rk3588-ddr-analysis/mmio_trace_deep.csv at main

Files

T

test0r 815e890056 Deep trace: 3606 unique PCs, 30% code coverage with smart injection

Aggressive MMIO injection (try 0xFFFFFFFF, then 0, then 0x2) breaks through
all poll loops. Blob executes 19963 instructions visiting 3606 unique PCs
before jumping to unmapped memory (0x100000FFF).

Key findings:
- DDRC channels at 0xF7000000/0xF8000000 (not 0xFE01 as in TRM - these are
  the direct DDRC addresses, not the MSCH wrapper)
- Blob reads training params from internal data at 0x000154xx
- 30% code path coverage achieved

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-04-03 23:20:03 +02:00

1015 B

Raw Permalink Blame History

1	instr	op	addr	register	value	pc	poll_count
2	13	R	0xFD588080	GRF+0x8080	0x00000000	0x109A0	1
3	17	R	0xFF000010	SRAM+0x10	0x00000000	0x109B0	1
4	39	W	0xFF016F58	SRAM+0x16F58	0x-5640EC1FEBFFFFFF	0x00B14	0
5	45	W	0xFF016F60	SRAM+0x16F60	0x58000164A9BF7BFD	0x00B14	0
6	51	W	0xFF016F68	SRAM+0x16F68	0x-6D87A3FF6BFFFFF9	0x00B14	0
7	57	W	0xFF016F70	SRAM+0x16F70	0x54000001EB04001F	0x00B14	0
8	77	R	0xFF000010	SRAM+0x10	0x00000000	0x009A8	1
9	84	W	0xFD5F8098	BUS_GRF+0x8098	0xFF005500	0x009C4	0
10	87	W	0xFE0100F0	DDRC+0xF0	0x00000000	0x009D0	0
11	88	W	0xFE0100F4	DDRC+0xF4	0x00000000	0x009D4	0
12	89	W	0xFE0100F8	DDRC+0xF8	0x00000000	0x009D8	0
13	90	W	0xFE0100FC	DDRC+0xFC	0x00000000	0x009DC	0
14	109	W	0xFD8C8004	SCRU+0x8004	0x00000000	0x10A8C	0
15	114	W	0xFD8C8014	SCRU+0x8014	0xFFFFFFFF	0x10AA0	0
16	115	W	0xFD8C8018	SCRU+0x8018	0xFFFFFFFF	0x10AA4	0
17	118	W	0xFD8C8008	SCRU+0x8008	0x00000000	0x10AB0	0
18	121	W	0xFD8C8004	SCRU+0x8004	0x00000001	0x10ABC	0
19	151	W	0xFD5F4000	BUS_GRF+0x4000	0x0FF00880	0x00660	0
20	154	W	0xFD5F800C	BUS_GRF+0x800C	0x0FF00AA0	0x0066C	0

1015 B Raw Permalink Blame History

1015 B

Raw Permalink Blame History