mirror of https://github.com/rizinorg/rizin synced 2026-08-22 20:26:16 -04:00

History

Anton Kochkov 38c3bed6c9 Some checks failed Code scanning / build (CodeQL-cpp) (push) Has been cancelled Details Code scanning / build (CodeQL-javascript) (push) Has been cancelled Details Code scanning / build (CodeQL-python) (push) Has been cancelled Details Mixed linter and checks / changes (push) Has been cancelled Details Mixed linter and checks / licenses (push) Has been cancelled Details Muon build / ubuntu-muon (push) Has been cancelled Details TinyCC build / ubuntu-tcc-test (push) Has been cancelled Details Mixed linter and checks / clang-format (push) Has been cancelled Details Mixed linter and checks / prettier (push) Has been cancelled Details Mixed linter and checks / cmd_descs_yaml_check (push) Has been cancelled Details Mixed linter and checks / bindgen-linter (push) Has been cancelled Details Mixed linter and checks / python (push) Has been cancelled Details librz/arch/tms320/c5x: classify BSAR as a right shift in analysis BSAR (Barrel Shift ACC Right) was grouped with the left-shift ops and reported RZ_ANALYSIS_OP_TYPE_SHL. It shifts the accumulator right (1..16 bits, sign-extended under SXM), so it belongs with the SHR group next to RORB/SFRB. The decode (shift code + 1) was already correct and continues to match the reference disassembler bit-for-bit.		2026-08-17 01:53:33 +08:00
..
c2x	librz/arch/tms320: add TMS320C2x RzIL lifter	2026-08-17 01:53:33 +08:00
c5x	librz/arch/tms320/c5x: classify BSAR as a right shift in analysis	2026-08-17 01:53:33 +08:00
c54x	librz/bin/coff: scale addresses on word-addressed TI targets	2026-08-17 01:53:33 +08:00
c55x	arch/tms320: drop c55x+ global state, populate op->val, lift rptadd/rptsub (#6525 )	2026-06-18 03:52:09 +08:00
c55x_plus	arch/tms320: drop c55x+ global state, populate op->val, lift rptadd/rptsub (#6525 )	2026-06-18 03:52:09 +08:00
c64x	Move RzAnalysis as private and force usage of C API (#6123 )	2026-04-06 16:07:53 +00:00
scripts	Merge rz_asm and rz_analysis into one library but keep deprecated apis.	2024-03-07 18:38:49 +08:00
c55_ir.c	librz/arch/tms320: add TMS320C2x disassembler and analysis	2026-08-17 01:53:33 +08:00
c55_ir.h	librz/arch/tms320: add TMS320C2x disassembler and analysis	2026-08-17 01:53:33 +08:00
README.md	arch/tms320: TMS320C55x+ analysis & RzIL (PR #6434 ) + extended lifter coverage	2026-06-15 23:31:05 +08:00
tms320_dwarf_regnum_table.h	arch/tms320: c55x and c55x+ analysis classifiers (byte-driven)	2026-05-28 17:44:54 +08:00
tms320c55x_insn.c	arch/tms320: rewrite C55x and C55x+ on a shared decode-IR engine	2026-06-15 23:31:05 +08:00
tms320c55x_insn.h	arch/tms320: rewrite C55x and C55x+ on a shared decode-IR engine	2026-06-15 23:31:05 +08:00

README.md

TMS320 architectures

Rizin's tms320 arch plugin covers three Texas Instruments DSP families, selected by analysis.cpu / asm.cpu:

cpu	family	word	endian	typical parts
`c55x`	TMS320C55x	16	LE	C5501, C5502, C5503, C5507, C5509, C5510
`c55x+`	TMS320C55x+	16	LE	C5504, C5505, C5514, C5515, C5517, C5535, C5545
`c64x`	TMS320C6000 / C64x	32	LE	C6201..C6748, C6655, KeyStone-II

c64x

VLIW 32-bit DSP. Independent disassembler under c64x/ based on the Capstone backend. Fixed 32-bit instruction width packed into execute packets.

c55x

Variable-length (1-7 byte) instructions, little-endian, 16-bit word. Documented in TI SPRU374 (TMS320C55x DSP Mnemonic Instruction Set Reference Guide, public). Bit 0 of the leading opcode byte is the parallel-execution marker: 02 04 05 is RETCC T0 == 0, the sibling encoding 03 04 05 is || RETCC T0 == 0. Same instruction, same operands, executed in parallel with the previous one.

c55x+

Two distinct things share this name:

TI's c55x+ core (publicly documented) -- the "C55x DSP Core+", a forward-compatible extension shipped in the Low-Power C55x family (C5504, C5505, C5514, C5515, C5517, C5535, C5545). Every baseline c55x instruction still decodes the same way; c55x+ adds new instructions in previously-unused opcode slots.
The pre-release c55x+ used in TI silicon ca. 2005-2010 -- documented in SWPU086 (CPU Reference Guide, May 2005) and SWPU104 (Algebraic Instruction Set, Dec 2006). Original name internally was "Ryujin"; appears in production silicon including a TMS320C55x+ DSP baseband (as used in some Motorola basebands) (firmware partition CG45.img, validated against version MSG39UPEU_A1.19_1.80 dated 2010-02-05). Several opcode slots differ from baseline c55x -- most notably 0x21 = RET (vs || nop in baseline). The instruction stream is not byte-compatible with the modern c55x+ in slot 2, but a sizeable subset agrees.

Rizin's c55x+ plugin handles both: the byte-driven analyzer classifies the opcodes that overlap between the two, and the disassembler covers SWPU086/104 encodings used by such silicon. SWPU086/104 are not redistributed in this tree.

Selecting a cpu

rizin -a tms320 -e analysis.cpu=c55x   FILE.coff   # baseline C55x
rizin -a tms320 -e analysis.cpu=c55x+  FILE.coff   # c55x+ (Ryujin / SWPU104)
rizin -a tms320 -e analysis.cpu=c64x   FILE.elf    # VLIW C64x

The COFF loader autodetects c55x (TI COFF v2 target_id 0x009c) and c55x+ (target_id 0x00a1) from the file header.

References

TI SPRU374 -- TMS320C55x DSP Mnemonic Instruction Set Reference Guide (public)
TI SPRU430 -- TMS320C6000 CPU and Instruction Set Reference Guide (public; covers c64x)
TI SWPU086 -- TMS320C55x 'C55x+' CPU Reference Guide, Preliminary, May 2005
TI SWPU104 -- TMS320C55x+ DSP Algebraic Instruction Set Reference Guide, December 2006