1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
|
"""Find the exact acceptance boundary for the undocumented commands 0x0c / 0x0d.
0x0c word0, 0x0c word1, 0x0d word0 all accept 1,2 but reject 0x10+.
The exact cutoff is a bounds constant we can grep for in SYS_DRV.
"""
import ctypes
from tinygrad import Device
from tinygrad.runtime.autogen.am import am
d = Device["AMD"]; adev = d.iface.dev_impl; psp = adev.psp
SZ = ctypes.sizeof(am.struct_psp_gfx_cmd_resp)
def submit(cmd_id, words):
adev.vram.view(psp.cmd_paddr, SZ)[:] = b"\x00" * SZ
c = am.struct_psp_gfx_cmd_resp(cmd_id=cmd_id)
buf = bytearray(memoryview(c).cast('B'))
for i, v in words.items():
buf[28+i*4:32+i*4] = int(v & 0xFFFFFFFF).to_bytes(4, 'little')
try:
psp._ring_submit(am.struct_psp_gfx_cmd_resp.from_buffer_copy(bytes(buf)))
return 0
except RuntimeError:
r = bytes(adev.vram.view(psp.cmd_paddr, SZ)[:])
return int.from_bytes(r[864:868], "little")
except TimeoutError:
return -1
for cid, wi in ((0x0c, 0), (0x0c, 1), (0x0d, 0)):
print(f"\n=== cmd {cid:#04x}, word {wi}: scanning 0..0x20 ===")
row = []
for v in range(0, 0x21):
s = submit(cid, {wi: v})
row.append((v, s))
mark = "ok " if s == 0 else ("ERR" if s > 0 else "TMO")
print(f" {v:#04x} -> {('TIMEOUT' if s<0 else hex(s)):>12s} {mark}")
ok = [v for v, s in row if s == 0]
bad = [v for v, s in row if s != 0]
print(f" ACCEPTED: {[hex(v) for v in ok]}")
if ok and bad:
print(f" => boundary: accepts < {min(bad):#x} (highest accepted {max(ok):#x}, count={len(ok)})")
print("\nsOS alive:", psp.is_sos_alive())
|
