marfrit/rk3588-ddr-analysis
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Deep trace: 3606 unique PCs, 30% code coverage with smart injection

Browse Source 
Aggressive MMIO injection (try 0xFFFFFFFF, then 0, then 0x2) breaks through
all poll loops. Blob executes 19963 instructions visiting 3606 unique PCs
before jumping to unmapped memory (0x100000FFF).

Key findings:
- DDRC channels at 0xF7000000/0xF8000000 (not 0xFE01 as in TRM - these are
  the direct DDRC addresses, not the MSCH wrapper)
- Blob reads training params from internal data at 0x000154xx
- 30% code path coverage achieved

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Markus Fritsche
2026-04-03 23:20:03 +02:00
parent a93ce6c3e9
commit 815e890056
2 changed files with 224 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mmio_trace_deep.csv
+20
View File
@@ -0,0 +1,20 @@
instr,op,addr,register,value,pc,poll_count
13,R,0xFD588080,GRF+0x8080,0x00000000,0x109A0,1
17,R,0xFF000010,SRAM+0x10,0x00000000,0x109B0,1
39,W,0xFF016F58,SRAM+0x16F58,0x-5640EC1FEBFFFFFF,0x00B14,0
45,W,0xFF016F60,SRAM+0x16F60,0x58000164A9BF7BFD,0x00B14,0
51,W,0xFF016F68,SRAM+0x16F68,0x-6D87A3FF6BFFFFF9,0x00B14,0
57,W,0xFF016F70,SRAM+0x16F70,0x54000001EB04001F,0x00B14,0
77,R,0xFF000010,SRAM+0x10,0x00000000,0x009A8,1
84,W,0xFD5F8098,BUS_GRF+0x8098,0xFF005500,0x009C4,0
87,W,0xFE0100F0,DDRC+0xF0,0x00000000,0x009D0,0
88,W,0xFE0100F4,DDRC+0xF4,0x00000000,0x009D4,0
89,W,0xFE0100F8,DDRC+0xF8,0x00000000,0x009D8,0
90,W,0xFE0100FC,DDRC+0xFC,0x00000000,0x009DC,0
109,W,0xFD8C8004,SCRU+0x8004,0x00000000,0x10A8C,0
114,W,0xFD8C8014,SCRU+0x8014,0xFFFFFFFF,0x10AA0,0
115,W,0xFD8C8018,SCRU+0x8018,0xFFFFFFFF,0x10AA4,0
118,W,0xFD8C8008,SCRU+0x8008,0x00000000,0x10AB0,0
121,W,0xFD8C8004,SCRU+0x8004,0x00000001,0x10ABC,0
151,W,0xFD5F4000,BUS_GRF+0x4000,0x0FF00880,0x00660,0
154,W,0xFD5F800C,BUS_GRF+0x800C,0x0FF00AA0,0x0066C,0
1 instr op addr register value pc poll_count
2 13 R 0xFD588080 GRF+0x8080 0x00000000 0x109A0 1
3 17 R 0xFF000010 SRAM+0x10 0x00000000 0x109B0 1
4 39 W 0xFF016F58 SRAM+0x16F58 0x-5640EC1FEBFFFFFF 0x00B14 0
5 45 W 0xFF016F60 SRAM+0x16F60 0x58000164A9BF7BFD 0x00B14 0
6 51 W 0xFF016F68 SRAM+0x16F68 0x-6D87A3FF6BFFFFF9 0x00B14 0
7 57 W 0xFF016F70 SRAM+0x16F70 0x54000001EB04001F 0x00B14 0
8 77 R 0xFF000010 SRAM+0x10 0x00000000 0x009A8 1
9 84 W 0xFD5F8098 BUS_GRF+0x8098 0xFF005500 0x009C4 0
10 87 W 0xFE0100F0 DDRC+0xF0 0x00000000 0x009D0 0
11 88 W 0xFE0100F4 DDRC+0xF4 0x00000000 0x009D4 0
12 89 W 0xFE0100F8 DDRC+0xF8 0x00000000 0x009D8 0
13 90 W 0xFE0100FC DDRC+0xFC 0x00000000 0x009DC 0
14 109 W 0xFD8C8004 SCRU+0x8004 0x00000000 0x10A8C 0
15 114 W 0xFD8C8014 SCRU+0x8014 0xFFFFFFFF 0x10AA0 0
16 115 W 0xFD8C8018 SCRU+0x8018 0xFFFFFFFF 0x10AA4 0
17 118 W 0xFD8C8008 SCRU+0x8008 0x00000000 0x10AB0 0
18 121 W 0xFD8C8004 SCRU+0x8004 0x00000001 0x10ABC 0
19 151 W 0xFD5F4000 BUS_GRF+0x4000 0x0FF00880 0x00660 0
20 154 W 0xFD5F800C BUS_GRF+0x800C 0x0FF00AA0 0x0066C 0