#!/usr/bin/env python3
"""Is the PSP BOOTLOADER command interface still live after sOS has booted?

The bootloader loads sOS components pre-boot via C2PMSG_35 (component id + status) and _36
(message address >> 20). It is a host->PSP interface completely separate from the ring, and
nothing in this audit has ever touched it.

Observed: `_35` reads `0x80000000` -- the "BL ready" bit -- while sOS is alive and the ring is
running. That is only suggestive: a latched idle bit is not proof the bootloader will accept
a command.

The clean experiment uses an INVALID component id. If the bootloader answers (clears the
ready bit and/or returns a status), the interface is live at runtime -- established without
asking it to load anything real. If `_35` never changes, the bit is idle state and the
interface is closed.

Deliberately NOT used: LOAD_IP_FW, a known wedge with junk payloads, and the DRAM training
ids, which would retrain memory on a running system.

argv[1]: 'invalid' (bogus id, default) | 'zero' | hex id
"""
import sys, time
sys.path.insert(0, '/root/psp/hw')
from tinygrad import Device
adev = Device["AMD"].iface.dev_impl; psp = adev.psp
P = psp.reg_pref
def snap(tag):
    d = {r: adev.reg(f"{P}_{r}").read() for r in (33, 35, 36, 64, 67, 81)}
    print('  %-10s _35=%#-12x _36=%#-10x _64=%#-12x _81=%#-11x _33=%#x'
          % (tag, d[35], d[36], d[64], d[81], d[33]), flush=True)
    return d
mode = sys.argv[1] if len(sys.argv) > 1 else 'invalid'
cid = {'invalid': 0x44000000, 'zero': 0x0}.get(mode, None)
if cid is None: cid = int(mode, 0)
print('bootloader runtime probe: component id %#x' % cid, flush=True)
before = snap('before')
print('  BLREADY_before=%s SOSALIVE=%s'
      % (bool(before[35] & 0x80000000), bool(psp.is_sos_alive())), flush=True)
if not (before[35] & 0x80000000):
    print('  ready bit not set -> nothing to test'); sys.exit(0)
pa = adev.mm.palloc(0x100000, align=0x100000, zero=True, boot=False)
mc = adev.paddr2mc(pa)
adev.gmc.flush_hdp()
adev.reg(f"{P}_36").write(mc >> 20)
adev.reg(f"{P}_35").write(cid)
t0 = time.time(); changed = None
while time.time() - t0 < 5.0:
    v = adev.reg(f"{P}_35").read()
    if v != cid and v != before[35]:
        changed = v; break
    time.sleep(0.05)
after = snap('after')
print('  VERDICT _35=%#x %s' % (after[35],
      'BOOTLOADER RESPONDED - interface live at runtime' if changed is not None
      else 'unchanged or echo - no response'), flush=True)
print('  SOSALIVE_after=%s HB_advancing=%s'
      % (bool(psp.is_sos_alive()), after[81] != before[81]), flush=True)