Rafał Miłecki ─ Zajec

Reverse engineering fglrx and HDMI audio

So this time instead of just improving HDMI audio support I've decided to also describe that RE process. I hope it may help some hacker who would like to help but doesn't know where to start.

First of all, I assume we want to include out work in Linux kernel, so we're interested only in clean room reverse engineering. It means we can't disassemble binary, but we are allowed to observe closed source driver behaviour. There are two methods left in this case: reading registers values or watching regs operations.

Reading registers

This is a simpler method that doesn't require any extra hacks or knowledge of closed driver architecture. It's based on just reading registers (all or some subset) and figuring out their meaning. It's usually a good idea to compare registers values from different moments: for example before connecting HDMI monitor and after. To verify your guesses, you can try modifying registers manually. For AMD/ATI GPUs there is a great tool radeontool/avivotool.

The problem with this method is you can't really watch the whole process (of enabling HDMI audio). You just see a state before and after, order of changes remains a mystery. It's also hard to figure out which registers are related to the investigated feature. And there is the worst case: indirect access. If there are so called "index" and "data" registers, it's pretty impossible to track changes performed by closed source driver. You can find tons of hardware with subsets of registers that are accessed by a 2 main registers. In such case writing values to 3 sequential registers is performed by: 1) Writing "1" to index reg and "0xbaad" to data reg. 2) Writing "2" to index reg and "0xdead" to data reg. 3) Writing "3" to index reg and "0xc0de" to data reg.

Luckily HDMI audio on AMD cards is handled in quite simple way. It doesn't require specific order of regs operations and doesn't use any indirect access. That's why we were able to RE it that way. Unfortunately fixing some bugs and adding support for the newest cards isn't possible using this method.

Tracing regs operations

The best idea is to track all operations performed by closed driver and analyze them. First of all you need a tool for tracking. In case of kernel modules it can be handled using "mmiotrace" and in case of user space drivers it's probably the best idea to use gdb. HDMI audio in fglrx is handled by DDX driver (you can verify that by removing fglrx.ko and still using fglrx DDX), so we need some gdb trick. Unfortunately I can't explain how to write gdb script tracing registers operations. I use the one created by Jerome Glisse and I didn't really have to worry about that. I guess you have to find proper functions names ("strings" may be your friend) and find out which CPU registers are holding interesting arguments like register and value (in case of writing).

So for HDMI reverse engineering I'm using fglrx.gdb, just note it's 64b specific (see CPU registers). Running this script results in xorg-trace.txt being created (with all registers operations logged). Having such a dump you just have to find a HDMI setup related operations, understand them and re-implement in your driver.

Some real-life example

OK, I've described the process, but there is nothing better than some real example. I've using fglrx.gdb to track fglrx's operations on my HD6320. I've found HDMI registers ops in the xorg-trace.txt and there is some part of them:
RREG32(0x000120dc); -> 0x00000000
WREG32(0x000120dc, 0x24414000);
RREG32(0x000120e0); -> 0x00000000
WREG32(0x000120e0, 0x00001000);
RREG32(0x000120e4); -> 0x00000000
WREG32(0x000120e4, 0x28488000);
RREG32(0x000120e8); -> 0x00000000
WREG32(0x000120e8, 0x00001880);
RREG32(0x000120ec); -> 0x00000000
WREG32(0x000120ec, 0x24414000);
RREG32(0x000120f0); -> 0x00000000
WREG32(0x000120f0, 0x00001800);
RREG32(0x00012104); -> 0x10000000
WREG32(0x00012104, 0x00100000);
RREG32(0x00012108); -> 0x00000000
WREG32(0x00012108, 0x00200000);
RREG32(0x00012120); -> 0x00000000
WREG32(0x00012120, 0x00876543);

Doesn't look too friendly, does it? Let me manually add registers names we received from AMD:
RREG32(0x000120dc); -> 0x00000000    HDMI_ACR_32_0
WREG32(0x000120dc, 0x24414000);        HDMI_ACR_32_0
RREG32(0x000120e0); -> 0x00000000    HDMI_ACR_32_1
WREG32(0x000120e0, 0x00001000);        HDMI_ACR_32_1
RREG32(0x000120e4); -> 0x00000000    HDMI_ACR_44_0
WREG32(0x000120e4, 0x28488000);        HDMI_ACR_44_0
RREG32(0x000120e8); -> 0x00000000    HDMI_ACR_44_1
WREG32(0x000120e8, 0x00001880);        HDMI_ACR_44_1
RREG32(0x000120ec); -> 0x00000000    HDMI_ACR_48_0
WREG32(0x000120ec, 0x24414000);        HDMI_ACR_48_0
RREG32(0x000120f0); -> 0x00000000    HDMI_ACR_48_1
WREG32(0x000120f0, 0x00001800);        HDMI_ACR_48_1

RREG32(0x00012104); -> 0x10000000    AFMT_60958_0
WREG32(0x00012104, 0x00100000);        AFMT_60958_0
RREG32(0x00012108); -> 0x00000000    AFMT_60958_1
WREG32(0x00012108, 0x00200000);        AFMT_60958_1
RREG32(0x00012120); -> 0x00000000    AFMT_60958_2
WREG32(0x00012120, 0x00876543);        AFMT_60958_2

Hope it looks better now. So you can see that after writing ACR registers fglrx start writing various values to the AFMT_60958_* regs. If you take a closer look at evergreend.h you can ever understand what that values mean. This 0x10000000 is actually a AFMT_60958_CS_CHANNEL_NUMBER_L(1) and 0x00200000 is AFMT_60958_CS_CHANNEL_NUMBER_R(2). So this code simply initialized channels with some sane order.

There is nothing left but just implementing the same for open source driver. How I've handled that? Take a look at this simple
[PATCH 6/6] drm/radeon/evergreen: write default channel numbers

  1. ~Marius Gedminas ─ 14.04.2013

    IIRC AMD used to release the specs for their graphics cards. Did they stop, or do those specs fail to completely describe how to do HDMI audio?

  2. Zajec ─ 14.04.2013

    Released specs don't cover all parts, that unfortunately includes audio and HDMI :(

  3. ~mentor ─ 14.04.2013

    And I doubt you're going to see spec's for the HDMI part ever.

  4. ~fake oakleys ─ 18.07.2013

    20% half fake oakleys http://www.wendystoeker.com

  5. ~Brutalix ─ 20.07.2013

    The HDMI parts are partly supplied by realtek. That's why no specs are forthcomming.

    Kind Regards

  6. ~replica louis vuitton belt ─ 08.03.2014

    <a href=http://www.ourjun...om><b>large quantity stock of louis vuitton outlet on sale for cheap with free shipping</b></a> <a href=http://www.maamis...sp><b>louis vuitton monogram quilling letters</b></a> <a href=http://www.bethan...ml><b>cheap louis vuitton m93090</b></a> <a href=http://www.justin...tm><b>louis vuitton factory outlet australia</b></a> <a href=http://www.bethan...</b></a> <a href=http://www.norcom...t;<b>authentic cheap louis vuitton diaper bags</b></a> <a href=http://fashiontec...om><b>louis vuitton outlet</b></a> <a href=http://www.canoec...html><b>top louis vuitton for cheap sale in our outlet <a href=http://www.urbant...et><b>louis vuitton outlet cabazon</b></a> <a href=http://www.redmon...s/><b>louis vuitton replica handbags</b></a> <a href=http://www.silver...ml><b>louis vuitton handbag real</b></a> <a href=http://www.cyndar...et><b>cheap replica louis vuitton</b></a> <a href=http://www.redmon...t/><b>louis vuitton replica wallets</b></a> <a href=http://www.wildgr...><b>replica louis vuitton bags</b></a> <a href=http://www.casare...tm><b>cheap new louis vuitton bags 2014 malaysia</b></a> <a href=http://latesteboo...html><b>buy 2014 cheap louis vuitton handbags from official online store enjoy free tax</b></a> <a href=http://www.redmon...t/><b>louis vuitton replica wallets</b></a> <a href=http://www.redmon...es/><b>mens replica louis vuitton mens shoes</b></a> <a href=http://www.canoec...t;<b>excellent charming louis vuitton replica shoes for sale at the reasonable price</b></a> <a href=http://www.ourjun...om><b>large quantity stock of louis vuitton outlet on sale for cheap with free shipping</b></a>
    replica louis vuitton belt http://www.avingtonplace.com

  7. ~jhprqcet ─ 21.03.2014

    WWW by Zajec (Rafał Miłecki)
    jhprqcet http://www.g2393c...8mebl7478i5j0ps.org/
    <a href="http://www.g2393c...;ajhprqcet</a>

  8. ~Hogan DONNA ─ 24.03.2014

    Abercrombie Homme
    lou bouti
    oakley straight jacketoakley ski pants
    Buy A Louis Vuitton
    christian louboutin pas cher
    ray ban tortoiseray ban boyfriend sunglasses
    Louis Vuitton Small Wallet
    cheap oakley sunglasses for men
    グッチ 財布 メンズ シマライン
    chaussures louboutin
    chaussure louboutin pas cher
    レイバン ティアドロップ 似合う
    oakley kidsoakley men sunglasses
    Louis Vuitton Shoes For Kids
    オークリー 修理
    air max 95 pas cher
    マイクロソフト ダウンロード 無料
    Louboutin Chaussures
    Hogan Sito Ufficiale
    fake ray bans for salecheap ray ban wayfarerscheap ray ban wayfarer sunglasses
    ray ban sunglasses cheap
    christian louboutin homme
    chaussure louboutin
    oakley jacketsoakley swimwear
    louboutin femme
    Hogan DONNA

  9. ~christian louboutin homme ─ 24.03.2014

    oakley shortssports sunglasses
    chaussure louboutin
    Where To Buy Louis Vuitton Cheap
    oakley restlessoakley prescription sunglasses
    cheap ray banscheap ray ban eyeglassescheap ray ban sunglasses
    louboutin prix
    chaussure louboutin pas cher
    ガガミラノ 海外腕時計
    Veste Abercrombie
    sunglass oakleyoakley radar sunglasses
    hogan outlet
    ray ban outlet onlinecheap aviator sunglassescheap ray ban sunglasses for men
    new balance mt100
    Borse Louis Vuitton Outlet
    グッチ 長財布 ジッパー
    oakley thumpoutlet nike
    louboutin femme
    air max pas cher femme
    Kontent Machine 3
    escarpins louboutin
    louboutin prix
    cheap oakley polarized sunglassesoakley shirts
    burberry bags
    oakley polarized sunglassesoakley socks
    ray ban olympiankids ray bans
    Veste Abercrombie Homme
    マイクロソフト パブリッシャー 使い方
    louboutin prix
    オークリー タレックス レンズ
    cheap polarized sunglassesoakley x squared
    oakley polarized sunglassesoakley canteen sunglasses
    cheap aviatorscheap ray ban sunglassesray bans wayfarer cheap
    Selling A Louis Vuitton Handbag
    Wholesale Louis Vuitton Handbags
    gaga 腕時計 コピー トリーバーチ
    cheap ray ban wayfarer
    Official Louis Vuitton Website
    christian louboutin pas cher
    oakley gascan soakley mars
    レイバン メガネ 店
    louboutin prix
    Hogan Italia
    christian louboutin homme

  10. ~グッチ バッグ 送料 無料 ピアチェーレ ─ 25.03.2014

    Louis Vuitton Wallet For Women
    microsoft 公式
    louis vuitton バッグ
    timberland 腕時計
    Louis Vuitton Cheap
    Cheap Louis Vuitton Handbags Replica
    Devin Santos
    burberry bags
    レイバン ルミ
    レイバン サングラス 格安
    ガガミラノ メンズウォッチ
    レイバン 黒縁メガネ 人気
    グッチ バッグ 送料 無料 ピアチェーレ

  11. ~mac office 価格 ─ 25.03.2014

    Cheap Louis Vuitton Bags Replica
    GSA search engine ranker
    burberry bags
    レイバン ウェイファーラー コレクション
    Damier Louis Vuitton Purse
    グッチ アウトレット りんくう
    ヴィトン アズール バッグ
    Replica Louis Vuitton Handbags
    gaga 時計 ショップ
    レイバン サングラス 人気モデル
    ray-ban ウェイファーラー
    mac office 価格

  12. ~Choose newest 2014 World Cup Croatia Jerseys Online Sale ─ 13.04.2014

    http://andrewsleisure.co.uk/prices.php http://aquila-tc.co.uk/faq/default.asp http://villaroyal.co.uk/scrolling.php http://baf.safmarine.com/fcktempla.asp
    Choose newest 2014 World Cup Croatia Jerseys Online Sale

  13. ~nike スニーカー 日本未発売 ─ 22.04.2014

    GSA search engine ranker
    ralph lauren outlet
    ナイキ スニーカー 白 ハイカット
    ray ban aviators sale
    ray ban aviator
    celine ラゲージ 赤
    celine 財布 中古
    ナイキ ゴルフ ウェッジ

  14. ~tee shirt ralph lauren femme ─ 23.04.2014

    tee shirt ralph lauren femme

  15. ~cheap belt outlet ─ 23.04.2014

    cal king Critics of the bill called it an unnecessary measure that had little to do with public safetytogether with tanker Instead, they cast the measure as open to abuse by officials with an anti since the beginning abortion agenda who might use increased latitude for inspections to interfere with clinic operations
    cheap belt outlet

  16. ~tiffany bracelets on sale ─ 23.04.2014

    tiffany bracelets on sale

  17. ~cheap christian louboutin sale ─ 23.04.2014

    <a href="http://funnewzeal...art-2/">shop michael kors handbags</a> <a href="http://www.joinch...com">replica christian louboutin boots</a> <a href="http://www.sweetc....com/">louis vuitton outlet store usa</a> <a href="http://www.southe...n.php">louis vuitton cheap belts</a> <a href="http://www.southe...t.php">louis vuitton outlet houston</a> <a href="http://www.moiolt...p">christian louboutin over the knee boots</a> <a href="http://www.bonniecash.com">cheap authentic christian louboutin shoes</a> <a href="http://bonniecash...php">maillot black christian louboutin sz. 7</a> cheap christian louboutin shoes cheap red bottom pumps christian louboutin sale christian louboutin sale outlet women christian louboutin shoes christian louboutin red bottoms replica christian louboutin heels sale red bottom heels christian louboutin flats shoes Christian Louboutin Sandals christian louboutin galaxy christian louboutin pigalle flat discount christian louboutin sale gucci belt sale gucci bags sale authentic gucci outlet gucci purses sale wholesale gucci belts gucci handbags wallets authentic gucci cheap gucci purses tory burch flats outlet tory burch sale cheap tory burch shoes tory burch wallets tory burch sandals fake cheap tory burch outlet tory burch handbags outlet fake oakleys wholesale oakley factory outlet discount real oakley sunglasses replica oakley radar oakley sunglasses for sale michael kors outlet handbags] michael kors handbags outlet michael kors tote bags michael kors belts michael kors purses dillards cheap michael kors wallets michael kors mens watches michael kors handbag sale louis vuitton outlet store louis vuitton speedy bag cheap louis vuitton belts louis vuitton purses outlet louis vuitton wallet fake louis vuitton mens belts authentic louis vuitton bags replica louis vuitton belts nike air max 2013 kids hollister kids sale discount hollister clothing hollister jeggings hollister sweatpants men mens hollister shirts discount hollister clothing hollister jeans cheap hollister uk cheap christian louboutin outlet red bottoms on sale christian louboutin outlet real christian louboutin sale christian louboutin sale shoes replica christian louboutin mengs christian louboutin heels on sale red bottom heels outelt christian louboutin flats sale Christian Louboutin Sandals christian louboutin galaxy pumps christian louboutin pigalle red cheap christian louboutin wedges gucci belt sale gucci hobo bag authentic gucci outlet gucci purse sale gucci belt buckle gucci wallets women authentic gucci cheap gucci backpack tory burch flats outlet tory burch bag sale tory burch shoes tory burch bag cheap tory burch flats tory burch sandals outlet cheap tory burch bags tory burch handbags cheap cheap fake oakley sunglasses fake oakley holbrook oakley outlet store discount oakley sunglasses outlet oakley sunglasses sale usa cheap michael kors outlet] michael kors outlet allen michael kors bag michael kors belts online michael kors aviator sunglasses michael kors women's watches michael kors sale bags louis vuitton outlet sale louis vuitton bag sale cheap louis vuitton luggage louis vuitton purses outlet louis vuitton wallet replica louis vuitton mens belts replica louis vuitton bags louis vuitton sale bags nike air max 2013 cheap hollister kids sale hollister sales discount hollister clothing hollister red jeggings men hollister sweatpants hollister shirts wholesale hollister jeans hollister uk hollister outlets <a href="http://www.insigh...6">christian louboutin cork peep toe wedge</a> <a href="http://www.sushin...4">christian louboutin bibi 140mm leather pumps black</a> <a href="http://www.concor...12">designer of red bottom shoes</a> <a href="http://www.insigh...4">christian louboutin cork peep toe shoes with tight</a> <a href="http://www.bigals...5">christian louboutin candy flats shoes wholesale lo</a>
    cheap christian louboutin sale

  18. ~MCM 財布 新作 ─ 23.04.2014

    <a href="http://cheaphandb...iagreenberg.com/mcm/ ">MCM 財布 新作</a>夏人気ITEM http://cheaphandb...iagreenberg.com/mcm/
    MCM 財布 新作

Nowy komentarz