loaded ta_22-0-0-77_7c426e7f.bin, session slot 0, cmd_buf PA 0x8200000 len 0x8000 residue set: TA blocks=248 faults=0 === snapshot at 0x402938 : sp=0x41bf70 ctx=0x41d030 (machine FROZEN before teardown) === freeze OK: translate(sp)=0x4257f70 DACR=0x00005401 -> accessible domains [0, 5, 6, 7] --realwrites: stack paint capped at 0x41bfa5 (measured writable boundary) attacker-writable regions (user-RW AND DACR-permitted in the TA's own TTBR0): 0x00407000-0x00417000 dom=6 magic prefix 0x50 (paint from 0x40707f) 0x00418000-0x0041bfa5 dom=6 magic prefix 0x51 (paint from 0x41807f) 0x0041d000-0x00421000 dom=6 magic prefix 0x52 (paint from 0x41d07f) 0x00422000-0x00423000 dom=6 magic prefix 0x53 (paint from 0x42207f) 0x04000000-0x04001000 dom=5 magic prefix 0x54 (paint from 0x400007f) 0x04002000-0x04003000 dom=5 magic prefix 0x55 (paint from 0x400207f) painted 27 pages; pinned 3 uncontrollable words vector base 0x0, abort hooks armed HW-measured residue applied to 24/24 slots === POSITIVE CONTROLS (predicted outcomes) === 0x00402425 DATA insn=0x40483a ctrl_regs=['r1', 'r4', 'r5', 'r6'] expected: add sp,#0x28 ; pop.w{..pc} -> pc from *(sp+0x44), PAINTED => PC_CONTROL vec=0x10 lr_abt=0x404842 sp_usr=0x41bfb8 0x0040371d PREFETCH fetch=0x0 sp=0x41d054 expected: mov sp,r4 ; pop.w{..pc} -> pc from *(ctx+0x20), BELOW carve floor => not ctrl vec=0xc lr_abt=0x4 sp_usr=0x41d054 0x0040157b DATA insn=0x40157a ctrl_regs=[] expected: str r0,[r1] with r1=0 -> data abort at 0 vec=0x10 lr_abt=0x401582 sp_usr=0x41bf70 === SWEEP: 24384 candidates, cap 200 insns === .. 250/24384 0s 3140.7/s eta 8s hits=0 {'RAN': 232, 'DATA': 17, 'SVC': 1, 'PREFETCH': 1} .. 500/24384 0s 3592.2/s eta 7s hits=0 {'RAN': 480, 'DATA': 17, 'PREFETCH': 3, 'SVC': 1} .. 750/24384 0s 3390.8/s eta 7s hits=0 {'RAN': 687, 'DATA': 57, 'PREFETCH': 6, 'SVC': 1} .. 1000/24384 0s 3551.9/s eta 7s hits=0 {'RAN': 687, 'DATA': 304, 'PREFETCH': 9, 'SVC': 1} .. 1250/24384 0s 3455.7/s eta 7s hits=0 {'RAN': 903, 'DATA': 334, 'PREFETCH': 13, 'SVC': 1} .. 1500/24384 0s 3570.8/s eta 6s hits=0 {'RAN': 1150, 'DATA': 334, 'PREFETCH': 16, 'SVC': 1} .. 1750/24384 1s 2542.4/s eta 9s hits=0 {'RAN': 1398, 'DATA': 334, 'PREFETCH': 18, 'SVC': 1} .. 2000/24384 1s 2654.0/s eta 8s hits=0 {'RAN': 1422, 'DATA': 357, 'SVC': 162, 'PREFETCH': 39, 'SP_IN_CTRL': 21} .. 2250/24384 1s 2819.7/s eta 8s hits=0 {'RAN': 1434, 'DATA': 424, 'SVC': 208, 'PREFETCH': 115, 'SP_IN_CTRL': 38} .. 2500/24384 1s 2955.9/s eta 7s hits=0 {'RAN': 1434, 'DATA': 477, 'SVC': 250, 'PREFETCH': 222, 'SP_IN_CTRL': 68} .. 2750/24384 1s 3077.2/s eta 7s hits=0 {'RAN': 1434, 'DATA': 580, 'PREFETCH': 312, 'SVC': 272, 'SP_IN_CTRL': 90} .. 3000/24384 1s 3162.4/s eta 7s hits=0 {'RAN': 1449, 'DATA': 649, 'PREFETCH': 446, 'SVC': 286, 'SP_IN_CTRL': 106} HIT V=0x004018a5 PC_CONTROL+SP_IN_CTRL pc<-CTRL 0x41bf5c (=0x418000+0x3f5c) | sp=0x41bf60 (in 0x418000) .. 3250/24384 1s 3227.5/s eta 7s hits=1 {'RAN': 1478, 'DATA': 685, 'PREFETCH': 609, 'SVC': 288, 'SP_IN_CTRL': 110} .. 3500/24384 1s 3293.9/s eta 6s hits=1 {'RAN': 1567, 'DATA': 748, 'PREFETCH': 686, 'SVC': 288, 'SP_IN_CTRL': 122} .. 3750/24384 1s 3341.6/s eta 6s hits=1 {'RAN': 1616, 'DATA': 807, 'PREFETCH': 805, 'SVC': 288, 'SP_IN_CTRL': 140} .. 4000/24384 1s 3393.9/s eta 6s hits=1 {'RAN': 1705, 'PREFETCH': 901, 'DATA': 857, 'SVC': 288, 'SP_IN_CTRL': 148} .. 4250/24384 1s 3462.6/s eta 6s hits=1 {'RAN': 1705, 'DATA': 1036, 'PREFETCH': 948, 'SVC': 298, 'SP_IN_CTRL': 149} .. 4500/24384 1s 3505.4/s eta 6s hits=1 {'RAN': 1722, 'DATA': 1104, 'PREFETCH': 1043, 'SVC': 321, 'SP_IN_CTRL': 185} .. 4750/24384 1s 3571.7/s eta 5s hits=1 {'RAN': 1727, 'DATA': 1215, 'PREFETCH': 1066, 'SVC': 374, 'SP_IN_CTRL': 212} .. 5000/24384 1s 3616.7/s eta 5s hits=1 {'RAN': 1762, 'DATA': 1316, 'PREFETCH': 1128, 'SVC': 384, 'SP_IN_CTRL': 238} .. 5250/24384 1s 3665.8/s eta 5s hits=1 {'RAN': 1786, 'DATA': 1406, 'PREFETCH': 1206, 'SVC': 399, 'SP_IN_CTRL': 263} .. 5500/24384 1s 3702.5/s eta 5s hits=1 {'RAN': 1838, 'DATA': 1525, 'PREFETCH': 1247, 'SVC': 404, 'SP_IN_CTRL': 280} .. 5750/24384 2s 3731.6/s eta 5s hits=1 {'RAN': 1897, 'DATA': 1615, 'PREFETCH': 1261, 'SVC': 447, 'SP_IN_CTRL': 307} .. 6000/24384 2s 3763.9/s eta 5s hits=1 {'RAN': 1933, 'DATA': 1760, 'PREFETCH': 1277, 'SVC': 464, 'SP_IN_CTRL': 329} .. 6250/24384 2s 3791.5/s eta 5s hits=1 {'RAN': 1961, 'DATA': 1906, 'PREFETCH': 1312, 'SVC': 469, 'SP_IN_CTRL': 351} .. 6500/24384 2s 3827.2/s eta 5s hits=1 {'DATA': 2010, 'RAN': 2009, 'PREFETCH': 1342, 'SVC': 506, 'SP_IN_CTRL': 366} .. 6750/24384 2s 3868.9/s eta 5s hits=1 {'DATA': 2140, 'RAN': 2020, 'PREFETCH': 1376, 'SVC': 549, 'SP_IN_CTRL': 382} .. 7000/24384 2s 3903.3/s eta 4s hits=1 {'DATA': 2317, 'RAN': 2020, 'PREFETCH': 1400, 'SVC': 573, 'SP_IN_CTRL': 396} .. 7250/24384 2s 3930.8/s eta 4s hits=1 {'DATA': 2429, 'RAN': 2034, 'PREFETCH': 1417, 'SVC': 600, 'SP_IN_CTRL': 453} .. 7500/24384 2s 3960.2/s eta 4s hits=1 {'DATA': 2506, 'RAN': 2057, 'PREFETCH': 1449, 'SVC': 668, 'SP_IN_CTRL': 480} .. 7750/24384 2s 3974.0/s eta 4s hits=1 {'DATA': 2611, 'RAN': 2107, 'PREFETCH': 1467, 'SVC': 669, 'SP_IN_CTRL': 534} .. 8000/24384 2s 3991.2/s eta 4s hits=1 {'DATA': 2720, 'RAN': 2141, 'PREFETCH': 1483, 'SVC': 728, 'SP_IN_CTRL': 550} .. 8250/24384 2s 4013.8/s eta 4s hits=1 {'DATA': 2798, 'RAN': 2177, 'PREFETCH': 1521, 'SVC': 793, 'SP_IN_CTRL': 572} .. 8500/24384 2s 4036.7/s eta 4s hits=1 {'DATA': 2848, 'RAN': 2226, 'PREFETCH': 1554, 'SVC': 809, 'SP_IN_CTRL': 628} .. 8750/24384 2s 4052.8/s eta 4s hits=1 {'DATA': 2897, 'RAN': 2306, 'PREFETCH': 1633, 'SVC': 822, 'SP_IN_CTRL': 639} .. 9000/24384 2s 4070.5/s eta 4s hits=1 {'DATA': 3034, 'RAN': 2348, 'PREFETCH': 1657, 'SVC': 830, 'SP_IN_CTRL': 660} .. 9250/24384 2s 4085.6/s eta 4s hits=1 {'DATA': 3132, 'RAN': 2398, 'PREFETCH': 1699, 'SVC': 858, 'SP_IN_CTRL': 680} .. 9500/24384 2s 4101.8/s eta 4s hits=1 {'DATA': 3254, 'RAN': 2441, 'PREFETCH': 1726, 'SVC': 871, 'SP_IN_CTRL': 705} HIT V=0x00404d13 PC_CONTROL+SP_IN_CTRL pc<-CTRL 0x41bf9c (=0x418000+0x3f9c) | sp=0x41bfa0 (in 0x418000) HIT V=0x00404d15 PC_CONTROL+SP_IN_CTRL pc<-CTRL 0x41bf9c (=0x418000+0x3f9c) | sp=0x41bfa0 (in 0x418000) .. 9750/24384 2s 4115.4/s eta 4s hits=3 {'DATA': 3343, 'RAN': 2484, 'PREFETCH': 1761, 'SVC': 896, 'SP_IN_CTRL': 747} HIT V=0x00404d7b PC_CONTROL+SP_IN_CTRL pc<-CTRL 0x41bf9c (=0x418000+0x3f9c) | sp=0x41bfa0 (in 0x418000) HIT V=0x00404d7d PC_CONTROL+SP_IN_CTRL pc<-CTRL 0x41bf9c (=0x418000+0x3f9c) | sp=0x41bfa0 (in 0x418000) HIT V=0x00404d7f PC_CONTROL+SP_IN_CTRL pc<-CTRL 0x41bf9c (=0x418000+0x3f9c) | sp=0x41bfa0 (in 0x418000) .. 10000/24384 2s 4127.3/s eta 3s hits=6 {'DATA': 3445, 'RAN': 2532, 'PREFETCH': 1791, 'SVC': 913, 'SP_IN_CTRL': 783} .. 10250/24384 2s 4142.7/s eta 3s hits=6 {'DATA': 3531, 'RAN': 2576, 'PREFETCH': 1839, 'SVC': 944, 'SP_IN_CTRL': 809} .. 10500/24384 3s 4163.1/s eta 3s hits=6 {'DATA': 3630, 'RAN': 2595, 'PREFETCH': 1862, 'SVC': 1012, 'SP_IN_CTRL': 833} .. 10750/24384 3s 4184.4/s eta 3s hits=6 {'DATA': 3711, 'RAN': 2603, 'PREFETCH': 1909, 'SVC': 1082, 'SP_IN_CTRL': 861} .. 11000/24384 3s 4211.0/s eta 3s hits=6 {'DATA': 3779, 'RAN': 2603, 'PREFETCH': 1923, 'SVC': 1204, 'SP_IN_CTRL': 896} .. 11250/24384 3s 4227.6/s eta 3s hits=6 {'DATA': 3860, 'RAN': 2626, 'PREFETCH': 1953, 'SVC': 1265, 'SP_IN_CTRL': 936} .. 11500/24384 3s 4230.0/s eta 3s hits=6 {'DATA': 3880, 'RAN': 2627, 'PREFETCH': 2038, 'SVC': 1399, 'SP_IN_CTRL': 936} .. 11750/24384 3s 4234.6/s eta 3s hits=6 {'DATA': 3893, 'RAN': 2627, 'PREFETCH': 2260, 'SVC': 1407, 'SP_IN_CTRL': 936} .. 12000/24384 3s 4253.8/s eta 3s hits=6 {'DATA': 3938, 'RAN': 2627, 'PREFETCH': 2331, 'SVC': 1526, 'SP_IN_CTRL': 943} .. 12250/24384 3s 4273.4/s eta 3s hits=6 {'DATA': 3938, 'RAN': 2627, 'PREFETCH': 2440, 'SVC': 1651, 'SP_IN_CTRL': 943} HIT V=0x00406271 PC_CONTROL+SP_IN_CTRL pc<-CTRL 0x41bf9c (=0x418000+0x3f9c) | sp=0x41bfa0 (in 0x418000) .. 12500/24384 3s 4280.6/s eta 3s hits=7 {'DATA': 4001, 'RAN': 2631, 'PREFETCH': 2485, 'SVC': 1764, 'SP_IN_CTRL': 943} .. 12750/24384 3s 4273.4/s eta 3s hits=7 {'DATA': 4124, 'RAN': 2637, 'PREFETCH': 2512, 'SVC': 1807, 'SP_IN_CTRL': 963} .. 13000/24384 3s 4283.7/s eta 3s hits=7 {'DATA': 4359, 'RAN': 2637, 'PREFETCH': 2515, 'SVC': 1807, 'SP_IN_CTRL': 963} .. 13250/24384 3s 4285.9/s eta 3s hits=7 {'DATA': 4599, 'RAN': 2637, 'PREFETCH': 2515, 'SVC': 1807, 'SP_IN_CTRL': 963} .. 13500/24384 3s 4295.8/s eta 3s hits=7 {'DATA': 4829, 'RAN': 2637, 'PREFETCH': 2523, 'SVC': 1807, 'SP_IN_CTRL': 963} .. 13750/24384 3s 4307.2/s eta 2s hits=7 {'DATA': 5059, 'RAN': 2637, 'PREFETCH': 2529, 'SVC': 1807, 'SP_IN_CTRL': 963} .. 14000/24384 3s 4287.4/s eta 2s hits=7 {'DATA': 5187, 'RAN': 2730, 'PREFETCH': 2532, 'SVC': 1807, 'SP_IN_CTRL': 963} .. 14250/24384 3s 4276.8/s eta 2s hits=7 {'DATA': 5189, 'RAN': 2779, 'PREFETCH': 2731, 'SVC': 1807, 'SP_IN_CTRL': 963} .. 14500/24384 3s 4276.4/s eta 2s hits=7 {'DATA': 5189, 'RAN': 2991, 'PREFETCH': 2731, 'SVC': 1807, 'SP_IN_CTRL': 963} .. 14750/24384 3s 4293.0/s eta 2s hits=7 {'DATA': 5194, 'RAN': 3021, 'PREFETCH': 2739, 'SVC': 1815, 'UCERR': 1012} .. 15000/24384 3s 4292.8/s eta 2s hits=7 {'DATA': 5194, 'RAN': 3240, 'PREFETCH': 2739, 'SVC': 1815, 'UCERR': 1043} .. 15250/24384 4s 4312.5/s eta 2s hits=7 {'DATA': 5199, 'RAN': 3240, 'PREFETCH': 2758, 'SVC': 1824, 'UCERR': 1256} .. 15500/24384 4s 4336.7/s eta 2s hits=7 {'DATA': 5242, 'RAN': 3240, 'PREFETCH': 2790, 'SVC': 1939, 'UCERR': 1316} .. 15750/24384 4s 4366.3/s eta 2s hits=7 {'DATA': 5300, 'RAN': 3240, 'PREFETCH': 2828, 'SVC': 1951, 'UCERR': 1458} .. 16000/24384 4s 4390.5/s eta 2s hits=7 {'DATA': 5351, 'RAN': 3240, 'PREFETCH': 2892, 'SVC': 1969, 'UCERR': 1575} .. 16250/24384 4s 4416.5/s eta 2s hits=7 {'DATA': 5403, 'RAN': 3240, 'PREFETCH': 2949, 'SVC': 1977, 'UCERR': 1708} .. 16500/24384 4s 4446.4/s eta 2s hits=7 {'DATA': 5440, 'RAN': 3240, 'PREFETCH': 2968, 'SVC': 2004, 'UCERR': 1858} .. 16750/24384 4s 4475.4/s eta 2s hits=7 {'DATA': 5480, 'RAN': 3240, 'PREFETCH': 2995, 'SVC': 2038, 'UCERR': 2007} .. 17000/24384 4s 4505.5/s eta 2s hits=7 {'DATA': 5512, 'RAN': 3240, 'PREFETCH': 3014, 'UCERR': 2167, 'SVC': 2077} .. 17250/24384 4s 4531.7/s eta 2s hits=7 {'DATA': 5565, 'RAN': 3240, 'PREFETCH': 3056, 'UCERR': 2304, 'SVC': 2095} .. 17500/24384 4s 4560.8/s eta 2s hits=7 {'DATA': 5604, 'RAN': 3240, 'PREFETCH': 3080, 'UCERR': 2470, 'SVC': 2116} .. 17750/24384 4s 4590.2/s eta 1s hits=7 {'DATA': 5617, 'RAN': 3240, 'PREFETCH': 3131, 'UCERR': 2647, 'SVC': 2125} .. 18000/24384 4s 4617.9/s eta 1s hits=7 {'DATA': 5654, 'RAN': 3240, 'PREFETCH': 3159, 'UCERR': 2808, 'SVC': 2149} .. 18250/24384 4s 4642.6/s eta 1s hits=7 {'DATA': 5695, 'RAN': 3240, 'PREFETCH': 3212, 'UCERR': 2942, 'SVC': 2171} .. 18500/24384 4s 4665.1/s eta 1s hits=7 {'DATA': 5749, 'PREFETCH': 3254, 'RAN': 3240, 'UCERR': 3095, 'SVC': 2172} .. 18750/24384 4s 4693.9/s eta 1s hits=7 {'DATA': 5771, 'UCERR': 3283, 'PREFETCH': 3277, 'RAN': 3240, 'SVC': 2189} .. 19000/24384 4s 4718.8/s eta 1s hits=7 {'DATA': 5817, 'UCERR': 3434, 'PREFETCH': 3314, 'RAN': 3240, 'SVC': 2205} .. 19250/24384 4s 4742.4/s eta 1s hits=7 {'DATA': 5863, 'UCERR': 3576, 'PREFETCH': 3357, 'RAN': 3240, 'SVC': 2224} .. 19500/24384 4s 4765.5/s eta 1s hits=7 {'DATA': 5915, 'UCERR': 3715, 'PREFETCH': 3399, 'RAN': 3240, 'SVC': 2241} .. 19750/24384 4s 4785.3/s eta 1s hits=7 {'DATA': 5942, 'UCERR': 3854, 'PREFETCH': 3460, 'RAN': 3240, 'SVC': 2264} .. 20000/24384 4s 4807.7/s eta 1s hits=7 {'DATA': 5977, 'UCERR': 3980, 'PREFETCH': 3523, 'RAN': 3240, 'SVC': 2289} .. 20250/24384 4s 4827.6/s eta 1s hits=7 {'DATA': 6008, 'UCERR': 4093, 'PREFETCH': 3618, 'RAN': 3240, 'SVC': 2300} .. 20500/24384 4s 4836.3/s eta 1s hits=7 {'DATA': 6027, 'UCERR': 4221, 'PREFETCH': 3669, 'RAN': 3254, 'SVC': 2332} .. 20750/24384 4s 4856.6/s eta 1s hits=7 {'DATA': 6082, 'UCERR': 4360, 'PREFETCH': 3696, 'RAN': 3254, 'SVC': 2361} .. 21000/24384 4s 4872.5/s eta 1s hits=7 {'DATA': 6168, 'UCERR': 4447, 'PREFETCH': 3728, 'RAN': 3254, 'SVC': 2406} .. 21250/24384 4s 4872.4/s eta 1s hits=7 {'DATA': 6233, 'UCERR': 4524, 'PREFETCH': 3823, 'RAN': 3254, 'SVC': 2419} .. 21500/24384 4s 4867.3/s eta 1s hits=7 {'DATA': 6380, 'UCERR': 4526, 'PREFETCH': 3915, 'RAN': 3256, 'SVC': 2424} .. 21750/24384 4s 4879.1/s eta 1s hits=7 {'DATA': 6433, 'UCERR': 4568, 'PREFETCH': 3974, 'RAN': 3278, 'SVC': 2474} .. 22000/24384 5s 4888.3/s eta 0s hits=7 {'DATA': 6597, 'UCERR': 4597, 'PREFETCH': 3989, 'RAN': 3306, 'SVC': 2479} .. 22250/24384 5s 4895.6/s eta 0s hits=7 {'DATA': 6686, 'UCERR': 4628, 'PREFETCH': 4059, 'RAN': 3309, 'SVC': 2485} .. 22500/24384 5s 4877.8/s eta 0s hits=7 {'DATA': 6705, 'UCERR': 4631, 'PREFETCH': 4059, 'RAN': 3535, 'SVC': 2487} .. 22750/24384 5s 4733.6/s eta 0s hits=7 {'DATA': 6705, 'UCERR': 4631, 'PREFETCH': 4059, 'RAN': 3785, 'SVC': 2487} .. 23000/24384 5s 4720.4/s eta 0s hits=7 {'DATA': 6705, 'UCERR': 4631, 'PREFETCH': 4059, 'RAN': 4035, 'SVC': 2487} .. 23250/24384 5s 4695.4/s eta 0s hits=7 {'DATA': 6705, 'UCERR': 4631, 'RAN': 4195, 'PREFETCH': 4149, 'SVC': 2487} .. 23500/24384 5s 4697.4/s eta 0s hits=7 {'DATA': 6720, 'UCERR': 4646, 'PREFETCH': 4260, 'RAN': 4196, 'SVC': 2524} .. 23750/24384 5s 4714.9/s eta 0s hits=7 {'DATA': 6771, 'UCERR': 4757, 'PREFETCH': 4304, 'RAN': 4196, 'SVC': 2566} .. 24000/24384 5s 4714.3/s eta 0s hits=7 {'DATA': 6785, 'UCERR': 4822, 'RAN': 4356, 'PREFETCH': 4312, 'SVC': 2567} .. 24250/24384 5s 4705.1/s eta 0s hits=7 {'DATA': 6785, 'UCERR': 4822, 'RAN': 4541, 'PREFETCH': 4377, 'SVC': 2567} === outcome histogram === DATA 6785 (27.8%) UCERR 4822 (19.8%) RAN 4541 (18.6%) PREFETCH 4510 (18.5%) SVC 2567 (10.5%) SP_IN_CTRL 1152 (4.7%) PC_CONTROL+SP_IN_CTRL 7 (0.0%) === CONTROL hits: 7 === V=0x004018a5 PC_CONTROL+SP_IN_CTRL pc<-CTRL 0x41bf5c (=0x418000+0x3f5c) | sp=0x41bf60 (in 0x418000) V=0x00404d13 PC_CONTROL+SP_IN_CTRL pc<-CTRL 0x41bf9c (=0x418000+0x3f9c) | sp=0x41bfa0 (in 0x418000) V=0x00404d15 PC_CONTROL+SP_IN_CTRL pc<-CTRL 0x41bf9c (=0x418000+0x3f9c) | sp=0x41bfa0 (in 0x418000) V=0x00404d7b PC_CONTROL+SP_IN_CTRL pc<-CTRL 0x41bf9c (=0x418000+0x3f9c) | sp=0x41bfa0 (in 0x418000) V=0x00404d7d PC_CONTROL+SP_IN_CTRL pc<-CTRL 0x41bf9c (=0x418000+0x3f9c) | sp=0x41bfa0 (in 0x418000) V=0x00404d7f PC_CONTROL+SP_IN_CTRL pc<-CTRL 0x41bf9c (=0x418000+0x3f9c) | sp=0x41bfa0 (in 0x418000) V=0x00406271 PC_CONTROL+SP_IN_CTRL pc<-CTRL 0x41bf9c (=0x418000+0x3f9c) | sp=0x41bfa0 (in 0x418000) wrote /tmp/sweep_cptr.json