1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
|
"""Map the DF flash aperture: which DF address corresponds to which flash offset,
and how big is the window? READ-ONLY. No flash commands are issued; this only
reads a memory-mapped view, which CONSTRAINTS.md permits."""
import sys, struct
sys.path.insert(0,"/Users/user/src/tinygrad"); sys.path.insert(0,"/Users/user/dev/amd-psp-re/psp_out")
from tinygrad import Device
d=Device["AMD"]; adev=d.iface.dev_impl
def rd(a):
adev.wreg(14,a&0xffffffff); return adev.rreg(15)
fl=open('flash_BIOS2_KNOWNGOOD_20260917.bin','rb').read()
def dfread(base,n):
return b"".join(struct.pack('<I',rd(base+4*i)) for i in range(n))
print("=== find the flash offset that DF base maps to, for each candidate base ===")
for base in (0xd800000,0xe000000,0xd821800,0xe021800,0xd822000,0xd300000,0xdb00000,0xcb00000):
blob=dfread(base,16) # 64 bytes
off=fl.find(blob)
n=fl.count(blob)
print(" DF %#011x -> flash offset %s (%d matches) %s"%(
base, hex(off) if off>=0 else "NO MATCH", n, blob[:16].hex()))
print("\n=== is it a linear window? check DF+delta vs flash+delta ===")
BASE=0xd800000; FOFF=0x20000
ok=0; bad=0
for delta in (0,0x40,0x100,0x400,0x1000,0x4000,0x10000,0x20000,0x40000):
blob=dfread(BASE+delta,8) # 32 bytes
exp=fl[FOFF+delta:FOFF+delta+32]
m=(blob==exp)
ok+=m; bad+= (not m)
print(" +%#08x DF=%s flash=%s %s"%(delta, blob[:12].hex(), exp[:12].hex(), "MATCH" if m else "differ"))
print(" linear so far: %d match / %d differ"%(ok,bad))
print("\n=== window extent: where does it stop matching? ===")
lo,hi=0,0x200000
d0=0
while d0 < 0x200000:
blob=dfread(BASE+d0,4)
exp=fl[FOFF+d0:FOFF+d0+16]
if blob!=exp:
print(" first mismatch at delta %#x (flash %#x)"%(d0,FOFF+d0)); break
d0 += 0x8000
else:
print(" matched every 0x8000 step up to %#x"%d0)
print("\nMEMSIZE=%s sos_alive=%s"%(hex(adev.rreg(0xde3)),adev.psp.is_sos_alive()))
|
