Commit graph

1314 commits

Author SHA1 Message Date
Hector Martin
ebd4613f61 proxy: Add smp_call[_sync]_el1 variants
Signed-off-by: Hector Martin <marcan@marcan.st>
2023-05-05 00:31:05 +09:00
Janne Grunau
7a84b2bbf9 tools/run_guest_kernel.sh: Support concatenated initramfs images
This allows booting a kernel with the firmware cpio and a cpio
containing matching modules. The modules initramfs can be prepared from
the kernel source directory with:

`make dir-pkg && usr/gen_initramfs.sh -o initramfs_mod.cpio -u squash -g squash ./tar-install/lib/`

The modules are available in /modules/$(uname -r) and the initramfs can
handle modules in the same way as the vendor firmware to make them
available for itself and the main OS.

Signed-off-by: Janne Grunau <j@jannau.net>
2023-04-27 04:09:49 +09:00
Hector Martin
54f44be7d6 hv_exc: Add hv_add_time() function & proxy thunk
Signed-off-by: Hector Martin <marcan@marcan.st>
2023-04-26 00:51:51 +09:00
Hector Martin
a0f01809ce experiments/touchbar_rainbow.py: Better rainbow
Signed-off-by: Hector Martin <marcan@marcan.st>
2023-04-23 18:12:09 +09:00
Hector Martin
a81314fe77 run_guest: Implement going to sleep
Getting back from sleep is left as an exercise to the reverse
engineer...

Signed-off-by: Hector Martin <marcan@marcan.st>
2023-04-19 03:21:58 +09:00
Hector Martin
06b732e788 smp: Add smp_stop_secondaries()
Doesn't work properly yet since we can't restart them...

Signed-off-by: Hector Martin <marcan@marcan.st>
2023-04-19 03:21:58 +09:00
Hector Martin
3288548faa utils: Add cpu_sleep() function
Signed-off-by: Hector Martin <marcan@marcan.st>
2023-04-19 03:21:58 +09:00
Hector Martin
4638632657 hv: Implement emulated guest CPU shutdown
Signed-off-by: Hector Martin <marcan@marcan.st>
2023-04-19 01:21:33 +09:00
Hector Martin
4d7b18d382 m1n1.proxy: Support negative arguments
Signed-off-by: Hector Martin <marcan@marcan.st>
2023-04-19 01:02:03 +09:00
Hector Martin
a75afff83b hv_exc: Pass through dangerous CYC_OVRD writes to Python
This makes it easier to experiment with the sleep/WFI stuff.

Signed-off-by: Hector Martin <marcan@marcan.st>
2023-04-18 23:36:55 +09:00
Hector Martin
a1be8f233c m1n1.fw.smc: Add read32f()
Signed-off-by: Hector Martin <marcan@marcan.st>
2023-04-18 22:09:07 +09:00
Hector Martin
7f9eaecbad m1n1.asm: Textually replace sysregs with their identifier
Signed-off-by: Hector Martin <marcan@marcan.st>
2023-04-18 22:08:41 +09:00
Hector Martin
b57a91726d experiments/cpu_pstate_latencies.py: Fix stuff
Extra pstates only for J416c, drop the second pstate field sets (still
no idea what that does), fix a mask.

Signed-off-by: Hector Martin <marcan@marcan.st>
2023-04-18 21:55:12 +09:00
Asahi Lina
8f6e13b170 firmware: Add 13.3
This has the same iBoot version as 13.3.1, so firmwares probably did not
change.

Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-04-18 20:45:10 +09:00
Hector Martin
88b1866fcc experiments/spi.py: Cleanup/updates
Signed-off-by: Hector Martin <marcan@marcan.st>
2023-04-16 21:23:46 +09:00
Hector Martin
9b7ae1b443 m1n1.fw.mtp: Fix parsing of init messages
Signed-off-by: Hector Martin <marcan@marcan.st>
2023-04-16 21:23:46 +09:00
Hector Martin
36bcc36173 m1n1.fw.asc.oslog: Implement properly
Signed-off-by: Hector Martin <marcan@marcan.st>
2023-04-16 21:23:46 +09:00
Hector Martin
d5267123c1 experiments/mtp.py: Clean up
Signed-off-by: Hector Martin <marcan@marcan.st>
2023-04-16 21:23:46 +09:00
Asahi Lina
19e00f1f23 m1n1.hv: Remove __OS_LOG segments from coprocessors
These are supposed to be after the kernel, so we'd have to move them
for the guest to be able to access them. It seems things work if we just
delete those segments.

Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-04-16 21:23:46 +09:00
Janne Grunau
22890f3ba1 experiments: Optimize bad apple video playback
Let ffmpeg rotate, align to stride and convert to RGBA.
Do not allocate a framebuffer for every frame.

Signed-off-by: Janne Grunau <j@jannau.net>
2023-04-16 17:11:33 +09:00
Sasha Finkelstein
5681036b2e Add touchbar screen experiments
Signed-off-by: Sasha Finkelstein <fnkl.kernel@gmail.com>
2023-04-15 17:23:36 +09:00
Hector Martin
ad53766d22 m1n1.fw.asc.{crash, ioreporting}: Do not align prealloc buffer sizes
On SMC on t602x, this is a small SRAM and we can run off the edge.

Signed-off-by: Hector Martin <marcan@marcan.st>
2023-04-12 00:40:06 +09:00
Hector Martin
aaeb3000e6 m1n1.hv: t6020 support
Signed-off-by: Hector Martin <marcan@marcan.st>
2023-04-12 00:40:06 +09:00
Hector Martin
3bc3b0131f tools/pmgr_adt2dt.py: Add multidie support
Signed-off-by: Hector Martin <marcan@marcan.st>
2023-04-09 23:50:42 +09:00
Hector Martin
06884b5613 experiments/cpu_pstate_latencies.py: Fix SoC configs
Signed-off-by: Hector Martin <marcan@marcan.st>
2023-04-09 21:04:40 +09:00
Hector Martin
2389fa9d3d m1n1.adt: Fix parsing of template ADTs
Adding the speaker calibration stuff broke it because we try to parse
template values as real values. Don't do that.

Signed-off-by: Hector Martin <marcan@marcan.st>
2023-04-09 19:46:13 +09:00
Hector Martin
fe104d3848 m1n1.hv: Also hook ATC_AON device
It seems 13.2 is messing with this now.

Signed-off-by: Hector Martin <marcan@marcan.st>
2023-04-09 19:46:13 +09:00
Hector Martin
795211c534 m1n1.fw.dcp.ipc: More fields
Signed-off-by: Hector Martin <marcan@marcan.st>
2023-04-09 19:46:13 +09:00
Mario Hros
693ebbae2b m1n1.hv: Support T6021 cpustart offset
Signed-off-by: Mario Hros <git@reversity.org>
2023-04-09 19:46:13 +09:00
Mario Hros
69012c0702 experiments/cpu_pstate_latencies.py: Extend for T6021
Signed-off-by: Mario Hros <git@reversity.org>
2023-04-09 19:46:12 +09:00
Asahi Lina
8bf08b0ff1 linux.py: Implement TSO
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-28 19:06:20 +09:00
Asahi Lina
0a05a0171e proxy: Add smp_is_alive() thunk
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-28 19:06:20 +09:00
Eileen Yoon
6ce14d8735 m1n1/ane: Initial commit
Signed-off-by: Eileen Yoon <eyn@gmx.com>
2023-03-28 17:10:15 +09:00
Hector Martin
8be0596ae8 experiments/mtp.py: Fix DART stuff
Signed-off-by: Hector Martin <marcan@marcan.st>
2023-03-15 13:54:35 +09:00
Hector Martin
43a737b608 m1n1.adt: Add speaker calibration parsing
Signed-off-by: Hector Martin <marcan@marcan.st>
2023-03-11 20:09:57 +09:00
Asahi Lina
7ad099a5b6 m1n1.trace.agx: Add exploit mitigation
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
6d3e594903 m1n1.hv: Fix read-only or write-only hooks
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
5cacbdc501 m1n1.fw.agx.initdata: Define buffer manager ctl fields better
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
90f4957725 experiments/agx_xtest.py: Here be exploits!
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
3548d4d210 m1n1.fw.ags.microsequence: Add more ops
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
e8377889d2 m1n1.proxyutils: Add 13.0 beta5/6 versions
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
c35168bb88 m1n1.hw.uat: Gracefully handle inaccessible page tables
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
b063fde19a m1n1.hw.uat: Support block maps
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
bfaf358f82 m1n1.agx.render: Add microsequence hooks
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
e49c90a314 m1n1.agx.context: Add GPUMicroSequence.cur_addr()
This requires that we pre-allocate the buffer

Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
586be52ec5 m1n1.trace.agx: Log structure UAT permissions as meta
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
b4c687ce13 m1n1.hw.uat: Add ioperm()
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
cc1284f264 hv/trace_agx_defer.py: Exclude context ID 1 (compositor)
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
9a8da80e8d m1n1.trace.agx: Add exclude_context_id option
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
9e93bd70e4 m1n1.fw.agx: More compute and blit stuff
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
074892377c m1n1.fw.agx: Fix some more sequence number-ish field names
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
b7fb8d98d8 m1n1.agx: Increase available VM size and reduce usage
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
25813d91b4 m1n1.trace.agx: Disable RegionC tracing
The atomic stuff breaks with Linux right now...

Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
3e572aba4a m1n1.fw.dcp.ipc: Add compression info struct
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
813c545509 m1n1.fw.agx: Compute struct fixes for 13.2
Assuming these apply at 13.0b4 too...

Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
f01a62b7a1 m1n1.fw.agx.cmdqueue: Misc fixes
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
1400b50157 m1n1.fw.agx: Initial 13.2 structure changes
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
e22d2fe049 m1n1.hw.agx: Fix fault status register fields
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
e7dee84c3a m1n1.trace.agx: Misc TA/3D dump changes
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
7e49d104ea m1n1.trace.agx: Add compute tracing
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
8fba6118ce m1n1.fw.agx: Add missing compute stuff
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
89e3fcb2ab m1n1.trace.agx: Fix delayed ring buffer fetches
This should solve the issue where we see commands that the GPU has
already processed.

Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
37f9c5149c m1n1.proxyutils/constructutils: Add missing versions
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
3117cdef99 m1n1.fw.agx: Fixes for 13.0b4 support
Found while adding 13.2, but almost certainly mistakes from back when we
did 13.0b4.

Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Asahi Lina
91e0809063 m1n1.fw.agx: Misc initdata/etc fixes
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-03-06 15:15:17 +09:00
Janne Grunau
5f3bd50b4a experiments/dart_dump.py: Fix register dump after 183991ca19
Fixes: 183991ca19 ("m1n1.hw.dart: Hide all DART variants behind common interface")
Signed-off-by: Janne Grunau <j@jannau.net>
2023-02-02 09:50:56 +09:00
Janne Grunau
2b4ed4abbf hv/trace_cd3217: Add tracing for TI/Apple cd3217 USB type C controller
Interface (as used by macOS) is simple enough to skip register
definitions.

Signed-off-by: Janne Grunau <j@jannau.net>
2023-01-28 10:49:04 +09:00
Janne Grunau
6f4c53279e hv/trace_dcp.py: Add support for for M2
Signed-off-by: Janne Grunau <j@jannau.net>
2023-01-28 10:48:46 +09:00
Janne Grunau
aaa04cfaba m1n1.trace.asc: Support tracing of a DART SID != 0
Required for DCP on M2.

Signed-off-by: Janne Grunau <j@jannau.net>
2023-01-28 10:48:46 +09:00
Janne Grunau
f8964ed0f9 m1n1.fw.asc: Increase DVA size to 36-bits
A single TTBR covers 36-bit address space with 16k pages. Necessary for
DCP on M2.

Signed-off-by: Janne Grunau <j@jannau.net>
2023-01-28 10:48:46 +09:00
Janne Grunau
39f933ec1f m1n1.fw.dcp.dcpep: DCPEp_SetShmem allows to query Shmem
When used with FLAG = 0, IOMFB replies with the current Shmem IOVA. It
is NULL on the first call and keeps the last set value. Updating it
seems to work without issues after shutdown.

Signed-off-by: Janne Grunau <j@jannau.net>
2023-01-28 10:48:46 +09:00
Janne Grunau
5631aaa74a experiments/scaler.py: Use unified DART implementation
Untested if that makes this work on M1 systems which use dart8020 for
the scaler.

Signed-off-by: Janne Grunau <j@jannau.net>
2023-01-28 10:48:46 +09:00
Janne Grunau
68bba35263 experiments/aes.py: Simplify by using unified DART
Signed-off-by: Janne Grunau <j@jannau.net>
2023-01-28 10:48:46 +09:00
Janne Grunau
183991ca19 m1n1.hw.dart: Hide all DART variants behind common interface
Allows m1n1 experiments and tracers not to care about the DART variant.
Required to trace and experiment with DCP sanely on M1 and M2.

Signed-off-by: Janne Grunau <j@jannau.net>
2023-01-28 10:48:46 +09:00
Janne Grunau
1fc26dbb1a hv/trace_dcp: Disable Disp0/DCP iboot EP tracing
Its usage in m1n1 it is incompatible with the generic EPICEp tracing.

Signed-off-by: Janne Grunau <j@jannau.net>
2023-01-28 10:48:46 +09:00
Janne Grunau
bf73c1416a m1n1.fw.asc.ioreporting: Support IOP provided buffers
SMC provides buffer from its MMIO space. Since the macOS 13 SMC firmware
the firmware crashes when ACK-ing a GetBuf which provided a buffer.

Signed-off-by: Janne Grunau <j@jannau.net>
2023-01-28 10:46:45 +09:00
Hector Martin
46f2811351 m1n1.fw.dcp.iboot: Identify colorspace values
Signed-off-by: Hector Martin <marcan@marcan.st>
2023-01-22 23:57:41 +09:00
Asahi Lina
3d28ac4d6f tools/chainload.py: Properly sleep DCP when chainloading macOS
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-01-20 18:18:13 +09:00
Asahi Lina
7a92257d30 m1n1.agx.render: Change heap size to 0x200
This seems to be the AGX value

Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-01-20 18:18:13 +09:00
Asahi Lina
e774b5c521 m1n1.trace.agx: Log hook writes
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-01-20 18:18:13 +09:00
Asahi Lina
8e77f8f49f m1n1.fw.agx.channels: Do not require contiguous pages for channel state
Signed-off-by: Asahi Lina <lina@asahilina.net>
2023-01-20 18:18:13 +09:00
Martin Povišer
2cb6cb46ca tools/run_guest.py: Add -v option for attaching 9P virtio exports
Signed-off-by: Martin Povišer <povik@cutebit.org>
2023-01-13 17:25:25 +09:00
Martin Povišer
93c20e9395 m1n1.hv: Allocate virtio resources if unspecified
Signed-off-by: Martin Povišer <povik@cutebit.org>
2023-01-13 17:25:25 +09:00
Martin Povišer
020d86a23f m1n1.utils: Fix len() overflow in RangeMap
This is to fix

  OverflowError: Python int too large to convert to C ssize_t

in case the upper bound of a range is 1<<64.

Signed-off-by: Martin Povišer <povik@cutebit.org>
2023-01-13 17:25:25 +09:00
Martin Povišer
c760e02388 hv: Insert attached virtios into ADT
Signed-off-by: Martin Povišer <povik@cutebit.org>
2023-01-13 17:25:25 +09:00
Martin Povišer
d94f918433 m1n1.adt: Add to_bus_addr() method
So that one knows what to put in reg properties.

Signed-off-by: Martin Povišer <povik@cutebit.org>
2023-01-13 17:25:25 +09:00
Martin Povišer
6f460b1f6a m1n1.adt: Add create_node() method
Signed-off-by: Martin Povišer <povik@cutebit.org>
2023-01-13 17:25:25 +09:00
Martin Povišer
2b33d7f801 m1n1.adt: Implement 'in' keyword on ADT nodes
So that one can check for children, like:

  >>> "/arm-io/aic" in u.adt
  True

Signed-off-by: Martin Povišer <povik@cutebit.org>
2023-01-13 17:25:25 +09:00
Martin Povišer
0249d04a4b m1n1.adt: Add missing 'sys' import
Used for sys.stderr later on.

Signed-off-by: Martin Povišer <povik@cutebit.org>
2023-01-13 17:25:25 +09:00
Martin Povišer
6661ab14d0 hv: Add 9P virtio peripheral
Add some minimal implementation of virtio peripherals. At the level
of on-target hypervisor code we implement the MMIO layout and
maintain virtqueues. Once a buffer is available, we break into the
host proxyclient to deal with it.

Specific device-classes of the virtio spec ought to be implemented in
the proxyclient. Here the one device implemented is 9P transport,
exporting the m1n1 source directory.

Signed-off-by: Martin Povišer <povik@cutebit.org>
2023-01-13 17:25:25 +09:00
Hector Martin
586157b8bf experiments/smc_watcher.py: new experiment
Signed-off-by: Hector Martin <marcan@marcan.st>
2022-12-26 15:07:52 +09:00
Sasha Finkelstein
8c2ad9ada6 Add z2 touch panel tracing
Signed-off-by: Sasha Finkelstein <fnkl.kernel@gmail.com>
2022-12-24 20:45:19 +09:00
Asahi Lina
87fa247d9b m1n1.fw.agx.microsequence: Identify visibility_result_buffer field
Signed-off-by: Asahi Lina <lina@asahilina.net>
2022-12-04 13:17:10 +09:00
Asahi Lina
9ebc38ca73 m1n1.trace.agx: Fix UAT TTBR PT size
Signed-off-by: Asahi Lina <lina@asahilina.net>
2022-12-04 13:17:10 +09:00
Asahi Lina
1b9cb35104 experiments/agx_*.py: Autodetect FW version and GPU rev
Signed-off-by: Asahi Lina <lina@asahilina.net>
2022-12-04 13:17:10 +09:00
Asahi Lina
2b0e022b78 m1n1.agx: Port rendering to G14
Signed-off-by: Asahi Lina <lina@asahilina.net>
2022-12-04 13:17:10 +09:00
Asahi Lina
696cdee114 m1n1.agx.initdata: Port to G14G
Signed-off-by: Asahi Lina <lina@asahilina.net>
2022-12-04 13:17:10 +09:00
Asahi Lina
80266ff93e m1n1.constructutils: Unify version conditional syntax with Rust
Signed-off-by: Asahi Lina <lina@asahilina.net>
2022-12-04 13:17:10 +09:00
Asahi Lina
82a9bf3c26 hv/trace_agx_pwr.py: Cleanup
Signed-off-by: Asahi Lina <lina@asahilina.net>
2022-12-04 13:17:10 +09:00
Asahi Lina
9360a92cdc m1n1/trace/agx.py: Add SGXTracer
Signed-off-by: Asahi Lina <lina@asahilina.net>
2022-12-04 13:17:10 +09:00