test0r
815e890056
Aggressive MMIO injection (try 0xFFFFFFFF, then 0, then 0x2) breaks through all poll loops. Blob executes 19963 instructions visiting 3606 unique PCs before jumping to unmapped memory (0x100000FFF). Key findings: - DDRC channels at 0xF7000000/0xF8000000 (not 0xFE01 as in TRM - these are the direct DDRC addresses, not the MSCH wrapper) - Blob reads training params from internal data at 0x000154xx - 30% code path coverage achieved Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
21 lines
1015 B
CSV
21 lines
1015 B
CSV
instr,op,addr,register,value,pc,poll_count
|
|
13,R,0xFD588080,GRF+0x8080,0x00000000,0x109A0,1
|
|
17,R,0xFF000010,SRAM+0x10,0x00000000,0x109B0,1
|
|
39,W,0xFF016F58,SRAM+0x16F58,0x-5640EC1FEBFFFFFF,0x00B14,0
|
|
45,W,0xFF016F60,SRAM+0x16F60,0x58000164A9BF7BFD,0x00B14,0
|
|
51,W,0xFF016F68,SRAM+0x16F68,0x-6D87A3FF6BFFFFF9,0x00B14,0
|
|
57,W,0xFF016F70,SRAM+0x16F70,0x54000001EB04001F,0x00B14,0
|
|
77,R,0xFF000010,SRAM+0x10,0x00000000,0x009A8,1
|
|
84,W,0xFD5F8098,BUS_GRF+0x8098,0xFF005500,0x009C4,0
|
|
87,W,0xFE0100F0,DDRC+0xF0,0x00000000,0x009D0,0
|
|
88,W,0xFE0100F4,DDRC+0xF4,0x00000000,0x009D4,0
|
|
89,W,0xFE0100F8,DDRC+0xF8,0x00000000,0x009D8,0
|
|
90,W,0xFE0100FC,DDRC+0xFC,0x00000000,0x009DC,0
|
|
109,W,0xFD8C8004,SCRU+0x8004,0x00000000,0x10A8C,0
|
|
114,W,0xFD8C8014,SCRU+0x8014,0xFFFFFFFF,0x10AA0,0
|
|
115,W,0xFD8C8018,SCRU+0x8018,0xFFFFFFFF,0x10AA4,0
|
|
118,W,0xFD8C8008,SCRU+0x8008,0x00000000,0x10AB0,0
|
|
121,W,0xFD8C8004,SCRU+0x8004,0x00000001,0x10ABC,0
|
|
151,W,0xFD5F4000,BUS_GRF+0x4000,0x0FF00880,0x00660,0
|
|
154,W,0xFD5F800C,BUS_GRF+0x800C,0x0FF00AA0,0x0066C,0
|