1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
|
import sys; sys.path.insert(0,"/Users/user/src/tinygrad")
from tinygrad import Device
from tinygrad.runtime.autogen.am import am
d=Device["AMD"]; adev=d.iface.dev_impl; pci=d.iface.pci_dev
NAME={k[:-5]:v for k,v in vars(am).items() if k.endswith('_HWIP') and isinstance(v,int)}
REV={v:k for k,v in NAME.items()}
STATUS={
'MP0':('PSP','AUDITED HARD - 6 modules reversed, ring+TA surface fuzzed'),
'MP1':('SMU','AUDITED - 79 msgs, 13 tables, I2C bound verified on HW'),
'GC':('Graphics/CP','MEC RV64 mapped; cannot reach MP0 (window tops 0x12BFF)'),
'SDMA0':('SDMA','firmware PLAINTEXT, F32 ISA - NOT reversed'),
'SDMA1':('SDMA','same'),
'DCE':('DISPLAY','*** NEVER TOUCHED - no driver, but regs are reachable ***'),
'JPEG':('JPEG/VCN','*** NEVER TOUCHED - VCN fw encrypted, regs reachable ***'),
'UMC':('Memory ctrl','*** NEVER TOUCHED - ECC/inject regs, RAS writes here ***'),
'DF':('Data Fabric','*** NEVER TOUCHED - routing/aperture control ***'),
'ATHUB':('Addr translation hub','*** NEVER TOUCHED ***'),
'MMHUB':('MM hub','*** NEVER TOUCHED ***'),
'HDP':('Host Data Path','lightly used (flush only)'),
'OSSSYS':('IH/OSS','used for interrupts'),
'LSDMA':('Light SDMA','*** NEVER TOUCHED ***'),
'SMUIO':('SMU IO','*** NEVER TOUCHED - GPIO/I2C pads ***'),
'THM':('Thermal','probed read-only (found 0x16600 live)'),
'CLK':('Clock','*** NEVER TOUCHED ***'),
'PWR':('Power','empty on this ASIC'),
'NBIF':('North Bridge IF','BAR5 host path lives here'),
'NBIO':('North Bridge IO','same block'),
'PCIE':('PCIe core','same block'),
}
W=118
def rule(c='='): print(c*W)
print(); rule()
print("HOST-ACCESSIBLE MEMORY / REGISTER MAP - Navi31 (7900XTX) over USB4/ASM2464PD")
rule()
print("\n-- PCI BARs (direct host windows) " + "-"*(W-34))
print(" %-5s %-16s %-14s %s"%("BAR","base","size","use"))
U={0:"VRAM aperture. NOTE: offsets past the real 24 GB raise a TLP error and WEDGE PCIe.",
2:"Doorbell aperture (ring doorbells).",
5:"MMIO register aperture - every IP register below is reached through here."}
for i in range(6):
try: info=pci.bar_info(i)
except Exception: continue
b,s=(info[0],info[1]) if isinstance(info,(tuple,list)) else (info,0)
if not b: continue
print(" %-5d %-16s %-14s %s"%(i,hex(b),hex(s),U.get(i,"")))
print(" %-5s %-16s %-14s %s"%("","","","vram_size = %#x (%d MB)"%(adev.vram_size,adev.vram_size>>20)))
print("\n-- Indirect windows reached THROUGH BAR5 " + "-"*(W-41))
print(" %-30s %-38s %s"%("window","index/data","reaches"))
for a,b,c in (("SMN","PCIE_INDEX2 / PCIE_DATA2 (dw 14/15)","full 32-bit SMN space - every base below"),
("RSMU","regBIF_BX_PF0_RSMU_INDEX/_DATA","byte-identical to SMN window (not a 2nd path)"),
("PCIe cfg","PCIE_INDEX / PCIE_DATA","PCIe core config"),
("GPUVM","MC_VM_* / VM_CONTEXT*","address translation, TMR fence")):
print(" %-30s %-38s %s"%(a,b,c))
print("\n-- IP blocks from the card's OWN discovery table " + "-"*(W-49))
print(" %-8s %-10s %-22s %-46s %s"%("IP","ver","bases (hex)","role","status"))
off=adev.regs_offset
for nm in sorted(off, key=lambda x: REV.get(x,str(x))):
label=REV.get(nm,str(nm))
inst=off[nm]
b0=inst.get(0,()) if isinstance(inst,dict) else inst
hexb=", ".join(hex(x) for x in (b0 if isinstance(b0,(tuple,list)) else [b0])[:4])
role,st=STATUS.get(label,('',''))
ninst=len(inst) if isinstance(inst,dict) else 1
print(" %-8s %-10s %-22s %-46s %s"%(label, str(adev.ip_ver.get(nm,'-')), hexb[:22], role+(" x%d"%ninst if ninst>1 else ""), st))
rule()
|
