#!/usr/bin/env python3 """Distinguish a real SMN read from an address echo. The first pass looked like it read 28 PSP registers. It did not: every "value" was the byte-reversed address (0x03710008 -> 0x08007103). A distinctness check passed and meant nothing, because echoes of distinct addresses are distinct. The right invariant is: value != byteswap(address). READ ONLY. """ import struct from tinygrad import Device adev = Device["AMD"].iface.dev_impl def smn_read(addr): adev.reg("regBIF_BX0_PCIE_INDEX2").write(addr & 0xFFFFFFFF) hi = (addr >> 32) & 0xFF if hi: adev.reg("regBIF_BX0_PCIE_INDEX2_HI").write(hi) v = adev.reg("regBIF_BX0_PCIE_DATA2").read() if hi: adev.reg("regBIF_BX0_PCIE_INDEX2_HI").write(0) return v def bswap(x): return struct.unpack("I", x & 0xFFFFFFFF))[0] def classify(addr): v = smn_read(addr) if v == bswap(addr): return v, "ECHO (not decoded)" if v == 0xFFFFFFFF: return v, "all-ones (no responder)" return v, "DECODED" print("%-40s %-12s %s" % ("register", "value", "verdict")) REGS = [ ("CONTROL MP0_SMN_C2PMSG_58", 0x581E8), ("CONTROL MP0_SMN_C2PMSG_81", 0x58224), ("MP0_MMU_SRAM_UNSECURE_BAR", 0x03710018), ("MP0_MMU_SRAM_ACC_VIOLATION_LOG_ADDR", 0x03710008), ("MP0_AEB_JTAG_DBG_CTRL", 0x037001D4), ("MP0_AEB_JTAG_DBG_CTRL_LOCK", 0x037001D8), ("MP0_NS_PROT_FAULT_STATUS_0", 0x037000C8), ("MP0_BOOTROM_REVID", 0x03700048), ("MP0_COLD_BOOT_EVENTS", 0x03700054), ("MP_ROM_MISC_CNTL", 0x03760008), ("SMNIF_ACC_VIOLATION_LOG_ADDR", 0x037200D4), ("DMAC_ACC_VIOLATION_LOG_ADDR", 0x03A71000), ("MP1_MMU_SRAM_UNSECURE_BAR", 0x03A10060), ("MP0_FW_DEBUG_CNT0", 0x03810008), ] dec = 0 for name, addr in REGS: v, verd = classify(addr) dec += verd == "DECODED" print(" %-38s %#010x %s" % (name, v, verd)) print("\n decoded: %d of %d" % (dec, len(REGS))) print("\nSweep: which SMN regions decode at all? (16 addresses per region)") for base, label in ((0x00058000, "MP0 C2PMSG window (known good)"), (0x03700000, "MP_MP0CRU"), (0x03710000, "MP_MP0MMU"), (0x03720000, "MP_MPSMNIF"), (0x03760000, "MP_MPROM"), (0x03810000, "MP0 FW debug"), (0x03A00000, "MP_MP1CRU"), (0x03A71000, "MP_MPDMAC")): n = 0 for i in range(16): a = base + i * 4 v = smn_read(a) if v != bswap(a) and v != 0xFFFFFFFF: n += 1 print(" %-34s %2d/16 decoded" % (label, n))