From: Michel Lanners <hidden> Date: 2000-08-30 13:44:03
Hi Gabriel,
All the OF I have seen had the capability to build new words in asm, with
a `code' definition IIRC. Maybe Apple's OF are crippled ?
Apple's OF seems to have that capability as well (I think, guess and hope ;-).
However, it does _not_ seem to have an assembler built-in. The 'code' word
is defined all right.
On one of my MVME2600 boxes (the only one which I can still switch to Open
Bug^WFirmware):
ok see hid0@
code hid0@
e49110 stwu r28,-4(r31)
e49114 mfspr r28,hid0
e49118 bcctr always
When I do a 'see hido@', I only get:
>0 see hid0@ code hid0 ok
>0
What I can do is look at the hex dump of the hid0@ word, and that gives me asm
statements like for you (except that in Apple's OF, r20 holds the top stack
item ;-). The fact that ' ' hid0@ dis' gives me a hex dump and not a
disassembly is another evidence that Apple's OF doesn't know anything about
asm....
ok see hid0!
code hid0!
e4912c sync
e49130 isync
e49134 mtspr hid0,r28
e49138 isync
e4913c sync
e49140 lwz r28,0(r31)
e49144 addi r31,r31,4
e49148 bcctr always
ok
Apple's code looks very similar....
The syntax to build with an unknwown SPR is strange:
code ictc@
stwu r28,-4(r31)
33f mfspr r28,*
bcctr 20,0
generates the correct code, since I don't have ictc spr defined.
Otherwise mfspr 28,ictc might work.
I will try this tonight, but I doubt I will be able to enter this as asm
words. Do you know the alternate syntax? Would something lime this work:
code 60000000 l, 6000000 l,
as a sequence of 2 NOP's? How do you terminate a 'code' sequence?
Thanks a lot
Michel
--
.sig eater at work
** Sent via the linuxppc-dev mail list. See http://lists.linuxppc.org/
From: Gabriel Paubert <hidden> Date: 2000-08-30 14:05:50
Hi Michel,
quoted
All the OF I have seen had the capability to build new words in asm, with
a `code' definition IIRC. Maybe Apple's OF are crippled ?
Apple's OF seems to have that capability as well (I think, guess and hope ;-).
However, it does _not_ seem to have an assembler built-in. The 'code' word
is defined all right.
You don't have any ppc-assembler vocabulary or similar, then ?
When I do a 'see hido@', I only get:
>0 see hid0@ code hid0 ok
>0
Ok, how can something this close to the machine be delivered without an
assembler ?
What I can do is look at the hex dump of the hid0@ word, and that gives me asm
statements like for you (except that in Apple's OF, r20 holds the top stack
item ;-). The fact that ' ' hid0@ dis' gives me a hex dump and not a
disassembly is another evidence that Apple's OF doesn't know anything about
asm....
Well, sincee you can type in hex, there is still some hope...
quoted
The syntax to build with an unknwown SPR is strange:
code ictc@
stwu r28,-4(r31)
33f mfspr r28,*
bcctr 20,0
generates the correct code, since I don't have ictc spr defined.
Otherwise mfspr 28,ictc might work.
I will try this tonight, but I doubt I will be able to enter this as asm
words. Do you know the alternate syntax? Would something lime this work:
code 60000000 l, 6000000 l,
I think so, let me try:
ok code ictc@ ok 979ffffc l, 7f99faa6 l, 4e800420 l, ;code
ok see ictc@
code ictc@
edcc5c stwu r28,-4(r31)
edcc60 mfspr r28,spr1017
edcc64 bcctr always
ok ictc@ .
264d2
ok
It just works and returns garbage on a 603e, everytime a different value.
as a sequence of 2 NOP's? How do you terminate a 'code' sequence?
Oops, forgot about it, my bad. With ';code', isn't it obvious ?
Gabriel.
** Sent via the linuxppc-dev mail list. See http://lists.linuxppc.org/
From: Michel Lanners <hidden> Date: 2000-08-30 21:38:24
Hi all,
Yep, it works! I can boot off mesh again ;-)
On 30 Aug, this message from Gabriel Paubert echoed through cyberspace:
quoted
Apple's OF seems to have that capability as well (I think, guess and hope ;-).
However, it does _not_ seem to have an assembler built-in. The 'code' word
is defined all right.
You don't have any ppc-assembler vocabulary or similar, then ?
Nope. Definitely not. We have hexdump and l, , isn't that enough? No
real hacker would use an assembler; thats for lamers ;-)
Ok, how can something this close to the machine be delivered without an
assembler ?
See above ;-))
Well, sincee you can type in hex, there is still some hope...
Hex worked.
quoted
I will try this tonight, but I doubt I will be able to enter this as asm
words. Do you know the alternate syntax? Would something lime this work:
code 60000000 l, 6000000 l,
I think so, let me try:
ok code ictc@ ok 979ffffc l, 7f99faa6 l, 4e800420 l, ;code
ok see ictc@
code ictc@
edcc5c stwu r28,-4(r31)
edcc60 mfspr r28,spr1017
1017 is actually l2cr, but never mind...
edcc64 bcctr always
ok ictc@ .
264d2
ok
quoted
How do you terminate a 'code' sequence?
Oops, forgot about it, my bad. With ';code', isn't it obvious ?
Hm, doesn't work in Apple's OF 1.0.5. end-code is the answer ;-). Here
is my ictc! implementation, if anyone's interested:
code ictc!
7e9bfba6 l, 829f0000 l, 3bff0004 l, 4e800020 l,
end-code
That is roughly this in asm:
mtictc r20 (or mtspr 1019,r20)
lwz r20,0(r31)
addi r31,r31,4
blr
Verifyed to slow the system on a busy loop:
: loop
begin
1- dup 0<
until
drop
;
11 ictc! slows this loop by a factor of 4.
Now, go figure why this helps the MESH driver... It seems to use some
busy loop timing somewhere; however there is the ms word available which
uses the timebase and is accurate even on my upgraded box.... That would
have been the better choice, unless the driver uses sub-1ms loops. Which
would explain...
Anyway, thanks for your help, Gabriel!
Cheers
Michel
-------------------------------------------------------------------------
Michel Lanners | " Read Philosophy. Study Art.
23, Rue Paul Henkes | Ask Questions. Make Mistakes.
L-1710 Luxembourg |
email mlan@cpu.lu |
http://www.cpu.lu/~mlan | Learn Always. "
** Sent via the linuxppc-dev mail list. See http://lists.linuxppc.org/
From: Gabriel Paubert <hidden> Date: 2000-08-31 07:52:23
On Wed, 30 Aug 2000, Michel Lanners wrote:
Hi,
Yep, it works! I can boot off mesh again ;-)
Glad it helped...
quoted
ok code ictc@ ok 979ffffc l, 7f99faa6 l, 4e800420 l, ;code
ok see ictc@
code ictc@
edcc5c stwu r28,-4(r31)
edcc60 mfspr r28,spr1017
1017 is actually l2cr, but never mind...
Right, anyway the 603e has neither ictc nor l2cr so I presume it would
work in ay case...
quoted
quoted
How do you terminate a 'code' sequence?
Oops, forgot about it, my bad. With ';code', isn't it obvious ?
Hm, doesn't work in Apple's OF 1.0.5. end-code is the answer ;-). Here
is my ictc! implementation, if anyone's interested:
You've just got to love OF portability across machines and architecture
independance :-( Add to this the fact that I have somewhere a FirmWorks
document which claims that on PPC the top of the stack is always in r28,
r20/r21 are scratch registers. r31 is still the stack pointer (and r30 the
return stack AFAIR).
11 ictc! slows this loop by a factor of 4.
Now, go figure why this helps the MESH driver... It seems to use some
busy loop timing somewhere; however there is the ms word available which
uses the timebase and is accurate even on my upgraded box.... That would
have been the better choice, unless the driver uses sub-1ms loops. Which
would explain...
Indeed, to find it you might simply try to `see' all the words in the mesh
driver, but it may be large. BTW there is another interesting word in my
OF (apart from the even more interesting bugs ;-)):
' some_word .calls
will show all Forth words which call some_word (with a few false positives
to make things more entertaining). Does Apple's OF have something similar
or is it also crippled ?