blob: 0c5fd223a8eb2250b1dedf0b2a85bd60870fe4d3 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
|
# Working notes
## Hardware safety
* The card is a 7900 XTX reached over USB4 (ASM2464PD). **Do not leave hardware
wedged.** A link reset (`psp_out/psp_recover.py`) does *not* restore HDCP
display-core state; that needs a cold ATX cycle.
* **Do not blind-sweep SMN.**
* No SPI flash writes, no TSU work. See `psp_out/CONSTRAINTS.md`.
## Emulator gotchas that cost real time
* Unicorn only calls `UC_HOOK_CODE` for blocks translated *after* the hook is
added; already-executed code is cached. Call `uc.ctl_flush_tb()`.
* Hooks fire *before* the instruction executes, so a register read at a hook
address gives the pre-instruction value.
* `uc.mem_read`/`mem_write` are **physical** and bypass the MMU. Translate first
when touching guest globals.
* Once the MMU is on, `count=` does not bound `emu_start`: a faulting access
retires zero instructions. Use `timeout=` / `require_mapped()`.
* Every TA runs at VA 0x400000 in its *own* address space. VA alone does not
identify a TA -- instrument with `(VA, live PA)` via `armmmu.translate_live()`.
* Unicorn reports an undefined instruction as `UC_ERR_INSN_INVALID` and stops,
rather than delivering an exception to the guest. A crash oracle must watch
that channel too.
* A known-bad probe must run **last**; `cmd 7` wedges the mailbox loop and has
silently invalidated downstream results twice.
|
