====== MegabitChip — Port Matrix ======

Per-function status for the "monster" ports and any port that needs a
narrative beyond the one-line entry in ''check_asm.sh''. Short ports
that are source-complete, byte-matching, and need no commentary live
only in ''~/projects/AMPere/benchmark/'' and the ''make audit'' output.

Last updated: 2026-04-21 (extended session).

===== Splicer baseline =====

  * **104** candidate ports total
  * **85** spliced (linked + installed into rebuilt blob)
  * **19** natural skip-larger (candidate > vendor byte budget — vendor bytes remain)
  * **0** failed
  * **1** explicit ''splicer_skip.txt'' entry (''154_FUN_de40'' — see below)

===== Monster ports =====

^ Port ^ Status ^ Size ^ Notes ^
| ''fn_fcc4'' (''115_FUN_fcc4'') | Source-complete full port | 1684 B | Natural skip-larger. Documented source. Training-result reporter — 1656 B vendor with 5 state-mutating stores that SAILR output was too contaminated to hand-rescue, rebuilt from ''func.s''. |
| ''fn_1c14'' (''101_FUN_1c14'') | Full port — replaces broken stub | 656 B ≤ 740 B vendor | Prior port was read-and-discard (''(void)*(u32v *)(rank + base + i * 4u);''). Vendor's body is a DDRPHY training-register save/restore/zero routine that copies configuration banks between source and destination offsets. Rebuilt from ''ddr_annotated.c:1555''. |
| ''fn_3268'' (''83_FUN_3268'') | Bug fix | same budget | Early-return restructured to fall through to the 0x208 RMW tail — matches vendor's ''b INTO_TAIL'' shape on both control-flow paths. See [[megabitchip:2026-04-21_extended|extended session]] bug-class 2. |
| ''fn_de40'' (''154_FUN_de40'') | Source-scaffold, installs under budget | 4888 B ≤ 4912 B vendor | Faithful ~700-line port from ''ddr_annotated.c:9695–10640'' (LPDDR5 frequency-band timing programmer). 27 callees resolved via ''fun_table'' (''0xd468'' via vendor bytes). 24 new ''DAT_00011ff0..DAT_000127c0'' defsyms added. **Diverges 1 bit at ''tp[0x4f]''** on the first install trial — currently parked in ''splicer_skip.txt'' pending internal task **#198**. Vendor bytes hold mmio_diff 3173/3173. |

===== fn_de40 — parked behind task #198 =====

Installs cleanly under budget and builds, but enabling install causes
mmio_diff write **#197** to diverge: vendor writes ''0x300000'' to
''ch0 + 0x504'', rebuilt writes ''0x310000''. One bit — bit-0 of
''tp[0x4f]'' is ''0x30'' in the rebuild vs ''0x31'' expected by the
downstream write composer.

Caller ''fn_5540'' computes ''tp[0x55] | (tp[0x4f] << 16)'', so the
bit-0 difference in ''tp[0x4f]'' ends up as bit-16 of the 0x504 write.

Task #198 tracks the narrow-window Unicorn trace needed to localize
which control-flow path in the rebuild is wrong. mmio_diff stays
**3173/3173** with vendor bytes in place. Details and reproduction
steps live in the internal task board.

===== Historical context =====

Earlier port milestones:

  * [[megabitchip:2026-04-20_dokuwiki|2026-04-20]] — 1/118 → 33/118 functions matching-decomped, poll-site coverage 4/16 → 15/16, canonical ''clang -O2 -ffreestanding -mgeneral-regs-only -fno-pic -fno-stack-protector -fno-jump-tables --target=aarch64-none-elf'' settled
  * [[megabitchip:2026-04-21_reloc_splice|2026-04-21 reloc-splice]] — reached 17 → 47/54; bug classes: jump-table .rodata loss (''-fno-jump-tables'' mitigates) + void-signature x0 mutation (audit against vendor's last pre-RET insns)
  * [[megabitchip:2026-04-21_simulation|2026-04-21 simulation]] — MMIO-trace diff adopted as primary gate; fn_9a68 dst/src swap, fn_2e88 arg swap, fn_2340 void→int, fn_4f8 case-2 BUS_GRF addresses
  * [[megabitchip:2026-04-21_extended|2026-04-21 extended]] — 6 silicon-hostile bugs / 3 classes caught pre-flash, three monster ports shipped (above), bitflip sweep + ADRP-to-NULL guard