BSAR (Barrel Shift ACC Right) was grouped with the left-shift ops and
reported RZ_ANALYSIS_OP_TYPE_SHL. It shifts the accumulator right (1..16
bits, sign-extended under SXM), so it belongs with the SHR group next to
RORB/SFRB. The decode (shift code + 1) was already correct and continues
to match the reference disassembler bit-for-bit.
Lift the TMS320C5x instruction set to RzIL. Shared-semantics
instructions reuse the C2x lifter (the C5x-only forms that are a renamed
C2x op, such as the delayed branches, map onto their non-delayed
equivalents); the C5x-only core instructions (the ACCB accumulator-buffer
loads and logical ops, the swap, the zero-accumulator forms, the control
bits and the store-long-immediate) are lifted directly. Instructions with
effects the per-instruction RzIL cannot model cleanly (conditional
control transfers, block moves, parallel-logic, memory-mapped register
access, the MAC fetch forms) are decoded and analysed but left without
IL. Wired into the analysis plugin's il_config under cpu "c5x", with the
C5x register bindings (ACCB and the C5x-specific registers). The asm
tests assert the lifted RzIL, with execution tests covering the IL VM.
Lift the TMS320C2x instruction set to RzIL: the 32-bit accumulator and
product paths, the auxiliary-register file with all indirect addressing
modes, the status bits (carry, overflow, OVM saturation, SXM sign
extension, product-mode shifts, TC), and the load/store, multiply,
accumulate, shift, logical and control-flow instructions. Wired into the
analysis plugin's il_config under cpu "c2x". The asm tests now assert the
lifted RzIL for every instruction, with execution tests covering the IL
VM end to end.
Add the real TMS320C5x (C50/C51/C53) object encoding. The C5x is
source-compatible with the C2x but encodes instructions differently, so
it cannot reuse the C2x decode table: a dedicated C5x decode front-end
fills the shared C55 instruction representation, carrying the C2x ids for
shared-semantics instructions (so the common consumers apply unchanged)
and new C5x-only ids for the C5x additions (ACCB ops, parallel-logic,
memory-mapped register access, conditional execute/call/return, block
moves, ...). Wired into the tms320 asm and analysis plugins under cpu
"c5x", with the C5x mnemonic and op-type tables and register profile.
Includes disassembly and opcode classification tests.
Add support for the legacy TMS320C2x (C25-class) fixed-point DSP family
to the shared C55 decode-IR engine: the C2x opcode table, operand
extractors, mnemonic and op-type tables, and the register profile, wired
into the tms320 asm and analysis plugins under cpu "c2x". The decoder
fills the shared C55 instruction representation so the common formatter
and analysis filler apply unchanged. Includes disassembly and opcode
classification tests, plus a COFF-loading test exercising the new bin
autodetect.
The C54x and C28x address 16-bit words, so their loadable section sizes
and every address in the file count words. Rizin's address space is
byte-based, so reading those unscaled mapped only half of each loadable
section and placed every symbol at half its true offset: _main in the
c54x emulateme object landed mid-instruction instead of on its prologue.
Scale section VAs, loadable section sizes and symbol addresses by the
target's address unit. Debug sections are byte streams even on these
targets and keep a scale of one, matching the loadable mask already used
for mapping. The C55x addresses program memory by byte and is left
alone; the ids were checked against the objects in rizin-testbins by
comparing each section's declared size against its extent in the file.
Branch and call targets on the C54x count program words too, and reached
analysis and RzIL unscaled. That went unnoticed while the sections were
half-mapped: the emulateme RzIL test ran from a mid-instruction address
whose decode happened to lift, so it pinned values produced by garbage.
Scale those as well and drive the test the way its C55x sibling does,
decrypting seckrit with the real key.
With the sections fully mapped, analysis now finds every routine the
c54x fixtures declare, so the function counts change.
The `RzFloat` changes fix or improve:
- binary80 explicit-integer-bit, pseudo-value, infinity, and NaN handling;
- binary16 conversions;
- gradual underflow and directed rounding;
- overflow, underflow, invalid-operation, and inexact exception reporting;
- exception propagation through nested conversions and arithmetic operations;
- binary80 fused multiply-add rounding, including reduced-precision and double-rounding edge cases;
- thread-local SoftFloat state, preventing rounding state from leaking between threads.
The `RzIL` changes add scoped binary80 precision support through `RzFloatRPrecision` and `FWITH_RPREC`. The supported precisions are 32, 64, and 80. Precision scopes restore the
previous thread-local SoftFloat state after successful evaluation and evaluation failures.
Runtime rounding modes are represented explicitly by dedicated pure opcodes:
- `FCONVERT_WITH_RMODE`
- `FROUND_WITH_RMODE`
- `FSQRT_WITH_RMODE`
- `FADD_WITH_RMODE`
- `FSUB_WITH_RMODE`
- `FMUL_WITH_RMODE`
- `FDIV_WITH_RMODE`
- `FMOD_WITH_RMODE`
Their rounding-mode operand is a 32-bit IL bitvector whose values correspond to `RzFloatRMode`: RNE, RNA, RTP, RTN, and RTZ. Invalid operand widths are rejected by validation,
while invalid runtime values cause evaluation to fail with an error.
Dedicated opcodes keep runtime-controlled floating-point expressions compact. This is useful for architectures whose rounding mode is selected from register state and avoids the
expression duplication caused by expanding every operation into nested `ITE` branches.
The new operations are supported by:
- construction, duplication, and destruction;
- type and operand validation;
- VM evaluation;
- plain, Unicode, and JSON exporters;
- graph output and opcode stringification.
`FEXCEPT` now emits a VM event only when the queried exception is present, while preserving exceptions raised by nested conversions and arithmetic operations.
* Allow to set dotall and multiline flag also for normal regex patterns.
* String search sees NUL as newline by default.
That is the most intuitive option for binary searches.
The behavior can still be changed. An example us added.
realloc with 0 size behavior is implementation-defined and not very
useful to us, also valgrind is noisy about it.
When we shrink with len 0, it is best to just free the array.
The jump addresses of call and jump instructions are now written to their own
and unique local variables. Before this, all jump instructions wrote to the
same local variable.
This was a problem for abstract interpretation: Because if multiple writes to
the same local var happen due to a previous TOP condition, the local variable
content is also TOP. If the jump target is TOP, the interpreter can't follow it
anymore.
Added tests for all the funny packet configurations with 0-2 jumps in it.
* Prefix Tree (Trie)
* Implemented complete RzTrie library, for prefix trees with all major APIs and full unit testing.
* Two unit tests: one for string and one for bitvector (to show usage). Almost 100% coverage
% 2**4.5 asserted both the %.17g rendering and the exact bit pattern of
pow(2.0, 4.5). The exact value is 22.62741699796952078...; glibc and the
UCRT return the correctly rounded 0x4036a09e667f3bcd, while FreeBSD and
NetBSD return 0x4036a09e667f3bcc, one ULP low. msun's pow is documented as
under one ULP, not correctly rounded, so the test asserted bit-exact libm
behaviour for a transcendental and could not pass everywhere.
Filter the output down to the rounded line, which every implementation
within one ULP agrees on. The full float/scifmt/hex table stays covered by
the tests whose results are exactly representable.
Replace the hand-written parser in calc.c with a tree-sitter grammar
(subprojects/rizin-math-parser) and a typed evaluator. The old parser
could only ever produce a ut64 and folded anything it failed to read to
0, which left callers unable to tell a failed expression from one that
evaluated to zero.
Expressions now evaluate to an RzNumValue, a tagged union over ut64,
double, RzBitVector, arbitrary-precision integer and arbitrary-precision
decimal, carrying an RzNumError rather than signalling failure as 0.
Literals keep the width they were written with (5u8, 0xffu128, any width
from 1 to 65536), results that outgrow 64 bits promote to a big number on
their own, and a parse error, division by zero or unresolved identifier
reaches the caller.
rz_num_math() is deprecated. rz_num_math_ut64() keeps its exact behaviour
for callers that want a ut64, and rz_num_math_value() exposes the typed
result. rz_core_math() adds the RzCore-backed form used by the % command,
with rz_core_math_ut64() deprecated alongside it. rz-ax routes through the
typed API, so it prints values at full precision, reports errors on stderr
and exits non-zero. rz_il_lift_num() converts an expression to an
RzILOpPure, so a numeric argument can be lifted instead of pre-evaluated.
Legacy input still works: trailing base suffixes (101b, 35o, 212t), the
trailing-'h' hex form and the k/m/g scale suffixes are all accepted and
warn once, pointing at the 0b/0o/0t prefixes. doc/math.md documents the
language and doc/math-il-lift.md the lift; the grammar, the evaluator,
rz-ax and the % command are covered by unit and db tests.
* Update rz_config list variables to set variables
* Linking error fix
* Update rz_config_get_options in cautocmpl.c
* Update rz_config_get_options in core/tui/config.c
* Test fix
* Assertion error fix
To perform the effect in a delay slot, if the branch was not taken, the
IL, which is already lifted as part of the delay slot instruction, would
explicitly jump to itself again, to execute the effect as normal.
This would create erroneous loop edges in the cfg.
It is actually not necessary to perform this jmp since we already have
the lifted effect and can inline it.
While processing xrefs for marking them as data:
1. classify target using `xref_ref_kind` for data section too, previously it was only classified if target was in exec segment. Which caused false positive when the target was in non-exec section. Happens when the immediate value is small and it points in data section.
2. restrict data block from bleeding into other sections. Currently it correctly caps data block at next "detected" function (or next data) but when the function is not detected yet (like in stripped bins) and the area onward from data ref is empty, the data block bleeds into other sections specifically executable section. This should never happen.
Flags are sorted into the name hashtable with their realnames as well.
Refcounting is used to prevent double-free and similar issues that would
be caused by this.
rz_reg_profile_to_cc() only emitted the first four argument registers
(A0-A3), so architectures that pass more arguments in registers -- the
C6000 EABI uses ten, and x86-64/riscv/ppc all declare more than four --
got a truncated convention. Walk the whole A0-A9 role range, stopping at
the first role the profile leaves undefined, and build the cc string with
RzStrBuf. Covered by a new test_reg unit test.
Co-authored-by agent: Claude/claude-opus-4-8
Co-authored-by: Anton Kochkov <anton.kochkov@gmail.com>
Warning: this also swaps the arguments of the old rz_bv_append() to be
consistend with the new inplace variant.
The reason why the inplace function has the low as the first operand is
that it can be more efficient to append to an existing vector inplace
than to prepend to it. Then, the first argument is being used as the
in-out one in all other inplace functions.
