f_ changed the topic of ##raspberrypi-internals to: The inner workings of the Raspberry Pi (Low level VPU/HW) -- for general queries please visit #raspberrypi -- open firmware: https://librerpi.github.io/ -- VC4 VPU Programmers Manual: https://github.com/hermanhermitage/videocoreiv/wiki -- chat logs: https://libera.irclog.whitequark.org/~h~raspberrypi-internals -- bridged to matrix and discord
<dolphinana> not the whole thing...
<dolphinana> sorry for taking so long, I'm quite excited because I've wanted to do this for so long and now I'm getting closer ^^
<clever> [ 0.000000] INITRD: 0x03100000+0x00f49000 is not a memory region - disabling initrd
<clever> dolphinana: anything after this one?
<dolphinana> clever: no...
<dolphinana> and sadly, I really should be going to sleep at this point...
<clever> oh, remove quiet from the cmdline
<clever> that makes it ... quiet!
<dolphinana> hmm...
<dolphinana> maybe just one more testing...
<dolphinana> I'll remove quiet...
<dolphinana> I could've done that sooner, but somehow my mind managed to ignore that...
<dolphinana> I guess I got really distracted...
<dolphinana> ooooh, now I can see the further boot process!
<clever> pastebin once more!
<dolphinana> YES!
<clever> looks like 64mb in the first memory range
<dolphinana> I really have to sleep now
<clever> and 400mb in the 2nd range
<dolphinana> good night clever ^^
<dolphinana> see you tomorrow
<clever> dolphinana: ah, your initrd is too big, it doesnt fit within the pre-allocated area
<clever> its too big by ~300kb, lol
dolphinana has quit [Quit: Leaving]
inara has quit [Quit: Leaving]
inara has joined ##raspberrypi-internals
jcea has quit [Ping timeout: 260 seconds]
jcea has joined ##raspberrypi-internals
jcea has quit [Ping timeout: 268 seconds]
Bitweasil has quit [Quit: ZNC 1.8.2+deb2build5 - https://znc.in]
Bitweasil has joined ##raspberrypi-internals
wael has quit [Ping timeout: 268 seconds]
wael has joined ##raspberrypi-internals
<f_ridge> <s​ystem/D> x2x6_ joins
bonda_000 has joined ##raspberrypi-internals
f_ has joined ##raspberrypi-internals
jcea has joined ##raspberrypi-internals
Stromeko has quit [Ping timeout: 245 seconds]
Stromeko has joined ##raspberrypi-internals
f_ has quit [Quit: To contact me, send a memo using MemoServ, PM f_[xmpp], or send an email. See https://vitali64.duckdns.org/.]
<bonda_000> clever: hello
<bonda_000> do you know what frequency is the core at if you boot with usb/ethernet option?
jcea has quit [Ping timeout: 268 seconds]
bonda_000 has quit [Read error: Connection reset by peer]
bonda_000 has joined ##raspberrypi-internals
<clever> bonda_000: if you boot from sd, the rom leaves things at the default, clocked directly by the crystal
<clever> bonda_000: but if you boot from usb/network, the rom increases the vpu clock
<clever> this is another reason to just forget that the mini-uart even exists
<clever> lines 44-46 will set gpio14 to pl011 mode
<clever> 46-58 sets the PL011 reference clock to the crystal, so it doesnt matter how it booted
<clever> and the #if changes the divisor, so both pi3 and pi4 get the same clock
<clever> 59-77 then configures the PL011 for 115200 baud tx only, and prints a single character
bonda_000 has quit [Ping timeout: 240 seconds]
bonda_000 has joined ##raspberrypi-internals
f_ has joined ##raspberrypi-internals
<bonda_000> do we have a supervisor call instruction or we just bitset sr,29?
<bonda_000> i see there's a "user" instruction but no "supervisor" one that I was able to find
<clever> bonda_000: no supervisor functions available in LK
<clever> ah, that
<bonda_000> I mean, in assembly
<clever> i think the only way to switch from user mode to supervisor mode, is with an exception
<clever> > If the least significant bit of the table entry is set, then the supervisor bit (bit 29) or sr is set when the handler is executed
<bonda_000> yeah that's what I'm doing right now, context switch. kernel needs to know whether we were interrupted in user mode or supervisor mode
<clever> all opcodes must be 16bit aligned, so any valid address for code must have bit0 set to a 0
<clever> the exception table cheats a bit, if bit0 must be a 0, just assume its always a 0
<clever> and then reuse the actual bit0, as a flag
<bonda_000> that's what I dont want to happen I think, that bit enabled
<clever> and then you have slots 32-63, the swi handlers
<clever> so you can rig up for `swi 0` to run the 32nd slot in that table
<clever> and then it handles that, it switches to supervisor mode
<bonda_000> so, basically
<bonda_000> supervisor mode = we are in kernel
<bonda_000> user mode = we are elsewhere
<clever> yep
<bonda_000> so upon interrupt entry we need to know do we need a context switch
<clever> you can also find this in the decompile, one min
<bonda_000> if we are in supervisor, we got interrupted while we were doing something in kernel
<bonda_000> so if we enable that bit on the irq table we won't be able to know
<bonda_000> where we came from
<clever> i believe it pushes the old sr to the stack before switching things
<clever> so the `rti` opcode can restore sr to its previous state
<bonda_000> oh
<clever> there it is, in the unstripped binary, rtos_secure_function_call
<bonda_000> rts is pop {lr} right?
<clever> there is no rts opcode in vpu
<clever> rtos_secure_function_call will disable interrupts, and issue an swi 0, then restore interrupt state
<clever> rtos_secure_function_register, will take a function pointer, and call secure function 0, to get the index of that secure function in a list of approved functions
<clever> in the .secfns section, is the whitelist of approved functions
<clever> everything there can be called via `swi 0` when on the official firmware
<clever> and rtos_init_security is also a fun one
<clever> it looks to be configuring the dram controller, for secure access
<bonda_000> its all over the place
<clever> not familiar with that exact function
<bonda_000> rti less often but I was wondering what's the difference between the two
<bonda_000> rts seems to be just mov pc, lr
<clever> rti is for interrupts/exceptions only
<clever> i forgot about rts, will need to dig into that on
<clever> e
<clever> oh, right
<clever> yeah, rts is exactly what you said, and i'm using it in my uart init i linked earlier, lol
<bonda_000> I think r29 is like fp register of ARM
<bonda_000> pointer to a structure describing current thread for a given core
<clever> in your decompile, skip over to _tx_vectors, and change the type to `void*[128]`
<clever> and it will be more clear what it is
<bonda_000> which section is it
<clever> and now rtos_init_security, is just setting bit0 to 1
<clever> its in .isr_vectors
<clever> and rtos_common_leave_secure_mode, just pushes lr and 0x0 to the stack, then does rti
<clever> so it winds up "restoring" lr into pc, and 0 into sr
<bonda_000> nothing changed
<bonda_000> they were uint32_t *
<clever> ah, on mine it was a byte array
<bonda_000> its 32 of _tx_exception_unknown, then all the swi's are zeroed out, the majority of peripheral irqs are going to the _tx_interrupt_shell
<bonda_000> _tx_timer_interrupt and two _tx_smp_interrupt are exception for the lack of better word
<clever> but 64 (INTERRUPT_TIMER0) and 78/79 (INTERRUPT_MULTICORESYNC2) are going somewhere special
<clever> yeah
<clever> 124/INTERRUPT_CPG is also referenced
<bonda_000> SMP interrupt is the thread controller I guess?
<clever> inter-core messaging
<clever> so when core0 wants core1 to do something, it uses the multicore sync block to fire an irq on the neighbor
<bonda_000> that's probably not very important in a kernel
<clever> it is when you have an SMP kernel
<bonda_000> since both cores just talk to their boss "kernel"
<clever> but how does the kernel talk to itself?
<clever> the 2 cores need some channel between them
<bonda_000> core is just running a thread
<bonda_000> what does it have to do with what program the other core is running
<bonda_000> it can send an ipc call through the kernel
<clever> what if core1 is in the idle loop, and core0 schedules more when for core1?
<clever> how will core1 learn that an ipc call is pending?
<bonda_000> core0 isnt scheduling anything kernel does all the scheduling
<bonda_000> cores are just workers on whatever tasks kernel gives them
<clever> and how does the kernel on core0 talk to the kernel on core1?
<bonda_000> there is one kernel
<bonda_000> for both cores
<clever> yeah, but the kernel on core1 needs an inter-core interrupt, to learn abotu changes occuring on core0
<clever> thats what the smp irq is
<bonda_000> yeah you are right
<bonda_000> there is one main but each core sits at its own place in it
<bonda_000> oh you mean that
<bonda_000> for example
<bonda_000> we don't want to wait for core1 to use all of its' time slice
<bonda_000> and want it to stop executing that program immediately
<bonda_000> that could be the inter-core interrupt
<bonda_000> but then
<bonda_000> that would be a kill()
<clever> that too, if you want to halt something running on the other core
<bonda_000> that will talk not the other core, but to kernel, to remove that other program from the list of active programs
<bonda_000> so it goes
<bonda_000> kernel
<bonda_000> / \
<bonda_000> core0 core1
<bonda_000> but you say its
<bonda_000> kernel
<bonda_000> / \
<bonda_000> core0 ------ core 1
<bonda_000> kernel is a software construct and cores are hardware concepts
<bonda_000> there shouldn't be any thread-bound or core-bound programs unless you implement affinity
<clever> for the official firmware, threads are assigned to a core on creation and will never migrate
<bonda_000> I may probably stumble upon the use case for that as I dig deeper into it
<bonda_000> I think ideally one core shouldn't be aware that there are other cores
<bonda_000> that's the spirit of UNIX like operating systems from my understanding
<bonda_000> all the resources it asks the kernel for
<bonda_000> possible, from it's copy or slot in the kernel but even that it doesn't know the internal organization of the kernel
<bonda_000> so is lea the PC relative load like in ARM we would do ldr r0,=LABEL?
<clever> yeah
<clever> but arm cheats, when you do that, it will insert a 32bit addr nearby
<clever> and then do a pc-relative load of the 32bit value
<clever> vpu doesnt cheat, and just does a direct pc-relative `r0 = pc + offset`
<bonda_000> yeah ARM can't reach very far with that code
<bonda_000> they do say its a pseudo-instruction
<bonda_000> be back soon
<clever> same
bonda_000 has quit [Ping timeout: 260 seconds]
dolphinana has joined ##raspberrypi-internals
bonda_000 has joined ##raspberrypi-internals
<dolphinana> hi! o/
<clever> dolphinana: afternoon!
<dolphinana> hi clever! ^^
<clever> dolphinana: i noticed 2 things with your last pastebin
<clever> first, your initrd is ~300kb too big, and its going over a limit in the bootloader
<clever> second, linux switches from earlycon to normal console, and logging stops, not sure why it isnt on the uart
<clever> do you have a tv hooked up to the ntsc output?
<dolphinana> clever, I'll be right back, just wait...
<dolphinana> (I'm doing something else right now.)
<bonda_000> Any idea what is tectrl.h?
<bonda_000> at address 0x7e20e000
<bonda_000> looking for A2W, APHY,DPHY in the brcm header folder
<bonda_000> looks like some timer
<bonda_000> also this stuff from VideoCore programming manual would be very cool to know how to use:
<bonda_000> p11 [B0] is PRTIMCTL for Closely Coupled Timer Control (core and sleep timers).
<bonda_000> p12 [B0] is PRCORTIM for Core Timer Result.
<bonda_000> p13 is PRSLPTIM for Sleep Timer Result.
<bonda_000> nwm I got A2W, APHY_CSR_BASE, DPHY_CSR_BASE
<bonda_000> is that USB stuff?
<clever> bonda_000: dont think any of that has to do with usb
<clever> usb is fairly self-contained in the dwc2 area
<bonda_000> CD_BASE at 0x1820b000 which is kind of weird for a peripheral
<bonda_000> and Thread controller at 18e00000 if I understand correctly
f_ has quit [Ping timeout: 260 seconds]
<bonda_000> oh found it
<bonda_000> its the other two sd_ files
<bonda_000> what does it mean in human language?
<bonda_000> "sd addr front" and "sd dq front"
<bonda_000> sdc*
<clever> that sounds like the dram controller
<clever> ive not made sense of it much either
<dolphinana> hey clever, is ARM really the second-class citizen on Raspberry Pi and that the VC4 VPU is the one that has direct hardware control?
<clever> dolphinana: pretty much, the VPU is just giving the arm permission to access some hw blocks
<clever> and ive not found all of the enable flags, so the arm cant do basic things like 2d accel
<dolphinana> mhm... exactly what I was thinking
<clever> dolphinana: related, there is an entire undocumented MMU...
<clever> dolphinana: this MMU can map ~16mb chunks of the arm's address space, into the VPU's address space
<clever> so its basically giving the arm permission to access a 16mb chunk of ram
<clever> so i could just limit the arm core to 64mb of ram, and it will just never be able to access anything more
<clever> this is also what gives the ARM permision to use MMIO
<dolphinana> I see
<clever> dolphinana: do you know about how MMIO is at 0x2000_0000 on a pi1, and 0x3f00_0000 on a pi2?
<clever> lines 373/374 of arm.c set it up, so its at both addresses, on the entire pi0-pi3 family!, because why not? :D
<dolphinana> o.o
<clever> this allows me to boot a pi1 with the mmio at 3f
<clever> and a pi2 with the mmio at 20
<dolphinana> mhm...
<dolphinana> I have a little trouble understanding this and I'm too sleepy now... I think I'll take a nap.
bonda_000 has quit [Ping timeout: 268 seconds]
bonda_000 has joined ##raspberrypi-internals
<bonda_000> vpu has an undocumented mmu?
<bonda_000> arm mmu is very well documented
<clever> bonda_000: this is an extra mmu, between the arm mmu and ram
<clever> so what the arm thinks is physical, isnt
<bonda_000> what they are hiding is the multimedia block
<bonda_000> :dolphinana
<bonda_000> try to look up the h264 video encoding, say you wanted to make a cartoon in Paint and stick 24 frames into 1s of video
<bonda_000> you won't find any, proprietary standard
<bonda_000> at least for free
<dolphinana> I'll be taking a nap now...
<clever> kk
<dolphinana> see y'all ^^
waveform has quit [Quit: Leaving]
waveform has joined ##raspberrypi-internals
Bitweasil- has joined ##raspberrypi-internals
robink_ has joined ##raspberrypi-internals
Bitweasil has quit [Quit: ZNC 1.8.2+deb2build5 - https://znc.in]
robink has quit [Quit: No Ping reply in 180 seconds.]