#!/usr/bin/env python3
"""Does the PSP validate the LOAD_TA command buffer against its own trusted memory region?

Every test so far fuzzed shared-buffer CONTENT. The LOAD_TA descriptor is a separate
host-controlled input: app address/length and cmd_buf address/length. The security-relevant
question is whether SYS_DRV checks that the host-supplied cmd_buf does not overlap the PSP's
own TMR. If it does not, a host can steer TA output into trusted memory -- a write primitive
against the security boundary.

Test, in increasing order of aggression, each on a fresh load:
  1. cmd_buf_len = 0            (does it reject a zero-length window?)
  2. cmd_buf_len = 0x100000     (a window far larger than the allocation)
  3. cmd_buf inside psp.tmr_paddr (the trusted region itself)

Only statuses are interpreted; no attempt is made to read TMR back (the host cannot).
A wedge is recoverable by ATX cycle.
"""
import glob, struct, sys, time
sys.path.insert(0,'/root/psp/hw')
from tinygrad import Device
import tinygrad.runtime.autogen.am.am as am
from ring_wrap import install
adev=Device["AMD"].iface.dev_impl; psp=adev.psp
submit=install(psp,adev)
def alloc(n):
    pa=adev.mm.palloc(n,align=0x1000,zero=True,boot=False); return pa,adev.paddr2mc(pa)
blob=open(glob.glob('/root/psp/contall/ta_42-0-0-6_1c874c3c*')[0],'rb').read()
print('tmr_paddr=%#x tmr_size=%#x'%(psp.tmr_paddr, psp.tmr_size), flush=True)
def try_load(tag, cmd_mc, cmd_len):
    ap_,amc=alloc(0x80000)
    n=(len(blob)+3)&~3
    adev.vram.view(ap_,n)[:]=blob+b'\x00'*(n-len(blob)); adev.gmc.flush_hdp()
    c=am.struct_psp_gfx_cmd_resp(cmd_id=am.GFX_CMD_ID_LOAD_TA); t=c.cmd.cmd_load_ta
    t.app_phy_addr_lo,t.app_phy_addr_hi=amc&0xFFFFFFFF,amc>>32; t.app_len=len(blob)
    t.cmd_buf_phy_addr_lo,t.cmd_buf_phy_addr_hi=cmd_mc&0xFFFFFFFF,cmd_mc>>32
    t.cmd_buf_len=cmd_len
    t0=time.time()
    try:
        r=submit(c); st=r.resp.status&0xFFFFFFFF; sid=r.resp.session_id
    except Exception as e:
        try: st=int(str(e).strip().split()[-1])&0xFFFFFFFF
        except Exception: st=-1
        sid=None
    print('  %-34s status %#-12x %.1fs sid=%s'%(tag,st,time.time()-t0,sid), flush=True)
    return st,sid
cp,cmc=alloc(0x8000)
try_load('cmd_buf_len = 0', cmc, 0)
try_load('cmd_buf_len = 0x100000', cmc, 0x100000)
tmr_mc = adev.paddr2mc(psp.tmr_paddr) if hasattr(adev,'paddr2mc') else psp.tmr_paddr
try_load('cmd_buf INSIDE the TMR', tmr_mc + 0x1000, 0x1000)