1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
|
#!/usr/bin/env python3
"""One-shot host-SMN PMI3 event-equivalence control, volatile only.
Test whether privileged *host* PCIE_INDEX2/DATA2 can send the same naturally
emitted diagnostic word that ASD 0x403 successfully enqueued on PSP fabric.
This is a bounded write to numeric 0x03B30600, NOT flash/fuse/security bar.
Queue pointer/status readbacks and bogus/MP0 controls distinguish mirrors;
it does NOT prove the event consumer or any PSP-only security advantage.
"""
import os
from tinygrad import Device
fd=os.open('/root/psp/hw/.mp1_pmi3_host_event_control.attempted',
os.O_WRONLY|os.O_CREAT|os.O_EXCL,0o600)
os.close(fd)
adev=Device['AMD'].iface.dev_impl
def read(a):
adev.wreg(14,a) # host PCIE_INDEX2 address selection
return adev.rreg(15)&0xffffffff
def snap(tag):
t=tuple(read(a) for a in (0x03B30604,0x03B30608,0x03B3060C))
print(tag,'candidate status/rptr/wptr',tuple(hex(x) for x in t),
'MP0',hex(read(0x03810ACC)),'bogus',hex(read(0x0FEEDC00)),flush=True)
return t
before=snap('BEFORE A')
again=snap('BEFORE B (no data write)')
assert before==again, 'unstable pointer, no host write'
assert before[0]==0 and before[1]==0x40000 and 0x40000<=before[2]<=0x403f0
assert read(0x03810ACC)==0x80000000 and read(0x0FEEDC00)==0x00DCEE0F
adev.wreg(14,0x03B30600)
adev.wreg(15,0xE3030100) # naturally emitted, bounded volatile event
print('ONE host-SMN write: address 0x03B30600 word 0xE3030100',flush=True)
after=snap('AFTER')
print('host wptr delta',hex((after[2]-before[2])&0xffffffff),flush=True)
|
