|
|
MES is the queue scheduler and, like the DMCUB inbox, is driven by host API
packets -- it had never been read here. Confirm RV64 by real decode (92%),
recover the container (code at 0xf0005000, data at 0xf0100000), and audit the
packet surface: the 256-byte stride matches MES_API_MAX, both dispatch sites
are bounds-checked, and 31 of 33 memcpy sites use constant lengths, so DMCUB's
FINDING-1 pattern is absent.
Retract, in place, an earlier identification of the two dispatchers against the
kernel enums. The bounds were exact ABI fits, which felt like confirmation, but
the table entries disassemble as mid-block fragments and epilogues; the
prologue-scan function boundaries behind that model are unreliable on this
image. MESAPI_MISC__WRITE_REG is left explicitly unresolved because the
screening dataflow is not call-clobber aware.
PFP and ME are also RV64 (container-parsed, load addr 0x3000). IMU is
Tensilica Xtensa, correcting this tree's "undetermined": the old call was made
over the whole container, which is dominated by the zero-padded DRAM half.
|
