Add new TMS320C2x (legacy) and TMS320C5x (legacy) series support#6582
Draft
notxvilka wants to merge 6 commits into
Draft
Add new TMS320C2x (legacy) and TMS320C5x (legacy) series support#6582notxvilka wants to merge 6 commits into
notxvilka wants to merge 6 commits into
Conversation
Rot127
requested changes
Jul 10, 2026
Comment on lines
+110
to
+116
| switch (m->amode) { | ||
| case C55_AM_POSTINC: kind = 1; break; | ||
| case C55_AM_POSTDEC: kind = 2; break; | ||
| case C55_AM_POSTADD: kind = 3; break; | ||
| case C55_AM_POSTSUB: kind = 4; break; | ||
| default: return NULL; // *no-modify or reverse-carry (AR left as-is) | ||
| } |
Member
There was a problem hiding this comment.
Instead of that it could just use m->amode directly, couldn't it?
notxvilka
force-pushed
the
asan-tms320-c2xc5x
branch
from
40bd096 to
4cca7b6
Compare
github-actions
Bot
added
the
AI/LLM
The legacy TMS320 fixed-point families ship as 16-bit big-endian COFF objects whose magic and machine identifiers were not recognised by the COFF loader. Teach the COFF format backend and the bin plugin to detect and load them so the new tms320 c2x/c5x analysis can operate on real object files.
Add support for the legacy TMS320C2x (C25-class) fixed-point DSP family to the shared C55 decode-IR engine: the C2x opcode table, operand extractors, mnemonic and op-type tables, and the register profile, wired into the tms320 asm and analysis plugins under cpu "c2x". The decoder fills the shared C55 instruction representation so the common formatter and analysis filler apply unchanged. Includes disassembly and opcode classification tests, plus a COFF-loading test exercising the new bin autodetect.
Add the real TMS320C5x (C50/C51/C53) object encoding. The C5x is source-compatible with the C2x but encodes instructions differently, so it cannot reuse the C2x decode table: a dedicated C5x decode front-end fills the shared C55 instruction representation, carrying the C2x ids for shared-semantics instructions (so the common consumers apply unchanged) and new C5x-only ids for the C5x additions (ACCB ops, parallel-logic, memory-mapped register access, conditional execute/call/return, block moves, ...). Wired into the tms320 asm and analysis plugins under cpu "c5x", with the C5x mnemonic and op-type tables and register profile. Includes disassembly and opcode classification tests.
Lift the TMS320C2x instruction set to RzIL: the 32-bit accumulator and product paths, the auxiliary-register file with all indirect addressing modes, the status bits (carry, overflow, OVM saturation, SXM sign extension, product-mode shifts, TC), and the load/store, multiply, accumulate, shift, logical and control-flow instructions. Wired into the analysis plugin's il_config under cpu "c2x". The asm tests now assert the lifted RzIL for every instruction, with execution tests covering the IL VM end to end.
Lift the TMS320C5x instruction set to RzIL. Shared-semantics instructions reuse the C2x lifter (the C5x-only forms that are a renamed C2x op, such as the delayed branches, map onto their non-delayed equivalents); the C5x-only core instructions (the ACCB accumulator-buffer loads and logical ops, the swap, the zero-accumulator forms, the control bits and the store-long-immediate) are lifted directly. Instructions with effects the per-instruction RzIL cannot model cleanly (conditional control transfers, block moves, parallel-logic, memory-mapped register access, the MAC fetch forms) are decoded and analysed but left without IL. Wired into the analysis plugin's il_config under cpu "c5x", with the C5x register bindings (ACCB and the C5x-specific registers). The asm tests assert the lifted RzIL, with execution tests covering the IL VM.
BSAR (Barrel Shift ACC Right) was grouped with the left-shift ops and reported RZ_ANALYSIS_OP_TYPE_SHL. It shifts the accumulator right (1..16 bits, sign-extended under SXM), so it belongs with the SHR group next to RORB/SFRB. The decode (shift code + 1) was already correct and continues to match the reference disassembler bit-for-bit.
notxvilka
force-pushed
the
asan-tms320-c2xc5x
branch
from
4cca7b6 to
8c44ed0
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Your checklist for this pull request
RZ_APIfunction and struct this PR changes.RZ_API).Detailed description
Legacy TMS320C2x (pre-C28x) and TMS320C5x (pre-C54x) were quite common in many places, and they share some of the infrastructure with already implemented TMS320C54x/C55x in Rizin.
Add both disassembly and RzIL uplifting.
Because no public toolchain available, I vibe-coded and verified against some other projects and pairs of source-binary the small toolchain for C2x and C5x in Rust - assembler, disassembler, C compiler, linker, and emulator: https://codeberg.org/xvilka/tms320-rs
Requires this PR for testbins: rizinorg/rizin-testbins#302
Test plan
CI is green