#!/bin/bash
# SERIALIZED. 8-byte stride -> fine coverage of [0x41bf90,0x41bfd8).
# PC_VAL in .bss: readable if dereferenced as a pointer, XN if branched to
# (branch -> prefetch abort with fault PC == PC_VAL, the hijack report's XN signature).
export PC_VAL=0x00416e60
echo "START $(date +%T)"
for SP in 0x41bfd8 0x41bfd0 0x41bfc8 0x41bfc0 0x41bfb8 0x41bfb0 0x41bfa8 0x41bfa0; do
  cd /root/psp && source ./env.sh >/dev/null 2>&1
  rm -f /tmp/am_usb*.lock
  $PSP_PY work/atx_power.py cycle 18 >/dev/null 2>&1
  cd /root/psp/hw
  SP_E=$SP PC_VAL=$PC_VAL timeout 150 $PSP_PY /root/psp/hw/gcp_lr_sweep.py 2>&1 | grep -E "^RESULT|Traceback" | head -2
done
echo SWEEP4-DONE