|
|
The emulator cannot open RAS's init gate because SYS_DRV opcode 0x000d fails a
capacity check on the zero context at 0xE575B8, and a bounded search found
nothing that fills it. Whether that is our missing state or something the
firmware never does is not answerable inside the emulator. It is answerable on a
card.
tinygrad has no TA loading path, so psp_out/load_ta.py builds one over
AM_PSP._ring_submit: VRAM for the signed container and a shared command buffer,
cmd_load_ta with MC addresses, LOAD_TA for a session id, INVOKE_CMD per command,
UNLOAD_TA at the end, with the PSP heartbeat checked before and after every
submit. The TA driven is the card's own signed RAS 27.0.2.5, whose body is
byte-identical to our ras2.elf -- the exact code the emulator runs.
A control saved this from being a fabricated result. The first run reported
status=0 for commands 1-4 and looked like a clean sweep. But resp.status is RING
DELIVERY only: 0xdead and 0x7fff also returned status=0 with byte-identical
output. The TA's own verdict is ras_status in the shared buffer
(struct ta_ras_shared_memory: cmd_id/resp_id/ras_status/if_version), and the
command id goes IN THE BUFFER, the same shape as the HDCP invoke ABI decoded
earlier here. With that fixed, valid and invalid commands separate cleanly.
Measured surface on this card:
cmd 1 ras_status 0x0 -- success
cmd 2 0xa002
cmd 3, 4 0xa010
cmd 5..0x10 rejected at the ring, 0xFFFF000A
Command 1 succeeding means RAS processed it rather than short-circuiting on its
init gate at 0x4060E0, and that gate is only written on a path bottoming out in
the SYS_DRV RPC chain containing 0x000d. So 0xE575B8 IS populated on a real
boot, and the blocker is our missing boot state, not firmware behaviour. The
harness's existing "uninitialised SYS_DRV state, NOT a defect" call is now
confirmed from outside the emulator instead of resting on careful reading.
Bounded, so it is not overread: this does NOT reveal what populates 0xE575B8.
That is PSP-internal on a path the host cannot observe; hardware confirms the
destination, finding the writer stays an emulator-side problem. It also does not
make emulated RAS coverage reportable -- but it does give an oracle the emulator
must match once the gate opens.
Housekeeping: LOAD_TA allocates a fresh session per call (seen climbing 0,1,2,...
across runs), so load_ta.py releases it. Card verified healthy after every run --
heartbeat advancing, LTSSM 0x78. No ATX cycle was needed.
|
