1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
|
#!/usr/bin/env python3
"""Index is not the discriminator -- every index gave 0xffff0006. Vary SIZE and
TABLE STRUCTURE instead.
Hypotheses:
a) vf_table_lookup wants a particular length (it walks len>>3 entries, and the
fixup list matches 4*index in {768,772,776,780,1552,1556,1724,1728}, i.e.
indices 192-195, 388-389, 431-432 -- maybe some must be present);
b) there is a minimum/exact size;
c) 0xffff0006 comes from somewhere before the loop entirely.
Progress to /tmp/vcnsz.txt.
"""
import struct, time
from tinygrad import Device
import tinygrad.runtime.autogen.am.am as am
OUT = "/tmp/vcnsz.txt"
def say(s):
with open(OUT, "a") as f:
f.write(s + "\n")
print(s, flush=True)
adev = Device["AMD"].iface.dev_impl
psp = adev.psp
hb = adev.reg("regMP0_SMN_C2PMSG_81")
def alive():
a = hb.read(); time.sleep(0.25); return hb.read() != a
def submit(fw_type, payload):
psp._prep_msg1(memoryview(bytes(payload)))
cmd = am.struct_psp_gfx_cmd_resp(cmd_id=am.GFX_CMD_ID_LOAD_IP_FW)
cmd.cmd.cmd_load_ip_fw.fw_phy_addr_lo = psp.msg1_addr & 0xFFFFFFFF
cmd.cmd.cmd_load_ip_fw.fw_phy_addr_hi = psp.msg1_addr >> 32
cmd.cmd.cmd_load_ip_fw.fw_size = len(payload)
cmd.cmd.cmd_load_ip_fw.fw_type = fw_type
try:
return psp._ring_submit(cmd).resp.status & 0xFFFFFFFF
except RuntimeError as e:
return int(str(e).rsplit(" ", 1)[-1]) & 0xFFFFFFFF
def ent(i, v):
return struct.pack("<II", i, v)
say("\n######## size / structure probe ########")
say("gate check type49 oversize = %#010x (0xffff300f = open)" % submit(49, b"\x00" * 0x208))
say("\nA) size sweep, zero-filled:")
for n in (8, 16, 32, 64, 128, 192, 256, 320, 384, 448, 504, 512):
st = submit(49, b"\x00" * n)
say(" size %-4d -> %#010x %s" % (n, st, "<== ACCEPTED" if st == 0 else ""))
if not alive():
say(" !! heartbeat stopped at size %d" % n); break
say("\nB) full 0x200 table of real entries:")
tbl = b"".join(ent(i, 0xA5A50000 | i) for i in range(64))
say(" 64 real entries -> %#010x" % submit(49, tbl))
say("\nC) table containing the fixup indices (192-195, 388-389, 431-432):")
fix = [192, 193, 194, 195, 388, 389, 431, 432]
tbl = b"".join(ent(i, 0) for i in fix)
say(" 8 fixup entries (size %d) -> %#010x" % (len(tbl), submit(49, tbl)))
tbl2 = b"".join(ent(i, 0) for i in fix) + b"".join(ent(0x10 + i, 0xA5A5A5A5) for i in range(56))
say(" fixups + 56 others (size %d) -> %#010x" % (len(tbl2), submit(49, tbl2)))
say("\nD) same sizes against type 85 (ungated reference):")
for n in (8, 512):
say(" type85 size %-4d -> %#010x" % (n, submit(85, b"\x00" * n)))
say("\npsp alive %s / smu alive %s" % (alive(), adev.smu.is_smu_alive()))
|
