0x8" dde508003b 0x0 (branch (&& (ule (cast 16 false (var ac5)) (bv 16 0x8)) (! (== (cast 16 false (var ac5)) (bv 16 0x8)))) (jmp (bv 24 0x40)) nop)
d "bccu #0x000037, ac2.l != #0xb" dd628b0037 0x0 (branch (! (== (cast 16 false (var ac2)) (bv 16 0xb))) (jmp (bv 24 0x3c)) nop)
d "call #0x00ffd0" 69ffd0 0x0 (jmp (bv 24 0xffffd3))
d "macm *ar2, *ar4, ac0, ac0" c832803400 0x0 (set ac0 (+ (var ac0) (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar2)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar2)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar4)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar4)) (bv 24 0x2)))))))
d "mpym *ar2, *ar4, ac0" c832003400 0x0 (set ac0 (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar2)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar2)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar4)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar4)) (bv 24 0x2))))))
d "pop t2, t3" 713233 0x0 (seq (set t2 (loadw 0 16 (* (cast 24 false (var sp)) (bv 24 0x2)))) (set sp (+ (var sp) (bv 16 0x1))) (set t3 (loadw 0 16 (* (cast 24 false (var sp)) (bv 24 0x2)))) (set sp (+ (var sp) (bv 16 0x1))))
d "pshboth xar5" 0d25
d "psh mmap(@st0_55)" 2461e400 0x0 (seq (set sp (- (var sp) (bv 16 0x1))) (storew 0 (* (cast 24 false (var sp)) (bv 24 0x2)) (var st0_55)))
d "pop mmap(@st1_55)" 2461e508 0x0 (seq (set st1_55 (loadw 0 16 (* (cast 24 false (var sp)) (bv 24 0x2)))) (set sp (+ (var sp) (bv 16 0x1))))
d "cmp t2 == t3, tc1" a4323300 0x0 (set st0_55 (ite (== (var t2) (var t3)) (| (var st0_55) (bv 16 0x2000)) (& (var st0_55) (bv 16 0xdfff))))
d "cmp t0 == t1, tc2" a4303101 0x0 (set st0_55 (ite (== (var t0) (var t1)) (| (var st0_55) (bv 16 0x1000)) (& (var st0_55) (bv 16 0xefff))))
d "cmp ar0 < ar1, tc1" a4202108 0x0 (set st0_55 (ite (&& (sle (var ar0) (var ar1)) (! (== (var ar0) (var ar1)))) (| (var st0_55) (bv 16 0x2000)) (& (var st0_55) (bv 16 0xdfff))))
d "cmp ar2 >= ar3, tc2" a422230d 0x0 (set st0_55 (ite (! (&& (sle (var ar2) (var ar3)) (! (== (var ar2) (var ar3))))) (| (var st0_55) (bv 16 0x1000)) (& (var st0_55) (bv 16 0xefff))))
@ -137,11 +193,189 @@ d "copy *(ar0-t0b), t1" 540071
d "copy *(ar0+t0b), t1" 541071
d "copy *ar0(t0<<#1), t1" 542071
d "copy *ar0, t1" 5400b1 0x0 (set t1 (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2))))
d "copy dbl(*ar5), xar0" 560580 0x0 (set xar0 (cast 23 false (loadw 0 32 (* (cast 24 false (var xar5)) (bv 24 0x2)))))
d "copy dbl(*ar5(short(#0x1))), xar0" 561580 0x0 (set xar0 (cast 23 false (loadw 0 32 (* (+ (cast 24 false (var xar5)) (bv 24 0x1)) (bv 24 0x2)))))
d "copy dbl(*ar5), xar15" 56058f 0x0 (set xar15 (cast 23 false (loadw 0 32 (* (cast 24 false (var xar5)) (bv 24 0x2)))))
d "copy dbl(*ar6(short(#0x8))), xar0" 568680 0x0 (set xar0 (cast 23 false (loadw 0 32 (* (+ (cast 24 false (var xar6)) (bv 24 0x8)) (bv 24 0x2)))))
d "copy dbl(*sp(#0x6)), xar0" 5686c0 0x0 (set xar0 (cast 23 false (loadw 0 32 (* (+ (cast 24 false (var sp)) (bv 24 0x6)) (bv 24 0x2)))))
d "copy dbl(*sp(#0x1)), xar1" 5681c1 0x0 (set xar1 (cast 23 false (loadw 0 32 (* (+ (cast 24 false (var sp)) (bv 24 0x1)) (bv 24 0x2)))))
d "copy dbl(*sp(#0x6)), xar8" 5686c8 0x0 (set xar8 (cast 23 false (loadw 0 32 (* (+ (cast 24 false (var sp)) (bv 24 0x6)) (bv 24 0x2)))))
d "copy dbl(*(#0x978ce8)), xar0" d180978ce8 0x0 (set xar0 (cast 23 false (loadw 0 32 (bv 24 0x978ce8))))
d "copy dbl(*(#0x9bbac0)), xar1" d1819bbac0 0x0 (set xar1 (cast 23 false (loadw 0 32 (bv 24 0x9bbac0))))
d "copy dbl(*(#0x123456)), xar8" d188123456 0x0 (set xar8 (cast 23 false (loadw 0 32 (bv 24 0x123456))))
d "mov *ar0-, ac0" 580000 0x0 (seq (set ac0 (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2))))) (set xar0 (- (var xar0) (bv 23 0x1))))
d "mov *ar0+, ac0" 581000 0x0 (seq (set ac0 (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2))))) (set xar0 (+ (var xar0) (bv 23 0x1))))
d "mov *ar0(t0), ac0" 582000 0x0 (set ac0 (cast 40 (msb (loadw 0 16 (* (+ (cast 24 false (var xar0)) (cast 24 (msb (var t0)) (var t0))) (bv 24 0x2)))) (loadw 0 16 (* (+ (cast 24 false (var xar0)) (cast 24 (msb (var t0)) (var t0))) (bv 24 0x2)))))
d "mov uns(byte(*ar7)), ac1" 8a0781e0 0x0 (set ac1 (cast 40 false (loadw 0 8 (* (cast 24 false (var xar7)) (bv 24 0x2)))))
d "mov uns(byte(*ar7)), ar1" 8a0781e1 0x0 (set ar1 (cast 16 false (loadw 0 8 (* (cast 24 false (var xar7)) (bv 24 0x2)))))
d "mov uns(byte(*ar7)), ac1.l" 8a0781e3 0x0 (set ac1 (| (& (var ac1) (bv 40 0xffffff0000)) (cast 40 false (cast 16 false (loadw 0 8 (* (cast 24 false (var xar7)) (bv 24 0x2)))))))
d "mov byte(*ar7), ac1.l" 8a0781c3 0x0 (set ac1 (| (& (var ac1) (bv 40 0xffffff0000)) (cast 40 false (cast 16 (msb (loadw 0 8 (* (cast 24 false (var xar7)) (bv 24 0x2)))) (loadw 0 8 (* (cast 24 false (var xar7)) (bv 24 0x2)))))))
d "mov ac1.l, byte(*ar7)" 8a0781a3 0x0 (storew 0 (* (cast 24 false (var xar7)) (bv 24 0x2)) (cast 8 false (cast 16 false (var ac1))))
d "mov uns(byte(*(#0x9bbd47))), ac1.l" 8ae041e39bbd47 0x0 (set ac1 (| (& (var ac1) (bv 40 0xffffff0000)) (cast 40 false (cast 16 false (loadw 0 8 (bv 24 0x9bbd47))))))
d "mov byte(*(#0x9bbd47)), ac1.l" 8ae041c39bbd47 0x0 (set ac1 (| (& (var ac1) (bv 40 0xffffff0000)) (cast 40 false (cast 16 (msb (loadw 0 8 (bv 24 0x9bbd47))) (loadw 0 8 (bv 24 0x9bbd47))))))
d "mov uns(byte(*sp(#0x60))), ac1.l" 8ae0c1e3 0x0 (set ac1 (| (& (var ac1) (bv 40 0xffffff0000)) (cast 40 false (cast 16 false (loadw 0 8 (* (+ (cast 24 false (var sp)) (bv 24 0x60)) (bv 24 0x2)))))))
d "mov dbl(*ar7), ac0" 5c0780 0x0 (set ac0 (cast 40 (msb (loadw 0 32 (* (cast 24 false (var xar7)) (bv 24 0x2)))) (loadw 0 32 (* (cast 24 false (var xar7)) (bv 24 0x2)))))
d "mov dbl(*(#0x95a004)), ac0" 5ce04095a004 0x0 (set ac0 (cast 40 (msb (loadw 0 32 (bv 24 0x95a004))) (loadw 0 32 (bv 24 0x95a004))))
d "mov *ar5(short(#0x8)), ac0.l" 5b8580 0x0 (set ac0 (| (& (var ac0) (bv 40 0xffffff0000)) (cast 40 false (loadw 0 16 (* (+ (cast 24 false (var xar5)) (bv 24 0x8)) (bv 24 0x2))))))
d "mov *(#0x95a000), ac0.l" 5be04095a000 0x0 (set ac0 (| (& (var ac0) (bv 40 0xffffff0000)) (cast 40 false (loadw 0 16 (bv 24 0x95a000)))))
d "mov ac0.l, *sp(#0x0)" 5180e0 0x0 (storew 0 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)) (cast 16 false (var ac0)))
d "mov ac0.h, *ar0" 510080 0x0 (storew 0 (* (cast 24 false (var xar0)) (bv 24 0x2)) (cast 16 false (>> (var ac0) (bv 8 0x10) false)))
d "mov ac1, dbl(*sp(#0x8))" 5088c1 0x0 (storew 0 (* (+ (cast 24 false (var sp)) (bv 24 0x8)) (bv 24 0x2)) (cast 32 false (var ac1)))
d "mov xar0, dbl(*ar0)" 520080 0x0 (storew 0 (* (cast 24 false (var xar0)) (bv 24 0x2)) (cast 32 false (var xar0)))
d "mov ac0, dbl(*(#0x95a004))" d00095a004 0x0 (storew 0 (bv 24 0x95a004) (cast 32 false (var ac0)))
d "mov ar0, *(#0x123456)" d020123456 0x0 (storew 0 (bv 24 0x123456) (var ar0))
d "mov ac0.h, *(#0x123456)" d040123456 0x0 (storew 0 (bv 24 0x123456) (cast 16 false (>> (var ac0) (bv 8 0x10) false)))
d "mov xar0, dbl(*(#0x123456))" d080123456 0x0 (storew 0 (bv 24 0x123456) (cast 32 false (var xar0)))
d "mov #0x0, byte(*ar6(#16))" 4c86400010 0x0 (storew 0 (* (+ (cast 24 false (var xar6)) (bv 24 0x10)) (bv 24 0x2)) (cast 8 false (bv 16 0x0)))
d "mov #0x1, byte(*ar6)" 4c0681 0x0 (storew 0 (* (cast 24 false (var xar6)) (bv 24 0x2)) (cast 8 false (bv 16 0x1)))
d "mov #0x1, byte(*sp(#0x64))" 4ce4c1 0x0 (storew 0 (* (+ (cast 24 false (var sp)) (bv 24 0x64)) (bv 24 0x2)) (cast 8 false (bv 16 0x1)))
d "mov #0x0, byte(*(#0x123456))" 4ce040123456 0x0 (storew 0 (bv 24 0x123456) (cast 8 false (bv 16 0x0)))
d "mov #0x40, byte(*ar0)" 4d0080 0x0 (storew 0 (* (cast 24 false (var xar0)) (bv 24 0x2)) (cast 8 false (bv 16 0x40)))
d "mov #0x80, byte(*ar0)" 4e0080 0x0 (storew 0 (* (cast 24 false (var xar0)) (bv 24 0x2)) (cast 8 false (bv 16 0x80)))
d "mov #0xff, byte(*ar0)" 4f00bf 0x0 (storew 0 (* (cast 24 false (var xar0)) (bv 24 0x2)) (cast 8 false (bv 16 0xff)))
d "mov *sp(#0x8), ac0.h" 5a88c0 0x0 (set ac0 (| (& (var ac0) (bv 40 0xff0000ffff)) (<< (cast 40 false (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x8)) (bv 24 0x2)))) (bv 8 0x10) false)))
d "mov *ar5(short(#0x7)), ac1.h" 5a7581 0x0 (set ac1 (| (& (var ac1) (bv 40 0xff0000ffff)) (<< (cast 40 false (loadw 0 16 (* (+ (cast 24 false (var xar5)) (bv 24 0x7)) (bv 24 0x2)))) (bv 8 0x10) false)))
d "mov #0x0, *sp(#0x5)" 4885c0 0x0 (storew 0 (* (+ (cast 24 false (var sp)) (bv 24 0x5)) (bv 24 0x2)) (bv 16 0x0))
d "mov #0x0, *(#0x123456)" 48e040123456 0x0 (storew 0 (bv 24 0x123456) (bv 16 0x0))
d "amov #0x5f0, ar0" ae8005f0 0x0 (set ar0 (bv 16 0x5f0))
d "asub #0x5f0, ar0" ae0005f0 0x0 (set ar0 (- (var ar0) (bv 16 0x5f0)))
d "amov #0x5f0, t0" ae9005f0 0x0 (set t0 (bv 16 0x5f0))
d "aadd #0x5f0, ar0" ae4005f0 0x0 (set ar0 (+ (var ar0) (bv 16 0x5f0)))
d "aadd #0x5f0, xar0" ae6005f0 0x0 (set xar0 (+ (var xar0) (bv 23 0x5f0)))
d "asub #0x5f0, xar0" ae2005f0 0x0 (set xar0 (- (var xar0) (bv 23 0x5f0)))
d "amov #0xff, xar0" d2800000ff 0x0 (set xar0 (bv 23 0xff))
d "asub #0xffff, xar0" d20000ffff 0x0 (set xar0 (- (var xar0) (bv 23 0xffff)))
d "aadd #0xeb, sp" 0ceb 0x0 (set sp (+ (var sp) (bv 16 0xeb)))
d "b ac1" 0201 0x0 (jmp (cast 24 false (var ac1)))
d "call ac0" 0280 0x0 (jmp (cast 24 false (var ac0)))
d "b ac7" 0207 0x0 (jmp (cast 24 false (var ac7)))
d "b ac16" 0210 0x0 (jmp (cast 24 false (var ac16)))
d "mpyk #0x60, ac0, ac0" c700000060 0x0 (set ac0 (* (bv 40 0x60) (cast 40 (msb (cast 16 false (var ac0))) (cast 16 false (var ac0)))))
d "mov #0x0, ac0.l" 2e7be000 0x0 (set ac0 (| (& (var ac0) (bv 40 0xffffff0000)) (cast 40 false (bv 16 0x0))))
d "mov ac0.l, *ar0" 2e5100a0 0x0 (storew 0 (* (cast 24 false (var xar0)) (bv 24 0x2)) (cast 16 false (var ac0)))
d "mov #0x0, *(#0x95a000)" 2e48e04095a000 0x0 (storew 0 (bv 24 0x95a000) (bv 16 0x0))
d "copy dbl(*(#0x9bba18)), xar0" 2ed1809bba18
d "xccpart ac0.l == #0" 0718
d "xccpart ac0 == #0" 0700
d "xccpart xar0 == #0" 07c0
d "xccpart !tc1" 07f4
d "xccpart overflow(ac0)" 07e0
d "xcc !tc1" 06f4
d "xcc ac0.l == #0" 0618
d "delay *ar0(t0<<#1)" 602043
d "delay *ar0" 600080
d "delay *ar0-" 600000
d "psh *ar0(t0<<#1)" 612043
d "psh *ar0" 610080
d "psh *(#0x95a000)" 61e04095a000
d "bfxtr #0x2, ac0, ac0.l" c660600002
d "bfxtr #0x2, ac1, ac0.l" c660610002
d "bfxtr #0xff02, ac0, ac0.l" c66060ff02
d "bfxtr #0x2, ac0, ac0.h" c640600002
d "bfxtr #0x2, ac0, ar0" c620600002
d "bfxtr #0x2, ac0, ac0" c600600002
d "btst @#0x5, ac1.l, tc1" 8905c1a3
d "btst @#0x5, ac5.h, tc1" 8905c5a2
d "btst @#0xf, t3, tc1" 890fd3a1
d "btst @#0x5, ac0.l, tc2" 8905e0a3
d "bclr @#0x0, ac0.l" 8900c023
d "bset @#0x4, ac0.l" 8904e023
d "bclr @#0x0, ac0" 8900c020
d "bnot @#0x5, ac0" 8905c060
d "btstp @#0x5, ac0" 8905c0e0
d "btstset #0x5, *ar0, tc2" 9100a805
d "btstset #0x0, *ar0, tc2" 9100a800
d "add #0x1, *(#0x95a008)" b1e040000195a008
d "add #0x1234, *ar0" b100801234
d "add #0xadc, *ar1(t3)" b1b1010adc
d "mov #0x1234, *ar0" b100981234 0x0 (storew 0 (* (cast 24 false (var xar0)) (bv 24 0x2)) (bv 16 0x1234))
d "mov #0xa00, *ar0(#26)" b180580a00001a 0x0 (storew 0 (* (+ (cast 24 false (var xar0)) (bv 24 0x1a)) (bv 24 0x2)) (bv 16 0xa00))
d "mov uns(*(#0x95a000)) << #0x4, ac0" b7e060c00495a000
d "add uns(*ar5(short(#0x7))) << #0x3, ac0, ac0" b775a00003
d "mov uns(*ar5(short(#0x7))) << #0x3, ac1" b775a1c003
d "add *(#0x9bbcc8) << #0x4, ac0, ac0" b7e04000049bbcc8
d "sub *ar0 << #0x0, ac0, ac0" b700804000
d "mov *ar0 << #0x0, ac0" b70080c000
d "add *ar5(short(#0x7)) << #0x3, ac2, ac0" b775800203
d "sftl ac0, ac5.l, ac2" a6820065
d "sftl ac2, ac0.l, ac0" a6800260
d "sftl ac0.l, ac1.l, ac0.l" a6e06061
d "sftl ac0.h, ac2.l, ac0.h" a6c04062
d "sftl ac8, ac0.l, ac0" a6800860
d "sfts ac0, ac0.l, ac0" a6808060
d "sfts ac0.l, #-1" 7b60a0
d "sftl ac0, #-1" 7b80a0
d "sfts ac0, #-1" 7b00a0
d "sfts ac0.l, #1" 7b6020
d "sfts ac5.l, #1" 7b6520
d "sftl ac1, #-1" 7b81a0
d "add uns(*ar5(short(#0x7))), ac0, ac0" 8c75a000
d "add uns(*ar5(short(#0x1))), ac5, ac0" 8c15a005
d "add uns(*ar5), ac5, ac0" 8c05a005
d "add uns(*(#0x9bbcd2)), ac5, ac0" 8ce060059bbcd2
d "add uns(*(#0x9bbcd2)), ac5, ac5" 8ce065059bbcd2
d "add uns(*ar5(short(#0x7))), ac16, ac0" 8c75a010
d "sub ac0, dbl(*ar0(short(#0x1))), ac0" 8d108080
d "add dbl(*ar5(short(#0x5))), ac5, ac1" 8d558105
d "sub dbl(*ar0+), ac0, ac0" 8d100040
d "sub ac0, dbl(*ar0+), ac0" 8d100080
d "sub ac1, dbl(*ar0(short(#0x1))), ac0" 8d108081
d "or *ar1(#25), ac0, ac0" 858140000019
d "or *ar1(#43), ac0, ac0" 85814000002b
d "or *ar1(#25), ac5, ac0" 858140050019
d "or *ar1(#25), ac0, ac0.h" 858140800019
d "or *(ar5-t0b), ac0, ac0" 85054000
d "sub ac0.l, *sp(#0x4), ac1.l" 8284e1e0
d "sub ac1.l, *sp(#0x16), ac1.l" 8296e1e1
d "sub ac6.l, *ar5(short(#0x2)), ac0.l" 8225a0e6
d "sub ac6.h, *ar5(short(#0x2)), ac0.l" 8225a0c6
d "sub ac0.l, *sp(#0x4), ac1.h" 8284c1e0
d "mov *ar2+, *ar0+" 97120810
d "mov *ar2, *ar1" 97028831
d "mov byte(*ar5(short(#0xc))), byte(*ar0)" 97c58c30
d "mov byte(*ar0+), byte(*ar1+)" 97100c11
d "mov byte(*ar0), byte(*ar1(short(#0x1)))" 97118430
d "mov byte(*ar5(#23)), byte(*ar1)" 97854c310017
d "mov byte(*ar0), byte(*(#0x9bba9f))" 97e044309bba9f
d "mov byte(*ar1(t0)), byte(*ar0(#2002))" 9780442107d2
d "add *(#0x9bbcc8), ac0, ac0" 80e040009bbcc8
d "add *(#0x9bbcc8), ac0, ac1" 80e041009bbcc8
d "add *(#0x9bbcc8), ac1, ac0" 80e040019bbcc8
d "add *(#0x9bbcc8), ac0, ac0.h" 80e040809bbcc8
d "cmp *(#0x9bba14) == #0x52c, tc1" b2e040052c9bba14
d "cmp *(#0x9bba14) == #0x100, tc1" b2e04001009bba14
d "cmp *(#0x9bba14) < #0x100, tc1" b2e04201009bba14
d "cmp *(#0x9bba14) >= #0x100, tc1" b2e04301009bba14
d "cmp *(#0x9bba14) == #0x100, tc2" b2e06001009bba14
d "sub #0x80 << #16, ac0, ac0" c000800080 0x0 (set ac0 (- (var ac0) (<< (bv 40 0x80) (bv 8 0x10) false)))
d "sub #0x80 << #16, ac1, ac0" c000810080 0x0 (set ac0 (- (var ac1) (<< (bv 40 0x80) (bv 8 0x10) false)))
d "sub #0x80 << #16, ac0, ac1" c001800080 0x0 (set ac1 (- (var ac0) (<< (bv 40 0x80) (bv 8 0x10) false)))
d "add #0x80 << #16, ac0, ac0" c000000080 0x0 (set ac0 (+ (var ac0) (<< (bv 40 0x80) (bv 8 0x10) false)))
d "neg ac5, ac0" 760085 0x0 (set ac0 (- (bv 40 0x0) (var ac5)))
d "neg ac5.l, ac1.l" 7661e5 0x0 (set ac1 (| (& (var ac1) (bv 40 0xffffff0000)) (cast 40 false (- (bv 16 0x0) (cast 16 false (var ac5))))))
d "mov ac0.l, mmap(@brc0)" 24513a20
d "mov ac0.h, mmap(@brc0)" 24513a00
d "mov ac1.l, mmap(@brc0)" 24513a21
d "mov ac0.l, mmap(@brc1)" 24513b20
d "mov ac0.l, mmap(@csr)" 24513820
d "sub #0x4e20, ac0.l, ac0.l" 2fc460e04e20
d "mpykr #0x60, ac0, ac0" c720000060
d "mpykf #0x60, ac0, ac0" c740000060
d "mpykfr #0x60, ac0, ac0" c760000060
d "mpyk #0x60, ac0.h, ac0" c700004060
d "mack #0x60, ac2, ac0, ac1" c701800260
d "mpyk #0x140, ac0.l, ac0" ee0000600140
d "mack #0x96, ac0.l, ac1, ac0" ee0081600096
d "bcc #0x000190, ac7.h == #0xff" de477f0190 0x0 (branch (== (cast 16 false (>> (var ac7) (bv 8 0x10) false)) (bv 16 0xff)) (jmp (bv 24 0x195)) nop)
d "bccu #0x000190, ac7.h == #0xff" df477f0190 0x0 (branch (== (cast 16 false (>> (var ac7) (bv 8 0x10) false)) (bv 16 0xff)) (jmp (bv 24 0x195)) nop)
d "bcc #0x000781, !tc1" 9a0781f4 0x0 (branch (! (lsb (>> (var st0_55) (bv 4 0xd) false))) (jmp (bv 24 0x785)) nop)
d "bcc #0x000000, ac0 != #0" 9a000020 0x0 (branch (! (== (var ac0) (bv 40 0x0))) (jmp (bv 24 0x4)) nop)
d "bcc #0x000781, xar0 == #0" 9a0781c0 0x0 (branch (== (var xar0) (bv 23 0x0)) (jmp (bv 24 0x785)) nop)
d "bcc #0x000781, !overflow(ac0)" 9a0781f0
d "macm *ar3+, *ar15-, ac0" e0130040000f
d "mpym *ar3+, *ar15-, ac0" e0130000000f
d "masm *ar3+, *ar15-, ac0" e0130080000f
d "macm *ar3+, *ar15+, ac0" e0130040001f
d "macm *ar3+, *ar15(t0), ac0" e0130040002f
d "macm *ar3+, *ar15, ac0" e0130040003f
@ -150,6 +384,8 @@ d "aadd #0xf8, sp" 0cf8
d "abdst *ar14, *(ar7-t1), ac28, ac18" ce3e9c5752
d "addsub2cc *-ar0, ac2, t3, tc1, tc2, ac2" b38022a2b3
d "addsubcc *ar7(t3), ac6, tc2, ac18" b3b7320607
d "addsubcc *ar7(t3), ac6, tc1, tc2, ac18" b3b7324607
d "addsub2cc *ar7(t3), ac6, ac7, tc1, tc2, ac18" b3b7328607
d "band *ar12(t1), #0x4c, tc1" b23c18004c
d "bcnt ac2, ac8, tc2," a9bd6208
d "bfxpa #0x500, ac11," c637eb0500
@ -162,12 +398,23 @@ d "btstp @#0x45, ac19" 8945d3e8
d "btstset #0x1d, dbl(*ar1(t1<<#1)), tc2" 91316f3d
d "callcc #0x008cce," 9b8cceef
d "circ" 27
d "rpt csr" 01dd 0x0 nop
d "rptadd csr, #0x7" 0177 0x0 nop
d "rptsub csr, #0x6" 0106 0x0 nop
d "rptadd csr, ar0" 0180 0x0 nop
d "cmpand ac29.h < ac25, !tc1, tc2" a4dd1989
d "cmporu ac13.l >= t0, !tc2, tc2" a4edb0af
d "delay @#0x1b" 601bf4
d "amar @#0x12" 6212c0
d "amar @#0x7f" 627fc0
d "dmaxdiff ac13, ac12, ac22, ac6, trn4" d4d6260d4c
d "dmindiff ac13, ac22, ac31, ac4, trn1" d49fe4adf6
d "exp ac23, ac12.h" a94c1457
d "mant ac31, ac0 :: nexp ac31, ac0" a900801f
d "mant ac0, ac16 :: nexp ac0, ac0.h" a9409000
d "cmpand ac1 < ac25, tc1, tc2" a4011989 0x0 (set st0_55 (ite (&& (&& (sle (var ac1) (var ac25)) (! (== (var ac1) (var ac25)))) (! (is_zero (& (var st0_55) (bv 16 0x2000))))) (| (var st0_55) (bv 16 0x1000)) (& (var st0_55) (bv 16 0xefff))))
d "cmpor ac1 < ac0, tc1, tc2" a4018089 0x0 (set st0_55 (ite (|| (&& (sle (var ac1) (var ac0)) (! (== (var ac1) (var ac0)))) (! (is_zero (& (var st0_55) (bv 16 0x2000))))) (| (var st0_55) (bv 16 0x1000)) (& (var st0_55) (bv 16 0xefff))))
d "bcnt ac2, ac8, tc2, ac0" a9806208
d "firsadd *ar6, *ar15+, *ar4, ac6, ac22" eb36861f3634
d "firssub *ar3-, *ar5-, *ar6-, ac10, ac18" eb038a055206
d "lms *(ar5+t0), *(ar15+t0), ac31, ac8" cee55fef48
@ -175,20 +422,29 @@ d "lmsf *(ar9+t1), *(ar3-t1), ac12, ac9" cef92cd3a9
d "mac ar8, ac22, ac5" aa05a816
d "mack #0x3d, rptc, ac12, ac15" c70fecb93d
d "macmk t3 = *ar6(t0), #0xcb, ac7, ac28" b9261cc7cb
d "mpymk t3 = *ar6(t0), #0xcb, ac28" b9261c00cb
d "mant ac29, ac27 :: nexp ac29, ac22.l" a976fb1d
d "mas ac13, ac6, ac25" aa99060d
d "masm t3 = *(ar10-t0), ac6, ac30, ac6" bb4a069e06
d "mpym t3 = *(ar10-t0), ac6, ac6" bb4a060006
d "macm t3 = *(ar10-t0), ac6, ac0, ac6" bb4a064006
d "maxdiff ac8, ac12, ac5, ac3, pair(trn4)" d44543c84c
d "mindiff ac17, ac7, ac8, ac7, pair(trn0)" d408c7b1c7
d "mpyr ar5, ac16, ac7" aa271025
d "mpyk #0x59, t2, ac1" c7012c3259
d "mpymk *(ar0-t0b), #0xd9, ac10" b8004a1ed9
d "macmk *(ar0-t0b), #0xd9, ac0, ac10" b8004a40d9
d "mpymkf *(ar0-t0b), #0xd9, ac10" b8004a20d9
d "not ac6.l, ar0" 75a0e6
d "popboth xar13" 0ded
d "reset" 0034
d "retcc ac3.l > #0" 089b
d "round ac19, ac2" 7922d3
d "satr ac19, ac2" 79a2d3
d "sat ac19, ac2" 79c2d3
d "rpt csr" 01dd
d "rpt #0x3" 6c0003 0x0 nop
d "rpt #0xffff" 6cffff 0x0 nop
d "rptadd csr, #0x7" 0177
d "rptb #0x004976" 6f4976
d "rptcc #0xed, == #0" 6d0ded
@ -198,9 +454,13 @@ d "sftcc ac7, tc2" a987b9b3
d "sftsc ac27, ac17.h," a6bd9bd1
d "sim_trig" 03fc
d "sqam *ar3, ac6, ac6" 92038646
d "sqrm *ar3, ac6" 92038600 0x0 (set ac6 (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar3)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar3)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar3)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar3)) (bv 24 0x2))))))
d "sqdst *(ar3+t0), *ar5+, ac10, ac2" ce636a1562
d "sqrmr *ar13, ac14" 920dae0b
d "sqsm @#0x5e, ac22, ac9" 925ec996
d "subadd t3, dual(*sp(#0x60)), ac3" 8fe0c3f3
d "subc *ar0, ac3, ac3" b30083e31a
d "subc @#0x0, ac3, ac3" b300c3e31a
d "swap ar1, ar3" 0386
d "swap ac0, ac2" 0381 0x0 (seq (set ac0 (^ (var ac0) (var ac2))) (set ac2 (^ (var ac2) (var ac0))) (set ac0 (^ (var ac0) (var ac2))))
d "swap t0, t2" 0389 0x0 (seq (set t0 (^ (var t0) (var t2))) (set t2 (^ (var t2) (var t0))) (set t0 (^ (var t0) (var t2))))

474
test/db/asm/tms320_c55x_32
View file

@ -49,6 +49,7 @@ d "b 0x1230" 061230 0x0 (jmp (bv 24 0x1233))
d "b 0x0123" 060123 0x0 (jmp (bv 24 0x126))
d "call 0xDEAD" 08dead 0x0 (jmp (bv 24 0xffdeb0))
d "rpt 0xDEAD" 0cdead 0x0 nop
d "|| rpt 0x1234" 0d1234 0x0 nop
d "rptb 0xDEAD" 0edead 0x0 nop
d "and ac0 << 0x00" 100000
d "or ac1 << 0x11, ac0" 101111 0x0 (set ac0 (| (var ac0) (<< (var ac1) (bv 8 0x11) false)))
@ -85,6 +86,21 @@ d "dmaxdiff ac0, ac1, ac2, ac3, trn1" 108d71
d "mindiff ac3, ac2, ac1, ac0" 107e80
d "dmindiff ac3, ac2, ac1, ac0, trn0" 107f80
d "dmindiff ac3, ac2, ac1, ac0, trn1" 107f81
d "sftl ac0, 0x01" 100701 0x0 (set ac0 (<< (var ac0) (bv 6 0x1) false))
d "sftl ac0, 0x37" 100737 0x0 (set ac0 (>> (var ac0) (bv 6 0x9) false))
d "sfts ac0, 0x01" 100501 0x0 (set ac0 (<< (var ac0) (bv 6 0x1) false))
d "sftl ac0, 0x01, ac1" 104701 0x0 (set ac1 (<< (var ac0) (bv 6 0x1) false))
d "sftsc ac0, 0x01" 100601
d "and ac0 << 0x01" 100001
d "or ac0 << 0x01" 100101
d "xor ac0 << 0x01" 100201
d "and ac0 << 0x01, ac1" 104001 0x0 (set ac1 (& (var ac1) (<< (var ac0) (bv 8 0x1) false)))
d "xor ac0 << 0x01, ac1" 104201 0x0 (set ac1 (^ (var ac1) (<< (var ac0) (bv 8 0x1) false)))
d "add ac0 << 0x01, ac0" 100301 0x0 (set ac0 (+ (var ac0) (<< (var ac0) (bv 8 0x1) false)))
d "sub ac0 << 0x01, ac0" 100401 0x0 (set ac0 (- (var ac0) (<< (var ac0) (bv 8 0x1) false)))
d "add ac0 << 0x01, ac1" 104301 0x0 (set ac1 (+ (var ac1) (<< (var ac0) (bv 8 0x1) false)))
d "add ac0 << 0x37, ac1" 104337 0x0 (set ac1 (+ (var ac1) (<< (var ac0) (bv 8 0x37) false)))
d "add ac0 << 0x3F, ac1" 10433f 0x0 (set ac1 (+ (var ac1) (<< (var ac0) (bv 8 0x3f) false)))
d "cmp ac0 == ar2, tc1" 1200a0 0x0 (set st0_55 (ite (== (var ac0) (cast 40 (msb (var ar2)) (var ar2))) (| (var st0_55) (bv 16 0x2000)) (& (var st0_55) (bv 16 0xdfff))))
d "cmpand ac1 == ar3, tc1, tc2" 1211b1 0x0 (set st0_55 (ite (&& (== (var ac1) (cast 40 (msb (var ar3)) (var ar3))) (! (is_zero (& (var st0_55) (bv 16 0x2000))))) (| (var st0_55) (bv 16 0x1000)) (& (var st0_55) (bv 16 0xefff))))
d "cmpand ac2 == ar4, !tc1, tc2" 1221c9 0x0 (set st0_55 (ite (&& (== (var ac2) (cast 40 (msb (var ar4)) (var ar4))) (! (! (is_zero (& (var st0_55) (bv 16 0x2000)))))) (| (var st0_55) (bv 16 0x1000)) (& (var st0_55) (bv 16 0xefff))))
@ -95,10 +111,31 @@ d "cmpandu t2 == ac0, tc2, tc1" 126106 0x0 (set st0_55 (ite (&& (== (cast 40 fal
d "cmpandu t3 == ac1, !tc2, tc1" 12711e 0x0 (set st0_55 (ite (&& (== (cast 40 false (var t3)) (var ac1)) (! (! (is_zero (& (var st0_55) (bv 16 0x1000)))))) (| (var st0_55) (bv 16 0x2000)) (& (var st0_55) (bv 16 0xdfff))))
d "cmporu ar0 == ac2, tc1, tc2" 128225 0x0 (set st0_55 (ite (|| (== (cast 40 false (var ar0)) (var ac2)) (! (is_zero (& (var st0_55) (bv 16 0x2000))))) (| (var st0_55) (bv 16 0x1000)) (& (var st0_55) (bv 16 0xefff))))
d "cmporu ar1 == ac3, !tc1, tc2" 12923d 0x0 (set st0_55 (ite (|| (== (cast 40 false (var ar1)) (var ac3)) (! (! (is_zero (& (var st0_55) (bv 16 0x2000)))))) (| (var st0_55) (bv 16 0x1000)) (& (var st0_55) (bv 16 0xefff))))
d "cmp ac0 == ac0, tc1" 120000 0x0 (set st0_55 (ite (== (var ac0) (var ac0)) (| (var st0_55) (bv 16 0x2000)) (& (var st0_55) (bv 16 0xdfff))))
d "cmp ac0 < ac1, tc1" 120410 0x0 (set st0_55 (ite (&& (sle (var ac0) (var ac1)) (! (== (var ac0) (var ac1)))) (| (var st0_55) (bv 16 0x2000)) (& (var st0_55) (bv 16 0xdfff))))
d "cmp ac3 >= ac0, tc2" 123801 0x0 (set st0_55 (ite (! (&& (sle (var ac3) (var ac0)) (! (== (var ac3) (var ac0))))) (| (var st0_55) (bv 16 0x1000)) (& (var st0_55) (bv 16 0xefff))))
d "cmp t0 != ac0, tc1" 124c00 0x0 (set st0_55 (ite (! (== (cast 40 (msb (var t0)) (var t0)) (var ac0))) (| (var st0_55) (bv 16 0x2000)) (& (var st0_55) (bv 16 0xdfff))))
d "cmpand ac0 == ac1, tc1, tc1" 120110 0x0 (set st0_55 (ite (&& (== (var ac0) (var ac1)) (! (is_zero (& (var st0_55) (bv 16 0x2000))))) (| (var st0_55) (bv 16 0x2000)) (& (var st0_55) (bv 16 0xdfff))))
d "cmpor ac0 == ac0, tc2, tc1" 120202 0x0 (set st0_55 (ite (|| (== (var ac0) (var ac0)) (! (is_zero (& (var st0_55) (bv 16 0x1000))))) (| (var st0_55) (bv 16 0x2000)) (& (var st0_55) (bv 16 0xdfff))))
d "rol carry, ac0, carry, ac3" 120330 0x0 (seq (set ac3 (| (<< (var ac0) (bv 6 0x1) false) (cast 40 false (& (>> (var st0_55) (bv 8 0xb) false) (bv 16 0x1))))) (set st0_55 (ite (msb (var ac0)) (| (var st0_55) (bv 16 0x800)) (& (var st0_55) (bv 16 0xf7ff)))))
d "rol tc2, ac1, carry, ac2" 121321 0x0 (seq (set ac2 (| (<< (var ac1) (bv 6 0x1) false) (cast 40 false (& (>> (var st0_55) (bv 8 0xc) false) (bv 16 0x1))))) (set st0_55 (ite (msb (var ac1)) (| (var st0_55) (bv 16 0x800)) (& (var st0_55) (bv 16 0xf7ff)))))
d "ror tc2, ac2, carry, ac1" 12231a 0x0 (seq (set ac1 (| (>> (var ac2) (bv 6 0x1) false) (<< (cast 40 false (& (>> (var st0_55) (bv 8 0xc) false) (bv 16 0x1))) (bv 6 0x27) false))) (set st0_55 (ite (lsb (var ac2)) (| (var st0_55) (bv 16 0x800)) (& (var st0_55) (bv 16 0xf7ff)))))
d "ror tc2, ac3, tc2, ac0" 12330b 0x0 (seq (set ac0 (| (>> (var ac3) (bv 6 0x1) false) (<< (cast 40 false (& (>> (var st0_55) (bv 8 0xc) false) (bv 16 0x1))) (bv 6 0x27) false))) (set st0_55 (ite (lsb (var ac3)) (| (var st0_55) (bv 16 0x1000)) (& (var st0_55) (bv 16 0xefff)))))
d "rol carry, ac0, tc2, ac3" 120332 0x0 (seq (set ac3 (| (<< (var ac0) (bv 6 0x1) false) (cast 40 false (& (>> (var st0_55) (bv 8 0xb) false) (bv 16 0x1))))) (set st0_55 (ite (msb (var ac0)) (| (var st0_55) (bv 16 0x1000)) (& (var st0_55) (bv 16 0xefff)))))
d "ror carry, ac1, tc2, ac1" 121319 0x0 (seq (set ac1 (| (>> (var ac1) (bv 6 0x1) false) (<< (cast 40 false (& (>> (var st0_55) (bv 8 0xb) false) (bv 16 0x1))) (bv 6 0x27) false))) (set st0_55 (ite (lsb (var ac1)) (| (var st0_55) (bv 16 0x1000)) (& (var st0_55) (bv 16 0xefff)))))
d "rol carry, ac0, carry, ar2" 1203a0
d "mpyk 0x1234, ac0" 79123400 0x0 (set ac0 (* (bv 40 0x1234) (cast 40 (msb (cast 16 false (var ac0))) (cast 16 false (var ac0)))))
d "mpyk 0x12, ac0, ac3" 1e1234 0x0 (set ac3 (* (bv 40 0x12) (cast 40 (msb (cast 16 false (var ac0))) (cast 16 false (var ac0)))))
d "mpykr 0x1234, ac0" 79123401 0x0 (set ac0 (& (+ (* (bv 40 0x1234) (cast 40 (msb (cast 16 false (var ac0))) (cast 16 false (var ac0)))) (bv 40 0x8000)) (bv 40 0xffffff0000)))
d "mpyk 0x80, ac0" 1e8000 0x0 (set ac0 (* (bv 40 0x80) (cast 40 (msb (cast 16 false (var ac0))) (cast 16 false (var ac0)))))
d "mpykr 0x00, ac0" 1e0001 0x0 (set ac0 (& (+ (* (bv 40 0x0) (cast 40 (msb (cast 16 false (var ac0))) (cast 16 false (var ac0)))) (bv 40 0x8000)) (bv 40 0xffffff0000)))
d "mpyk 0x1234, ac0, ac1" 79123410 0x0 (set ac1 (* (bv 40 0x1234) (cast 40 (msb (cast 16 false (var ac0))) (cast 16 false (var ac0)))))
d "mack t0, 0x1234, ac0" 79123402 0x0 (set ac0 (+ (var ac0) (* (cast 40 (msb (var t0)) (var t0)) (bv 40 0x1234))))
d "mackr t0, 0x1234, ac0" 79123403 0x0 (set ac0 (& (+ (+ (var ac0) (* (cast 40 (msb (var t0)) (var t0)) (bv 40 0x1234))) (bv 40 0x8000)) (bv 40 0xffffff0000)))
d "mack t3, 0x80, ac0" 1e800e 0x0 (set ac0 (+ (var ac0) (* (cast 40 (msb (var t3)) (var t3)) (bv 40 0x80))))
d "mack t2, 0x12, ac1, ac3" 1e127a 0x0 (set ac3 (+ (var ac1) (* (cast 40 (msb (var t2)) (var t2)) (bv 40 0x12))))
d "|| mpyk 0x12, ac0, ac3" 1f1234 0x0 (set ac3 (* (bv 40 0x12) (cast 40 (msb (cast 16 false (var ac0))) (cast 16 false (var ac0)))))
d "|| mack t2, 0x12, ac1, ac3" 1f127a 0x0 (set ac3 (+ (var ac1) (* (cast 40 (msb (var t2)) (var t2)) (bv 40 0x12))))
d "aadd ac0, ac0" 140000 0x0 (set ac0 (+ (var ac0) (var ac0)))
d "amov ac0, ac0" 140001 0x0 (set ac0 (var ac0))
d "asub ac0, ac0" 140002 0x0 (set ac0 (- (var ac0) (var ac0)))
@ -117,6 +154,37 @@ d "asub xar2, xar3" 14a1b2 0x0 (set xar3 (- (var xar3) (var xar2)))
d "aadd xar3, xar2" 14b1a8 0x0 (set xar2 (+ (var xar2) (var xar3)))
d "amov xar4, xar1" 14c199 0x0 (set xar1 (var xar4))
d "asub xar5, xar0" 14d18a 0x0 (set xar0 (- (var xar0) (var xar5)))
d "amov ac0, ac0" 140001 0x0 (set ac0 (var ac0))
d "asub ac0, ac1" 140012 0x0 (set ac1 (- (var ac1) (var ac0)))
d "asub ac0, t0" 140042 0x0 (set t0 (- (var t0) (cast 16 false (var ac0))))
d "amov ac0, xar0" 140081 0x0 (set xar0 (cast 23 false (var ac0)))
d "rptcc 0x00, ac0 == 0" 000000 0x0 nop
d "rptcc 0xFF, ac0 == 0" 0000ff 0x0 nop
d "rptcc 0x00, ac0 > 0" 004000 0x0 nop
d "rptcc 0x00, !tc1 ^ !tc2" 00ff00 0x0 nop
d "rptb 0x0000" 0e0000 0x0 nop
d "rptb 0xFF00" 0eff00 0x0 nop
d "rpt csr" 4800 0x0 nop
d "rptadd csr, ac0" 4801 0x0 nop
d "rptadd csr, ar7" 48f1 0x0 nop
d "rptadd csr, 0xF" 48f2 0x0 nop
d "rptsub csr, 0x0" 4803 0x0 nop
d "rptsub csr, 0xF" 48f3 0x0 nop
d "exp ac0, t0" 100800
d "exp ac1, t0" 101800
d "exp ac2, t1" 102810
d "exp ac3, t3" 103830
d "bcnt ac0, ac1, tc2, t0" 100a41
d "maxdiff ac1, ac0, ac0, ac0" 101c00
d "maxdiff ac0, ac3, ac0, ac3" 100cff
d "mindiff ac0, ac0, ac0, ac0" 100e00
d "dmaxdiff ac0, ac0, ac0, ac0, trn1" 100d01
d "dmindiff ac0, ac0, ac0, ac1, trn0" 100f10
d "mov *+ar0, ac0" a019
d "mov *-ar0, ac0" a01b
d "mov *+ar3, ac1" a179
d "mov ac0, *+ar0" c019
d "mov ac0, *-ar0" c01b
d "mov 0x1A, dph" 1601a0 0x0 (set dph (bv 7 0x1a))
d "mov 0x25, dph" 160250 0x0 (set dph (bv 7 0x25))
d "mov 0x4A, dph" 1604a0 0x0 (set dph (bv 7 0x4a))
@ -131,6 +199,8 @@ d "mov 0x5B1, brc1" 165b1a 0x0 (set brc1 (bv 16 0x5b1))
d "and 0x11, ac0, ac1" 181110 0x0 (set ac1 (& (var ac0) (bv 40 0x11)))
d "or 0x22, ac2, ac3" 1a2232 0x0 (set ac3 (| (var ac2) (bv 40 0x22)))
d "xor 0x33, t0, t1" 1c3354 0x0 (set t1 (^ (var t0) (bv 16 0x33)))
d "|| or 0x12, ac0, ac1" 1b1210 0x0 (set ac1 (| (var ac0) (bv 40 0x12)))
d "and 0x12, ac0, t0" 181240 0x0 (set t0 (& (cast 16 false (var ac0)) (bv 16 0x12)))
d "mpyk 0x11, ac0, ac1" 1e1110 0x0 (set ac1 (* (bv 40 0x11) (cast 40 (msb (cast 16 false (var ac0))) (cast 16 false (var ac0)))))
d "mpykr 0x22, ac1, ac2" 1e2261 0x0 (set ac2 (& (+ (* (bv 40 0x22) (cast 40 (msb (cast 16 false (var ac1))) (cast 16 false (var ac1)))) (bv 40 0x8000)) (bv 40 0xffffff0000)))
d "mack t1, 0x33, ac0, ac1" 1e3316 0x0 (set ac1 (+ (var ac0) (* (cast 40 (msb (var t1)) (var t1)) (bv 40 0x33))))
@ -155,13 +225,29 @@ d "neg t1, ar4" 345c 0x0 (set ar4 (- (bv 16 0x0) (var t1)))
d "not t2, ar5" 366d 0x0 (set ar5 (~ (var t2)))
d "psh ac1, ac2" 3812 0x0 (seq (set sp (- (var sp) (bv 16 0x2))) (storew 0 (* (cast 24 false (var sp)) (bv 24 0x2)) (cast 32 false (var ac1))) (set sp (- (var sp) (bv 16 0x2))) (storew 0 (* (cast 24 false (var sp)) (bv 24 0x2)) (cast 32 false (var ac2))))
d "pop ac3, t0" 3a34 0x0 (seq (set ac3 (| (& (var ac3) (bv 40 0xff00000000)) (cast 40 false (loadw 0 32 (* (cast 24 false (var sp)) (bv 24 0x2)))))) (set sp (+ (var sp) (bv 16 0x2))) (set t0 (loadw 0 16 (* (cast 24 false (var sp)) (bv 24 0x2)))) (set sp (+ (var sp) (bv 16 0x1))))
d "|| psh ac0, t0" 3904 0x0 (seq (set sp (- (var sp) (bv 16 0x2))) (storew 0 (* (cast 24 false (var sp)) (bv 24 0x2)) (cast 32 false (var ac0))) (set sp (- (var sp) (bv 16 0x1))) (storew 0 (* (cast 24 false (var sp)) (bv 24 0x2)) (var t0)))
d "psh ar0, ar4" 388c 0x0 (seq (set sp (- (var sp) (bv 16 0x1))) (storew 0 (* (cast 24 false (var sp)) (bv 24 0x2)) (var ar0)) (set sp (- (var sp) (bv 16 0x1))) (storew 0 (* (cast 24 false (var sp)) (bv 24 0x2)) (var ar4)))
d "mov 0xF, t0" 3cf4 0x0 (set t0 (bv 16 0xf))
d "mov -0xF, t1" 3ef5
d "add 0xF, t2" 40f6 0x0 (set t2 (+ (var t2) (bv 16 0xf)))
d "sub 0xF, t3" 42f7 0x0 (set t3 (- (var t3) (bv 16 0xf)))
d "mov hi(ac0), ar0" 4408 0x0 (set ar0 (cast 16 false (>> (var ac0) (bv 8 0x10) false)))
d "sfts ac0, #-1" 4440
d "mov hi(ac0), ac0" 4400 0x0 (set ac0 (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false))))
d "mov hi(ac1), ac0" 4410 0x0 (set ac0 (cast 40 (msb (cast 16 false (>> (var ac1) (bv 8 0x10) false))) (cast 16 false (>> (var ac1) (bv 8 0x10) false))))
d "mov hi(ac0), ar7" 440f 0x0 (set ar7 (cast 16 false (>> (var ac0) (bv 8 0x10) false)))
d "|| mov hi(ac0), ac0" 4500 0x0 (set ac0 (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false))))
d "sfts ac0, #-1" 4440 0x0 (set ac0 (>> (var ac0) (bv 6 0x1) (msb (var ac0))))
d "sfts ac0, #1" 4450 0x0 (set ac0 (<< (var ac0) (bv 6 0x1) false))
d "sfts t0, #1" 4454 0x0 (set t0 (<< (var t0) (bv 6 0x1) false))
d "sfts ar0, #1" 4458 0x0 (set ar0 (<< (var ar0) (bv 6 0x1) false))
d "|| sfts ac0, #1" 4550 0x0 (set ac0 (<< (var ac0) (bv 6 0x1) false))
d "mov sp, ac0" 4480 0x0 (set ac0 (cast 40 (msb (var sp)) (var sp)))
d "mov ssp, ac0" 4490 0x0 (set ac0 (cast 40 (msb (var ssp)) (var ssp)))
d "mov cdp, ac0" 44a0 0x0 (set ac0 (cast 40 (msb (var cdp)) (var cdp)))
d "mov brc0, ac0" 44c0 0x0 (set ac0 (cast 40 (msb (var brc0)) (var brc0)))
d "mov rptc, ac0" 44e0 0x0 (set ac0 (cast 40 (msb (var rptc)) (var rptc)))
d "mov sp, ar0" 4488 0x0 (set ar0 (var sp))
d "|| mov sp, ac0" 4580 0x0 (set ac0 (cast 40 (msb (var sp)) (var sp)))
d "mov sp, ar0" 4488 0x0 (set ar0 (var sp))
d "mov ssp, ar1" 4499 0x0 (set ar1 (var ssp))
d "mov cdp, ar2" 44aa 0x0 (set ar2 (var cdp))
@ -187,15 +273,40 @@ d "b 0x7F" 4a7f 0x0 (jmp (bv 24 0x81))
d "rptblocal 0x7F" 4aff 0x0 nop
d "rpt 0xFF" 4cff 0x0 nop
d "aadd 0xFF, sp" 4eff 0x0 (set sp (+ (var sp) (bv 16 0xff)))
d "aadd 0x08, sp" 4e08 0x0 (set sp (+ (var sp) (bv 16 0x8)))
d "|| aadd 0x01, sp" 4f01 0x0 (set sp (+ (var sp) (bv 16 0x1)))
d "sftl ac0, #1" 5000 0x0 (set ac0 (<< (var ac0) (bv 6 0x1) false))
d "sftl ac0, #-1" 5001
d "sftl ac0, #-1" 5001 0x0 (set ac0 (>> (var ac0) (bv 6 0x1) false))
d "sftl t0, #1" 5040 0x0 (set t0 (<< (var t0) (bv 6 0x1) false))
d "sftl ar0, #1" 5080 0x0 (set ar0 (<< (var ar0) (bv 6 0x1) false))
d "pop ac0" 5002 0x0 (seq (set ac0 (| (& (var ac0) (bv 40 0xff00000000)) (cast 40 false (loadw 0 32 (* (cast 24 false (var sp)) (bv 24 0x2)))))) (set sp (+ (var sp) (bv 16 0x2))))
d "pop dbl(ac0)" 5003 0x0 (seq (set ac0 (| (& (var ac0) (bv 40 0xff00000000)) (cast 40 false (loadw 0 32 (* (cast 24 false (var sp)) (bv 24 0x2)))))) (set sp (+ (var sp) (bv 16 0x2))))
d "psh ac0" 5006 0x0 (seq (set sp (- (var sp) (bv 16 0x2))) (storew 0 (* (cast 24 false (var sp)) (bv 24 0x2)) (cast 32 false (var ac0))))
d "psh dbl(ac0)" 5007 0x0 (seq (set sp (- (var sp) (bv 16 0x2))) (storew 0 (* (cast 24 false (var sp)) (bv 24 0x2)) (cast 32 false (var ac0))))
d "popboth ac0" 5004
d "pshboth ac0" 5005
d "popboth xsp" 5044
d "popboth xcdp" 5074
d "popboth xar0" 5084
d "pshboth xar7" 50f5
d "|| popboth ac0" 5104
d "pop t0" 5042 0x0 (seq (set t0 (loadw 0 16 (* (cast 24 false (var sp)) (bv 24 0x2)))) (set sp (+ (var sp) (bv 16 0x1))))
d "psh t0" 5046 0x0 (seq (set sp (- (var sp) (bv 16 0x1))) (storew 0 (* (cast 24 false (var sp)) (bv 24 0x2)) (var t0)))
d "pop ar0" 5082 0x0 (seq (set ar0 (loadw 0 16 (* (cast 24 false (var sp)) (bv 24 0x2)))) (set sp (+ (var sp) (bv 16 0x1))))
d "psh ar0" 5086 0x0 (seq (set sp (- (var sp) (bv 16 0x1))) (storew 0 (* (cast 24 false (var sp)) (bv 24 0x2)) (var ar0)))
d "pop dbl(ac0)" 5083 0x0 (seq (set ac0 (| (& (var ac0) (bv 40 0xff00000000)) (cast 40 false (loadw 0 32 (* (cast 24 false (var sp)) (bv 24 0x2)))))) (set sp (+ (var sp) (bv 16 0x2))))
d "psh dbl(ac2)" 5067 0x0 (seq (set sp (- (var sp) (bv 16 0x2))) (storew 0 (* (cast 24 false (var sp)) (bv 24 0x2)) (cast 32 false (var ac2))))
d "|| pop ac0" 5102 0x0 (seq (set ac0 (| (& (var ac0) (bv 40 0xff00000000)) (cast 40 false (loadw 0 32 (* (cast 24 false (var sp)) (bv 24 0x2)))))) (set sp (+ (var sp) (bv 16 0x2))))
d "|| psh ac0" 5106 0x0 (seq (set sp (- (var sp) (bv 16 0x2))) (storew 0 (* (cast 24 false (var sp)) (bv 24 0x2)) (cast 32 false (var ac0))))
d "mov ac0, hi(ac0)" 5200 0x0 (set ac0 (| (& (var ac0) (bv 40 0xff0000ffff)) (<< (cast 40 false (cast 16 false (var ac0))) (bv 6 0x10) false)))
d "mov ac0, hi(ac1)" 5201 0x0 (set ac1 (| (& (var ac1) (bv 40 0xff0000ffff)) (<< (cast 40 false (cast 16 false (var ac0))) (bv 6 0x10) false)))
d "mov t0, hi(ac0)" 5240 0x0 (set ac0 (| (& (var ac0) (bv 40 0xff0000ffff)) (<< (cast 40 false (var t0)) (bv 6 0x10) false)))
d "mov ar0, hi(ac0)" 5280 0x0 (set ac0 (| (& (var ac0) (bv 40 0xff0000ffff)) (<< (cast 40 false (var ar0)) (bv 6 0x10) false)))
d "|| mov ac0, hi(ac0)" 5300 0x0 (set ac0 (| (& (var ac0) (bv 40 0xff0000ffff)) (<< (cast 40 false (cast 16 false (var ac0))) (bv 6 0x10) false)))
d "mov ac0, sp" 5208 0x0 (set sp (cast 16 false (var ac0)))
d "mov ac0, csr" 520c 0x0 (set csr (cast 16 false (var ac0)))
d "mov ac0, brc0" 520e 0x0 (set brc0 (cast 16 false (var ac0)))
d "mov t0, sp" 5248 0x0 (set sp (var t0))
d "mov ac0, sp" 5208 0x0 (set sp (cast 16 false (var ac0)))
d "mov ac0, ssp" 5209 0x0 (set ssp (cast 16 false (var ac0)))
d "mov ac0, cdp" 520a 0x0 (set cdp (cast 16 false (var ac0)))
@ -203,24 +314,86 @@ d "mov ac0, csr" 520c 0x0 (set csr (cast 16 false (var ac0)))
d "mov ac0, brc1" 520d 0x0 (set brc1 (cast 16 false (var ac0)))
d "mov ac0, brc0" 520e 0x0 (set brc0 (cast 16 false (var ac0)))
d "addrv ac1, ac2" 5491
d "sqar ac1, ac2" 5493 0x0 (set ac2 (* (cast 40 (msb (cast 16 false (var ac1))) (cast 16 false (var ac1))) (cast 40 (msb (cast 16 false (var ac1))) (cast 16 false (var ac1)))))
d "addv ac0" 5400 0x0 (set ac0 (+ (var ac0) (ite (msb (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false)))) (- (bv 40 0x0) (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false)))) (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false))))))
d "addrv ac0" 5401 0x0 (set ac0 (+ (var ac0) (ite (msb (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false)))) (- (bv 40 0x0) (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false)))) (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false))))))
d "addv ac1, ac2" 5490 0x0 (set ac2 (+ (var ac2) (ite (msb (cast 40 (msb (cast 16 false (>> (var ac1) (bv 8 0x10) false))) (cast 16 false (>> (var ac1) (bv 8 0x10) false)))) (- (bv 40 0x0) (cast 40 (msb (cast 16 false (>> (var ac1) (bv 8 0x10) false))) (cast 16 false (>> (var ac1) (bv 8 0x10) false)))) (cast 40 (msb (cast 16 false (>> (var ac1) (bv 8 0x10) false))) (cast 16 false (>> (var ac1) (bv 8 0x10) false))))))
d "addrv ac1, ac2" 5491 0x0 (set ac2 (+ (var ac2) (ite (msb (cast 40 (msb (cast 16 false (>> (var ac1) (bv 8 0x10) false))) (cast 16 false (>> (var ac1) (bv 8 0x10) false)))) (- (bv 40 0x0) (cast 40 (msb (cast 16 false (>> (var ac1) (bv 8 0x10) false))) (cast 16 false (>> (var ac1) (bv 8 0x10) false)))) (cast 40 (msb (cast 16 false (>> (var ac1) (bv 8 0x10) false))) (cast 16 false (>> (var ac1) (bv 8 0x10) false))))))
d "addv ac1, ac0" 5410 0x0 (set ac0 (+ (var ac0) (ite (msb (cast 40 (msb (cast 16 false (>> (var ac1) (bv 8 0x10) false))) (cast 16 false (>> (var ac1) (bv 8 0x10) false)))) (- (bv 40 0x0) (cast 40 (msb (cast 16 false (>> (var ac1) (bv 8 0x10) false))) (cast 16 false (>> (var ac1) (bv 8 0x10) false)))) (cast 40 (msb (cast 16 false (>> (var ac1) (bv 8 0x10) false))) (cast 16 false (>> (var ac1) (bv 8 0x10) false))))))
d "sqar ac1, ac2" 5493 0x0 (set ac2 (& (+ (+ (var ac2) (* (cast 40 (msb (cast 16 false (>> (var ac1) (bv 8 0x10) false))) (cast 16 false (>> (var ac1) (bv 8 0x10) false))) (cast 40 (msb (cast 16 false (>> (var ac1) (bv 8 0x10) false))) (cast 16 false (>> (var ac1) (bv 8 0x10) false))))) (bv 40 0x8000)) (bv 40 0xffffff0000)))
d "sqsr ac1, ac2" 5495
d "mpyr ac1, ac2" 5497 0x0 (set ac2 (& (+ (* (cast 40 (msb (cast 16 false (var ac1))) (cast 16 false (var ac1))) (cast 40 (msb (cast 16 false (var ac2))) (cast 16 false (var ac2)))) (bv 40 0x8000)) (bv 40 0xffffff0000)))
d "sqrr ac1, ac2" 5499 0x0 (set ac2 (& (+ (* (cast 40 (msb (cast 16 false (var ac1))) (cast 16 false (var ac1))) (cast 40 (msb (cast 16 false (var ac1))) (cast 16 false (var ac1)))) (bv 40 0x8000)) (bv 40 0xffffff0000)))
d "mpyr ac1, ac2" 5497 0x0 (set ac2 (& (+ (* (cast 40 (msb (cast 16 false (>> (var ac1) (bv 8 0x10) false))) (cast 16 false (>> (var ac1) (bv 8 0x10) false))) (cast 40 (msb (cast 16 false (>> (var ac2) (bv 8 0x10) false))) (cast 16 false (>> (var ac2) (bv 8 0x10) false)))) (bv 40 0x8000)) (bv 40 0xffffff0000)))
d "mpy ac1, ac2" 5496 0x0 (set ac2 (* (cast 40 (msb (cast 16 false (>> (var ac1) (bv 8 0x10) false))) (cast 16 false (>> (var ac1) (bv 8 0x10) false))) (cast 40 (msb (cast 16 false (>> (var ac2) (bv 8 0x10) false))) (cast 16 false (>> (var ac2) (bv 8 0x10) false)))))
d "sqr ac1, ac2" 5498 0x0 (set ac2 (* (cast 40 (msb (cast 16 false (>> (var ac1) (bv 8 0x10) false))) (cast 16 false (>> (var ac1) (bv 8 0x10) false))) (cast 40 (msb (cast 16 false (>> (var ac1) (bv 8 0x10) false))) (cast 16 false (>> (var ac1) (bv 8 0x10) false)))))
d "sqa ac1, ac2" 5492 0x0 (set ac2 (+ (var ac2) (* (cast 40 (msb (cast 16 false (>> (var ac1) (bv 8 0x10) false))) (cast 16 false (>> (var ac1) (bv 8 0x10) false))) (cast 40 (msb (cast 16 false (>> (var ac1) (bv 8 0x10) false))) (cast 16 false (>> (var ac1) (bv 8 0x10) false))))))
d "sqs ac1, ac2" 5494 0x0 (set ac2 (- (var ac2) (* (cast 40 (msb (cast 16 false (>> (var ac1) (bv 8 0x10) false))) (cast 16 false (>> (var ac1) (bv 8 0x10) false))) (cast 40 (msb (cast 16 false (>> (var ac1) (bv 8 0x10) false))) (cast 16 false (>> (var ac1) (bv 8 0x10) false))))))
d "mpy ac0" 5406 0x0 (set ac0 (* (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false)))))
d "sqr ac0" 5408 0x0 (set ac0 (* (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false)))))
d "sqa ac0" 5402 0x0 (set ac0 (+ (var ac0) (* (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false))))))
d "sqr ac0, ac3" 54c8 0x0 (set ac3 (* (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false)))))
d "sqrr ac1, ac2" 5499 0x0 (set ac2 (& (+ (* (cast 40 (msb (cast 16 false (>> (var ac1) (bv 8 0x10) false))) (cast 16 false (>> (var ac1) (bv 8 0x10) false))) (cast 40 (msb (cast 16 false (>> (var ac1) (bv 8 0x10) false))) (cast 16 false (>> (var ac1) (bv 8 0x10) false)))) (bv 40 0x8000)) (bv 40 0xffffff0000)))
d "round ac1, ac2" 549b 0x0 (set ac2 (& (+ (var ac1) (bv 40 0x8000)) (bv 40 0xffffff0000)))
d "satr ac1, ac2" 549d 0x0 (set ac2 (ite (! (sle (var ac1) (bv 40 0x7fffffff))) (bv 40 0x7fffffff) (ite (&& (sle (var ac1) (bv 40 0xff80000000)) (! (== (var ac1) (bv 40 0xff80000000)))) (bv 40 0xff80000000) (var ac1))))
d "macr ac0, t0, ac0" 5601 0x0 (set ac0 (& (+ (+ (var ac0) (* (cast 40 (msb (cast 16 false (var ac0))) (cast 16 false (var ac0))) (cast 40 (msb (var t0)) (var t0)))) (bv 40 0x8000)) (bv 40 0xffffff0000)))
d "macr ac0, t0, ac1, ac1" 5641 0x0 (set ac1 (& (+ (+ (var ac1) (* (cast 40 (msb (cast 16 false (var ac0))) (cast 16 false (var ac0))) (cast 40 (msb (var t0)) (var t0)))) (bv 40 0x8000)) (bv 40 0xffffff0000)))
d "macr ac1, t0, ac0, ac1" 5843 0x0 (set ac1 (& (+ (+ (var ac0) (* (cast 40 (msb (cast 16 false (var ac1))) (cast 16 false (var ac1))) (cast 40 (msb (var t0)) (var t0)))) (bv 40 0x8000)) (bv 40 0xffffff0000)))
d "masr t0, ac0, ac1" 5643 0x0 (set ac1 (& (+ (- (var ac1) (* (cast 40 (msb (var t0)) (var t0)) (cast 40 (msb (cast 16 false (var ac0))) (cast 16 false (var ac0))))) (bv 40 0x8000)) (bv 40 0xffffff0000)))
d "mpyr t0, ac0, ac1" 5841 0x0 (set ac1 (& (+ (* (cast 40 (msb (var t0)) (var t0)) (cast 40 (msb (cast 16 false (var ac0))) (cast 16 false (var ac0)))) (bv 40 0x8000)) (bv 40 0xffffff0000)))
d "round ac0" 540a 0x0 (set ac0 (& (+ (var ac0) (bv 40 0x8000)) (bv 40 0xffffff0000)))
d "round ac1, ac2" 549a 0x0 (set ac2 (& (+ (var ac1) (bv 40 0x8000)) (bv 40 0xffffff0000)))
d "sat ac0" 540c 0x0 (set ac0 (ite (! (sle (var ac0) (bv 40 0x7fffffff))) (bv 40 0x7fffffff) (ite (&& (sle (var ac0) (bv 40 0xff80000000)) (! (== (var ac0) (bv 40 0xff80000000)))) (bv 40 0xff80000000) (var ac0))))
d "sat ac1, ac2" 549c 0x0 (set ac2 (ite (! (sle (var ac1) (bv 40 0x7fffffff))) (bv 40 0x7fffffff) (ite (&& (sle (var ac1) (bv 40 0xff80000000)) (! (== (var ac1) (bv 40 0xff80000000)))) (bv 40 0xff80000000) (var ac1))))
d "satr ac0" 540d 0x0 (set ac0 (ite (! (sle (var ac0) (bv 40 0x7fffffff))) (bv 40 0x7fffffff) (ite (&& (sle (var ac0) (bv 40 0xff80000000)) (! (== (var ac0) (bv 40 0xff80000000)))) (bv 40 0xff80000000) (var ac0))))
d "macr ac0, t0, ac0" 5601 0x0 (set ac0 (& (+ (+ (var ac0) (* (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 40 (msb (var t0)) (var t0)))) (bv 40 0x8000)) (bv 40 0xffffff0000)))
d "macr ac0, t0, ac1, ac1" 5641 0x0 (set ac1 (& (+ (+ (var ac1) (* (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 40 (msb (var t0)) (var t0)))) (bv 40 0x8000)) (bv 40 0xffffff0000)))
d "macr ac1, t0, ac0, ac1" 5843 0x0 (set ac1 (& (+ (+ (var ac0) (* (cast 40 (msb (cast 16 false (>> (var ac1) (bv 8 0x10) false))) (cast 16 false (>> (var ac1) (bv 8 0x10) false))) (cast 40 (msb (var t0)) (var t0)))) (bv 40 0x8000)) (bv 40 0xffffff0000)))
d "masr t0, ac0, ac1" 5643 0x0 (set ac1 (& (+ (- (var ac1) (* (cast 40 (msb (var t0)) (var t0)) (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false))))) (bv 40 0x8000)) (bv 40 0xffffff0000)))
d "mac ac0, t0, ac0" 5600 0x0 (set ac0 (+ (var ac0) (* (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 40 (msb (var t0)) (var t0)))))
d "mac ac1, t0, ac0, ac0" 5610 0x0 (set ac0 (+ (var ac0) (* (cast 40 (msb (cast 16 false (>> (var ac1) (bv 8 0x10) false))) (cast 16 false (>> (var ac1) (bv 8 0x10) false))) (cast 40 (msb (var t0)) (var t0)))))
d "mas t0, ac0" 5602 0x0 (set ac0 (- (var ac0) (* (cast 40 (msb (var t0)) (var t0)) (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false))))))
d "mas t0, ac1, ac0" 5612 0x0 (set ac0 (- (var ac0) (* (cast 40 (msb (var t0)) (var t0)) (cast 40 (msb (cast 16 false (>> (var ac1) (bv 8 0x10) false))) (cast 16 false (>> (var ac1) (bv 8 0x10) false))))))
d "mac ac0, t2, ac3, ac3" 56c8 0x0 (set ac3 (+ (var ac3) (* (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 40 (msb (var t2)) (var t2)))))
d "mas t2, ac0, ac3" 56ca 0x0 (set ac3 (- (var ac3) (* (cast 40 (msb (var t2)) (var t2)) (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false))))))
d "mpyr t0, ac0, ac1" 5841 0x0 (set ac1 (& (+ (* (cast 40 (msb (var t0)) (var t0)) (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false)))) (bv 40 0x8000)) (bv 40 0xffffff0000)))
d "mpy t0, ac0" 5800 0x0 (set ac0 (* (cast 40 (msb (var t0)) (var t0)) (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false)))))
d "mpy t0, ac1, ac0" 5810 0x0 (set ac0 (* (cast 40 (msb (var t0)) (var t0)) (cast 40 (msb (cast 16 false (>> (var ac1) (bv 8 0x10) false))) (cast 16 false (>> (var ac1) (bv 8 0x10) false)))))
d "mpyr t0, ac0" 5801 0x0 (set ac0 (& (+ (* (cast 40 (msb (var t0)) (var t0)) (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false)))) (bv 40 0x8000)) (bv 40 0xffffff0000)))
d "mpy t2, ac0, ac3" 58c8 0x0 (set ac3 (* (cast 40 (msb (var t2)) (var t2)) (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false)))))
d "sftl ac0, t0" 5c00 0x0 (set ac0 (ite (&& (sle (var t0) (bv 16 0x0)) (! (== (var t0) (bv 16 0x0)))) (>> (var ac0) (- (bv 16 0x0) (var t0)) false) (<< (var ac0) (var t0) false)))
d "sfts ac0, t0" 5c01 0x0 (set ac0 (ite (&& (sle (var t0) (bv 16 0x0)) (! (== (var t0) (bv 16 0x0)))) (>> (var ac0) (- (bv 16 0x0) (var t0)) (msb (var ac0))) (<< (var ac0) (var t0) false)))
d "sftl ac1, t0, ac0" 5c10 0x0 (set ac0 (ite (&& (sle (var t0) (bv 16 0x0)) (! (== (var t0) (bv 16 0x0)))) (>> (var ac1) (- (bv 16 0x0) (var t0)) false) (<< (var ac1) (var t0) false)))
d "sfts ac1, t0, ac0" 5c11 0x0 (set ac0 (ite (&& (sle (var t0) (bv 16 0x0)) (! (== (var t0) (bv 16 0x0)))) (>> (var ac1) (- (bv 16 0x0) (var t0)) (msb (var ac1))) (<< (var ac1) (var t0) false)))
d "sftl ac0, t1, ac1" 5c44 0x0 (set ac1 (ite (&& (sle (var t1) (bv 16 0x0)) (! (== (var t1) (bv 16 0x0)))) (>> (var ac0) (- (bv 16 0x0) (var t1)) false) (<< (var ac0) (var t1) false)))
d "sftl ac3, t2, ac2" 5cb8 0x0 (set ac2 (ite (&& (sle (var t2) (bv 16 0x0)) (! (== (var t2) (bv 16 0x0)))) (>> (var ac3) (- (bv 16 0x0) (var t2)) false) (<< (var ac3) (var t2) false)))
d "mpym *sp(#0h), *cdp, ac0" d10000 0x0 (set ac0 (* (cast 40 (msb (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2))))))
d "mpym *sp(#0h), *cdp+, ac0" d10001 0x0 (seq (set ac0 (* (cast 40 (msb (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))))) (set xcdp (+ (var xcdp) (bv 23 0x1))))
d "mpym *ar0, *cdp, ac0" d10100 0x0 (set ac0 (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2))))))
d "mpymr *sp(#0h), *cdp, ac0" d10040 0x0 (set ac0 (& (+ (* (cast 40 (msb (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2))))) (bv 40 0x8000)) (bv 40 0xffffff0000)))
d "macm *sp(#0h), *cdp, ac0" d10004 0x0 (set ac0 (+ (var ac0) (* (cast 40 (msb (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))))))
d "masm *sp(#0h), *cdp, ac0" d10008 0x0 (set ac0 (- (var ac0) (* (cast 40 (msb (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))))))
d "macmr *sp(#0h), *cdp, ac0" d10044 0x0 (set ac0 (& (+ (+ (var ac0) (* (cast 40 (msb (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))))) (bv 40 0x8000)) (bv 40 0xffffff0000)))
d "macm *sp(#0h), ac0, ac1" d20010 0x0 (set ac1 (+ (var ac1) (* (cast 40 (msb (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false))))))
d "masm *sp(#0h), ac0, ac1" d20014 0x0 (set ac1 (- (var ac1) (* (cast 40 (msb (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false))))))
d "macmr *sp(#0h), ac0, ac1" d20050 0x0 (set ac1 (& (+ (+ (var ac1) (* (cast 40 (msb (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false))))) (bv 40 0x8000)) (bv 40 0xffffff0000)))
d "macm *sp(#0h), t0, ac0" d40000 0x0 (set ac0 (+ (var ac0) (* (cast 40 (msb (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (cast 40 (msb (var t0)) (var t0)))))
d "macm *sp(#0h), t0, ac0, ac1" d40010 0x0 (set ac1 (+ (var ac0) (* (cast 40 (msb (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (cast 40 (msb (var t0)) (var t0)))))
d "masm *sp(#0h), t0, ac0, ac1" d50010 0x0 (set ac1 (- (var ac0) (* (cast 40 (msb (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (cast 40 (msb (var t0)) (var t0)))))
d "mpym *sp(#0h), ac0, ac1" d30010 0x0 (set ac1 (* (cast 40 (msb (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false)))))
d "mpym *sp(#0h), t0, ac0" d30004 0x0 (set ac0 (* (cast 40 (msb (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (cast 40 (msb (var t0)) (var t0))))
d "mpymr *sp(#0h), ac0" d30040 0x0 (set ac0 (& (+ (* (cast 40 (msb (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false)))) (bv 40 0x8000)) (bv 40 0xffffff0000)))
d "mpy *sp(#0h), uns(*cdp), ac0" d00004 0x0 (set ac0 (* (cast 40 (msb (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (cast 40 false (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2))))))
d "mac *sp(#0h), uns(*cdp), ac0" d00008 0x0 (set ac0 (+ (var ac0) (* (cast 40 (msb (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (cast 40 false (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))))))
d "mas *sp(#0h), uns(*cdp), ac0" d0000c 0x0 (set ac0 (- (var ac0) (* (cast 40 (msb (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (cast 40 false (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))))))
d "mpym *sp(#0h), *(cdp+t0), ac0" d10003 0x0 (seq (set ac0 (* (cast 40 (msb (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))))) (set xcdp (+ (var xcdp) (cast 23 (msb (var t0)) (var t0)))))
d "mpy *sp(#0h), uns(*(cdp+t0)), ac0" d00007 0x0 (seq (set ac0 (* (cast 40 (msb (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (cast 40 false (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))))) (set xcdp (+ (var xcdp) (cast 23 (msb (var t0)) (var t0)))))
d "mpym t3=*sp(#0h), *cdp, ac0" d10080 0x0 (seq (set t3 (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (set ac0 (* (cast 40 (msb (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))))))
d "macm t3=*ar0, t0, ac0" d40180 0x0 (seq (set t3 (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (set ac0 (+ (var ac0) (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (cast 40 (msb (var t0)) (var t0))))))
d "add ac0 << t0, ac0" 5a00 0x0 (set ac0 (+ (var ac0) (<< (var ac0) (var t0) false)))
d "sub ac0 << t0, ac0" 5a01 0x0 (set ac0 (- (var ac0) (<< (var ac0) (var t0) false)))
d "sftcc ac0, tc1" 5a02
d "sftcc ac0, tc2" 5a03
d "sftcc ac1, tc1" 5a42
d "sftcc ac2, tc1" 5a82
d "sftcc ac3, tc1" 5ac2
d "sftl ac0, t0, ac1" 5c40 0x0 (set ac1 (ite (&& (sle (var t0) (bv 16 0x0)) (! (== (var t0) (bv 16 0x0)))) (>> (var ac0) (- (bv 16 0x0) (var t0)) false) (<< (var ac0) (var t0) false)))
d "sfts ac0, t0, ac1" 5c41 0x0 (set ac1 (ite (&& (sle (var t0) (bv 16 0x0)) (! (== (var t0) (bv 16 0x0)))) (>> (var ac0) (- (bv 16 0x0) (var t0)) (msb (var ac0))) (<< (var ac0) (var t0) false)))
d "sftsc ac0, t0, ac1" 5c42
d "sftsc ac0, t0" 5c02
d "sftsc ac1, t0, ac0" 5c12
d "swap ac0, ac2" 5e00 0x0 (seq (set ac0 (^ (var ac0) (var ac2))) (set ac2 (^ (var ac2) (var ac0))) (set ac0 (^ (var ac0) (var ac2))))
d "swap ac1, ac3" 5e01 0x0 (seq (set ac1 (^ (var ac1) (var ac3))) (set ac3 (^ (var ac3) (var ac1))) (set ac1 (^ (var ac1) (var ac3))))
d "swap t0, t2" 5e04 0x0 (seq (set t0 (^ (var t0) (var t2))) (set t2 (^ (var t2) (var t0))) (set t0 (^ (var t0) (var t2))))
@ -238,14 +411,37 @@ d "swapp ar4, t0" 5e1c 0x0 (seq (set ar4 (^ (var ar4) (var t0))) (set t0 (^ (var
d "swapp ar6, t2" 5e1e 0x0 (seq (set ar6 (^ (var ar6) (var t2))) (set t2 (^ (var t2) (var ar6))) (set ar6 (^ (var ar6) (var t2))) (set ar7 (^ (var ar7) (var t3))) (set t3 (^ (var t3) (var ar7))) (set ar7 (^ (var ar7) (var t3))))
d "swap4 ar4, t0" 5e2c 0x0 (seq (set ar4 (^ (var ar4) (var t0))) (set t0 (^ (var t0) (var ar4))) (set ar4 (^ (var ar4) (var t0))) (set ar5 (^ (var ar5) (var t1))) (set t1 (^ (var t1) (var ar5))) (set ar5 (^ (var ar5) (var t1))) (set ar6 (^ (var ar6) (var t2))) (set t2 (^ (var t2) (var ar6))) (set ar6 (^ (var ar6) (var t2))) (set ar7 (^ (var ar7) (var t3))) (set t3 (^ (var t3) (var ar7))) (set ar7 (^ (var ar7) (var t3))))
d "swap ar0, ar1" 5e38 0x0 (seq (set ar0 (^ (var ar0) (var ar1))) (set ar1 (^ (var ar1) (var ar0))) (set ar0 (^ (var ar0) (var ar1))))
d "add ac0 << t0, ac0" 5a00 0x0 (set ac0 (+ (var ac0) (<< (var ac0) (var t0) false)))
d "sub ac0 << t0, ac0" 5a01 0x0 (set ac0 (- (var ac0) (<< (var ac0) (var t0) false)))
d "add ac1 << t0, ac0" 5a10 0x0 (set ac0 (+ (var ac0) (<< (var ac1) (var t0) false)))
d "add ac0 << t1, ac1" 5a44 0x0 (set ac1 (+ (var ac1) (<< (var ac0) (var t1) false)))
d "add ac3 << t3, ac3" 5afc 0x0 (set ac3 (+ (var ac3) (<< (var ac3) (var t3) false)))
d "sub ac3 << t3, ac3" 5afd 0x0 (set ac3 (- (var ac3) (<< (var ac3) (var t3) false)))
d "bclr 0x0, st0_55" 4600 0x0 (set st0_55 (& (var st0_55) (bv 16 0xfffe)))
d "bset 0x0, st0_55" 4601 0x0 (set st0_55 (| (var st0_55) (bv 16 0x1)))
d "bclr 0x0, st1_55" 4602 0x0 (set st1_55 (& (var st1_55) (bv 16 0xfffe)))
d "bclr 0x0, st3_55" 4606 0x0 (set st3_55 (& (var st3_55) (bv 16 0xfffe)))
d "bclr 0xE, st0_55" 46e0 0x0 (set st0_55 (& (var st0_55) (bv 16 0xbfff)))
d "bset 0xE, st0_55" 46e1 0x0 (set st0_55 (| (var st0_55) (bv 16 0x4000)))
d "amov 0x0000, ac0" 77000000 0x0 (set ac0 (bv 40 0x0))
d "amov 0xFF12, ac3" 77ff1230 0x0 (set ac3 (bv 40 0xff12))
d "amov 0x0000, t0" 77000040 0x0 (set t0 (bv 16 0x0))
d "amov 0x0000, ar4" 770000c0 0x0 (set ar4 (bv 16 0x0))
d "amov 0x00FF, ac0" 7700ff00 0x0 (set ac0 (bv 40 0xff))
d "b 0x123456" 6a123456 0x0 (jmp (bv 24 0x123456))
d "call 0x123456" 6c123456 0x0 (jmp (bv 24 0x123456))
d "bcc 0xF, ac0 == 0" 6780 0x0 (branch (== (var ac0) (bv 40 0x0)) (jmp (bv 24 0x11)) nop)
d "bcc 0x1234, ac0 == 0" 6d001234 0x0 (branch (== (var ac0) (bv 40 0x0)) (jmp (bv 24 0x38)) nop)
d "bcc 0x123456, ac0 == 0" 6800123456 0x0 (branch (== (var ac0) (bv 40 0x0)) (jmp (bv 24 0x5b)) nop)
d "bcc 0x1234, ac0 == 0" 6d001234 0x0 (branch (== (var ac0) (bv 40 0x0)) (jmp (bv 24 0x1238)) nop)
d "bcc 0x123456, ac0 == 0" 6800123456 0x0 (branch (== (var ac0) (bv 40 0x0)) (jmp (bv 24 0x123456)) nop)
d "bcc 0x22, ac0 == 0x11" 6f001122 0x0 (branch (== (var ac0) (bv 40 0x11)) (jmp (bv 24 0x26)) nop)
d "callcc 0x123456, ac0 == 0" 6900123456 0x0 (branch (== (var ac0) (bv 40 0x0)) (jmp (bv 24 0x123456)) nop)
d "callcc 0x1234, ac0 == 0" 6e001234 0x0 (branch (== (var ac0) (bv 40 0x0)) (jmp (bv 24 0x1234)) nop)
d "callcc 0x1234, ac0 == 0" 6e001234 0x0 (branch (== (var ac0) (bv 40 0x0)) (jmp (bv 24 0x1238)) nop)
d "xcc tc1" 9664 0x0 nop
d "bcc 0x1234, tc1" 6d641234 0x0 (branch (lsb (>> (var st0_55) (bv 4 0xd) false)) (jmp (bv 24 0x1238)) nop)
d "bcc 0x1234, !carry" 6d761234 0x0 (branch (! (lsb (>> (var st0_55) (bv 4 0xb) false))) (jmp (bv 24 0x1238)) nop)
d "bcc 0x123456, tc1" 6864123456 0x0 (branch (lsb (>> (var st0_55) (bv 4 0xd) false)) (jmp (bv 24 0x123456)) nop)
d "callcc 0x1234, tc1" 6e641234 0x0 (branch (lsb (>> (var st0_55) (bv 4 0xd) false)) (jmp (bv 24 0x1238)) nop)
d "retcc tc1" 026400
d "add 0x1122 << 0x0, ac1, ac0" 70112240 0x0 (set ac0 (+ (var ac1) (<< (bv 40 0x1122) (bv 8 0x0) false)))
d "sub 0x1122 << 0x1, ac1, ac0" 71112241 0x0 (set ac0 (- (var ac1) (<< (bv 40 0x1122) (bv 8 0x1) false)))
d "and 0x1122 << 0x2, ac1, ac0" 72112242 0x0 (set ac0 (& (var ac1) (<< (bv 40 0x1122) (bv 8 0x2) false)))
@ -253,7 +449,11 @@ d "or 0x1122 << 0x3, ac1, ac0" 73112243 0x0 (set ac0 (| (var ac1) (<< (bv 40 0x1
d "xor 0x1122 << 0x4, ac1, ac0" 74112244 0x0 (set ac0 (^ (var ac1) (<< (bv 40 0x1122) (bv 8 0x4) false)))
d "mov 0x1122 << 0x5, ac0" 75112245
d "bfxtr 0x1122, ac0, ac0" 76112200
d "bfxtr 0x0000, ac1, ac0" 76000001
d "bfxtr 0x0000, ac0, ac1" 76000010
d "bfxtr 0x0000, ac0, t0" 76000040
d "bfxpa 0x1122, ac0, ac0" 76112204
d "bfxpa 0x0000, ac1, ac0" 76000005
d "mov 0x1122, ac0" 76112208 0x0 (set ac0 (bv 40 0x1122))
d "amov 0x1122, ac0" 77112200 0x0 (set ac0 (bv 40 0x1122))
d "mov 0x1122, dp" 78112200 0x0 (set dp (bv 16 0x1122))
@ -278,6 +478,9 @@ d "sub 0x1122, ac0, t0" 7c112240 0x0 (set t0 (cast 16 false (- (var ac0) (bv 40
d "and 0x1122, ac0, t0" 7d112240 0x0 (set t0 (& (cast 16 false (var ac0)) (bv 16 0x1122)))
d "or 0x1122, ac0, t0" 7e112240 0x0 (set t0 (| (cast 16 false (var ac0)) (bv 16 0x1122)))
d "xor 0x1122, ac0, t0" 7f112240 0x0 (set t0 (^ (cast 16 false (var ac0)) (bv 16 0x1122)))
d "add 0x8000, ac0" 7b800000 0x0 (set ac0 (+ (var ac0) (bv 40 0x8000)))
d "sub 0x8000, ac0, ac1" 7c800010 0x0 (set ac1 (- (var ac0) (bv 40 0xffffff8000)))
d "and 0x8000, ac0, ac0" 7d800000 0x0 (set ac0 (& (var ac0) (bv 40 0x8000)))
d "idle" 7a00000c
d "mov dbl(*ar0), dbl(*ar7(t0))" 8003f0 0x0 (storew 0 (* (+ (cast 24 false (var xar7)) (cast 24 (msb (var t0)) (var t0))) (bv 24 0x2)) (loadw 0 32 (* (cast 24 false (var xar0)) (bv 24 0x2))))
d "mov dbl(*ar1+), dbl(*(ar6 - t1))" 802760 0x0 (seq (storew 0 (* (cast 24 false (var xar6)) (bv 24 0x2)) (loadw 0 32 (* (cast 24 false (var xar1)) (bv 24 0x2)))) (set xar1 (+ (var xar1) (bv 23 0x1))) (set xar6 (- (var xar6) (cast 23 (msb (var t1)) (var t1)))))
@ -311,9 +514,51 @@ d "amar *ar0 :: mac *ar0, *cdp, ac0" 83000c00 0x0 (seq nop (set ac0 (+ (var ac0)
d "amar *ar0 :: mac *ar0, *cdp, ac0 >> #16" 84000400 0x0 (seq nop (set ac0 (+ (>> (var ac0) (bv 6 0x10) (msb (var ac0))) (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2))))))))
d "amar *ar0 :: mas *ar0, *cdp, ac0" 85000000 0x0 (seq nop (set ac0 (- (var ac0) (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2))))))))
d "amar *ar0, *ar0, *cdp" 85000800 0x0 nop
d "firsadd *ar0, *ar0, *cdp, ac0, ac0" 85000c00
d "firssub *ar0, *ar0, *cdp, ac0, ac0" 85000c10
d "firsadd *ar0, *ar0, *cdp, ac0, ac0" 85000c00 0x0 (seq (set ac0 (+ (var ac0) (* (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2))))))) (set ac0 (+ (<< (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (bv 8 0x10) false) (<< (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (bv 8 0x10) false))))
d "firssub *ar0, *ar0, *cdp, ac0, ac0" 85000c10 0x0 (seq (set ac0 (+ (var ac0) (* (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2))))))) (set ac0 (- (<< (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (bv 8 0x10) false) (<< (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (bv 8 0x10) false))))
d "firsadd *ar1+, *ar3-, *cdp, ac1, ac1" 8525ac44 0x0 (seq (set ac1 (+ (var ac1) (* (cast 40 (msb (cast 16 false (>> (var ac1) (bv 8 0x10) false))) (cast 16 false (>> (var ac1) (bv 8 0x10) false))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2))))))) (set ac1 (+ (<< (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar1)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar1)) (bv 24 0x2)))) (bv 8 0x10) false) (<< (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar3)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar3)) (bv 24 0x2)))) (bv 8 0x10) false))) (set xar1 (+ (var xar1) (bv 23 0x1))) (set xar3 (- (var xar3) (bv 23 0x1))))
d "firsadd *ar0, *ar0, *cdp+, ac0, ac0" 85000d00 0x0 (seq (set ac0 (+ (var ac0) (* (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2))))))) (set ac0 (+ (<< (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (bv 8 0x10) false) (<< (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (bv 8 0x10) false))) (set xcdp (+ (var xcdp) (bv 23 0x1))))
d "firsadd *ar0+, *ar0, *cdp, ac1, ac2" 85040c84 0x0 (seq (set ac2 (+ (var ac2) (* (cast 40 (msb (cast 16 false (>> (var ac1) (bv 8 0x10) false))) (cast 16 false (>> (var ac1) (bv 8 0x10) false))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2))))))) (set ac1 (+ (<< (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (bv 8 0x10) false) (<< (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (bv 8 0x10) false))) (set xar0 (+ (var xar0) (bv 23 0x1))))
d "mpym *ar0, *ar0, ac0" 86000000 0x0 (set ac0 (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2))))))
d "mpym uns(*ar0), uns(*ar0), ac0" 8600000c 0x0 (set ac0 (* (cast 40 false (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (cast 40 false (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2))))))
d "mpym40 *ar0, *ar0, ac0" 86000010 0x0 (set ac0 (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2))))))
d "mpym *ar1+, *ar2, ac0" 86250000 0x0 (seq (set ac0 (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar1)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar1)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar2)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar2)) (bv 24 0x2)))))) (set xar1 (+ (var xar1) (bv 23 0x1))))
d "macm *ar0, *ar0, ac0" 86000020 0x0 (set ac0 (+ (var ac0) (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))))))
d "macm *ar0, *ar0, ac1, ac0" 86000420 0x0 (set ac0 (+ (var ac1) (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))))))
d "macm uns(*ar1+), *ar3-, ac3, ac0" 8625ac28 0x0 (seq (set ac0 (+ (var ac3) (* (cast 40 false (loadw 0 16 (* (cast 24 false (var xar1)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar3)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar3)) (bv 24 0x2))))))) (set xar1 (+ (var xar1) (bv 23 0x1))) (set xar3 (- (var xar3) (bv 23 0x1))))
d "masm *ar0, *ar0, ac0" 86000060 0x0 (set ac0 (- (var ac0) (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))))))
d "masm *ar0, *ar0, ac1, ac0" 86000460 0x0 (set ac0 (- (var ac1) (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))))))
d "macm t3=*ar0, *ar0, ac0" 86000022 0x0 (seq (set t3 (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (set ac0 (+ (var ac0) (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2))))))))
d "macm *ar0, *ar0, ac0 >> #16" 86000040 0x0 (set ac0 (+ (>> (var ac0) (bv 6 0x10) (msb (var ac0))) (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))))))
d "macm *ar0, *ar0, ac1 >> #16, ac0" 86000440 0x0 (set ac0 (+ (>> (var ac1) (bv 6 0x10) (msb (var ac1))) (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))))))
d "macm *ar0, *ar0, ac0 >> #16, ac1" 86000140 0x0 (set ac1 (+ (>> (var ac0) (bv 6 0x10) (msb (var ac0))) (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))))))
d "macm *ar1+, *ar2, ac0 >> #16" 86250040 0x0 (seq (set ac0 (+ (>> (var ac0) (bv 6 0x10) (msb (var ac0))) (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar1)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar1)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar2)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar2)) (bv 24 0x2))))))) (set xar1 (+ (var xar1) (bv 23 0x1))))
d "macmr *ar0, *ar0, ac0 >> #16" 86000041 0x0 (set ac0 (& (+ (+ (>> (var ac0) (bv 6 0x10) (msb (var ac0))) (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))))) (bv 40 0x8000)) (bv 40 0xffffff0000)))
d "macm40 *ar0, *ar0, ac0 >> #16" 86000050 0x0 (set ac0 (+ (>> (var ac0) (bv 6 0x10) (msb (var ac0))) (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))))))
d "sqdst *ar0, *ar0, ac0, ac0" 860000e0 0x0 (seq (set ac0 (+ (var ac0) (* (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false)))))) (set ac0 (- (<< (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (bv 8 0x10) false) (<< (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (bv 8 0x10) false))))
d "sqdst *ar1+, *ar2, ac0, ac3" 86250ce0 0x0 (seq (set ac3 (+ (var ac3) (* (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false)))))) (set ac0 (- (<< (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar1)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar1)) (bv 24 0x2)))) (bv 8 0x10) false) (<< (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar2)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar2)) (bv 24 0x2)))) (bv 8 0x10) false))) (set xar1 (+ (var xar1) (bv 23 0x1))))
d "sqdst *ar0, *ar0, ac0, ac1" 860004e0 0x0 (seq (set ac1 (+ (var ac1) (* (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false)))))) (set ac0 (- (<< (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (bv 8 0x10) false) (<< (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (bv 8 0x10) false))))
d "abdst *ar0, *ar0, ac0, ac0" 860000f0 0x0 (seq (set ac0 (+ (var ac0) (ite (sle (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (bv 40 0x0)) (- (bv 40 0x0) (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false)))) (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false)))))) (set ac0 (- (<< (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (bv 8 0x10) false) (<< (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (bv 8 0x10) false))))
d "abdst *ar1+, *ar2, ac0, ac3" 86250cf0 0x0 (seq (set ac3 (+ (var ac3) (ite (sle (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (bv 40 0x0)) (- (bv 40 0x0) (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false)))) (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false)))))) (set ac0 (- (<< (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar1)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar1)) (bv 24 0x2)))) (bv 8 0x10) false) (<< (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar2)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar2)) (bv 24 0x2)))) (bv 8 0x10) false))) (set xar1 (+ (var xar1) (bv 23 0x1))))
d "abdst *ar0, *ar0, ac0, ac1" 860004f0 0x0 (seq (set ac1 (+ (var ac1) (ite (sle (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (bv 40 0x0)) (- (bv 40 0x0) (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false)))) (cast 40 (msb (cast 16 false (>> (var ac0) (bv 8 0x10) false))) (cast 16 false (>> (var ac0) (bv 8 0x10) false)))))) (set ac0 (- (<< (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (bv 8 0x10) false) (<< (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (bv 8 0x10) false))))
d "lms *ar1+, *ar2, ac0, ac3" 86250cc0 0x0 (seq (set lms_acx (var ac0)) (set ac3 (+ (var ac3) (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar1)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar1)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar2)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar2)) (bv 24 0x2))))))) (set ac0 (& (+ (+ (var lms_acx) (<< (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar1)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar1)) (bv 24 0x2)))) (bv 8 0x10) false)) (bv 40 0x8000)) (bv 40 0xffffff0000))) (set xar1 (+ (var xar1) (bv 23 0x1))))
d "lms *ar0, *ar0, ac0, ac1" 860004c0 0x0 (seq (set lms_acx (var ac0)) (set ac1 (+ (var ac1) (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2))))))) (set ac0 (& (+ (+ (var lms_acx) (<< (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (bv 8 0x10) false)) (bv 40 0x8000)) (bv 40 0xffffff0000))))
d "lms *ar0, *ar0, ac0, ac0" 860000c0 0x0 (seq (set lms_acx (var ac0)) (set ac0 (+ (var ac0) (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2))))))) (set ac0 (& (+ (+ (var lms_acx) (<< (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (bv 8 0x10) false)) (bv 40 0x8000)) (bv 40 0xffffff0000))))
d "amar *ar0+, *ar0, *cdp+" 85040900 0x0 (seq (set xar0 (+ (var xar0) (bv 23 0x1))) (set xcdp (+ (var xcdp) (bv 23 0x1))))
d "amar *(ar0 + t0), *ar0, *(cdp+t0)" 850c0b00 0x0 (seq (set xar0 (+ (var xar0) (cast 23 (msb (var t0)) (var t0)))) (set xcdp (+ (var xcdp) (cast 23 (msb (var t0)) (var t0)))))
d "amar *ar0, *(ar0 + t0), *cdp" 85003800 0x0 (set xar0 (+ (var xar0) (cast 23 (msb (var t0)) (var t0))))
d "amar *(ar0 + t1), *ar0, *cdp" 85100800 0x0 (set xar0 (+ (var xar0) (cast 23 (msb (var t1)) (var t1))))
d "mpy *(ar0 + t1), *cdp, ac0 :: mpy *ar0, *cdp, ac0" 82100000 0x0 (seq (set ac0 (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))))) (set xar0 (+ (var xar0) (cast 23 (msb (var t1)) (var t1)))) (set ac0 (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))))))
d "mpy *ar0(t0), *cdp, ac0 :: mpy *ar0, *cdp, ac0" 821c0000 0x0 (seq (set ac0 (* (cast 40 (msb (loadw 0 16 (* (+ (cast 24 false (var xar0)) (cast 24 (msb (var t0)) (var t0))) (bv 24 0x2)))) (loadw 0 16 (* (+ (cast 24 false (var xar0)) (cast 24 (msb (var t0)) (var t0))) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))))) (set ac0 (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))))))
d "mpy *ar0, *cdp, ac0 :: mpy *(ar0 - t0), *cdp, ac0" 82005000 0x0 (seq (set ac0 (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))))) (set ac0 (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))))) (set xar0 (- (var xar0) (cast 23 (msb (var t0)) (var t0)))))
d "mpy *ar0, *cdp, ac0 :: mpy *(ar0 - t1), *cdp, ac0" 82006000 0x0 (seq (set ac0 (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))))) (set ac0 (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))))) (set xar0 (- (var xar0) (cast 23 (msb (var t1)) (var t1)))))
d "mpy *ar0, *cdp, ac0 :: mpy *ar0(t0), *cdp, ac0" 82007000 0x0 (seq (set ac0 (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))))) (set ac0 (* (cast 40 (msb (loadw 0 16 (* (+ (cast 24 false (var xar0)) (cast 24 (msb (var t0)) (var t0))) (bv 24 0x2)))) (loadw 0 16 (* (+ (cast 24 false (var xar0)) (cast 24 (msb (var t0)) (var t0))) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))))))
d "amar *ar0 :: mpy uns(*ar0), uns(*cdp), ac1" 82000c84 0x0 (seq nop (set ac1 (* (cast 40 false (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (cast 40 false (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))))))
d "amar *ar4 :: mac uns(*ar7-), uns(*cdp), ac1 >> #16" 8483a4c4 0x0 (seq nop (set ac1 (+ (>> (var ac1) (bv 6 0x10) (msb (var ac1))) (* (cast 40 false (loadw 0 16 (* (cast 24 false (var xar7)) (bv 24 0x2)))) (cast 40 false (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2))))))) (set xar7 (- (var xar7) (bv 23 0x1))))
d "amar *ar0 :: mac uns(*(ar0 + t1)), uns(*cdp), ac1" 83004c84 0x0 (seq nop (set ac1 (+ (var ac1) (* (cast 40 false (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (cast 40 false (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2))))))) (set xar0 (+ (var xar0) (cast 23 (msb (var t1)) (var t1)))))
d "mas *ar1+, *cdp, ac1 :: mas uns(*ar3-), uns(*cdp), ac0" 8525a444 0x0 (seq (set ac1 (- (var ac1) (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar1)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar1)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2))))))) (set xar1 (+ (var xar1) (bv 23 0x1))) (set ac0 (- (var ac0) (* (cast 40 false (loadw 0 16 (* (cast 24 false (var xar3)) (bv 24 0x2)))) (cast 40 false (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2))))))) (set xar3 (- (var xar3) (bv 23 0x1))))
d "macr40 *ar0, *(cdp+t0), ac0 :: macr40 uns(*ar0), uns(*(cdp+t0)), ac0" 83000343 0x0 (seq (set ac0 (& (+ (+ (var ac0) (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))))) (bv 40 0x8000)) (bv 40 0xffffff0000))) (set xcdp (+ (var xcdp) (cast 23 (msb (var t0)) (var t0)))) (set ac0 (& (+ (+ (var ac0) (* (cast 40 false (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (cast 40 false (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))))) (bv 40 0x8000)) (bv 40 0xffffff0000))) (set xcdp (+ (var xcdp) (cast 23 (msb (var t0)) (var t0)))))
d "mpy40 *ar7, *cdp+, ac0 :: mpy40 *ar2, *cdp+, ac0" 82e10102 0x0 (seq (set ac0 (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar7)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar7)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))))) (set xcdp (+ (var xcdp) (bv 23 0x1))) (set ac0 (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar2)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar2)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))))) (set xcdp (+ (var xcdp) (bv 23 0x1))))
d "mpymr *ar0, *ar0, ac0" 86000001 0x0 (set ac0 (& (+ (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2))))) (bv 40 0x8000)) (bv 40 0xffffff0000)))
d "mpymr40 *ar0, *ar0, ac0" 86000011 0x0 (set ac0 (& (+ (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2))))) (bv 40 0x8000)) (bv 40 0xffffff0000)))
d "mpymr40 t3=*ar0, *ar0, ac0" 86000013 0x0 (seq (set t3 (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (set ac0 (& (+ (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2))))) (bv 40 0x8000)) (bv 40 0xffffff0000))))
@ -325,19 +570,54 @@ d "macmr40 *ar0, *ar0, ac0, ac1" 86000131 0x0 (set ac1 (& (+ (+ (var ac0) (* (ca
d "macmr40 *ar0, *ar0, ac0 >> #16" 86000051 0x0 (set ac0 (& (+ (+ (>> (var ac0) (bv 6 0x10) (msb (var ac0))) (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))))) (bv 40 0x8000)) (bv 40 0xffffff0000)))
d "macmr40 *ar0, *ar0, ac0 >> #16, ac1" 86000151 0x0 (set ac1 (& (+ (+ (>> (var ac0) (bv 6 0x10) (msb (var ac0))) (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))))) (bv 40 0x8000)) (bv 40 0xffffff0000)))
d "masmr40 t3=uns(*ar0), uns(*ar0), ac0, ac1" 8600017f 0x0 (seq (set t3 (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (set ac1 (& (+ (- (var ac0) (* (cast 40 false (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (cast 40 false (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))))) (bv 40 0x8000)) (bv 40 0xffffff0000))))
d "masm *ar0, t0, ac0 :: mov *ar0 << #16, ac0" 86000080
d "macm *ar0, t0, ac0 :: mov *ar0 << #16, ac0" 860000a0
d "masm *ar0, t0, ac0 :: mov *ar0 << #16, ac0" 86000080 0x0 (seq (set ac0 (- (var ac0) (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (cast 40 (msb (var t0)) (var t0))))) (set ac0 (<< (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (bv 8 0x10) false)))
d "macm *ar0, t0, ac0 :: mov *ar0 << #16, ac0" 860000a0 0x0 (seq (set ac0 (+ (var ac0) (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (cast 40 (msb (var t0)) (var t0))))) (set ac0 (<< (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (bv 8 0x10) false)))
d "masm t3=*ar1+, t2, ac0 :: mov *ar2 << #16, ac3" 86250c8a 0x0 (seq (set t3 (loadw 0 16 (* (cast 24 false (var xar1)) (bv 24 0x2)))) (set ac0 (- (var ac0) (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar1)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar1)) (bv 24 0x2)))) (cast 40 (msb (var t2)) (var t2))))) (set xar1 (+ (var xar1) (bv 23 0x1))) (set ac3 (<< (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar2)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar2)) (bv 24 0x2)))) (bv 8 0x10) false)))
d "masm t3=*ar0, t0, ac1 :: mov *ar0 << #16, ac0" 86000182 0x0 (seq (set t3 (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (set ac1 (- (var ac1) (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (cast 40 (msb (var t0)) (var t0))))) (set ac0 (<< (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (bv 8 0x10) false)))
d "macm t3=*ar0, t0, ac1 :: mov *ar0 << #16, ac1" 860005a2 0x0 (seq (set t3 (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (set ac1 (+ (var ac1) (* (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (cast 40 (msb (var t0)) (var t0))))) (set ac1 (<< (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (bv 8 0x10) false)))
d "mpym *ar0, t0, ac0 :: mov hi(ac0 << t2), *ar0" 87000000
d "macm *ar0, t0, ac0 :: mov hi(ac0 << t2), *ar0" 87000020
d "masm *ar0, t0, ac0 :: mov hi(ac0 << t2), *ar0" 87000040
d "lms *ar0, *ar0, ac0, ac0" 860000c0
d "sqdst *ar0, *ar0, ac0, ac0" 860000e0
d "abdst *ar0, *ar0, ac0, ac0" 860000f0
d "lmsf *ar0, *ar0, ac0, ac0" 87000061
d "add *ar0 << #16, ac0, ac0 :: mov hi(ac0 << t2), *ar0" 87000080
d "sub *ar0 << #16, ac0, ac0 :: mov hi(ac0 << t2), *ar0" 870000a0
d "mov *ar0 << #16, ac0 :: mov hi(ac0 << t2), *ar0" 870000c0
d "mov ac0, ac0" 9000 0x0 (set ac0 (var ac0))
d "mov ac0, ac1" 9001 0x0 (set ac1 (var ac0))
d "mov xar0, ac0" 9080 0x0 (set ac0 (cast 40 false (var xar0)))
d "mov ac0, xar0" 9008 0x0 (set xar0 (cast 23 false (var ac0)))
d "mov xar4, xar4" 90cc 0x0 (set xar4 (var xar4))
d "not ac0" 3600 0x0 (set ac0 (~ (var ac0)))
d "not ac0, ac1" 3601 0x0 (set ac1 (~ (var ac0)))
d "not ac0, t0" 3604
d "|| not ac3" 3733 0x0 (set ac3 (~ (var ac3)))
d "neg ac0" 3400 0x0 (set ac0 (- (bv 40 0x0) (var ac0)))
d "abs ac0" 3200 0x0 (set ac0 (ite (&& (sle (var ac0) (bv 40 0x0)) (! (== (var ac0) (bv 40 0x0)))) (- (bv 40 0x0) (var ac0)) (var ac0)))
d "max ac0" 2e00 0x0 (set ac0 (ite (! (sle (var ac0) (var ac0))) (var ac0) (var ac0)))
d "min ac0, ac1" 3001 0x0 (set ac1 (ite (&& (sle (var ac0) (var ac1)) (! (== (var ac0) (var ac1)))) (var ac0) (var ac1)))
d "mov 0x44AA, dp" 7844aa00 0x0 (set dp (bv 16 0x44aa))
d "mov 0x1234, bsac" 7812340e 0x0 (set bsac (bv 16 0x1234))
d "mov 0x1234, sp" 78123410 0x0 (set sp (bv 16 0x1234))
d "add 0x0044 << #16, ac0" 7a004400 0x0 (set ac0 (+ (var ac0) (<< (bv 40 0x44) (bv 8 0x10) false)))
d "sub 0x8000 << #16, ac1, ac0" 7a800042 0x0 (set ac0 (- (var ac1) (<< (bv 40 0xffffff8000) (bv 8 0x10) false)))
d "and 0x8000 << #16, ac0" 7a800004 0x0 (set ac0 (& (var ac0) (<< (bv 40 0x8000) (bv 8 0x10) false)))
d "xor 0xFFFF << #16, ac0, ac1" 7affff18 0x0 (set ac1 (^ (var ac0) (<< (bv 40 0xffff) (bv 8 0x10) false)))
d "mov 0x8000 << #16, ac2" 7a80002a 0x0 (set ac2 (bv 40 0xff80000000))
d "add 0x1234 << 0x8, ac0" 70123408 0x0 (set ac0 (+ (var ac0) (<< (bv 40 0x1234) (bv 8 0x8) false)))
d "sub 0x8000 << 0xF, ac1, ac0" 7180004f 0x0 (set ac0 (- (var ac1) (<< (bv 40 0xffffff8000) (bv 8 0xf) false)))
d "and 0x8000 << 0x4, ac0" 72800004 0x0 (set ac0 (& (var ac0) (<< (bv 40 0x8000) (bv 8 0x4) false)))
d "or 0x1234 << 0x4, ac0" 73123404 0x0 (set ac0 (| (var ac0) (<< (bv 40 0x1234) (bv 8 0x4) false)))
d "mov 0x1234 << 0xA, ac2" 7512342a
d "add ac0" 2400 0x0 (set ac0 (+ (var ac0) (var ac0)))
d "sub ac3" 2633 0x0 (set ac3 (- (var ac3) (var ac3)))
d "add t0" 2444 0x0 (set t0 (+ (var t0) (var t0)))
d "mov -0x4, t0" 3e44
d "mov -0xF, ar7" 3eff
d "mov -0x0, ac0" 3e00
d "mov 0x44A, brc1" 1644aa 0x0 (set brc1 (bv 16 0x44a))
d "mov 0xFF0, bk03" 16ff04 0x0 (set bk03 (bv 16 0xff0))
d "mov 0x000, csr" 160008 0x0 (set csr (bv 16 0x0))
d "xor 0x1234 << 0x0, ac1, ac2" 74123460 0x0 (set ac2 (^ (var ac1) (<< (bv 40 0x1234) (bv 8 0x0) false)))
d "b ac0" 9100 0x0 (jmp (cast 24 false (var ac0)))
d "call ac0" 9200 0x0 (jmp (cast 24 false (var ac0)))
d "reset" 9400
@ -351,19 +631,169 @@ d "xcc ac0 == 0" 9f00 0x0 nop
d "xccpart ac0 == 0" 9f80 0x0 nop# --- coverage expansion: additional instruction-class disassembly tests ---
d "addsub t3, dual(*sp(#57h)), ac2" eeaeed
d "addsub2cc *ar4+, ac3, t2, TC1, TC2, ac0" dd83ca
d "addsub2cc *sp(#0h), ac3, t2, TC1, TC2, ac1" dd00da
d "mov *sp(#0h) << t0, ac0" dd0003
d "mov rnd(*sp(#0h) << t0), ac0" dd0043
d "mov *sp(#9h) << t1, ac1" dd1217
d "addsubcc *-ar7, ac0, TC2, ac3" defb31
d "addsubcc *sp(#0h), ac1, TC1, ac0" de0040
d "addsubcc *sp(#0h), ac3, TC1, ac0" de00c0
d "addsubcc *sp(#0h), ac0, TC2, ac0" de0001
d "addsubcc *sp(#0h), ac0, TC1, TC2, ac0" de0002
d "band *cdp+, 0x1E70, TC1" f2911e70
d "bnot ar3, *sp(#3Eh)" e37cbe
d "bset ac0, *sp(#0h)" e3000c
d "bclr t0, *sp(#0h)" e3004d
d "bnot ar0, *sp(#0h)" e3008e
d "btst 0x3, *ar0, TC2" dc013d
d "btst 0x0, *sp(#0h), TC1" dc0000
d "btst 0xF, *sp(#0h), TC1" dc00f0
d "btst 0x0, *sp(#8h), TC1" dc1000
d "btst 0x4, *sp(#0h), TC2" dc0041
d "btst ac0, *ar0, tc1" e00100
d "btst ac0, *ar0, tc2" e00101
d "btst t0, *ar0, tc1" e00140
d "btst ar7, *ar0, tc1" e001f0
d "btst ac0, *ar0+, tc1" e00300
d "band *ar0, 0x0000, TC1" f2010000
d "band *ar0, 0x0000, TC2" f3010000
d "band *ar0, 0xABCD, TC1" f201abcd
d "band *ar2, 0x1234, TC1" f2411234
d "mov *sp(#0h), dp" dc0002 0x0 (set dp (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2))))
d "mov *sp(#0h), cdp" dc0012 0x0 (set cdp (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2))))
d "mov *sp(#0h), dph" dc00c2 0x0 (set dph (cast 7 false (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))))
d "mov *sp(#0h), pdp" dc00f2 0x0 (set pdp (cast 9 false (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))))
d "mov *sp(#0h), csr" dc0003 0x0 (set csr (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2))))
d "mov *sp(#0h), trn1" dc0043 0x0 (set trn1 (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2))))
d "btstclr 0x8, *sp(#54h), TC1" e3a885
d "btstnot 0xB, *ar2(t1), TC1" e357b8
d "btstp Baddr, ac0" ece304
d "btstset 0x5, *sp(#55h), TC1" e3aa51
d "btstset 0x0, *sp(#0h), TC1" e30000
d "btstset 0x0, *sp(#0h), TC2" e30002
d "btstset 0xF, *sp(#0h), TC1" e300f0
d "btstclr 0x0, *sp(#0h), TC2" e30006
d "btstnot 0x0, *sp(#0h), TC2" e3000a
d "delay *(ar0 - t1)" b615
d "delay *ar0" b601
d "delay *ar0+" b603
d "delay *+ar0" b619
d "mov *(ar0 + t0b), ac0" a01d
d "mov *(ar0 - t0b), ac0" a01f
d "mov *(ar4 + t0b), ac0" a09d
d "mov ac0, *(ar0 + t0b)" c01d
d "mov ac0, *(ar0 - t0b)" c01f
d "delay *(ar0 + t0b)" b61d
d "amar *(ar0 + t0b)" b41d
d "amar *(ar0 - t0b)" b41f
d "macmk *(ar2 + t0b), 0xB1, ac0, ac3" f85db134
d "mpymk t3=*sp(#2h), 0x1C, ac2" f8041cea
d "sqamr *-ar2, ac2" d25b6a
d "sqrm *sp(#64h), ac2" d3c828
d "sqsm *sp(#55h), ac3" d2aa3f
d "sqrm *sp(#64h), ac2" d3c828 0x0 (set ac2 (* (cast 40 (msb (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x64)) (bv 24 0x2)))) (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x64)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x64)) (bv 24 0x2)))) (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x64)) (bv 24 0x2))))))
d "sqsm *sp(#55h), ac3" d2aa3f 0x0 (set ac3 (- (var ac3) (* (cast 40 (msb (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x55)) (bv 24 0x2)))) (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x55)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x55)) (bv 24 0x2)))) (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x55)) (bv 24 0x2)))))))
d "subadd t0, dual(*(ar5 - t0b)), ac2" eebf2f
d "subc *ar4, ac3" de81f3
d "subc *sp(#0h), ac1, ac0" de0043
d "subc *sp(#0h), ac0, ac1" de0013
d "subc *sp(#0h), ac1" de0053
d "add *sp(#0h) << #16, ac0" de0004
d "add *sp(#0h) << #16, ac1, ac0" de0044
d "sub *sp(#0h) << #16, ac0" de0005
d "sub ac0, *sp(#0h) << #16, ac0" de0006
d "sub ac1, *sp(#0h) << #16, ac0" de0046
d "addsub t0, *sp(#0h), ac0" de0008
d "addsub t1, *sp(#0h), ac1" de0058
d "subadd t0, *sp(#0h), ac0" de0009
d "subadd t3, *sp(#0h), ac0" de00c9
d "add *sp(#0h), ac0" df000c
d "add uns(*sp(#0h)), ac0" df000d
d "add *sp(#0h), ac1, ac0" df004c
d "sub *sp(#0h), ac0" df000e
d "sub uns(*sp(#0h)), ac3, ac0" df00cf
d "mov *sp(#0h), ac0" df0004 0x0 (set ac0 (cast 40 (msb (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))))
d "mov uns(*sp(#0h)), ac0" df0005 0x0 (set ac0 (cast 40 false (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))))
d "mov *sp(#0h), ac1" df0014 0x0 (set ac1 (cast 40 (msb (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))))
d "mov *ar0, ac0" df0104 0x0 (set ac0 (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))))
d "mov high_byte(*sp(#0h)), ac0" df0000
d "mov uns(high_byte(*sp(#0h))), ac0" df0001
d "mov low_byte(*sp(#0h)), ac0" df0002
d "mov low_byte(*sp(#0h)), ac3" df0032
d "mov high_byte(*ar0), ac0" df0100
d "add *sp(#0h), CARRY, ac0" df0008
d "add uns(*sp(#0h)), CARRY, ac0" df0009
d "add *sp(#0h), CARRY, ac1, ac0" df0048
d "sub *sp(#0h), BORROW, ac0" df000a
d "sub *sp(#0h), BORROW, ac1, ac0" df004a
d "mov *ar0, ac0" a001 0x0 (set ac0 (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))))
d "mov *ar0+, ac0" a003 0x0 (seq (set ac0 (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2))))) (set xar0 (+ (var xar0) (bv 23 0x1))))
d "mov *(ar0 + t0), ac0" a007 0x0 (seq (set ac0 (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2))))) (set xar0 (+ (var xar0) (cast 23 (msb (var t0)) (var t0)))))
d "mov *ar0(t1), ac0" a017 0x0 (set ac0 (cast 40 (msb (loadw 0 16 (* (+ (cast 24 false (var xar0)) (cast 24 (msb (var t1)) (var t1))) (bv 24 0x2)))) (loadw 0 16 (* (+ (cast 24 false (var xar0)) (cast 24 (msb (var t1)) (var t1))) (bv 24 0x2)))))
d "mov *ar0, t0" a401 0x0 (set t0 (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2))))
d "mov *ar0, ar0" a801 0x0 (set ar0 (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2))))
d "mov *sp(#0h), ac0" a000 0x0 (set ac0 (cast 40 (msb (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))))
d "mov *sp(#10h), ac1" a120 0x0 (set ac1 (cast 40 (msb (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x10)) (bv 24 0x2)))) (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x10)) (bv 24 0x2)))))
d "mov ac0, *ar0" c001 0x0 (storew 0 (* (cast 24 false (var xar0)) (bv 24 0x2)) (cast 16 false (var ac0)))
d "mov ac0, *sp(#0h)" c000 0x0 (storew 0 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)) (cast 16 false (var ac0)))
d "mov t0, *ar0" c401 0x0 (storew 0 (* (cast 24 false (var xar0)) (bv 24 0x2)) (var t0))
d "mov ar0, *ar0" c801 0x0 (storew 0 (* (cast 24 false (var xar0)) (bv 24 0x2)) (var ar0))
d "mov hi(ac0), *ar0" bc01 0x0 (storew 0 (* (cast 24 false (var xar0)) (bv 24 0x2)) (cast 16 false (>> (var ac0) (bv 8 0x10) false)))
d "mov hi(ac0), *sp(#0h)" bc00 0x0 (storew 0 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)) (cast 16 false (>> (var ac0) (bv 8 0x10) false)))
d "mov 0x12, *sp(#0h)" e60012 0x0 (storew 0 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)) (bv 16 0x12))
d "mov 0xAB, *sp(#4h)" e608ab 0x0 (storew 0 (* (+ (cast 24 false (var sp)) (bv 24 0x4)) (bv 24 0x2)) (bv 16 0xab))
d "mov 0x1234, *sp(#0h)" fb001234 0x0 (storew 0 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)) (bv 16 0x1234))
d "mov *sp(#0h) << #16, ac0" b000
d "mov *ar0 << #16, ac0" b001
d "amar *sp(#0h)" b400 0x0 nop
d "amar *ar0+" b403 0x0 (set xar0 (+ (var xar0) (bv 23 0x1)))
d "psh *sp(#0h)" b500
d "pop *ar0" bb01
d "psh dbl(*sp(#0h))" b700
d "pop dbl(*ar0)" b801
d "mpymu *sp(#0h), t0, ac0" d3000c 0x0 (set ac0 (* (cast 40 false (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (cast 40 false (var t0))))
d "mpymu *ar1-, t0, ac0" d3250c 0x0 (seq (set ac0 (* (cast 40 false (loadw 0 16 (* (cast 24 false (var xar1)) (bv 24 0x2)))) (cast 40 false (var t0)))) (set xar1 (- (var xar1) (bv 23 0x1))))
d "mpymu *sp(#0h), t0, ac1" d3001c 0x0 (set ac1 (* (cast 40 false (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (cast 40 false (var t0))))
d "add *sp(#0h), ac0" d60000
d "add *sp(#0h), ac0, ac1" d60010
d "add *sp(#0h), ac0, t0" d60040
d "add *ar0, ac1, ac0" d60101
d "add *sp(#8h), ac0" d61000
d "sub *sp(#0h), ac0" d70000
d "sub *sp(#0h), ac0, ac1" d70010
d "sub *sp(#0h), ac1, ac0" d70001
d "and *sp(#0h), ac0, ac0" d90000 0x0 (set ac0 (& (var ac0) (cast 40 (msb (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2))))))
d "and *sp(#0h), ac1, ac0" d90001 0x0 (set ac0 (& (var ac1) (cast 40 (msb (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2))))))
d "and *sp(#0h), ac0, t0" d90040
d "or *sp(#0h), ac0, ac0" da0000 0x0 (set ac0 (| (var ac0) (cast 40 (msb (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2))))))
d "or *sp(#0h), ac2, ac0" da0002 0x0 (set ac0 (| (var ac2) (cast 40 (msb (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2))))))
d "xor *sp(#0h), ac1, ac0" db0001 0x0 (set ac0 (^ (var ac1) (cast 40 (msb (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2)))) (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x0)) (bv 24 0x2))))))
d "and *sp(#0h), ar0, ac0" d90008
d "xor *sp(#0h), ac0, t0" db0040
d "sub ac0, *sp(#0h), ac0" d80000
d "sub ac0, *sp(#0h), ac1" d80010
d "sub ac1, *sp(#0h), ac0" d80001
d "sub ac0, *sp(#0h), t0" d80040
d "sub ac0, *ar0, ac0" d80100
d "sub ar0, *sp(#0h), ac0" d80008
d "add *sp(#0h) << t0, ac0" dd0000
d "add *sp(#0h) << t0, ac0, ac1" dd0010
d "sub *sp(#0h) << t0, ac0" dd0001
d "add *sp(#0h) << t0, ac1, ac0" dd0040
d "add *sp(#0h) << t2, ac0" dd0008
d "add *ar0 << t0, ac0" dd0100
d "add *ar0+ << t0, ac0" dd0300
d "sub *sp(#0h) << t0, ac0, ac1" dd0011
d "mpym *ar0(0x3412), *cdp, ac0" d10d003412 0x0 (set ac0 (* (cast 40 (msb (loadw 0 16 (* (+ (cast 24 false (var xar0)) (bv 24 0x3412)) (bv 24 0x2)))) (loadw 0 16 (* (+ (cast 24 false (var xar0)) (bv 24 0x3412)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2))))))
d "mpym *+ar0(0x3412), *cdp, ac0" d10f003412 0x0 (seq (set ac0 (* (cast 40 (msb (loadw 0 16 (* (+ (cast 24 false (var xar0)) (bv 24 0x3412)) (bv 24 0x2)))) (loadw 0 16 (* (+ (cast 24 false (var xar0)) (bv 24 0x3412)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))))) (set xar0 (+ (var xar0) (bv 23 0x3412))))
d "mpym abs16(0x3412), *cdp, ac0" d111003412 0x0 (set ac0 (* (cast 40 (msb (loadw 0 16 (* (| (<< (cast 24 false (var dph)) (bv 8 0x10) false) (bv 24 0x3412)) (bv 24 0x2)))) (loadw 0 16 (* (| (<< (cast 24 false (var dph)) (bv 8 0x10) false) (bv 24 0x3412)) (bv 24 0x2)))) (cast 40 (msb (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2)))) (loadw 0 16 (* (cast 24 false (var xcdp)) (bv 24 0x2))))))
d "and 0xF91F, *sp(#3h)" f406f91f 0x0 (storew 0 (* (+ (cast 24 false (var sp)) (bv 24 0x3)) (bv 24 0x2)) (& (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x3)) (bv 24 0x2))) (bv 16 0xf91f)))
d "and 0xFA00, *sp(#4Bh)" f496fa00 0x0 (storew 0 (* (+ (cast 24 false (var sp)) (bv 24 0x4b)) (bv 24 0x2)) (& (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x4b)) (bv 24 0x2))) (bv 16 0xfa00)))
d "or 0x4100, *sp(#3h)" f5064100 0x0 (storew 0 (* (+ (cast 24 false (var sp)) (bv 24 0x3)) (bv 24 0x2)) (| (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x3)) (bv 24 0x2))) (bv 16 0x4100)))
d "or 0x8000, *sp(#4Bh)" f5968000 0x0 (storew 0 (* (+ (cast 24 false (var sp)) (bv 24 0x4b)) (bv 24 0x2)) (| (loadw 0 16 (* (+ (cast 24 false (var sp)) (bv 24 0x4b)) (bv 24 0x2))) (bv 16 0x8000)))
d "and 0x1234, *ar0" f4011234 0x0 (storew 0 (* (cast 24 false (var xar0)) (bv 24 0x2)) (& (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2))) (bv 16 0x1234)))
d "or 0x2345, *ar0" f5012345 0x0 (storew 0 (* (cast 24 false (var xar0)) (bv 24 0x2)) (| (loadw 0 16 (* (cast 24 false (var xar0)) (bv 24 0x2))) (bv 16 0x2345)))
d "amar *ar3, xar0" ec618e
d "amar *ar6+, xar0" ecc38e
d "amar *ar3, xar1" ec619e
d "amar *ar3, t0" ec614e
d "amar *sp(#20h), xar0" ec408e 0x0 (set xar0 (cast 23 false (+ (cast 24 false (var sp)) (bv 24 0x20))))

285
test/db/rzil/tms320
View file

@ -1,5 +1,5 @@
NAME=C55x+ RzIL VM: mov-imm, 16-bit add, bitwise xor, xar move execute
FILE=malloc://64
NAME=C55x/C55x+ RzIL VM: register, immediate, memory and multiply execute
FILE=malloc://0x100
CMDS=<<EOF
e asm.arch=tms320
e cfg.bigendian=false
@ -18,28 +18,6 @@ ar t0
ar t3
ar ac3
ar xar4
EOF
EXPECT=<<EOF
t0 = 0x0
t2 = 0x10
t3 = 0x20
ac3 = 0xf0
xar2 = 0x55
ac0 = 0x0000000042
t1 = 0x0001
t0 = 0x0009
t3 = 0x0030
ac3 = 0x00000000b2
xar4 = 0x000055
EOF
RUN
NAME=C55x+ RzIL VM: memory load/store, post-increment, accumulator add execute
FILE=malloc://0x100
CMDS=<<EOF
e asm.arch=tms320
e cfg.bigendian=false
e analysis.cpu=c55x+
wx 5802807400015105a0581301580583 @ 0
wx 3412 @ 0x20
wx 7856 @ 0x24
@ -53,43 +31,26 @@ ar ac0
ar ac1
ar ac3
ar xar3
EOF
EXPECT=<<EOF
ac1 = 0x1000
xar2 = 0x10
xar3 = 0x12
xar5 = 0x18
ac0 = 0x0000002234
ac1 = 0x0000005678
ac3 = 0x0000002234
xar3 = 0x000013
EOF
RUN
NAME=C55x+ RzIL VM: indexed word load *arN(short(#K)) execute
FILE=malloc://0x100
CMDS=<<EOF
e asm.arch=tms320
e cfg.bigendian=false
e analysis.cpu=c55x+
wx 5b8580 @ 0
wx cdab @ 0x30
aezi
aezv xar5 0x10
aezs 1
ar ac0
EOF
EXPECT=<<EOF
xar5 = 0x10
ac0 = 0x000000abcd
EOF
RUN
NAME=C55x RzIL VM: reg move + immediate add execute
FILE=malloc://64
CMDS=<<EOF
e asm.arch=tms320
e cfg.bigendian=false
wx 72a4277220a1722023760382770162c5626000ff @ 0
aezi
aezv xar0 0x100
aezv xar1 0x10
aezv xar3 0x5
aezv xar7 0x123
aezv ac0 0xabcdef
aezv ac2 0x12345
aezs 6
ar xar4
ar xar0
ar ac3
ar ac1
ar ac2
e analysis.cpu=c55x
wx 229840107b006400 @ 0
aezi
@ -98,40 +59,12 @@ aezv ac0 0
aezs 3
ar ar0
ar ac0
EOF
EXPECT=<<EOF
ar1 = 0x55
ac0 = 0x0
ar0 = 0x0055
ac0 = 0x0000000065
EOF
RUN
NAME=C55x RzIL VM: sp-relative load execute (word-pointer addressing)
FILE=malloc://0x80
CMDS=<<EOF
e asm.arch=tms320
e cfg.bigendian=false
e analysis.cpu=c55x
wx ac00 @ 0
wx efbe @ 0x40
aezi
aezv sp 0x20
aezs 1
ar ar4
EOF
EXPECT=<<EOF
sp = 0x20
ar4 = 0xbeef
EOF
RUN
NAME=C55x RzIL VM: cmpu writes TC1 (ST0_55 bit 13) from unsigned compare
FILE=malloc://64
CMDS=<<EOF
e asm.arch=tms320
e cfg.bigendian=false
e analysis.cpu=c55x
wx 3c01121804 @ 0
aezi
aezv ac0 0
@ -141,12 +74,162 @@ aezi
aezv ac0 5
aezs 2
ar st0_55
wx 5824 @ 0
aezi
aezv t1 0x4
aezv ac2 0x60000
aezs 1
ar ac0
wx d10100 @ 0
wx 0300 @ 0x20
wx 0500 @ 0x30
aezi
aezv xar0 0x10
aezv xcdp 0x18
aezs 1
ar ac0
wx d10104 @ 0
wx 0300 @ 0x20
wx 0500 @ 0x30
aezi
aezv ac0 0x10
aezv xar0 0x10
aezv xcdp 0x18
aezs 1
ar ac0
wx d20101 @ 0
wx 0300 @ 0x20
aezi
aezv ac0 0x10
aezv ac1 0x50000
aezv xar0 0x10
aezs 1
ar ac0
wx d40101 @ 0
wx 0300 @ 0x20
aezi
aezv ac1 0x100
aezv t0 0x5
aezv xar0 0x10
aezs 1
ar ac0
wx d30104 @ 0
wx 0700 @ 0x20
aezi
aezv ac0 0xff
aezv t0 0x6
aezv xar0 0x10
aezs 1
ar ac0
wx d00104 @ 0
wx 0200 @ 0x20
wx ffff @ 0x30
aezi
aezv xar0 0x10
aezv xcdp 0x18
aezs 1
ar ac0
wx d40180 @ 0
wx 0300 @ 0x20
aezi
aezv ac0 0
aezv xar0 0x10
aezv t0 0x2
aezs 1
ar t3
ar ac0
wx d30108 @ 0
wx fdff @ 0x20
aezi
aezv xar0 0x10
aezs 1
ar ac0
wx d20108 @ 0
wx 0300 @ 0x20
aezi
aezv xar0 0x10
aezv ac0 0x10
aezs 1
ar ac0
EOF
EXPECT=<<EOF
t0 = 0x0
t2 = 0x10
t3 = 0x20
ac3 = 0xf0
xar2 = 0x55
ac0 = 0x0000000042
t1 = 0x0001
t0 = 0x0009
t3 = 0x0030
ac3 = 0x00000000b2
xar4 = 0x000055
ac1 = 0x1000
xar2 = 0x10
xar3 = 0x12
xar5 = 0x18
ac0 = 0x0000002234
ac1 = 0x0000005678
ac3 = 0x0000002234
xar3 = 0x000013
xar5 = 0x10
ac0 = 0x000000abcd
xar0 = 0x100
xar1 = 0x10
xar3 = 0x5
xar7 = 0x123
ac0 = 0xabcdef
ac2 = 0x12345
xar4 = 0x000123
xar0 = 0x00010b
ac3 = 0xfffffedcbb
ac1 = 0x0000002345
ac2 = 0x00000100ef
ar1 = 0x55
ac0 = 0x0
ar0 = 0x0055
ac0 = 0x0000000065
sp = 0x20
ar4 = 0xbeef
ac0 = 0x0
st0_55 = 0x2000
ac0 = 0x5
st0_55 = 0x0000
t1 = 0x4
ac2 = 0x60000
ac0 = 0x0000000018
xar0 = 0x10
xcdp = 0x18
ac0 = 0x000000000f
ac0 = 0x10
xar0 = 0x10
xcdp = 0x18
ac0 = 0x000000001f
ac0 = 0x10
ac1 = 0x50000
xar0 = 0x10
ac0 = 0x000000001f
ac1 = 0x100
t0 = 0x5
xar0 = 0x10
ac0 = 0x000000010f
ac0 = 0xff
t0 = 0x6
xar0 = 0x10
ac0 = 0x000000002a
xar0 = 0x10
xcdp = 0x18
ac0 = 0x000001fffe
ac0 = 0x0
xar0 = 0x10
t0 = 0x2
t3 = 0x0003
ac0 = 0x0000000006
xar0 = 0x10
ac0 = 0x0000000009
xar0 = 0x10
ac0 = 0x10
ac0 = 0x0000000019
EOF
RUN
@ -175,42 +258,6 @@ ar1 = 0x0058
EOF
RUN
NAME=C55x+ RzIL VM: amov/aadd/asub, neg, mov half->reg, and-half execute
FILE=malloc://64
CMDS=<<EOF
e asm.arch=tms320
e cfg.bigendian=false
e analysis.cpu=c55x+
wx 72a4277220a1722023760382770162c5626000ff @ 0
aezi
aezv xar0 0x100
aezv xar1 0x10
aezv xar3 0x5
aezv xar7 0x123
aezv ac0 0xabcdef
aezv ac2 0x12345
aezs 6
ar xar4
ar xar0
ar ac3
ar ac1
ar ac2
EOF
EXPECT=<<EOF
xar0 = 0x100
xar1 = 0x10
xar3 = 0x5
xar7 = 0x123
ac0 = 0xabcdef
ac2 = 0x12345
xar4 = 0x000123
xar0 = 0x00010b
ac3 = 0xfffffedcbb
ac1 = 0x0000002345
ac2 = 0x00000100ef
EOF
RUN
NAME=C55x+ RzIL VM: emulateme _decrypt decrypts seckrit to "Hello from RzIL!"
FILE=bins/tms320/coff2/19_emulateme_nostd.obj
CMDS=<<EOF