fw: recover helper arity by dataflow, validated first -- 632/632 functions now typed

179 prototypes came from an established role, leaving ~450 helpers with none.
Guessing their argument count would repeat the lvar mistake, producing output that
reads well and says something false. Arity is recoverable instead: on AAPCS a
register read before it is written on any path is an incoming parameter, so
fw/ta_arity.py walks basic blocks from the entry and derives it.

The validation is the point. The control is the set of handlers the dispatch table
points at, which the dispatcher calls as mov r0,r5; mov r1,r4; bl handler, so their
arity of two is proven rather than assumed, plus zero_fill and memcmp. Two attempts
failed the control before one passed: push {r3,r4,r5,lr} is the alignment idiom and
reads r3, making every such function look like it took four arguments; excluding
push and pop then over-corrected by also excluding stm, which for the ASD RPC thunks
is the argument-passing idiom, so those reported zero arguments. With push and pop
excluded, stm and ldm treated as real dataflow, and the control restricted to proven
arities, it agrees 19 of 19.

That last correction disproved four prototypes already applied: gcp_asd_rpc_304
takes none since it zero-fills its own buffer, _107 takes two because movs r2,#0
writes r2 before the stm reads it, _202 takes four, and only _305 was the single
argument all four had been declared with.

Coverage is now 632 of 632 functions carrying a prototype across all twelve TAs,
with 554 named and 78 documented. Measured against a pristine database, raw
pointer-arithmetic casts fall from 81 to 8 and anonymous parameters from 113 to 0.

1 files changed, 2 insertions, 2 deletions

diff --git a/fw/pseudo/gcp_command_surface.c b/fw/pseudo/gcp_command_surface.c
index b78ca99..79f7f75 100644
--- a/fw/pseudo/gcp_command_surface.c
+++ b/fw/pseudo/gcp_command_surface.c
@@ -1,7 +1,7 @@
 // GCP TA command surface, decompiled with restored names, prototypes and structure types.
 // Source: psp_out/versions_win/ta_22-0-4-50_81b082b4.bin (GCP 22.0.4.50, Windows driver train;
-// absent from linux-firmware). Command -> handler decoded from the dispatcher's two tbb
-// tables; function names are the TA's OWN log strings. Generated by fw/ta_ida.py.
+// absent from linux-firmware). Command -> handler decoded from the dispatcher's two tbb tables;
+// function names are the TA's OWN log strings. Generated by fw/ta_ida.py + fw/ta_arity.py.
 
 // ================ cmd 0x1 @ 0x402718 ================
 // COPY AUDIT: 1 call(s) with a non-literal length.