RE Blog

Documenting the reverse engineering process

8: The *actual* $a instructions, pt. 2

Time to think about the data store a bit. The d0/d2/d4/d6 opcodes are very likely just ld/st instructions targetting it. However, the channel switch sequence is supposed to read/write the context DMA object, and the VP architecture diagram shows a line connecting the data store to the memory interface. This means we should likely be […]

Posted in VP1 | No Comments

7: the *actual* $a instructions, pt. 1

Today I’ll attempt to look at the channel switch microcode. Its only tasks should be loading/storing the context data and some administrative stuff. Since so far we’ve only worked on NV50, let’s look at the NV50 version. 00000000: 6a0000c7 mov $y0 $a0 00000000: 6a0840c7 mov $y1 $a1 00000000: 6a1080c7 mov $y2 $a2 00000000: 6a18c0c7 mov […]

Posted in VP1 | No Comments

6: Branches, pt. 2

Let’s continue REing the branch instructions. 0xe0   2897    2330     branch if predicate 0xe1   1036     913     branch ? 0xe2   1707    1188     branch if not predicate 0xe3    120      89     ??? [XXX] 0xe4   2020     695     call if predicate 0xe6     92      84     call if not predicate 0xe8    694     552     ret 0xea    248       1     abra 0xef  23932   13521     bnop 0xf0    […]

Posted in VP1 | No Comments

5: Branches, pt. 1

Today my goal is to look into an issue I’ve briefly mentioned at the beginning, but ignored afterwards: the code fetch and execution process. The initial guess was that the ISA is VLIW with a bundle size of 16 bytes, containing 4 32-bit opcodes. The known branches certainly can only aim at targets aligned to […]

Posted in VP1 | No Comments

4: $a instructions, pt. 2

Today’s aim is to RE the remaining $a-related opcodes. That is, boring but required stuff before we can get to looking at the microcode. First, let’s look at the pXX.2 code again: mwk@nightmare ~/microcode/vp1/p1 $ envydis -m vp1 -w part-00.2 00000000: 6b0fc0af mov $a1 $x63 00000000: 7e087f80 shr $a1 $c0 $a1 -0×10 00000000: 7e084080 shr […]

Posted in VP1 | No Comments

3: $a instructions, pt. 1

14.02.2012-16.02.2012 No obvious place to go now. Let’s try some statistical analysis. We’ll count how many times each opcode [as distinguished by top 8 bits] is used. op NV44 NV50 0×04 1026 – 0x0b 26 2 0x0c 96 – 0x0d 288 – 0x0f 526 255 0×24 364 336 0×40 – 766 0×41 1439 1091 0×42 […]

Posted in VP1 | No Comments

2: First code run

13.02.2012 Today’s first idea is to look at the VP1′s MMIO registers to see if we can run some test code. Before I managed to figure this out, I noticed some nice things in the MMIO scan: 00f448: df000000 ffffffff 00000000 * 00f44c: 4f000000 ffffffff 00000000 * 00f450: bf000000 ffffffff 00000000 * 00f454: ef000000 ffffffff […]

Posted in VP1 | No Comments

1: The beginning

12.02.2012 My next target will be the VP1 video processor. This processor is present on most NV40 generation cards and the original NV50, corresponding to the first generation of PureVideo HD. Together with two other engines (PMPEG and PMSRCH) and an arbiter, it makes up the video decoding/encoding subsystem. The tasks of this engine include […]

Posted in VP1 | No Comments