1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
|
#!/usr/bin/env python3
"""Look for the VCN DPG LMA port over host SMN, now that VCN0 is powered.
NV22 map: UVD_DPG_LMA_CTL/_DATA/_MASK at SMN 0x1F844/48/4C (inst0) and
0x48044/48/4C (inst1). If those decode, we have an index/data port into VCN's
shadow register file -- the readback channel the write finding lacks.
READ ONLY here. Small targeted batch with the mirror test and a known control.
"""
import struct, time
from tinygrad import Device
adev = Device["AMD"].iface.dev_impl
idx = adev.reg("regBIF_BX0_PCIE_INDEX2")
dat = adev.reg("regBIF_BX0_PCIE_DATA2")
hb = adev.reg("regMP0_SMN_C2PMSG_81")
def alive():
a = hb.read(); time.sleep(0.25); return hb.read() != a
def bswap(x):
return struct.unpack("<I", struct.pack(">I", x & 0xFFFFFFFF))[0]
def rd(a):
idx.write(a & 0xFFFFFFFF)
return dat.read()
def cls(a):
v = rd(a)
return v, ("MIRROR" if v == bswap(a) else "all-ones" if v == 0xFFFFFFFF else "DECODED")
print("control C2PMSG_58 = %#x (expect 0x310036)" % rd(0x581E8))
print("smu alive %s / psp alive %s" % (adev.smu.is_smu_alive(), alive()))
T = [
(0x1F844, "UVD_DPG_LMA_CTL inst0"),
(0x1F848, "UVD_DPG_LMA_DATA inst0"),
(0x1F84C, "UVD_DPG_LMA_MASK inst0"),
(0x48044, "UVD_DPG_LMA_CTL inst1"),
(0x48048, "UVD_DPG_LMA_DATA inst1"),
(0x1FD58, "UVD_VCPU_CNTL"),
(0x1FD00, "UVD_VCPU_CACHE_OFFSET0"),
(0x20AA0, "UVD_LMI_CTRL"),
(0x21B04, "UVD_AVM_GP_SCRATCH0"),
]
print("\n%-28s %-10s %s" % ("register", "value", "verdict"))
dec = 0
for a, nm in T:
v, k = cls(a)
dec += (k == "DECODED")
print(" %-26s %#010x %s" % (nm, v, k))
print("\ndecoded %d/%d" % (dec, len(T)))
print("alive after: %s" % alive())
|
