"""Does the SMU clamp NumCmds to MAX_SW_I2C_COMMANDS (24)? port=1 demonstrably reaches the I2C engine (transaction time scales with work, vs port=0 which is rejected in ~0.3ms). If the firmware clamps NumCmds to 24, elapsed time flattens at n=24. If it walks all NumCmds entries, time keeps scaling past 24 -> the array walk is unbounded -> OOB read of SwI2cCmds[]. SAFETY: READ commands only (READWRITE bit clear) => nothing is written to any I2C device. NumCmds kept <= 56 so any over-walk stays inside the 116-byte table buffer that the SMU DMA'd from our own DRAM. """ import time, struct, statistics from tinygrad import Device import tinygrad.runtime.autogen.am.smu_13_0_0 as smu d=Device["AMD"]; adev=d.iface.dev_impl TP=adev.smu.driver_table_paddr; SIZE=116 MSG=adev.mmMP1_SMN_C2PMSG_66; ARG=adev.mmMP1_SMN_C2PMSG_82; RESP=adev.mmMP1_SMN_C2PMSG_90 N={0:'BUSY',1:'OK',0xFF:'FAILED',0xFE:'UNKNOWN',0xFD:'BAD_PREREQ',0xFC:'REJ_BUSY',0xFB:'REJ_PREREQ'} def send(msg,param=0,tmo=5.0): RESP.write(0); ARG.write(param&0xffffffff); MSG.write(msg) t0=time.monotonic() while time.monotonic()-t0 STOP|RESTART bits set return bytes(b) print("=== NumCmds vs elapsed time (port=1, READ cmds) ===") print(" n resp median_ms samples") res={} for n in (1,2,4,8,16,24,28,32,40,48,56): ts=[]; rr=None for _ in range(7): wr(build(n)) r,ms=send(smu.PPSMC_MSG_TransferTableDram2Smu,9) rr=r; ts.append(ms) res[n]=statistics.median(ts) print(" %-5d %-10s %8.2f %s"%(n,rr,res[n]," ".join("%.1f"%x for x in sorted(ts)))) print() base=res[24] print("median(n=24) = %.2f ms"%base) for n in (28,32,40,48,56): print(" n=%-3d %.2f ms ratio vs n=24: %.2fx"%(n,res[n],res[n]/base if base else 0)) print() print("MEMSIZE:",hex(adev.rreg(0xde3)))