Rafał Miłecki ─ Zajec

Reverse engineering fglrx and HDMI audio

So this time instead of just improving HDMI audio support I've decided to also describe that RE process. I hope it may help some hacker who would like to help but doesn't know where to start.

First of all, I assume we want to include out work in Linux kernel, so we're interested only in clean room reverse engineering. It means we can't disassemble binary, but we are allowed to observe closed source driver behaviour. There are two methods left in this case: reading registers values or watching regs operations.


Reading registers

This is a simpler method that doesn't require any extra hacks or knowledge of closed driver architecture. It's based on just reading registers (all or some subset) and figuring out their meaning. It's usually a good idea to compare registers values from different moments: for example before connecting HDMI monitor and after. To verify your guesses, you can try modifying registers manually. For AMD/ATI GPUs there is a great tool radeontool/avivotool.

The problem with this method is you can't really watch the whole process (of enabling HDMI audio). You just see a state before and after, order of changes remains a mystery. It's also hard to figure out which registers are related to the investigated feature. And there is the worst case: indirect access. If there are so called "index" and "data" registers, it's pretty impossible to track changes performed by closed source driver. You can find tons of hardware with subsets of registers that are accessed by a 2 main registers. In such case writing values to 3 sequential registers is performed by: 1) Writing "1" to index reg and "0xbaad" to data reg. 2) Writing "2" to index reg and "0xdead" to data reg. 3) Writing "3" to index reg and "0xc0de" to data reg.

Luckily HDMI audio on AMD cards is handled in quite simple way. It doesn't require specific order of regs operations and doesn't use any indirect access. That's why we were able to RE it that way. Unfortunately fixing some bugs and adding support for the newest cards isn't possible using this method.

Tracing regs operations

The best idea is to track all operations performed by closed driver and analyze them. First of all you need a tool for tracking. In case of kernel modules it can be handled using "mmiotrace" and in case of user space drivers it's probably the best idea to use gdb. HDMI audio in fglrx is handled by DDX driver (you can verify that by removing fglrx.ko and still using fglrx DDX), so we need some gdb trick. Unfortunately I can't explain how to write gdb script tracing registers operations. I use the one created by Jerome Glisse and I didn't really have to worry about that. I guess you have to find proper functions names ("strings" may be your friend) and find out which CPU registers are holding interesting arguments like register and value (in case of writing).

So for HDMI reverse engineering I'm using fglrx.gdb, just note it's 64b specific (see CPU registers). Running this script results in xorg-trace.txt being created (with all registers operations logged). Having such a dump you just have to find a HDMI setup related operations, understand them and re-implement in your driver.

Some real-life example

OK, I've described the process, but there is nothing better than some real example. I've using fglrx.gdb to track fglrx's operations on my HD6320. I've found HDMI registers ops in the xorg-trace.txt and there is some part of them:
RREG32(0x000120dc); -> 0x00000000
WREG32(0x000120dc, 0x24414000);
RREG32(0x000120e0); -> 0x00000000
WREG32(0x000120e0, 0x00001000);
RREG32(0x000120e4); -> 0x00000000
WREG32(0x000120e4, 0x28488000);
RREG32(0x000120e8); -> 0x00000000
WREG32(0x000120e8, 0x00001880);
RREG32(0x000120ec); -> 0x00000000
WREG32(0x000120ec, 0x24414000);
RREG32(0x000120f0); -> 0x00000000
WREG32(0x000120f0, 0x00001800);
RREG32(0x00012104); -> 0x10000000
WREG32(0x00012104, 0x00100000);
RREG32(0x00012108); -> 0x00000000
WREG32(0x00012108, 0x00200000);
RREG32(0x00012120); -> 0x00000000
WREG32(0x00012120, 0x00876543);

Doesn't look too friendly, does it? Let me manually add registers names we received from AMD:
RREG32(0x000120dc); -> 0x00000000    HDMI_ACR_32_0
WREG32(0x000120dc, 0x24414000);        HDMI_ACR_32_0
RREG32(0x000120e0); -> 0x00000000    HDMI_ACR_32_1
WREG32(0x000120e0, 0x00001000);        HDMI_ACR_32_1
RREG32(0x000120e4); -> 0x00000000    HDMI_ACR_44_0
WREG32(0x000120e4, 0x28488000);        HDMI_ACR_44_0
RREG32(0x000120e8); -> 0x00000000    HDMI_ACR_44_1
WREG32(0x000120e8, 0x00001880);        HDMI_ACR_44_1
RREG32(0x000120ec); -> 0x00000000    HDMI_ACR_48_0
WREG32(0x000120ec, 0x24414000);        HDMI_ACR_48_0
RREG32(0x000120f0); -> 0x00000000    HDMI_ACR_48_1
WREG32(0x000120f0, 0x00001800);        HDMI_ACR_48_1

RREG32(0x00012104); -> 0x10000000    AFMT_60958_0
WREG32(0x00012104, 0x00100000);        AFMT_60958_0
RREG32(0x00012108); -> 0x00000000    AFMT_60958_1
WREG32(0x00012108, 0x00200000);        AFMT_60958_1
RREG32(0x00012120); -> 0x00000000    AFMT_60958_2
WREG32(0x00012120, 0x00876543);        AFMT_60958_2

Hope it looks better now. So you can see that after writing ACR registers fglrx start writing various values to the AFMT_60958_* regs. If you take a closer look at evergreend.h you can ever understand what that values mean. This 0x10000000 is actually a AFMT_60958_CS_CHANNEL_NUMBER_L(1) and 0x00200000 is AFMT_60958_CS_CHANNEL_NUMBER_R(2). So this code simply initialized channels with some sane order.

There is nothing left but just implementing the same for open source driver. How I've handled that? Take a look at this simple
[PATCH 6/6] drm/radeon/evergreen: write default channel numbers

  1. ~Marius Gedminas ─ 14.04.2013

    IIRC AMD used to release the specs for their graphics cards. Did they stop, or do those specs fail to completely describe how to do HDMI audio?

  2. Zajec ─ 14.04.2013

    Released specs don't cover all parts, that unfortunately includes audio and HDMI :(

  3. ~mentor ─ 14.04.2013

    And I doubt you're going to see spec's for the HDMI part ever.

  4. ~fake oakleys ─ 18.07.2013

    20% half fake oakleys http://www.wendystoeker.com

  5. ~Brutalix ─ 20.07.2013

    The HDMI parts are partly supplied by realtek. That's why no specs are forthcomming.

    Kind Regards
    Brutalix

  6. ~replica louis vuitton belt ─ 08.03.2014

    <a href=http://www.ourjun...om><b>large quantity stock of louis vuitton outlet on sale for cheap with free shipping</b></a> <a href=http://www.maamis...sp><b>louis vuitton monogram quilling letters</b></a> <a href=http://www.bethan...ml><b>cheap louis vuitton m93090</b></a> <a href=http://www.justin...tm><b>louis vuitton factory outlet australia</b></a> <a href=http://www.bethan...</b></a> <a href=http://www.norcom...t;<b>authentic cheap louis vuitton diaper bags</b></a> <a href=http://fashiontec...om><b>louis vuitton outlet</b></a> <a href=http://www.canoec...html><b>top louis vuitton for cheap sale in our outlet <a href=http://www.urbant...et><b>louis vuitton outlet cabazon</b></a> <a href=http://www.redmon...s/><b>louis vuitton replica handbags</b></a> <a href=http://www.silver...ml><b>louis vuitton handbag real</b></a> <a href=http://www.cyndar...et><b>cheap replica louis vuitton</b></a> <a href=http://www.redmon...t/><b>louis vuitton replica wallets</b></a> <a href=http://www.wildgr...><b>replica louis vuitton bags</b></a> <a href=http://www.casare...tm><b>cheap new louis vuitton bags 2014 malaysia</b></a> <a href=http://latesteboo...html><b>buy 2014 cheap louis vuitton handbags from official online store enjoy free tax</b></a> <a href=http://www.redmon...t/><b>louis vuitton replica wallets</b></a> <a href=http://www.redmon...es/><b>mens replica louis vuitton mens shoes</b></a> <a href=http://www.canoec...t;<b>excellent charming louis vuitton replica shoes for sale at the reasonable price</b></a> <a href=http://www.ourjun...om><b>large quantity stock of louis vuitton outlet on sale for cheap with free shipping</b></a>
    replica louis vuitton belt http://www.avingtonplace.com

  7. ~jhprqcet ─ 21.03.2014

    WWW by Zajec (Rafał Miłecki)
    ujhprqcet
    jhprqcet http://www.g2393c...8mebl7478i5j0ps.org/
    <a href="http://www.g2393c...;ajhprqcet</a>

  8. ~Hogan DONNA ─ 24.03.2014

    Abercrombie Homme
    lou bouti
    oakley straight jacketoakley ski pants
    Buy A Louis Vuitton
    christian louboutin pas cher
    http://dartsclubmioveni.ro/vechi/2014/2/28/dartsclubmioveni-17-19.html
    ray ban tortoiseray ban boyfriend sunglasses
    Louis Vuitton Small Wallet
    cheap oakley sunglasses for men
    グッチ 財布 メンズ シマライン
    chaussures louboutin
    chaussure louboutin pas cher
    レイバン ティアドロップ 似合う
    oakley kidsoakley men sunglasses
    Louis Vuitton Shoes For Kids
    オークリー 修理
    air max 95 pas cher
    マイクロソフト ダウンロード 無料
    Louboutin Chaussures
    Hogan Sito Ufficiale
    fake ray bans for salecheap ray ban wayfarerscheap ray ban wayfarer sunglasses
    ray ban sunglasses cheap
    christian louboutin homme
    chaussure louboutin
    oakley jacketsoakley swimwear
    louboutin femme
    Hogan DONNA

  9. ~christian louboutin homme ─ 24.03.2014

    oakley shortssports sunglasses
    chaussure louboutin
    Where To Buy Louis Vuitton Cheap
    oakley restlessoakley prescription sunglasses
    cheap ray banscheap ray ban eyeglassescheap ray ban sunglasses
    louboutin prix
    chaussure louboutin pas cher
    ガガミラノ 海外腕時計
    Veste Abercrombie
    sunglass oakleyoakley radar sunglasses
    hogan outlet
    ray ban outlet onlinecheap aviator sunglassescheap ray ban sunglasses for men
    new balance mt100
    Borse Louis Vuitton Outlet
    グッチ 長財布 ジッパー
    oakley thumpoutlet nike
    louboutin femme
    air max pas cher femme
    Kontent Machine 3
    escarpins louboutin
    louboutin prix
    cheap oakley polarized sunglassesoakley shirts
    burberry bags
    oakley polarized sunglassesoakley socks
    http://haiduongvui.vn/banner/2014/3/3/prostrate-lamb.html
    ray ban olympiankids ray bans
    Veste Abercrombie Homme
    マイクロソフト パブリッシャー 使い方
    louboutin prix
    オークリー タレックス レンズ
    cheap polarized sunglassesoakley x squared
    oakley polarized sunglassesoakley canteen sunglasses
    cheap aviatorscheap ray ban sunglassesray bans wayfarer cheap
    Selling A Louis Vuitton Handbag
    Wholesale Louis Vuitton Handbags
    gaga 腕時計 コピー トリーバーチ
    cheap ray ban wayfarer
    Official Louis Vuitton Website
    christian louboutin pas cher
    oakley gascan soakley mars
    レイバン メガネ 店
    louboutin prix
    Hogan Italia
    christian louboutin homme

  10. ~グッチ バッグ 送料 無料 ピアチェーレ ─ 25.03.2014

    Louis Vuitton Wallet For Women
    microsoft 公式
    louis vuitton バッグ
    timberland 腕時計
    Louis Vuitton Cheap
    Cheap Louis Vuitton Handbags Replica
    Devin Santos
    burberry bags
    http://www.autobus.se/work/2014/3/3/shone-swung.html
    レイバン ルミ
    レイバン サングラス 格安
    ガガミラノ メンズウォッチ
    レイバン 黒縁メガネ 人気
    グッチ バッグ 送料 無料 ピアチェーレ

  11. ~mac office 価格 ─ 25.03.2014

    #27005;天靴通販
    http://kajakowy.pl/cache/2014/3/20/specific-stentorian.html
    Cheap Louis Vuitton Bags Replica
    GSA search engine ranker
    burberry bags
    レイバン ウェイファーラー コレクション
    Damier Louis Vuitton Purse
    グッチ アウトレット りんくう
    ヴィトン アズール バッグ
    Replica Louis Vuitton Handbags
    gaga 時計 ショップ
    レイバン サングラス 人気モデル
    ray-ban ウェイファーラー
    mac office 価格

  12. ~Choose newest 2014 World Cup Croatia Jerseys Online Sale ─ 13.04.2014

    http://andrewsleisure.co.uk/prices.php http://aquila-tc.co.uk/faq/default.asp http://villaroyal.co.uk/scrolling.php http://baf.safmarine.com/fcktempla.asp
    Choose newest 2014 World Cup Croatia Jerseys Online Sale

Nowy komentarz