Caanoo / WIZ Wiz Mmuhack


Exophase

Nothing good will ever come of Exophase.
Joined
Sep 21, 2006
Messages
10,307
Age
41
Location
Cleveland OH
I wrote an mmuhack that follows the old fashioned technique that Squidge first introduced. In other words, something that modifies sys_newuname rather than a kernel module (since I can't write those w/o source). However, it is different from Squidge's in a couple ways. First, it scans /proc/kallsyms (or /proc/ksyms if it can't load that) to get the address of sys_newuname, so it shouldn't be as prone to breaking between kernel versions. Second, it flushes icache/dcache between uname patches - this is vital or it won't work for coherency issues (it is self modifying code afterall). Third, it does some sanity checks to make sure the process is working as expected along the way.

I tried to flush icache/dcache in the usual GP2X way (with syscall 0x9F0002) but it didn't work. Maybe you have to do icache/dcache separately now instead of it merging the two, I don't know, I didn't investigate. Instead I just wrote some functions to flush all of icache/dcache in software by loading in new things. If anyone can point out an alternative that'd be good. I tried making the dcache flush load the icache flush routine instead of from a BSS section area but that failed to work - it might be that text section things are not data cacheable.

Anyway, here are the files:

http://exophase.devzero.co.uk/wiz_mmuhack.c
http://exophase.devzero.co.uk/asm_util.S

I'm getting as much as 2ms per frame improvement or more (hard to tell exactly, timing is really inconsistent for some reason) so it's definitely worth it, even if your program just writes to the whole framebuffer once per frame (Temper potentially does multiple, for BG and sprites).

Edit: Still doesn't work all the time, not at all sure why. Just keep trying it until it does, I guess :/ (tell me if anyone has any ideas)
 
Not working for me :(

CODE

got uname location 533a8
uname backup: e1a0c00d e92dd810 e24cb004 e1a04000
uname now: ffffffa3 e12fff1e e24cb004 e1a04000
Kernel panic - not syncing: Attempted to kill init!



CODE

Internal error: Oops - undefined instruction: 0 [#1]
Modules linked in:
CPU: 0 Not tainted (2.6.24 #236)
PC is at sys_newuname+0x0/0x78
LR is at ret_fast_syscall+0x0/0x2c
pc : [<c00533a8>] lr : [<c002eea0>] psr: 80000013
sp : c25c1fa8 ip : 00000000 fp : 00000000
r10: bef25c5c r9 : c25c0000 r8 : c002f044
r7 : 0000007a r6 : 00000003 r5 : bef25c6c r4 : e12fff1e
r3 : 00000000 r2 : 00000000 r1 : 00000000 r0 : 00000000
Flags: Nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
Control: 0005317f Table: 026f4000 DAC: 00000015
Process mame (pid: 692, stack limit = 0xc25c0258)
Stack: (0xc25c1fa8 to 0xc25c2000)
1fa0: e12fff1e bef25c6c 00000000 00000000 00000000 00000000
1fc0: e12fff1e bef25c6c 00000003 00000000 000533a8 bef25c4c bef25c5c 00000000
1fe0: bef2162c bef21bc8 0027f714 00280010 60000010 00000000 00000000 00000000
Backtrace: no frame pointer
Code: e2899001 baffffe7 e1a00008 e89daff0 (ffffffa3)
---[ end trace 7b851ca500105147 ]---

Internal error: Oops - undefined instruction: 0 [#2]
Modules linked in:
CPU: 0 Tainted: G D (2.6.24 #236)
PC is at sys_newuname+0x0/0x78
LR is at ret_fast_syscall+0x0/0x2c
pc : [<c00533a8>] lr : [<c002eea0>] psr: 80000013
sp : c1cdffa8 ip : 00000000 fp : 00000000
r10: 40218000 r9 : c1cde000 r8 : c002f044
r7 : 0000007a r6 : becabcb3 r5 : 0000000b r4 : 4021ae00
r3 : 00000214 r2 : 4021a470 r1 : 00000000 r0 : becabaf0
Flags: Nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
Control: 0005317f Table: 01cbc000 DAC: 00000015
Process sh (pid: 656, stack limit = 0xc1cde258)
Stack: (0xc1cdffa8 to 0xc1ce0000)
ffa0: 4021ae00 0000000b becabaf0 00000000 4021a470 00000214
ffc0: 4021ae00 0000000b becabcb3 0009f280 00096cb8 00000001 40218000 00096cd8
ffe0: 00000000 becabaf0 4012fe34 4018c474 60000010 becabaf0 00000000 00000000
Backtrace: no frame pointer
Code: e2899001 baffffe7 e1a00008 e89daff0 (ffffffa3)
---[ end trace 7b851ca500105147 ]---

Internal error: Oops - undefined instruction: 0 [#3]
Modules linked in:
CPU: 0 Tainted: G D (2.6.24 #236)
PC is at sys_newuname+0x0/0x78
LR is at ret_fast_syscall+0x0/0x2c
pc : [<c00533a8>] lr : [<c002eea0>] psr: 80000013
sp : c2419fa8 ip : 00000000 fp : 00000000
r10: 00000000 r9 : c2418000 r8 : c002f044
r7 : 0000007a r6 : 0000dbe4 r5 : 00000290 r4 : 00000008
r3 : be99fbd7 r2 : be99fbd7 r1 : 00000000 r0 : be99fa28
Flags: Nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
Control: 0005317f Table: 0269c000 DAC: 00000015
Process init (pid: 1, stack limit = 0xc2418258)
Stack: (0xc2419fa8 to 0xc241a000)
9fa0: 00000008 00000290 be99fa28 00000000 be99fbd7 be99fbd7
9fc0: 00000008 00000290 0000dbe4 0001791c be99fa28 be99fbb0 00000000 be99fdb0
9fe0: 000164c0 be99fa24 0000d6fc 400a9474 60000010 be99fa28 ffffffff ffffffff
Backtrace: no frame pointer
Code: e2899001 baffffe7 e1a00008 e89daff0 (ffffffa3)
---[ end trace 7b851ca500105147 ]---
 
Franxis; It's a compiler difference, I think, char must be signed for you and unsigned for me. I uploaded a new one that makes the parameter explicitly unsigned char, please try it.
 
It seems to work just like my original on the gp2x :)

kk = frames/sec.

Without MMU hack:
root@wiz:/mnt/sd# ./fbtest.gpe
The framebuffer device was opened successfully.
320x240, 16bpp
The framebuffer device was mapped to memory successfully.
kk = 1, time = 1199554732
kk = 101, time = 1199554733
kk = 152, time = 1199554734
kk = 153, time = 1199554735
kk = 152, time = 1199554736
kk = 152, time = 1199554737
kk = 152, time = 1199554738
kk = 153, time = 1199554739
kk = 152, time = 1199554740
kk = 152, time = 1199554741
kk = 152, time = 1199554742
kk = 152, time = 1199554743
kk = 153, time = 1199554744
kk = 152, time = 1199554745
kk = 152, time = 1199554746
kk = 152, time = 1199554747
kk = 152, time = 1199554748
kk = 153, time = 1199554749
kk = 152, time = 1199554750
kk = 152, time = 1199554751

with MMU hack

root@wiz:/mnt/sd# ./fbtestmmu.gpe
The framebuffer device was opened successfully.
320x240, 16bpp
The framebuffer device was mapped to memory successfully.
got uname location 533a8
uname backup: e1a0c00d e92dd810 e24cb004 e1a04000
uname now: e3a000a3 e12fff1e e24cb004 e1a04000
test 1: expected 0xA3, got a3
uname now: e3a000e9 e12fff1e e24cb004 e1a04000
test 2: expected 0xE9, got e9
modifying pagetable at 1d00000
hacking coarse pagetable entry mapping to 2a00000
hacking coarse pagetable entry mapping to 2a00000
[snip!]
kk = 1, time = 1199554908
kk = 186, time = 1199554909
kk = 236, time = 1199554910
kk = 236, time = 1199554911
kk = 236, time = 1199554912
kk = 236, time = 1199554913
kk = 235, time = 1199554914
kk = 236, time = 1199554915
kk = 236, time = 1199554916
kk = 236, time = 1199554917

55% improvement. Nice!

Nice work Exophase, now all we need is a kernel module :)
 
quake 1 with castor
at 533 Mhz 969 frames 47.0 seconds 20.6 fps
at 750 Mhz 969 frames 35.7 seconds 27.2 fps
at 800 Mhz 969 frames 31.8 seconds 30.5 fps (no sound)

So there is an improvement

Update these were numbers without it:
23.5 fps at 700 Mhz (limit with sound)
26.7 fps at 795 Mhz (limit with no sound)

This really opens things up! Good work Exophase
 
Exophase said:
Franxis; It's a compiler difference, I think, char must be signed for you and unsigned for me. I uploaded a new one that makes the parameter explicitly unsigned char, please try it.
Yes, you are ok :) , i have tried the new ones and it runs perfectly... Congratulations :D .
 
Last edited by a moderator:
A truly landmark moment in Wiz development history - fantastic work Exophase!:)

To be forever known as Exophase's (feat. Squidge) MMU hack ;)

Cheers
Simon
 
Exophase said:
I tried to flush icache/dcache in the usual GP2X way (with syscall 0x9F0002) but it didn't work.
Make sure r2 is set to 0 or it will just ignore your call (2.6 kernels started doing that). If that doesn't help try the EABI way:
CODE

mov r2, #0
ldr r7, =#0x0f0002
swi 0


You will need to stack r7, non-saved registers, well you know that stuff.
 
Last edited by a moderator:
notaz said:
Exophase said:
I tried to flush icache/dcache in the usual GP2X way (with syscall 0x9F0002) but it didn't work.
Make sure r2 is set to 0 or it will just ignore your call (2.6 kernels started doing that). If that doesn't help try the EABI way:
CODE

mov r2, #0
ldr r7, =#0x0f0002
swi 0


You will need to stack r7, non-saved registers, well you know that stuff.


Thanks, I will try that (funny thing is I used to set r2 to 0, now I removed it since I thought it was unneeded >_>)
 
Last edited by a moderator:
Awesome! It's like GP2X nastalgia all over again. Thanks for working on this Exophase! Also thanks Squidge for the original hack!
 
Excellent! I like the idea of source code over a module (unless it comes with the firmware).
 
I have modified the Exophase MMUHack to run correctly in the latest WIZ firmware (0.6.2):

CODE

http://www.talfi.net/gp32_franxis/wiz_mmuhack.c



The problem was that he hack didn't run all the times, i have added retries in some of the library calls until it returns the expected values to continue with the hack apply.

Cheers
 
Last edited by a moderator:
Franxis said:
I have modified the Exophase MMUHack to run correctly in the latest WIZ firmware (0.6.2):

CODE

http://www.talfi.net/gp32_franxis/wiz_mmuhack.c
The problem was that he hack didn't run all the times, i have added retries in some of the library calls until it returns the expected values to continue with the hack apply.

Cheers


Now that you mention it I see it too, your update works.
 
Last edited by a moderator:
Back
Top