marfrit
00d655187a
Three small functions extracted from the v1.19 conservative blob with
ground-truth C and per-tool (Ghidra / retdec / decomp.me) docs:
01_memset — byte memset, 28 B
02_memcpy32 — word-aligned memcpy, 36 B
03_magic_memset — magic check + tail-call to memset, 40 B
04_train_phy_block — first real poll-site function (104 B, 26 insts),
contains poll sites 12-15
Results in RESULTS.md:
- Ghidra: A on all four. Auto-decompile is close to final.
- retdec: A on #3, F on #1 and #2 (no register-arg inference on raw),
C on #4 (mistakes & 0xF0000000 for < 0x10000000).
GRIND_LOG.md (in 04_train_phy_block/) records the matching-decomp
iteration: 116-byte candidate.c at -Os vs vendor 104 bytes = 89.7%
size match on first real iteration. Remaining gap is GCC's choice of
`cmp w, w_const; b.ls` over vendor's `tst w, #imm; b.eq` for the
mask tests.
gdb_debug/ holds a native-aarch64 GDB single-stepper for the three
benchmark functions — boltzmann smoke test passed (memset:
buf[10] 0x00→0xab).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
21 lines
770 B
Python
21 lines
770 B
Python
#!/usr/bin/env python3
|
|
"""Slice named functions out of the RK3588 DDR v1.19 conservative blob."""
|
|
import os
|
|
|
|
BLOB = os.path.expanduser('~/projects/AMPere/rkbin/bin/rk35/rk3588_ddr_lp4_1848MHz_lp5_2112MHz_v1.19.bin')
|
|
BASE = os.path.expanduser('~/projects/AMPere/benchmark')
|
|
|
|
functions = [
|
|
('01_memset', 0x0aac, 0x1c, 'byte memset'),
|
|
('02_memcpy32', 0x1200, 0x24, 'word-aligned memcpy32'),
|
|
('03_magic_memset', 0x0da4, 0x28, 'magic-check + tail-call to memset'),
|
|
]
|
|
|
|
blob = open(BLOB, 'rb').read()
|
|
for name, off, sz, desc in functions:
|
|
d = os.path.join(BASE, name)
|
|
os.makedirs(d, exist_ok=True)
|
|
with open(os.path.join(d, 'func.bin'), 'wb') as f:
|
|
f.write(blob[off:off+sz])
|
|
print(f"{name}: {sz} bytes @ 0x{off:x} — {desc}")
|