| View previous topic :: View next topic |
| Author |
Message |
hlide
Joined: 10 Sep 2006
Posts: 750
|
 Posted: Mon Dec 04, 2006 8:09 am Post subject: ME processor : 0x84000000-0x841FFFFF is a RAM-like region |
 |
|
Okay, I played with ME.
I first tried to access this address 0x04000000 on ME processor but get a bus error. I tried to access this another address 0x84000000 and it works ! I can have the value at this address increasing.
Okay what could this address be ? a mirror from 0x80000000 (internal 2MB RAM of ME processor) ? so i tried to increase the value in both addresses and let SC get their values to compare them, they are totally different, so they don't point on the same physical address. Trying to access 0x83FFFFFC and 0x84200000, I got a bus error, so there is a valid address range between 0x84000000 and 0x84200000 non included, 2 MB long. What's the hell may this memory be ? i wonder...
EDIT:
very weird region, it seems only accessible as a cached memory, when trying to access this region as a uncached memory I got a bus error.
EDIT2:
ok, since this region is only accessible via cached memory, I tried to fool the cache by doing it in ME processor :
while (1)
{
...
*pctr2 = vptr2[0];
vptr2[0] = vptr2[0] + 1;
vptr2[0x400] = 0;
vptr2[0x800] = 0;
}
where vptr2 points to 0x84000000;
normally vptr2[0x400] and vptr2[0x800] should discard value of vptr2[0] in cache. Indeed pctr2 doesn't increase anymore whereas it should do so !
weirder i got a value of 0x0000001a.
So we have a phantom RAM between 0x84000000-0x841FFFFF here ! |
|
| Back to top |
|
 |
J.F.
Joined: 22 Feb 2004
Posts: 2906
|
| Posted: Mon Dec 04, 2006 9:15 am Post subject: |
|
|
| Well, this is the video ram on the main cpu. Maybe on the ME, you can only access vram through the cached segment. |
|
| Back to top |
|
|
hlide
Joined: 10 Sep 2006
Posts: 750
|
| Posted: Mon Dec 04, 2006 10:03 am Post subject: |
|
|
| J.F. wrote: | | Well, this is the video ram on the main cpu. Maybe on the ME, you can only access vram through the cached segment. |
i don't think so, the fact you lose the data after writing back the cache seems to indicate that you can write on ME cache at this address instead of getting a bus error and read it but still there is no permanent storage where cache could write back if necessary. This is why I talking about a PHANTOM "RAM".
Maybe this region has something to have with a PSP for development purpose and would point to nowhere in a standard PSP.
Or you may need to activate this region to access it properly. Still the fact we don't trigger a bus error is weird in that case.
when ME cache fetches words after forced writeback :
0x84000000 -> 0x0000001a
0x84000004 -> 0x00000000
0x84000008 -> 0x00000000
since I increase their values before forcing ME cache to writeback them, they should increase their value. Instead of that, they are not increasing because their value is seemingly written back to nowhere.
Anyway, i'm quite disappointed, this region has no interest. |
|
| Back to top |
|
|
J.F.
Joined: 22 Feb 2004
Posts: 2906
|
| Posted: Mon Dec 04, 2006 10:19 am Post subject: |
|
|
If you don't force the cache, what happens? Maybe this is a special form of scratch pad ram using the cache in the the ME... it gives you XXX amount of space that acts like ram, but is in the cache, so you have a small, VERY fast, section of ram to use for frequent data.
Try writing an increasing number to an increasing address and see if what you read back mirrors after a certain range. Find out how large the area you really can use is. |
|
| Back to top |
|
|
hlide
Joined: 10 Sep 2006
Posts: 750
|
| Posted: Mon Dec 04, 2006 5:43 pm Post subject: |
|
|
As I told there is no point to use it because it IS very dangerous. If you don't force the cache and if you're not accessing another address else 0x84000000 which can conflicts in cache , yes its value keeps increasing because nothing is disturbing the cache. But if you use a more complex program which has a better probability to disturb the cache, the value at that address is unreliable. Worse, if you have some asynchronous events occuring (exceptions like SC processor signaling ME processor) you may greatly have an undetermined behavior of the cache too.
as a result, you mustn't rely on a cache contents without a REAL writeback storage to have "a small, VERY fast, section of ram to use for frequent data." |
|
| Back to top |
|
|
groepaz
Joined: 01 Sep 2005
Posts: 305
|
|
| Back to top |
|
|
hlide
Joined: 10 Sep 2006
Posts: 750
|
| Posted: Tue Dec 05, 2006 4:17 am Post subject: |
|
|
| groepaz wrote: | | maybe this is something like "locked cache" on ppc? |
You need to use a cache instruction to do so, and you need to be sure that nothing is calling an INVALIDATE or INDEX UNLOCK cache operation at the same address.
| Code: |
// FILL AND LOCK 0x84000000
asm volatile("cache 0x1F, %0" : : "m"(*vptr2) : "memory");
while(1)
{
long long x;
for (x = 0; x < 50*1024*1024; x ++); // sleep a little bit
(*pctr1) = (*vptr1); // witness to be sure ME is running
*vptr1 = *vptr1 + 1;
(*pctr2) = (*vptr2);
vptr2[0] = vptr2[0] + 1; // try to increase its value
vptr2[0x400] = 0;
vptr2[0x800] = 0xffffffff;
}
|
and yes now i can see the value at 0x84000000 increasing |
|
| Back to top |
|
|
J.F.
Joined: 22 Feb 2004
Posts: 2906
|
| Posted: Tue Dec 05, 2006 4:23 am Post subject: |
|
|
| I was thinking it's more like the cache in the SH processors. They have a special mode where half the cache becomes a special scratch pad at a certain address. There's no real memory, just the cache, but it's completely safe to use it as if it were memory (but no DMA, cpu access only). |
|
| Back to top |
|
|
hlide
Joined: 10 Sep 2006
Posts: 750
|
| Posted: Tue Dec 05, 2006 4:32 am Post subject: |
|
|
| J.F. wrote: | | I was thinking it's more like the cache in the SH processors. They have a special mode where half the cache becomes a special scratch pad at a certain address. There's no real memory, just the cache, but it's completely safe to use it as if it were memory (but no DMA, cpu access only). |
ohh that, i remember so. But here i'm doubtful that we have a 2MB cache ! |
|
| Back to top |
|
|
dot_blank
Joined: 28 Sep 2005
Posts: 498
Location: Brasil
|
| Posted: Tue Dec 05, 2006 7:48 am Post subject: |
|
|
this might prove to be very useful :)
_________________
10011011 00101010 11010111 10001001 10111010 |
|
| Back to top |
|
|
J.F.
Joined: 22 Feb 2004
Posts: 2906
|
| Posted: Tue Dec 05, 2006 1:34 pm Post subject: |
|
|
| hlide wrote: | | J.F. wrote: | | I was thinking it's more like the cache in the SH processors. They have a special mode where half the cache becomes a special scratch pad at a certain address. There's no real memory, just the cache, but it's completely safe to use it as if it were memory (but no DMA, cpu access only). |
ohh that, i remember so. But here i'm doubtful that we have a 2MB cache ! |
I didn't figure it filled the whole space. More like 2K mirrored many times over the 2M space. That's why I asked if you saw some kind of wrap boundary. For example, let's assume it was only 2K. If you write out 64K of data, only the last 2K would be seen mirrored over and over on 2K blocks. |
|
| Back to top |
|
|
hlide
Joined: 10 Sep 2006
Posts: 750
|
| Posted: Tue Dec 05, 2006 4:48 pm Post subject: |
|
|
Here is what you can read between 0x84000000-0x840FFFFF :
| Code: |
1A 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
notice they have the same 64-byte pattern (does a cache line contain 64 bytes ?)
and between 0x84100000-0x841FFFFF :
| Code: |
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
Now i use this code on ME processor :
| Code: |
int i = 0;
int j = 0;
(*pctr1) = (int)0;
while(1)
{
long long x;
(*pctr2) = (*vptr2);
vptr2[0] = vptr2[0] + i++;
vptr1[0] = vptr2[0];
vptr1++;
vptr2++;
if ((int)vptr2 == 0x84200000)
{
if (++j == 2)
{
(*pctr1) = (int)-1;
for (;;);
}
vptr2 = (volatile unsigned int *)(0x84000000);
i = 0;
}
}
|
so there are 2 passes, if there is a real storage i would have their values increases twice. But i got this :
| Code: |
1A 00 00 00 01 00 00 00 02 00 00 00 03 00 00 00
1E 00 00 00 05 00 00 00 06 00 00 00 07 00 00 00
22 00 00 00 09 00 00 00 0A 00 00 00 0B 00 00 00
26 00 00 00 0D 00 00 00 0E 00 00 00 0F 00 00 00
2A 00 00 00 11 00 00 00 12 00 00 00 13 00 00 00
2E 00 00 00 15 00 00 00 16 00 00 00 17 00 00 00
32 00 00 00 19 00 00 00 1A 00 00 00 1B 00 00 00
36 00 00 00 1D 00 00 00 1E 00 00 00 1F 00 00 00
and so on
|
as if there is only one pass. So my hunch would be that : what we see is the contents of a cache line which are never written back (so you need absolutely to use "cache 31, %0" to lock the cache line at the address you are interested with).
I'm doubtful that Sony adds a possibility to use half of a cache as a extermely fast small ram. Sony really sucks with the poor design of the scratch pad (it should have been an internal memory but it isn't) so I'm pretty sure they don't even bother with having such a possibility.
EDIT:
oh sorry ! i did a mistake on my code i forgot to increase their values the right way ://////
i corrected the code but the result is the same anyway. |
|
| Back to top |
|
|
hlide
Joined: 10 Sep 2006
Posts: 750
|
| Posted: Wed Dec 06, 2006 10:34 am Post subject: |
|
|
| address starting at 0xA0000000 is readable too, there is a lot of pattern but i don't think it is vram. |
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
