f_ changed the topic of ##raspberrypi-internals to: The inner workings of the Raspberry Pi (Low level VPU/HW) -- for general queries please visit #raspberrypi -- open firmware: https://librerpi.github.io/ -- VC4 VPU Programmers Manual: https://github.com/hermanhermitage/videocoreiv/wiki -- chat logs: https://libera.irclog.whitequark.org/~h~raspberrypi-internals -- bridged to matrix and discord
Guest32 has joined ##raspberrypi-internals
Guest32 has left ##raspberrypi-internals [##raspberrypi-internals]
fxsheep has joined ##raspberrypi-internals
fxsheep has quit [Client Quit]
fxsheep has joined ##raspberrypi-internals
<fxsheep> Hello everyone,
<fxsheep> I tried dumping rpi1 bootrom via lk-overlay (rpi3-bootcode), and there's a weird symptom
<fxsheep> Every even-numbered dword is overwritten with the one before it (odd numbered)
<clever> fxsheep: do ou have an example of the corruption? what command did you use?
<fxsheep> e.g. 0x60000004, 0x6000000C... reads the content of 0x60000000, 0x60000008 ...instead, while 0x60000000, 0x60000008 is fine
<fxsheep> bootram 0x60008000 isn't affected
<clever> and what command did you use?
<fxsheep> No matter what memory access I use, same (hexdump, dw db etc)
<clever> thats strange, i had no issues dumping the rom with LK
<clever> can you paste an example line?
<fxsheep> currently away from pi, I'll paste 3hrs later
<clever> fxsheep: i'll be asleep then, but can help out more tomorrow
<fxsheep> ))
fxsheep55 has joined ##raspberrypi-internals
fxsheep55 has quit [Client Quit]
fxsheep73 has joined ##raspberrypi-internals
fxsheep73 has quit [Client Quit]
fxsheep has quit [Quit: Client closed]
fxsheep has joined ##raspberrypi-internals
<fxsheep> here
<fxsheep> ] hexdump 0x60000000 0x20
<fxsheep> 0x60000000 00 b0 00 01 00 b0 00 01  e0 00 00 6d e0 00 00 6d  |...........m...m|
<fxsheep> 0x60000010 1d c0 41 07 1d c0 41 07  00 60 19 e8 00 60 19 e8  |..A...A..`...`..|
<fxsheep> ] dw 0x60000000 0x20
<fxsheep> 0x60000000: 0100b000 0100b000 6d0000e0 6d0000e0
<fxsheep> 0x60000010: 0741c01d 0741c01d e8196000 e8196000
<fxsheep> ] db 0x60000000 0x20
<fxsheep> 0x60000000: 00 b0 00 01 00 b0 00 01 e0 00 00 6d e0 00 00 6d
<fxsheep> 0x60000010: 1d c0 41 07 1d c0 41 07 00 60 19 e8 00 60 19 e8
<fxsheep> ] dh 0x60000000 0x20
<fxsheep> 0x60000000: b000 0100 b000 0100 00e0 6d00 00e0 6d00
<fxsheep> 0x60000010: c01d 0741 c01d 0741 6000 e819 6000 e819
<fxsheep> actual content should be:
<fxsheep> 00000000  00 b0 00 01 f0 81 00 c0  e0 00 00 6d 82 18 0d 1f  |...........m....|
<fxsheep> 00000010  1d c0 41 07 18 e8 00 80  00 60 19 e8 47 80 00 60  |..A......`..G..`|
<clever> ] db 0x60000000 0x5000
<clever> 0x60000000: 00 b0 00 01 f0 81 00 c0 e0 00 00 6d 82 18 0d 1f
<clever> this is what my dump had, yeah that matches up
<clever> ive never seen it do something like that before, we can try to debug it more tomorrow
<fxsheep> btw I have rpi1 A+ V1.1, with old style revision number
<fxsheep> maybe has to do with chip revision
<clever> fxsheep: oh, do the logs mention the VPU frequency?
<fxsheep> there is, `VPU now at 500mhz(500), PLLC_CORE0 at 500mhz, PLLC_PER at 500MHz, PLLC at 500mhz
<fxsheep> `
<clever> ah, i think the pi1 is only rated for 250mhz
<clever> it might just be overclocked too hard
<clever> fxsheep: try adding PLLC_CORE0_DIV := 2, to your project/rpi3-bootcode.mk file
<fxsheep> yeah it worked :P
<clever> that would explain things perfectly then
<clever> hermanhermitage's stuff never touches the clock config
<clever> so its running at a slow 19.2mhz
<clever> i'll need to add some model detection, and force a 250mhz limit on the pi1
<fxsheep> same thing causes `Fatal VPU Exception: Forbidden instruction` on rpi3-start
<fxsheep> strange that official overclock sets core to 500mhz and it worked well
<fxsheep> is it right to be stuck at `legacy layer`? don't have A/V cable yet
<clever> fxsheep: is the shell enabled in the project file?
<clever> starting app shell
<clever> fxsheep: does it print this line?
Stromeko has quit [Ping timeout: 268 seconds]
Stromeko has joined ##raspberrypi-internals
jcea has quit [Ping timeout: 256 seconds]
fxsheep86 has joined ##raspberrypi-internals
fxsheep86 has quit [Client Quit]
<fxsheep> yes it's enabled and no it doesn't print :(
bonda_000 has joined ##raspberrypi-internals
<bonda_000> good morninh
<bonda_000> morning
<bonda_000> :clever can you look at isp_schedule lines 58-63?
<bonda_000> in the start_x.elf
fxsheep has quit [Quit: Client closed]
<bonda_000> whatever the result of iVar7 is, is a isp params struct
<bonda_000> it's then passed into isp_program and from there every isp_write_X that modifies hardware regs takes values from that struct
<bonda_000> while ((iVar7 = iVar3, iVar6 != 0 &&
<bonda_000> what does this even mean
<bonda_000> around line 58
fxsheep has joined ##raspberrypi-internals
<bonda_000> that doesn't even look like C
<bonda_000> imgur.com/a/hgvXT7E
<bonda_000> iVar6 = isp.globals._4_4_
<bonda_000> ISP2_7ea00000.TILE_ADDR = param_1 & 0x3fffffff | 0x40000000;
<bonda_000> puts tiles in a '4' alias, L2 cache coherent (non-allocating)
<bonda_000> ah no
<bonda_000> my bad
<bonda_000> it runs in a loop
<bonda_000> starts at iVar6 = isp_globals._4_4_;
<bonda_000> and then increments iVar6 = *(int *)(iVar6 + 0x11a9c);
<bonda_000> on each loop iteration
fxsheep has quit [Quit: Client closed]
jcea has joined ##raspberrypi-internals
fxsheep has joined ##raspberrypi-internals
fxsheep has quit [Client Quit]
<bonda_000> the only problem with the gp
<bonda_000> is the actual data those globals point to, the structs, don't get XREFS
<bonda_000> the solution I came up with so far is
<bonda_000> allocate some memory, say at 0x20000000 and that will be our "isp_struct area"
<bonda_000> and then assign a data type to that area "isp_struct" and make it of size 0x11a9c
<bonda_000> if you set register value gp=0ef07e00 for this function, isp_schedule
<bonda_000> then it will point to a global variable "isp_globals"
<bonda_000> isp_globals is undefined8 initially
<bonda_000> I initialized that memory segment and using byte editor wrote 0x20000000 to the top word of isp_globals (at 0ef09dc0)
<bonda_000> you can see that three loops in this function isp_schedule traverse some kind of array of such isp_structs
<bonda_000> each of those entries it passes through the function isp_tiles_ready and whichever one it stops at (isp_struct) is passed as param_1 to isp_program
bonda_000 has quit [Ping timeout: 268 seconds]
bonda_000 has joined ##raspberrypi-internals
<bonda_000> :clever u here?
Bitweasil- is now known as Bitweasil
bonda_000 has quit [Quit: Leaving]