# Working notes

## Hardware safety
* The card is a 7900 XTX reached over USB4 (ASM2464PD). **Do not leave hardware
  wedged.** A link reset (`psp_out/psp_recover.py`) does *not* restore HDCP
  display-core state; that needs a cold ATX cycle.
* **Do not blind-sweep SMN.**
* No SPI flash writes, no TSU work. See `psp_out/CONSTRAINTS.md`.

## Emulator gotchas that cost real time
* Unicorn only calls `UC_HOOK_CODE` for blocks translated *after* the hook is
  added; already-executed code is cached. Call `uc.ctl_flush_tb()`.
* Hooks fire *before* the instruction executes, so a register read at a hook
  address gives the pre-instruction value.
* `uc.mem_read`/`mem_write` are **physical** and bypass the MMU. Translate first
  when touching guest globals.
* Once the MMU is on, `count=` does not bound `emu_start`: a faulting access
  retires zero instructions. Use `timeout=` / `require_mapped()`.
* Every TA runs at VA 0x400000 in its *own* address space. VA alone does not
  identify a TA -- instrument with `(VA, live PA)` via `armmmu.translate_live()`.
* Unicorn reports an undefined instruction as `UC_ERR_INSN_INVALID` and stops,
  rather than delivering an exception to the guest. A crash oracle must watch
  that channel too.
* A known-bad probe must run **last**; `cmd 7` wedges the mailbox loop and has
  silently invalidated downstream results twice.