Following a cold trail...
After a bit more experiments, I finally got why I couldn't get anything into the BSP's IMEM. The chip is supposedly 16 bits and, despite writing BSP code word by word to the IMEM, I was trying to read it back 64 bits at a time
(see disclaimer in 1st post !). After fixing this mistake, I could read back exactly what was written to instruction memory.
So, now that we can feed *something* to the BSP, maybe it's time to have a look at that binutils BSP patch from 2002. There is no indications about which binutils version it is supposed to apply against. By having a look at binutils version around that time frame, I downloaded and attempted to patch all versions from 2.12 (~ March 2002) to 2.17 (~June 2006). All patch attempts failed more or less, so I decided to settle with the version that failed less, that is 2.14. After a few hours of tweaking and compiling I finally got the patched binutils to compile.
Time to try to compile something. After having a look at the source code and the instruction set, there is a lot of unusual stuff there, but we can see some familiar MIPS looking instructions adapted to a 16 bits ISA. Here is a quick grep that should give you an idea of the instruction set of the beast :
lh $rAB $imm
lbl $rAB $imm
lbh $rAB $imm
sh $rAB $imm
sbl $rAB $imm
sbh $rAB $imm
lil $rAB $imm
lih $rAB $imm
nop
cmpi $rAB $imm
andi $rAB $imm
addi $rAB $imm
b $imm
beq $imm
bne $imm
bge $imm
blt $imm
bext0 $imm
bext1 $imm
bext2 $imm
jr $rT
jreq $rT
jreq $rT
jrge $rT
jrge $rT
jrext0 $rT
jrext1 $rT
jrext2 $rT
break
resume
add $rDCD $rSC $rT
addc $rDCD $rSC $rT
sub $rDCD $rSC $rT
subc $rDCD $rSC $rT
and $rDCD $rSC $rT
or $rDCD $rSC $rT
sll $rDCD $rSC $rT
sra $rDCD $rSC $rT
mul $rDCD $rSC $rT
xor $rDCD $rSC $rT
abs $rDCD $rT
copyto $rAltC $rSC
copyfrom $rAltC $rDCD
lhr $rDCD $rSC
lhr $rSC $rT
gtbitsi $bitswallow $rDCD $N
probebitsi $rDCD $N
shiftstream $bitswallow $N
getbitsr $bitswallow $rDCD $rT
genlookuppack $rT
leafrunlevelparse $bitswallow
blockrunlevelparse $bitswallow
loadcodepackH261 $bitswallow $p $imm
genericleafparse
blockrunsizeparse $bitswallow
codesearch $q $p
packbitstream $q $L $rT
loadcodepack $q $p $imm
bytealign
There are also 8 general purpose registers, and some other exotic stuff I still have no clue about.
So let's set the bar low and compile the simplest thing we can, just a "break" instruction (interestingly there is also a "resume" instruction). Then load and attempt to make the BSP run the code :
regs 4000000
buffers 400F000
BSP reset
loop halt
loop halt reset
MSP fill IRAM
BSP fill IRAM
Read code size 18
BSP IRAM
4000: 07010200 00000000 00000000 00000100 20000000 00000000 00000000 00000000
4020: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
4040: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
4060: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
...
4fc0: 00060006 00060006 00060006 00060006 00060006 00060006 00060006 00060006
4fe0: 00060006 00060006 00060006 00060006 00060006 00060006 00060006 00060006
EPC 8 Cause 0
BSP run
PC 0000
PC 0016
PC 0016
PC 0016
...
PC 0016
PC 0016
EPC 10 Cause 4
Not so impressive, but at least it's doing what we asked for ! Started with a PC at 0x0000 (or absolute 0x4000, it does not seems to matter which one we load in the PC register), stopped at 0x16 with an exception PC at 0x10 wich is the address of our "break" instruction. I attempted more sophisticated stuff with branches and jumps but didn't get anything to work yet.
It would be nice to be able to disassemble some known BSP code and have a look at how it works. In the previous posts, we noted that libvice loads code from
/var/arch/vicedx/ or
/var/arch/vicetre/ depending on your VICE chip revision. Here is an example of what your will find on your O2 :
total 144
drwxr-xr-x 2 root sys 4096 Feb 1 2001 .
drwxr-xr-x 8 root sys 79 Feb 1 2001 ..
-r--r--r-- 1 root sys 2716 Feb 1 2001 cjfif.mex
-r--r--r-- 1 root sys 7680 Feb 1 2001 cjpeg-mcoef.bin
-r--r--r-- 1 root sys 650 Feb 1 2001 cjpeg.bex
-r--r--r-- 1 root sys 2176 Feb 1 2001 cjpeg.btbl
-r--r--r-- 1 root sys 2564 Feb 1 2001 cjpeg.mex
-r--r--r-- 1 root sys 650 Feb 1 2001 cjpeg_luma.bex
-r--r--r-- 1 root sys 2564 Feb 1 2001 cjpeg_luma.mex
-r--r--r-- 1 root sys 1184 Feb 1 2001 dfjpeg.bex
-r--r--r-- 1 root sys 3664 Feb 1 2001 dfjpeg.mex
-r--r--r-- 1 root sys 3088 Feb 1 2001 djfif.mex
-r--r--r-- 1 root sys 304 Feb 1 2001 djpeg-mcoef.bin
-r--r--r-- 1 root sys 1276 Feb 1 2001 djpeg.bex
-r--r--r-- 1 root sys 2688 Feb 1 2001 djpeg.btbl
-r--r--r-- 1 root sys 3056 Feb 1 2001 djpeg.mex
-r--r--r-- 1 root sys 1088 Feb 1 2001 dvcVLC.bin
-r--r--r-- 1 root sys 1450 Feb 1 2001 dvcntsc.bex
-r--r--r-- 1 root sys 4064 Feb 1 2001 dvcntsc.mex
-r--r--r-- 1 root sys 1460 Feb 1 2001 dvcpal.bex
-r--r--r-- 1 root sys 4060 Feb 1 2001 dvcpal411.mex
-r--r--r-- 1 root sys 3528 Feb 1 2001 dvcpal420.mex
-r--r--r-- 1 root sys 4024 Feb 1 2001 dvencodentsc.mex
-r--r--r-- 1 root sys 4024 Feb 1 2001 dvencodepal411.mex
-r--r--r-- 1 root sys 3688 Feb 1 2001 dvencodepal420.mex
-r--r--r-- 1 root sys 5056 Feb 1 2001 m1tabs.btbl
-r--r--r-- 1 root sys 5056 Feb 1 2001 m2tabs.btbl
-r--r--r-- 1 root sys 2034 Feb 1 2001 mpeg1dec.bex
-r--r--r-- 1 root sys 3492 Feb 1 2001 mpeg1dec.mex
-r--r--r-- 1 root sys 2032 Feb 1 2001 mpeg2dec.bex
-r--r--r-- 1 root sys 3548 Feb 1 2001 mpeg2dec.mex
-r--r--r-- 1 root sys 2032 Feb 1 2001 mpeg2dec_fld.bex
-r--r--r-- 1 root sys 3548 Feb 1 2001 mpeg2dec_fld.mex
-r--r--r-- 1 root sys 2976 Feb 1 2001 rs.mex
The MEX files are MSP executable code, the BEX files are BSP executables and the BTBL are BSP tables to be loaded in BSP table memory.
Let's attempt to disassemble
djpeg.bex (supposedly the BSP part of the JPEG decoder) :
bash-5.0$ ./binutils/objdump -b a.out-bsp -m bsp -D /var/arch/vicetre/djpeg.bex
./binutils/objdump: /var/arch/vicetre/djpeg.bex: File format not recognized
Pretty disappointing indeed
But the attentive reader may have noticed that when we loaded our compiled BSP code, we had an object 18 bytes long for a single instruction that should be only 2 bytes :
Read code size 18
BSP IRAM
4000: 07010200 00000000 00000000 00000100 20000000 00000000 00000000 00000000
The first 16 bytes looks like a header and, if we have a closer look, bytes at offset 2 and 3 looks like our code length. This can be verified by compiling a few code sample and confirm that only these bytes are changing and reflect code length.
So let's take our
djpeg.bex object, prepend this 16 bytes header, and hexedit bytes 2 & 3 to reflect our code length, and try again objdump :
Disassembly of section .text:
0000000000000000 <.text>:
0: 64 00 abs r0 r0
2: bd 01 lih r5 0x1
4: b5 f0 lil r5 0xf0
6: b4 00 lil r4 0x0
8: 1f 04 *unknown*
a: bc 80 lih r4 0x80
c: 20 00 break
e: 00 00 nop
10: 20 00 break
12: be 80 lih r6 0x80
14: b6 00 lil r6 0x0
16: 00 00 nop
18: 79 c5 *unknown*
1a: 4d fe and r3 r7 r6
1c: 48 3e *unknown*
1e: 19 fb bne 0xfb
20: 00 00 nop
22: 70 20 copyto rpage r4
24: 00 00 nop
26: 81 09 lh r1 0x9
28: 82 0b lh r2 0xb
2a: 64 db xor r1 r3 r3
2c: 86 0f lh r6 0xf
2e: b5 00 lil r5 0x0
30: bd 14 lih r5 0x14
32: 41 6c add r2 r5 r4
34: 70 28 copyto rpage r5
36: 00 00 nop
38: 99 00 sh r1 0x0
3a: 99 02 sh r1 0x2
3c: 9a 01 sh r2 0x1
3e: 9a 03 sh r2 0x3
40: 9b 04 sh r3 0x4
42: 9b 05 sh r3 0x5
44: 98 06 sh r0 0x6
46: 0e 04 cmpi r6 0x4
48: 19 04 bne 0x4
4a: 9e 07 sh r6 0x7
4c: b6 01 lil r6 0x1
4e: be 00 lih r6 0x0
50: 9e 07 sh r6 0x7
52: 81 07 lh r1 0x7
54: 77 b8 *unknown*
56: b7 04 lil r7 0x4
58: bf 00 lih r7 0x0
5a: 51 b7 or r3 r6 r7
5c: 73 f0 copyto mask_h r6
5e: b5 04 lil r5 0x4
60: 77 b8 *unknown*
62: bd 00 lih r5 0x0
64: 65 b7 xor r3 r6 r7
66: 73 f0 copyto mask_h r6
68: b7 00 lil r7 0x0
6a: bf 70 lih r7 0x70
6c: 7c 2f *unknown*
6e: 00 00 nop
70: 79 87 *unknown*
72: 00 00 nop
74: 65 b5 xor r3 r6 r5
76: 00 00 nop
78: 7c 2f *unknown*
7a: c1 cf gtbitsi puke r3 0xf
7c: c1 cf gtbitsi puke r3 0xf
7e: b7 db lil r7 0xdb
80: bf ff lih r7 0xff
82: 71 78 copyto alpha_l r7
84: 71 80 copyto beta_h r0
86: b7 ff lil r7 0xff
88: bf ff lih r7 0xff
8a: 71 f8 copyto beta_h r7
8c: 72 00 copyto beta_l r0
8e: ea 00 codesearch 0x1 0x0
90: b5 30 lil r5 0x30
92: bd 00 lih r5 0x0
94: 41 6c add r2 r5 r4
96: 70 28 copyto rpage r5
98: 00 00 nop
9a: c1 cf gtbitsi puke r3 0xf
9c: c1 cf gtbitsi puke r3 0xf
9e: c1 c7 gtbitsi puke r3 0x7
a0: c1 87 gtbitsi puke r3 0x7
a2: c1 c7 gtbitsi puke r3 0x7
a4: 9e 00 sh r6 0x0
a6: 9f 01 sh r7 0x1
a8: c1 87 gtbitsi puke r3 0x7
aa: c1 c7 gtbitsi puke r3 0x7
ac: 9e 08 sh r6 0x8
ae: 9f 10 sh r7 0x10
b0: c1 87 gtbitsi puke r3 0x7
b2: c1 c7 gtbitsi puke r3 0x7
b4: 9e 09 sh r6 0x9
b6: 9f 02 sh r7 0x2
b8: c1 87 gtbitsi puke r3 0x7
ba: c1 c7 gtbitsi puke r3 0x7
bc: 9e 03 sh r6 0x3
be: 9f 0a sh r7 0xa
c0: c1 87 gtbitsi puke r3 0x7
c2: c1 c7 gtbitsi puke r3 0x7
c4: 9e 11 sh r6 0x11
c6: 9f 18 sh r7 0x18
c8: c1 87 gtbitsi puke r3 0x7
ca: c1 c7 gtbitsi puke r3 0x7
cc: 9e 20 sh r6 0x20
ce: 9f 19 sh r7 0x19
d0: c1 87 gtbitsi puke r3 0x7
d2: c1 c7 gtbitsi puke r3 0x7
d4: 9e 12 sh r6 0x12
d6: 9f 0b sh r7 0xb
d8: c1 87 gtbitsi puke r3 0x7
da: c1 c7 gtbitsi puke r3 0x7
dc: 9e 04 sh r6 0x4
de: 9f 05 sh r7 0x5
e0: c1 87 gtbitsi puke r3 0x7
e2: c1 c7 gtbitsi puke r3 0x7
e4: 9e 0c sh r6 0xc
e6: 9f 13 sh r7 0x13
e8: c1 87 gtbitsi puke r3 0x7
ea: c1 c7 gtbitsi puke r3 0x7
ec: 9e 1a sh r6 0x1a
ee: 9f 21 sh r7 0x21
f0: c1 87 gtbitsi puke r3 0x7
f2: c1 c7 gtbitsi puke r3 0x7
f4: 9e 28 sh r6 0x28
f6: 9f 30 sh r7 0x30
f8: c1 87 gtbitsi puke r3 0x7
fa: c1 c7 gtbitsi puke r3 0x7
fc: 9e 29 sh r6 0x29
fe: 9f 22 sh r7 0x22
100: c1 87 gtbitsi puke r3 0x7
102: c1 c7 gtbitsi puke r3 0x7
104: 9e 1b sh r6 0x1b
106: 9f 14 sh r7 0x14
108: c1 87 gtbitsi puke r3 0x7
10a: c1 c7 gtbitsi puke r3 0x7
10c: 9e 0d sh r6 0xd
10e: 9f 06 sh r7 0x6
110: c1 87 gtbitsi puke r3 0x7
112: c1 c7 gtbitsi puke r3 0x7
114: 9e 07 sh r6 0x7
116: 9f 0e sh r7 0xe
118: c1 87 gtbitsi puke r3 0x7
11a: c1 c7 gtbitsi puke r3 0x7
11c: 9e 15 sh r6 0x15
11e: 9f 1c sh r7 0x1c
120: c1 87 gtbitsi puke r3 0x7
122: c1 c7 gtbitsi puke r3 0x7
124: 9e 23 sh r6 0x23
126: 9f 2a sh r7 0x2a
128: c1 87 gtbitsi puke r3 0x7
12a: c1 c7 gtbitsi puke r3 0x7
12c: 9e 31 sh r6 0x31
12e: 9f 38 sh r7 0x38
130: c1 87 gtbitsi puke r3 0x7
132: c1 c7 gtbitsi puke r3 0x7
134: 9e 39 sh r6 0x39
136: 9f 32 sh r7 0x32
138: c1 87 gtbitsi puke r3 0x7
13a: c1 c7 gtbitsi puke r3 0x7
13c: 9e 2b sh r6 0x2b
13e: 9f 24 sh r7 0x24
140: c1 87 gtbitsi puke r3 0x7
142: c1 c7 gtbitsi puke r3 0x7
144: 9e 1d sh r6 0x1d
146: 9f 16 sh r7 0x16
148: c1 87 gtbitsi puke r3 0x7
14a: c1 c7 gtbitsi puke r3 0x7
14c: 9e 0f sh r6 0xf
14e: 9f 17 sh r7 0x17
150: c1 87 gtbitsi puke r3 0x7
152: c1 c7 gtbitsi puke r3 0x7
154: 9e 1e sh r6 0x1e
156: 9f 25 sh r7 0x25
158: c1 87 gtbitsi puke r3 0x7
15a: c1 c7 gtbitsi puke r3 0x7
15c: 9e 2c sh r6 0x2c
15e: 9f 33 sh r7 0x33
160: c1 87 gtbitsi puke r3 0x7
162: c1 c7 gtbitsi puke r3 0x7
164: 9e 3a sh r6 0x3a
166: 9f 3b sh r7 0x3b
168: c1 87 gtbitsi puke r3 0x7
16a: c1 c7 gtbitsi puke r3 0x7
16c: 9e 34 sh r6 0x34
16e: 9f 2d sh r7 0x2d
170: c1 87 gtbitsi puke r3 0x7
172: c1 c7 gtbitsi puke r3 0x7
174: 9e 26 sh r6 0x26
176: 9f 1f sh r7 0x1f
178: c1 87 gtbitsi puke r3 0x7
17a: c1 c7 gtbitsi puke r3 0x7
17c: 9e 27 sh r6 0x27
17e: 9f 2e sh r7 0x2e
180: c1 87 gtbitsi puke r3 0x7
182: c1 c7 gtbitsi puke r3 0x7
184: 9e 35 sh r6 0x35
186: 9f 3c sh r7 0x3c
188: c1 87 gtbitsi puke r3 0x7
18a: c1 c7 gtbitsi puke r3 0x7
18c: 9e 3d sh r6 0x3d
18e: 9f 36 sh r7 0x36
190: c1 87 gtbitsi puke r3 0x7
192: c1 c7 gtbitsi puke r3 0x7
194: 9e 2f sh r6 0x2f
196: 9f 37 sh r7 0x37
198: c1 87 gtbitsi puke r3 0x7
19a: c1 c7 gtbitsi puke r3 0x7
19c: 9e 3e sh r6 0x3e
19e: 9f 3f sh r7 0x3f
1a0: 09 00 cmpi r1 0x0
1a2: 19 04 bne 0x4
1a4: b7 c8 lil r7 0xc8
1a6: bf 02 lih r7 0x2
1a8: 37 07 *unknown*
1aa: 00 00 nop
1ac: c5 87 probebitsi r3 0x7
1ae: 00 00 nop
1b0: 0e ff cmpi r6 0xff
1b2: 19 04 bne 0x4
1b4: 00 00 nop
1b6: ea 00 codesearch 0x1 0x0
1b8: c1 cf gtbitsi puke r3 0xf
1ba: c1 cf gtbitsi puke r3 0xf
1bc: b6 80 lil r6 0x80
1be: be 00 lih r6 0x0
1c0: 41 6e add r2 r5 r6
1c2: 70 28 copyto rpage r5
1c4: 00 00 nop
1c6: c1 c7 gtbitsi puke r3 0x7
1c8: c1 87 gtbitsi puke r3 0x7
1ca: c1 c7 gtbitsi puke r3 0x7
1cc: 9e 00 sh r6 0x0
1ce: 9f 01 sh r7 0x1
1d0: c1 87 gtbitsi puke r3 0x7
1d2: c1 c7 gtbitsi puke r3 0x7
1d4: 9e 08 sh r6 0x8
1d6: 9f 10 sh r7 0x10
1d8: c1 87 gtbitsi puke r3 0x7
1da: c1 c7 gtbitsi puke r3 0x7
1dc: 9e 09 sh r6 0x9
1de: 9f 02 sh r7 0x2
1e0: c1 87 gtbitsi puke r3 0x7
1e2: c1 c7 gtbitsi puke r3 0x7
1e4: 9e 03 sh r6 0x3
1e6: 9f 0a sh r7 0xa
1e8: c1 87 gtbitsi puke r3 0x7
1ea: c1 c7 gtbitsi puke r3 0x7
1ec: 9e 11 sh r6 0x11
1ee: 9f 18 sh r7 0x18
1f0: c1 87 gtbitsi puke r3 0x7
1f2: c1 c7 gtbitsi puke r3 0x7
1f4: 9e 20 sh r6 0x20
1f6: 9f 19 sh r7 0x19
1f8: c1 87 gtbitsi puke r3 0x7
1fa: c1 c7 gtbitsi puke r3 0x7
1fc: 9e 12 sh r6 0x12
1fe: 9f 0b sh r7 0xb
200: c1 87 gtbitsi puke r3 0x7
202: c1 c7 gtbitsi puke r3 0x7
204: 9e 04 sh r6 0x4
206: 9f 05 sh r7 0x5
208: c1 87 gtbitsi puke r3 0x7
20a: c1 c7 gtbitsi puke r3 0x7
20c: 9e 0c sh r6 0xc
20e: 9f 13 sh r7 0x13
210: c1 87 gtbitsi puke r3 0x7
212: c1 c7 gtbitsi puke r3 0x7
214: 9e 1a sh r6 0x1a
216: 9f 21 sh r7 0x21
218: c1 87 gtbitsi puke r3 0x7
21a: c1 c7 gtbitsi puke r3 0x7
21c: 9e 28 sh r6 0x28
21e: 9f 30 sh r7 0x30
220: c1 87 gtbitsi puke r3 0x7
222: c1 c7 gtbitsi puke r3 0x7
224: 9e 29 sh r6 0x29
226: 9f 22 sh r7 0x22
228: c1 87 gtbitsi puke r3 0x7
22a: c1 c7 gtbitsi puke r3 0x7
22c: 9e 1b sh r6 0x1b
22e: 9f 14 sh r7 0x14
230: c1 87 gtbitsi puke r3 0x7
232: c1 c7 gtbitsi puke r3 0x7
234: 9e 0d sh r6 0xd
236: 9f 06 sh r7 0x6
238: c1 87 gtbitsi puke r3 0x7
23a: c1 c7 gtbitsi puke r3 0x7
23c: 9e 07 sh r6 0x7
23e: 9f 0e sh r7 0xe
240: c1 87 gtbitsi puke r3 0x7
242: c1 c7 gtbitsi puke r3 0x7
244: 9e 15 sh r6 0x15
246: 9f 1c sh r7 0x1c
248: c1 87 gtbitsi puke r3 0x7
24a: c1 c7 gtbitsi puke r3 0x7
24c: 9e 23 sh r6 0x23
24e: 9f 2a sh r7 0x2a
250: c1 87 gtbitsi puke r3 0x7
252: c1 c7 gtbitsi puke r3 0x7
254: 9e 31 sh r6 0x31
256: 9f 38 sh r7 0x38
258: c1 87 gtbitsi puke r3 0x7
25a: c1 c7 gtbitsi puke r3 0x7
25c: 9e 39 sh r6 0x39
25e: 9f 32 sh r7 0x32
260: c1 87 gtbitsi puke r3 0x7
262: c1 c7 gtbitsi puke r3 0x7
264: 9e 2b sh r6 0x2b
266: 9f 24 sh r7 0x24
268: c1 87 gtbitsi puke r3 0x7
26a: c1 c7 gtbitsi puke r3 0x7
26c: 9e 1d sh r6 0x1d
26e: 9f 16 sh r7 0x16
270: c1 87 gtbitsi puke r3 0x7
272: c1 c7 gtbitsi puke r3 0x7
274: 9e 0f sh r6 0xf
276: 9f 17 sh r7 0x17
278: c1 87 gtbitsi puke r3 0x7
27a: c1 c7 gtbitsi puke r3 0x7
27c: 9e 1e sh r6 0x1e
27e: 9f 25 sh r7 0x25
280: c1 87 gtbitsi puke r3 0x7
282: c1 c7 gtbitsi puke r3 0x7
284: 9e 2c sh r6 0x2c
286: 9f 33 sh r7 0x33
288: c1 87 gtbitsi puke r3 0x7
28a: c1 c7 gtbitsi puke r3 0x7
28c: 9e 3a sh r6 0x3a
28e: 9f 3b sh r7 0x3b
290: c1 87 gtbitsi puke r3 0x7
292: c1 c7 gtbitsi puke r3 0x7
294: 9e 34 sh r6 0x34
296: 9f 2d sh r7 0x2d
298: c1 87 gtbitsi puke r3 0x7
29a: c1 c7 gtbitsi puke r3 0x7
29c: 9e 26 sh r6 0x26
29e: 9f 1f sh r7 0x1f
2a0: c1 87 gtbitsi puke r3 0x7
2a2: c1 c7 gtbitsi puke r3 0x7
2a4: 9e 27 sh r6 0x27
2a6: 9f 2e sh r7 0x2e
2a8: c1 87 gtbitsi puke r3 0x7
2aa: c1 c7 gtbitsi puke r3 0x7
2ac: 9e 35 sh r6 0x35
2ae: 9f 3c sh r7 0x3c
2b0: c1 87 gtbitsi puke r3 0x7
2b2: c1 c7 gtbitsi puke r3 0x7
2b4: 9e 3d sh r6 0x3d
2b6: 9f 36 sh r7 0x36
2b8: c1 87 gtbitsi puke r3 0x7
2ba: c1 c7 gtbitsi puke r3 0x7
2bc: 9e 2f sh r6 0x2f
2be: 9f 37 sh r7 0x37
2c0: c1 87 gtbitsi puke r3 0x7
2c2: c1 c7 gtbitsi puke r3 0x7
2c4: 9e 3e sh r6 0x3e
2c6: 9f 3f sh r7 0x3f
2c8: bd 01 lih r5 0x1
2ca: b5 f8 lil r5 0xf8
2cc: 7c 05 *unknown*
2ce: b7 da lil r7 0xda
2d0: bf ff lih r7 0xff
2d2: 71 78 copyto alpha_l r7
2d4: 71 80 copyto beta_h r0
2d6: b7 ff lil r7 0xff
2d8: bf ff lih r7 0xff
2da: 71 f8 copyto beta_h r7
2dc: 72 00 copyto beta_l r0
2de: eb 00 codesearch 0x1 0x1
2e0: c3 cf gtbitsi swallow r7 0xf
2e2: c3 cf gtbitsi swallow r7 0xf
2e4: be 00 lih r6 0x0
2e6: b6 01 lil r6 0x1
2e8: 45 fe *unknown*
2ea: 45 fe *unknown*
2ec: c3 47 gtbitsi swallow r6 0x7
2ee: 45 fe *unknown*
2f0: 19 fd bne 0xfd
2f2: 00 00 nop
2f4: 71 48 copyto alpha_l r1
2f6: 64 49 xor r0 r1 r1
2f8: 64 92 xor r1 r2 r2
2fa: 64 db xor r1 r3 r3
2fc: bd 01 lih r5 0x1
2fe: b5 f0 lil r5 0xf0
300: be 80 lih r6 0x80
302: b6 00 lil r6 0x0
304: 00 00 nop
306: 79 c5 *unknown*
308: 4d fe and r3 r7 r6
30a: 48 3e *unknown*
30c: 19 fb bne 0xfb
30e: 00 00 nop
310: 73 60 copyto cmp_l r4
312: 70 20 copyto rpage r4
314: 73 80 copyto mask_h r0
316: 00 00 nop
318: b5 00 lil r5 0x0
31a: bd 00 lih r5 0x0
31c: 72 68 copyto beta_l r5
31e: 00 00 nop
320: 00 00 nop
322: e6 00 blockrunsizeparse swallow
324: b5 06 lil r5 0x6
326: bd 00 lih r5 0x0
328: 72 68 copyto beta_l r5
32a: 00 00 nop
32c: 00 00 nop
32e: e4 00 blockrunsizeparse puke
330: b5 00 lil r5 0x0
332: 77 f8 *unknown*
334: bd 01 lih r5 0x1
336: 4d 7d and r2 r7 r5
338: 18 fc beq 0xfc
33a: b5 00 lil r5 0x0
33c: 85 00 lh r5 0x0
33e: 40 4d add r0 r1 r5
340: 99 00 sh r1 0x0
342: 77 68 *unknown*
344: b6 80 lil r6 0x80
346: be 00 lih r6 0x0
348: 41 6e add r2 r5 r6
34a: 73 68 copyto cmp_l r5
34c: 70 28 copyto rpage r5
34e: 73 80 copyto mask_h r0
350: 00 00 nop
352: b5 00 lil r5 0x0
354: bd 00 lih r5 0x0
356: 72 68 copyto beta_l r5
358: 00 00 nop
35a: 00 00 nop
35c: e6 00 blockrunsizeparse swallow
35e: b5 06 lil r5 0x6
360: bd 00 lih r5 0x0
362: 72 68 copyto beta_l r5
364: 00 00 nop
366: 00 00 nop
368: e4 00 blockrunsizeparse puke
36a: b5 00 lil r5 0x0
36c: 77 f8 *unknown*
36e: bd 01 lih r5 0x1
370: 4d 7d and r2 r7 r5
372: 18 fc beq 0xfc
374: b5 00 lil r5 0x0
376: 85 00 lh r5 0x0
378: 40 4d add r0 r1 r5
37a: 99 00 sh r1 0x0
37c: 75 68 *unknown*
37e: 48 28 *unknown*
380: 18 74 beq 0x74
382: 00 00 nop
384: 0d 01 cmpi r5 0x1
386: 18 3b beq 0x3b
388: 00 00 nop
38a: 77 68 *unknown*
38c: b6 80 lil r6 0x80
38e: be 00 lih r6 0x0
390: 41 6e add r2 r5 r6
392: 73 68 copyto cmp_l r5
394: 70 28 copyto rpage r5
396: 73 80 copyto mask_h r0
398: 00 00 nop
39a: b5 00 lil r5 0x0
39c: bd 00 lih r5 0x0
39e: 72 68 copyto beta_l r5
3a0: 00 00 nop
3a2: 00 00 nop
3a4: e6 00 blockrunsizeparse swallow
3a6: b5 06 lil r5 0x6
3a8: bd 00 lih r5 0x0
3aa: 72 68 copyto beta_l r5
3ac: 00 00 nop
3ae: 00 00 nop
3b0: e4 00 blockrunsizeparse puke
3b2: b5 00 lil r5 0x0
3b4: 77 f8 *unknown*
3b6: bd 01 lih r5 0x1
3b8: 4d 7d and r2 r7 r5
3ba: 18 fc beq 0xfc
3bc: b5 00 lil r5 0x0
3be: 85 00 lh r5 0x0
3c0: 40 4d add r0 r1 r5
3c2: 99 00 sh r1 0x0
3c4: 77 68 *unknown*
3c6: b6 80 lil r6 0x80
3c8: be 00 lih r6 0x0
3ca: 41 6e add r2 r5 r6
3cc: 73 68 copyto cmp_l r5
3ce: 70 28 copyto rpage r5
3d0: 73 80 copyto mask_h r0
3d2: 00 00 nop
3d4: b5 00 lil r5 0x0
3d6: bd 00 lih r5 0x0
3d8: 72 68 copyto beta_l r5
3da: 00 00 nop
3dc: 00 00 nop
3de: e6 00 blockrunsizeparse swallow
3e0: b5 06 lil r5 0x6
3e2: bd 00 lih r5 0x0
3e4: 72 68 copyto beta_l r5
3e6: 00 00 nop
3e8: 00 00 nop
3ea: e4 00 blockrunsizeparse puke
3ec: b5 00 lil r5 0x0
3ee: 77 f8 *unknown*
3f0: bd 01 lih r5 0x1
3f2: 4d 7d and r2 r7 r5
3f4: 18 fc beq 0xfc
3f6: b5 00 lil r5 0x0
3f8: 85 00 lh r5 0x0
3fa: 40 4d add r0 r1 r5
3fc: 99 00 sh r1 0x0
3fe: 77 68 *unknown*
400: 41 6e add r2 r5 r6
402: 73 68 copyto cmp_l r5
404: 70 28 copyto rpage r5
406: 73 80 copyto mask_h r0
408: 00 00 nop
40a: b5 03 lil r5 0x3
40c: bd 00 lih r5 0x0
40e: 72 68 copyto beta_l r5
410: 00 00 nop
412: 00 00 nop
414: e6 00 blockrunsizeparse swallow
416: b5 17 lil r5 0x17
418: bd 00 lih r5 0x0
41a: 72 68 copyto beta_l r5
41c: 00 00 nop
41e: 00 00 nop
420: e4 00 blockrunsizeparse puke
422: b5 00 lil r5 0x0
424: 77 f8 *unknown*
426: bd 01 lih r5 0x1
428: 4d 7d and r2 r7 r5
42a: 18 fc beq 0xfc
42c: b5 00 lil r5 0x0
42e: 85 00 lh r5 0x0
430: 40 95 add r1 r2 r5
432: 9a 00 sh r2 0x0
434: 77 68 *unknown*
436: 41 6e add r2 r5 r6
438: 73 68 copyto cmp_l r5
43a: 70 28 copyto rpage r5
43c: 73 80 copyto mask_h r0
43e: 00 00 nop
440: b5 03 lil r5 0x3
442: bd 00 lih r5 0x0
444: 72 68 copyto beta_l r5
446: 00 00 nop
448: 00 00 nop
44a: e6 00 blockrunsizeparse swallow
44c: b5 17 lil r5 0x17
44e: bd 00 lih r5 0x0
450: 72 68 copyto beta_l r5
452: 00 00 nop
454: 00 00 nop
456: e4 00 blockrunsizeparse puke
458: b5 00 lil r5 0x0
45a: 77 f8 *unknown*
45c: bd 01 lih r5 0x1
45e: 4d 7d and r2 r7 r5
460: 18 fc beq 0xfc
462: b5 00 lil r5 0x0
464: 85 00 lh r5 0x0
466: 40 dd add r1 r3 r5
468: 9b 00 sh r3 0x0
46a: 77 68 *unknown*
46c: 41 6e add r2 r5 r6
46e: 70 28 copyto rpage r5
470: 00 00 nop
472: bd 01 lih r5 0x1
474: b5 f8 lil r5 0xf8
476: 7c 05 *unknown*
478: b4 00 lil r4 0x0
47a: bc 80 lih r4 0x80
47c: b5 00 lil r5 0x0
47e: bd 14 lih r5 0x14
480: 41 25 add r2 r4 r5
482: 70 20 copyto rpage r4
484: 00 00 nop
486: 84 04 lh r4 0x4
488: 00 00 nop
48a: 48 20 *unknown*
48c: 18 0a beq 0xa
48e: 00 00 nop
490: bf de lih r7 0xde
492: b7 ad lil r7 0xad
494: be 00 lih r6 0x0
496: b6 02 lil r6 0x2
498: 73 f0 copyto mask_h r6
49a: 00 00 nop
49c: 64 49 xor r0 r1 r1
49e: 64 92 xor r1 r2 r2
4a0: 64 db xor r1 r3 r3
4a2: 84 02 lh r4 0x2
4a4: b5 01 lil r5 0x1
4a6: bd 00 lih r5 0x0
4a8: 45 25 *unknown*
4aa: 19 0a bne 0xa
4ac: 9c 02 sh r4 0x2
4ae: 84 00 lh r4 0x0
4b0: 00 00 nop
4b2: 9c 02 sh r4 0x2
4b4: 84 03 lh r4 0x3
4b6: 45 25 *unknown*
4b8: 19 03 bne 0x3
4ba: 9c 03 sh r4 0x3
4bc: 1f 10 *unknown*
4be: 00 00 nop
4c0: 77 28 *unknown*
4c2: b6 00 lil r6 0x0
4c4: be f8 lih r6 0xf8
4c6: 4d 26 and r2 r4 r6
4c8: b6 00 lil r6 0x0
4ca: be 08 lih r6 0x8
4cc: 65 26 xor r2 r4 r6
4ce: bd 01 lih r5 0x1
4d0: b5 f0 lil r5 0xf0
4d2: be 80 lih r6 0x80
4d4: b6 00 lil r6 0x0
4d6: b7 04 lil r7 0x4
4d8: bf 03 lih r7 0x3
4da: 37 07 *unknown*
4dc: 00 00 nop
4de: bd 01 lih r5 0x1
4e0: b5 f0 lil r5 0xf0
4e2: be 80 lih r6 0x80
4e4: b6 00 lil r6 0x0
4e6: 00 00 nop
4e8: 79 c5 *unknown*
4ea: 4d fe and r3 r7 r6
4ec: 48 3e *unknown*
4ee: 19 fb bne 0xfb
4f0: 00 00 nop
4f2: b7 0d lil r7 0xd
4f4: bf 90 lih r7 0x90
4f6: 00 00 nop
4f8: 1f fe *unknown*
And that looks like a very plausible BSP source code to me
With what we just learned, we can indeed strip the 16 bytes header from compiled code and it will run just fine on the BSP.
Now that we have a better understanding of the BSP, it is clear that it is a very different thing to the N64's RDP... But is it so different ? After all, they share a common goal that is bitstream processing. So, would it be possible to replicate the RDP behavior with our BSP ?
That would definitly be a very long shot...