Record PSP security investigation artifacts and probesHEADmain

1 files changed, 37 insertions, 0 deletions

diff --git a/hw/mp1_pmi3_host_event_control.py b/hw/mp1_pmi3_host_event_control.py
new file mode 100644
index 0000000..554026e
--- /dev/null
+++ b/hw/mp1_pmi3_host_event_control.py
@@ -0,0 +1,37 @@
+#!/usr/bin/env python3
+"""One-shot host-SMN PMI3 event-equivalence control, volatile only.
+
+Test whether privileged *host* PCIE_INDEX2/DATA2 can send the same naturally
+emitted diagnostic word that ASD 0x403 successfully enqueued on PSP fabric.
+This is a bounded write to numeric 0x03B30600, NOT flash/fuse/security bar.
+Queue pointer/status readbacks and bogus/MP0 controls distinguish mirrors;
+it does NOT prove the event consumer or any PSP-only security advantage.
+"""
+import os
+from tinygrad import Device
+
+fd=os.open('/root/psp/hw/.mp1_pmi3_host_event_control.attempted',
+           os.O_WRONLY|os.O_CREAT|os.O_EXCL,0o600)
+os.close(fd)
+adev=Device['AMD'].iface.dev_impl
+
+def read(a):
+    adev.wreg(14,a) # host PCIE_INDEX2 address selection
+    return adev.rreg(15)&0xffffffff
+
+def snap(tag):
+    t=tuple(read(a) for a in (0x03B30604,0x03B30608,0x03B3060C))
+    print(tag,'candidate status/rptr/wptr',tuple(hex(x) for x in t),
+          'MP0',hex(read(0x03810ACC)),'bogus',hex(read(0x0FEEDC00)),flush=True)
+    return t
+
+before=snap('BEFORE A')
+again=snap('BEFORE B (no data write)')
+assert before==again, 'unstable pointer, no host write'
+assert before[0]==0 and before[1]==0x40000 and 0x40000<=before[2]<=0x403f0
+assert read(0x03810ACC)==0x80000000 and read(0x0FEEDC00)==0x00DCEE0F
+adev.wreg(14,0x03B30600)
+adev.wreg(15,0xE3030100) # naturally emitted, bounded volatile event
+print('ONE host-SMN write: address 0x03B30600 word 0xE3030100',flush=True)
+after=snap('AFTER')
+print('host wptr delta',hex((after[2]-before[2])&0xffffffff),flush=True)