"""Diff LIVE flash (via the DF aperture) against our archived image.

Any region that differs is runtime-mutable state -- anti-rollback counters,
secure NVRAM, RAS EEPROM records, event logs. Those are regions the PSP writes
and trusts, which makes them interesting targets.

READ-ONLY. No SPI commands. SMN reads are slow over USB (~3 transactions per
dword), so this samples rather than dumping 1 MB.
"""
import sys, struct, time
sys.path.insert(0,"/Users/user/src/tinygrad")
from tinygrad import Device
d=Device["AMD"]; adev=d.iface.dev_impl
def rd(a):
    adev.wreg(14,a&0xffffffff); return adev.rreg(15)
BASE=0xd800000; FOFF=0x20000; SPAN=0xe0000     # verified linear region
fl=open('flash_BIOS2_KNOWNGOOD_20260917.bin','rb').read()
def chunk(delta, n=8):
    return b"".join(struct.pack('<I',rd(BASE+delta+4*i)) for i in range(n))
print("live-flash aperture: DF %#x .. +%#x  == flash[%#x .. %#x]"%(BASE,SPAN,FOFF,FOFF+SPAN))
print("sampling every 0x1000 (32 bytes per sample)...")
t0=time.time(); diffs=[]; n=0
for delta in range(0, SPAN, 0x1000):
    live=chunk(delta); disk=fl[FOFF+delta:FOFF+delta+32]; n+=1
    if live!=disk:
        diffs.append((delta, FOFF+delta, live, disk))
        print("  DIFF flash %#08x  live=%s"%(FOFF+delta, live[:16].hex()))
        print("                     disk=%s"%disk[:16].hex())
print("\nsampled %d points in %.0fs ; %d differ"%(n, time.time()-t0, len(diffs)))
if not diffs:
    print("  live flash matches the archive at every sampled point ->")
    print("  no runtime-mutable region detected in [%#x,%#x)"%(FOFF,FOFF+SPAN))
print("\n=== also probe the region BELOW the aperture start (flash 0..0x20000) ===")
B2=0xd300000    # maps flash 0x0
for delta in range(0, 0x20000, 0x2000):
    live=b"".join(struct.pack('<I',rd(B2+delta+4*i)) for i in range(8))
    disk=fl[delta:delta+32]
    if live!=disk:
        print("  DIFF flash %#08x  live=%s  disk=%s"%(delta,live[:16].hex(),disk[:16].hex()))
print("  (done)")
print("\nMEMSIZE=%s sos_alive=%s"%(hex(adev.rreg(0xde3)),adev.psp.is_sos_alive()))