#!/usr/bin/env python3
"""SYS_DRV .54 0x1059: synthetic descriptor-bit mutation before error return.

Signed dispatcher and leaf execute; SVC 0x8B returns modeled failure. This
never maps a hardware region or establishes live ownership/restoration.
"""
from __future__ import annotations

import sys
from pathlib import Path

sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
from pspemu import sysdrv_env  # noqa: E402

SIGNED = Path(__file__).resolve().parents[2] / 'psp_out/elf/sys_drv_0.49.0.54_18bd9d26.elf'
ENTRY, TABLE = 0xE087E4, 0xE45A20


def main() -> None:
    sd = sysdrv_env.make()
    assert Path(sd.image_path).read_bytes() == SIGNED.read_bytes()
    ret, fault, _ = sysdrv_env.run_init(sd)
    assert ret == 0 and fault is None and sysdrv_env.init_flag(sd) == 1
    req, cfg = sd.alloc(0x100), sd.alloc(0x400)
    sd.write(cfg, bytes(0x400))
    calls: list[int] = []
    def deny_region(comp, number):
        calls.append(number)
        return 9
    sd.svc.register(0x8B, deny_region)
    slot, neighbor, last = TABLE + 8*3, TABLE+8*4, TABLE+8*15
    old0, old1, old15 = sd.rd32(slot), sd.rd32(neighbor), sd.rd32(last)
    sd.wr32(slot, 0)
    sd.wr32(neighbor, 0x11223344)
    sd.wr32(last, 0)

    def request(index: int, flag: int) -> int:
        sd.write(req, bytes(0x100))
        for i,word in ((0,0x1059),(14,0x1234),(15,index),(16,flag),
                       (sysdrv_env.REQ_CONFIG_DWORD,cfg)):
            sd.wr32(req + 4*i, word)
        rv = sd.run_function(ENTRY,(req,2,0,0),count=3_000_000,
                             timeout=4_000_000)
        assert not sd.faults, (hex(rv),sd.faults)
        return rv & 0xffffffff

    try:
        rv=request(3,1)
        assert rv == 0xffff000a and sd.rd32(slot)==0 and not calls, (hex(rv),calls)
        rv=request(16,0)
        assert rv == 0xffff000a and sd.rd32(slot)==0 and not calls, (hex(rv),calls)
        rv=request(3,0)
        print('status',hex(rv),'selected',hex(sd.rd32(slot)),
              'neighbor',hex(sd.rd32(neighbor)),'SVC 0x8B calls',len(calls))
        assert rv==0xffff000a and sd.rd32(slot)==5
        assert sd.rd32(neighbor)==0x11223344 and calls==[0x8b], calls
        rv=request(15,0)
        assert rv==0xffff000a and sd.rd32(last)==5 and len(calls)==2
        # Only exercise the signed 0x311A leaf's early invalid-index branch;
        # never invoke the stateful clear/unmap path for an accepted selector.
        denied=sd.run_function(0xE1B48C,(15,),count=10_000,timeout=1_000_000)
        assert not sd.faults and denied != 0 and sd.rd32(last)==5
        assert len(calls)==2, calls
        print('slot 15 set to',hex(sd.rd32(last)),
              'signed 0x311A early guard returns',hex(denied & 0xffffffff))
    finally:
        sd.wr32(slot,old0)
        sd.wr32(neighbor,old1)
        sd.wr32(last,old15)
        assert sd.rd32(slot)==old0 and sd.rd32(neighbor)==old1 and sd.rd32(last)==old15
    print('synthetic descriptor snapshot restored; no card request')


if __name__ == '__main__':
    main()