chore: transform runtime model complete (stage kernels, slot map, driver loc)

SearchRefs.java

@@ -8,7 +8,7 @@ import java.io.PrintWriter;
 public class SearchRefs extends GhidraScript {
     @Override
     public void run() throws Exception {
-        String[] targets = {"18003fa20","1800025e0","180008500","1800104e0"};
+        String[] targets = {"182615f08","182615f20","182616208","182616220","1826164a0","1826159e8"};
         AddressSpace as = currentProgram.getAddressFactory().getDefaultAddressSpace();
         PrintWriter pw = new PrintWriter(new java.io.BufferedWriter(
             new java.io.FileWriter("/home/m/re-tools/xrefs.txt")));
@@ -18,7 +18,7 @@ public class SearchRefs extends GhidraScript {
             pw.println("### TARGET " + ts);
             ReferenceIterator it = currentProgram.getReferenceManager().getReferencesTo(t);
             int n=0;
-            while (it.hasNext() && n<120) {
+            while (it.hasNext() && n<150) {
                 Reference r = it.next();
                 pw.println("  from " + r.getFromAddress() + " type=" + r.getReferenceType());
                 n++;

focus_decomp.txt

@@ -1,25 +1,8 @@
-############ FUN_ 18000845d size=51 ############
+############ FUN_ 18000c080 size=507 ############
-
-undefined8 FUN_180008440(longlong param_1,longlong param_2,int param_3)
-
-{
-  if ((param_1 != 0) && (param_2 != 0)) {
-    if (param_3 < 1) {
-      return 0xfffffffa;
-    }
-    FUN_18003fa20();
-    return 0;
-  }
-  return 0xfffffff8;
-}
-
-
-
-############ FUN_ 18000c6a0 size=507 ############
 
 /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
 
-undefined8 FUN_18000c5e0(longlong param_1,longlong param_2,longlong param_3,int param_4)
+undefined8 FUN_18000bfc0(longlong param_1,longlong param_2,longlong param_3,int param_4)
 
 {
   undefined1 *puVar1;
@@ -46,18 +29,18 @@ undefined8 FUN_18000c5e0(longlong param_1,longlong param_2,longlong param_3,int
     puVar1 = local_470 + uVar3;
     puVar2 = auStack_270 + uVar3;
     for (; 0x40 < param_4; param_4 = param_4 + -0x40) {
-      thunk_FUN_1801560a0(param_2,puVar1,puVar2,0x40);
+      thunk_FUN_18014ec20(param_2,puVar1,puVar2,0x40);
-      FUN_180008500(param_1,puVar1,0x40);
+      FUN_180008440(param_1,puVar1,0x40);
-      FUN_180008500(param_1,puVar2,0x40);
+      FUN_180008440(param_1,puVar2,0x40);
-      FUN_180044700(puVar2,puVar1,param_3,0x40);
+      FUN_1800437c0(puVar2,puVar1,param_3,0x40);
       param_1 = param_1 + 0x200;
       param_2 = param_2 + 0x200;
       param_3 = param_3 + 0x400;
     }
-    thunk_FUN_1801560a0(param_2,puVar1,puVar2,param_4);
+    thunk_FUN_18014ec20(param_2,puVar1,puVar2,param_4);
-    FUN_180008500(param_1,puVar1,param_4);
+    FUN_180008440(param_1,puVar1,param_4);
-    FUN_180008500(param_1,puVar2,param_4);
+    FUN_180008440(param_1,puVar2,param_4);
-    FUN_180044700(puVar2,puVar1,param_3,param_4);
+    FUN_1800437c0(puVar2,puVar1,param_3,param_4);
     if ((local_30 ^ (ulonglong)auStack_498) == DAT_182615970) {
       return 0;
     }
@@ -66,53 +49,13 @@ undefined8 FUN_18000c5e0(longlong param_1,longlong param_2,longlong param_3,int
 
 
 
-############ FUN_ 18000c711 size=507 ############
+############ FUN_ 180140ca7 size=9 ############
 
-/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
+void thunk_FUN_1801560a0(void)
-
-undefined8 FUN_18000c5e0(longlong param_1,longlong param_2,longlong param_3,int param_4)
 
 {
-  undefined1 *puVar1;
+  (*(code *)PTR_FUN_1826178a0)();
-  undefined1 *puVar2;
+  return;
-  ulonglong uVar3;
-  undefined1 auStack_498 [32];
-  undefined1 local_470 [512];
-  undefined1 auStack_270 [576];
-  ulonglong local_30;
-  
-  local_30 = DAT_182615970 ^ (ulonglong)auStack_498;
-  if (((param_3 == 0) || (param_1 == 0)) || (param_2 == 0)) {
-    if ((local_30 ^ (ulonglong)auStack_498) == DAT_182615970) {
-      return 0xfffffff8;
-    }
-  }
-  else if (param_4 < 1) {
-    if ((local_30 ^ (ulonglong)auStack_498) == DAT_182615970) {
-      return 0xfffffffa;
-    }
-  }
-  else {
-    uVar3 = -((ulonglong)local_470 & 0x3f) & 0x3f;
-    puVar1 = local_470 + uVar3;
-    puVar2 = auStack_270 + uVar3;
-    for (; 0x40 < param_4; param_4 = param_4 + -0x40) {
-      thunk_FUN_1801560a0(param_2,puVar1,puVar2,0x40);
-      FUN_180008500(param_1,puVar1,0x40);
-      FUN_180008500(param_1,puVar2,0x40);
-      FUN_180044700(puVar2,puVar1,param_3,0x40);
-      param_1 = param_1 + 0x200;
-      param_2 = param_2 + 0x200;
-      param_3 = param_3 + 0x400;
-    }
-    thunk_FUN_1801560a0(param_2,puVar1,puVar2,param_4);
-    FUN_180008500(param_1,puVar1,param_4);
-    FUN_180008500(param_1,puVar2,param_4);
-    FUN_180044700(puVar2,puVar1,param_3,param_4);
-    if ((local_30 ^ (ulonglong)auStack_498) == DAT_182615970) {
-      return 0;
-    }
-  }
 }
 
 

focus_list.txt

@@ -1 +1 @@
-18000845d,18000c6a0,18000c711
+18000c080,180140ca7

roadmap.md

@@ -169,3 +169,12 @@
 - OBtained: full FFT-plan model, factor tables, per-type kernels, block->detector->mask flow.
 - Next sub-goal: trace the FFT-stage kernel call order used by detector (which plan fields drive per-stage twiddle/mul) 
   => then C++ re-implementation is a direct transcription of that order.
+
+### Transform runtime (tracing complete -> next: reimpl)
+- Plan fields consumed via plan->thunk indirection: `thunk_FUN_1801560a0` -> `PTR_FUN_1826178a0`; `FUN_18014ec20` thunk -> `PTR_FUN_182617828/850/878` (3 twiddle-loaders).
+- Stage kernels:
+  - **FUN_18000bfc0** (complex stage, slot @182616208): loop 0x40: load-twiddle(re,im) ; `FUN_180008440`(cplx-mul, slot @182615f08) twice (re,im) ; `FUN_1800437c0`(accum). out+=0x200, tw+=0x200, acc+=0x400.
+  - **FUN_18000c5e0** (double stage, slot @182616220): 0x40-chunks: load-twiddle(re,im); `FUN_180008500`(double mul, slot @182615f20) x2; `FUN_180044700`(accum).
+- Dispatch-slot readers (drivers): slot cplx-mul @182615f08 read at 180001c47; stage @182616208 read at 180001e87 => runtime dispatch executors live in 0x180001xxx (thunk chain).
+- DSP runtime model := plan + per-stage kernel calls (all ops = dispatched vector kernels), all through `thunk_FUN_181ba94b0` from PACE-protected callers.
+- => Reimplementation path: transcribe stage-loop math (kernel shapes known), replicate plan generation, drive per-stage calls in same order; validate losses to within 0.001 dB on Reaper renders.

xrefs.txt

@@ -1,15 +1,8 @@
-### TARGET 18003fa20
+### TARGET 182615f08
-  from 18000845d type=UNCONDITIONAL_CALL
+  from 180001c47 type=DATA
-### TARGET 1800025e0
+### TARGET 182615f20
-  from 18267c078 type=DATA
+### TARGET 182616208
-  from 1826159e8 type=DATA
+  from 180001e87 type=DATA
-### TARGET 180008500
+### TARGET 182616220
-  from 18267c708 type=DATA
+### TARGET 1826164a0
-  from 18000c6a0 type=UNCONDITIONAL_CALL
+### TARGET 1826159e8
-  from 18000c6b1 type=UNCONDITIONAL_CALL
-  from 18000c711 type=UNCONDITIONAL_CALL
-  from 18000c71f type=UNCONDITIONAL_CALL
-  from 182615f20 type=DATA
-### TARGET 1800104e0
-  from 18267cd08 type=DATA
-  from 1826164a0 type=DATA