Table of Contents
MegabitChip — Port Matrix
Per-function status for the “monster” ports and any port that needs a
narrative beyond the one-line entry in check_asm.sh. Short ports
that are source-complete, byte-matching, and need no commentary live
only in ~/projects/AMPere/benchmark/ and the make audit output.
Last updated: 2026-04-21 (extended session).
Splicer baseline
- 104 candidate ports total
- 85 spliced (linked + installed into rebuilt blob)
- 19 natural skip-larger (candidate > vendor byte budget — vendor bytes remain)
- 0 failed
- 1 explicit
splicer_skip.txtentry (154_FUN_de40— see below)
Monster ports
| Port | Status | Size | Notes |
|---|---|---|---|
fn_fcc4 (115_FUN_fcc4) | Source-complete full port | 1684 B | Natural skip-larger. Documented source. Training-result reporter — 1656 B vendor with 5 state-mutating stores that SAILR output was too contaminated to hand-rescue, rebuilt from func.s. |
fn_1c14 (101_FUN_1c14) | Full port — replaces broken stub | 656 B ≤ 740 B vendor | Prior port was read-and-discard ((void)*(u32v *)(rank + base + i * 4u);). Vendor's body is a DDRPHY training-register save/restore/zero routine that copies configuration banks between source and destination offsets. Rebuilt from ddr_annotated.c:1555. |
fn_3268 (83_FUN_3268) | Bug fix | same budget | Early-return restructured to fall through to the 0x208 RMW tail — matches vendor's b INTO_TAIL shape on both control-flow paths. See extended session bug-class 2. |
fn_de40 (154_FUN_de40) | Source-scaffold, installs under budget | 4888 B ≤ 4912 B vendor | Faithful ~700-line port from ddr_annotated.c:9695–10640 (LPDDR5 frequency-band timing programmer). 27 callees resolved via fun_table (0xd468 via vendor bytes). 24 new DAT_00011ff0..DAT_000127c0 defsyms added. Diverges 1 bit at tp[0x4f] on the first install trial — currently parked in splicer_skip.txt pending internal task #198. Vendor bytes hold mmio_diff 3173/3173. |
fn_de40 — parked behind task #198
Installs cleanly under budget and builds, but enabling install causes
mmio_diff write #197 to diverge: vendor writes 0x300000 to
ch0 + 0x504, rebuilt writes 0x310000. One bit — bit-0 of
tp[0x4f] is 0x30 in the rebuild vs 0x31 expected by the
downstream write composer.
Caller fn_5540 computes tp[0x55] | (tp[0x4f] « 16), so the
bit-0 difference in tp[0x4f] ends up as bit-16 of the 0x504 write.
Task #198 tracks the narrow-window Unicorn trace needed to localize which control-flow path in the rebuild is wrong. mmio_diff stays 3173/3173 with vendor bytes in place. Details and reproduction steps live in the internal task board.
Historical context
Earlier port milestones:
- 2026-04-20 — 1/118 → 33/118 functions matching-decomped, poll-site coverage 4/16 → 15/16, canonical
clang -O2 -ffreestanding -mgeneral-regs-only -fno-pic -fno-stack-protector -fno-jump-tables –target=aarch64-none-elfsettled - 2026-04-21 reloc-splice — reached 17 → 47/54; bug classes: jump-table .rodata loss (
-fno-jump-tablesmitigates) + void-signature x0 mutation (audit against vendor's last pre-RET insns) - 2026-04-21 simulation — MMIO-trace diff adopted as primary gate; fn_9a68 dst/src swap, fn_2e88 arg swap, fn_2340 void→int, fn_4f8 case-2 BUS_GRF addresses
- 2026-04-21 extended — 6 silicon-hostile bugs / 3 classes caught pre-flash, three monster ports shipped (above), bitflip sweep + ADRP-to-NULL guard