f_ changed the topic of ##raspberrypi-internals to: The inner workings of the Raspberry Pi (Low level VPU/HW) -- for general queries please visit #raspberrypi -- open firmware: https://librerpi.github.io/ -- VC4 VPU Programmers Manual: https://github.com/hermanhermitage/videocoreiv/wiki -- chat logs: https://libera.irclog.whitequark.org/~h~raspberrypi-internals -- bridged to matrix and discord
bonda_000 has quit [Quit: Leaving]
jcea has quit [Ping timeout: 260 seconds]
bonda_000 has joined ##raspberrypi-internals
angerisagift has quit [Read error: Connection reset by peer]
angerisagift has joined ##raspberrypi-internals
<bonda_000> just said to myself
<bonda_000> "stack operations have arrived!"
<bonda_000> clever:
jcea has joined ##raspberrypi-internals
f_ has joined ##raspberrypi-internals
<bonda_000> clever: figured something out
<bonda_000> this function:
<bonda_000> void ilcs_command(int param_1,uint param_2,undefined4 param_3,int *param_4,undefined4 param_5)
<bonda_000> will do this call:
<bonda_000> pcVar1 = *(code **)(*(int *)(param_1 + 0x1f8) + param_2 * 4)
<bonda_000> where:
<bonda_000> param_1 + 0x1f8 points at ilcs_fns
<bonda_000> this is called from:
<bonda_000> undefined4 ilcs_task(int param_1)
<bonda_000> that does the call:
<bonda_000> (**(code **)(param_1 + 0x204))(*(undefined4 *)(param_1 + 500));
<bonda_000> where param_1 + 0x204 is ilcs_thread_init()
<bonda_000> ilcs_task(), in turn, is scheduled in vcos_thread_create
<bonda_000> from ilcs_init().
<bonda_000> now, you can see that vcos_thread_create() in turn calls vcos_llthread_create() and passes 0xee5de38 as one of the args
<bonda_000> and that's a void vcos_thread_wrapper() function pointer
<bonda_000> that will do uVar3 = (**(code **)(param_1 + 0x100))(*(undefined4 *)(param_1 + 0x104));
<bonda_000> so param_4 and param_5 which were passed to vcos_thread_create() are the function and it's only argument
<bonda_000> in our case, ilcs_task is a function and a struct of size 0x5298 is its' argument
<bonda_000> and as you can see, one of the entries of the ilcs_fns is a function called ilcs_create_component
<bonda_000> and that, in turn, creates evrything from that _dummy_functab you pointed me at
<bonda_000> https://imgur.com/4PHOZw0 ilcs_fns
f_ has quit [Remote host closed the connection]
f_ has joined ##raspberrypi-internals
bonda_000 has quit [Ping timeout: 256 seconds]
bonda_000 has joined ##raspberrypi-internals
funderscore has joined ##raspberrypi-internals
f_ has quit [Quit: To contact me, send a memo using MemoServ, PM f_[xmpp], or send an email. See https://vitali64.duckdns.org/.]
funderscore is now known as f_
bonda_000 has quit [Quit: Leaving]
bonda_000 has joined ##raspberrypi-internals
dolphinana has joined ##raspberrypi-internals