How does the pad patch work ?

[shazz]

Hi,
Just very curious about the swiss low level stuff which really impresses me. Could you explain me how the pad patch works ?

• Where is the caller of CheckStatus(chan, status) ?
• is OSResetSystem(OS_RESET_RESTART, 0, 0); triggering the restart of swiss? How does it work (resident? OS pointer ?...)

Thanks!

[Extrems]

• It is PADRead. The call is inserted where status->button &= ~PAD_USE_ORIGIN; originally was.
• This normally load the disc's apploader which loads the game again, but our hypervisor is intercepting the read so that it loads our own apploader instead.

[shazz]

Sorry I'm a bit slow :) Feel free to tell me "find by yourself" :)

• It is PADRead. The call is inserted where status->button &= ~PAD_USE_ORIGIN; originally was.

PADRead.... so if I understand well:

Now what exactly is PADRead? Well, it reads out the gamecube controller plugged in, updating whatever buttons you press or analog sticks you move. The actual controller update type though can theoretically vary depending on the gamecube revision, early development models and such actually had a different setup for updating the controls and even though retail units I think always use the same function, the gamecube software development kit always has this function on a pointer for what I can only assume maximum backwards compatibility, just in case such an alternative type is needed. This pointer gets set by PADSetSpec right when the game first boots up and then never touched again.
Thanks to the gamecube software development kit being statically linked into memory, the address used for that set by PADSetSpec never changes. [from FIX94]

So that's an system call or something like that loaded at boot. Do you patch PADRead to call CheckStatus?

What represents #define PAD_USE_ORIGIN 0x0080 ? (I guess 8th bit set but...)

• This normally load the disc's apploader which loads the game again, but our hypervisor is intercepting the read so that it loads our own apploader instead.

Where is this interceptor code?

About OSResetSystem, when a program is executed from swiss and call exit(0), does it call sth like OSResetSystem(OS_RESET_HOTRESET, 0, 0); ?

[Extrems]

PADRead is part of the PAD library of the Dolphin SDK, which games are statically linked with. The libogc equivalent is PAD_Read.

The intercept is here: https://github.com/emukidid/swiss-gc/blob/master/cube/patches/base/blockdevice.c#L71-L74

libogc: https://github.com/devkitPro/libogc/blob/master/libogc/system.c#L261-L268
libogc2: https://github.com/extremscorner/libogc2/blob/master/libogc/system.c#L255-L296

[shazz]

One step at a time...

libogc

In the original code, what means to set 0 at 0xCC003024 ?
I just found that:

0xCC003024 | 4 | ?/? | Reset?
-- | -- | -- | --
Writing anything here seems to cause a complete reset.

libogc2

your code looks to be a little more interesting... if I understand well:
if 0x5354554248415858ULL (STUBHAXX) is written at 0x80001808 (exception vector)

• then the systems performs a SYS_SHUTDOWN,
• stops all threads,
• ack exceptions (__exception_closeall())
• triggers reload located at the first unused exception handler at 0x80001800
• call __reset (from system_asm.S, not sure what it does...)

What is located at 0x80001800? Does swiss set something there ?
Which part of the code sets STUBHAXX?

Did I understand well ?

Interceptor

	if ((*VAR_IGR_TYPE & 0x80) && offset == 0x2440) {
		*VAR_CURRENT_DISC = FRAGS_APPLOADER;
		*VAR_SECOND_DISC = 0;
	}

that's only for block devices no? If I execute a DOL from swiss, the custom hackloader won't be called ?

[Extrems]

In the original code, what means to set 0 at 0xCC003024 ?

This trigger a system + memory + disc interface reset.

What is located at 0x80001800? Does swiss set something there ?

Yes, we provide a reload stub since v0.5r990. The magic word was shifted up from where it is on Wii so that we could provide compatibility with the older PSOload/SDload standard.

Which part of the code sets STUBHAXX?

https://github.com/emukidid/swiss-gc/blob/master/cube/patches/stub/crt0.S#L43

that's only for block devices no?

It's present in the perform_read for each device type.

If I execute a DOL from swiss, the custom hackloader won't be called ?

The Swiss hypervisor only support Dolphin SDK software.

[shazz]

By Dolphin SDK software I guess you meant official SDK. So probably easier in my case, as I'd like to intercept the reset from a libogc/libogc2 program to go back to my loader (USB Gecko/BBA Loader).

In this piece of code (https://github.com/crtc-demos/the-scary-demo/blob/master/filemgr.c) it does:

static void return_to_loader (void)
{
    void (*reload)() = (void(*)()) 0x80001800;
    reload ();
}

int main (int argc, char **argv)
{
    ...
    /* Hopefully this will trigger if we exit unexpectedly...  */
    atexit (return_to_loader);    
   ....
   return_to_loader ();

  return 0;
}

How can I set a pointer to USB Gecko/BBA Loader in this first exception vector (0x80001800) ? It looks like you're doing something similar in libogc2 when exiting...

[Extrems]

Anytime you're still in control. Could be at the very beginning.

[shazz]

Ok I was concerned the SYS_SHUTDOWN may wipe the memory/vectors.

Practically, what is the easiest way to get the exception vector set up? As in your makefile, to get the result on the bin2s command and then instead of patching the DOL, do a memcpy of its content at `0x80001800-0x80003000' ?

[Extrems]

memcpy, DCFlushRange, ICInvalidateRange. We don't patch homebrew executables either.

[shazz]

something like that ?

extern u8 stub_bin[];
extern u32 stub_bin_size;

int installStub() {

	void * dst = (void *) 0x80001800;

	// Copy LoaderStub to 0x80001800
	if (((u32)dst + stub_bin_size) > 0x80003000) return 1;

	memcpy(dst, stub_bin, stub_bin_size);

	DCFlushRange(dst, stub_bin_size);
	ICInvalidateRange(dst, stub_bin_size);

	return 0;
}

[Extrems]

Sure.

[shazz]

Ah ah it works !!! So great :D
Thanks! I owe you a beer!

Any example on how to catch a push on the RESET button?
I mean not using SYS_ResetButtonDown but to set a callback if the reset button is pushed (and possibly the current program doesn't respond) to my reload stub.

[Extrems]

• Yes, that's what __reload is for.
• It's still broken at this time, and it can't be fixed now that devkitPPC is shipping an older version of gdb that doesn't support the DWARF format used by current GCC.
• You should be using a devoptab.

[shazz]

about __reload, yeah I saw that in the code but in practice I added a /0 in my test program, the exception dump happens

Exception (Program) occured!
...

STACK DUMP:
80004a20 --> ...
Reset

But nothing happens after, stuck there, even the reset button doesn't go back to my loader

Any idea why ?

[shazz]

about devoptab... I feel dumb, no clue what it is :)
Is it to add the equivalent of this code but for the BBA ?

from /libogc2/libogc/console.c

void CON_EnableGecko(int channel,int safe)
{
	if(channel && (channel>1 || !usb_isgeckoalive(channel))) channel = -1;

	__gecko_status = channel;
	__gecko_safe = safe;

	if(__gecko_status!=-1) {
		devoptab_list[STD_OUT] = &dotab_stdout;
		devoptab_list[STD_ERR] = &dotab_stdout;

		// line buffered output for threaded apps when only using the usbgecko
		if(!curr_con) {
			setvbuf(stdout, NULL, _IOLBF, 0);
			setvbuf(stderr, NULL, _IOLBF, 0);
		}
	}
}

[Extrems]

Don't press the A Button, press the Z Button or Reset Button. That path might be broken.

[shazz]

ok works with Z. Bug for you :)
Maybe better to print explicitly which button to push

[shazz]

Any comment on my previous question on devoptab before I go down the rabbit hole? :D

I also found dotab_stdnet in lwip/network.c but not used

[Extrems]

The devoptab system is basically a dispatcher for Newlib file I/O syscalls that enable support for multiple devices.

[shazz]

I checked... not obvious at all, do you have a good example I could look like (for example if this is used for USB Gecko ?)
Should it be done within libogc2 or outside ?

[Extrems]

It's already used for the USB Gecko and terminal emulator.
It should be done outside.

[shazz]

Come on :) Tell me a little bit more or point me to a good example :)
Here is my current bba_debug code (simple UDP client) I added to your libogc2 console example, what should I add to make it a devoptab?

link: bba_debug.c

Why is this code commented? lwip/netio.c

[shazz]

something like that? (Quick hack just to see if I'm on the good track)

#include <stdio.h>
#include <stdarg.h>
#include <string.h>
#include <network.h>
#include <errno.h>
#include <ogcsys.h>
#include <sys/iosupport.h>

#include "exi.h"
#include "bba_debug.h"

// --------------------------------------------------------------------------------
//  INTERNAL DECLARATIONS
//---------------------------------------------------------------------------------
int open_udp_socket(int port, char * server_ip);
int netudp_write(struct _reent *r, void *fd, const char *ptr, size_t len);

// --------------------------------------------------------------------------------
//  GLOBALS
//---------------------------------------------------------------------------------
s32 sock = -1;
bool devoptab_is_enabled = false;

//---------------------------------------------------------------------------------
//
//---------------------------------------------------------------------------------
const devoptab_t dotab_stdudp = {
    "stdudp",     // device name
    0,            // size of file structure
    NULL,         // device open
    NULL,         // device close
    netudp_write, // device write
    NULL,         // device read
    NULL,         // device seek
    NULL,         // device fstat
    NULL,         // device stat
    NULL,         // device link
    NULL,         // device unlink
    NULL,         // device chdir
    NULL,         // device rename
    NULL,         // device mkdir
    0,            // dirStateSize
    NULL,         // device diropen_r
    NULL,         // device dirreset_r
    NULL,         // device dirnext_r
    NULL,         // device dirclose_r
    NULL,         // device statvfs_r
    NULL,         // device ftrunctate_r
    NULL,         // device fsync_r
    NULL,         // deviceData;
};

//---------------------------------------------------------------------------------
// Configure BBA
//---------------------------------------------------------------------------------
int setup_bba_logging(int port, char* ip_address, bool use_kprintf, bool use_printf) {

	char localip[16] = {0};
	char gateway[16] = {0};
	char netmask[16] = {0};
	int ret = 1;

	// allow 32mhz exi bus
	*(volatile unsigned long*)0xcc00643c = 0x00000000;
	ipl_set_config(6);

	printf("Checking BBA\n");
	if(exi_bba_exists()) {

		printf("Configuring network...\n");
		ret = if_config( localip, netmask, gateway, TRUE);
		if(ret < 0) {
			printf("BBA network stack not configured!\n");
			return -1;
		}
		printf("Network configured IP: %s, GW: %s, MASK: %s\n", localip, gateway, netmask);
	}
	else {
		printf("BBA not found!!!!\n");
		return -1;
	}

    printf("Creating socket\n");
    // assuming path is a string containing the IP address and not a hostname
    if (open_udp_socket(port, ip_address) < 0)
        return -1;

    if(use_printf || use_kprintf) {

        printf("Replacing devoptab_list entries for stdout/stderr\n");

        // update newlib devoptab_list with this devoptab
        if(use_printf)
            devoptab_list[STD_OUT] = &dotab_stdudp;
        if(use_kprintf)
            devoptab_list[STD_ERR] = &dotab_stdudp;

        devoptab_is_enabled = true;

        // Traces tests
        kprintf("[kprintf] BBA traces enabled\n");
        printf("[printf] BBA traces enabled\n");
    }

	return 1;
}

//---------------------------------------------------------------------------------
// Close UDP Socket
//---------------------------------------------------------------------------------
void close_bba_logging() {
	net_close(sock);
}

//---------------------------------------------------------------------------------
// Print on the remote terminal
//---------------------------------------------------------------------------------
int bba_printf(const char *fmt, ...) {
	char temp[1026];
	va_list ap;
	int rc;

	va_start(ap, fmt);
	rc = vsnprintf(temp, sizeof (temp), fmt, ap);
	va_end (ap);

	if (net_send(sock, temp, strlen (temp), 0) < 0) {
		printf("Cannot send UDP packet\n");
	}

	return rc;
}


//---------------------------------------------------------------------------------
// Internals
//---------------------------------------------------------------------------------

//---------------------------------------------------------------------------------
// Create UDP Socket to Trace server
//---------------------------------------------------------------------------------
int open_udp_socket(int port, char * server_ip) {

	struct sockaddr_in address;

	if ((sock = net_socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP)) < 0) {
		printf("open_udp_socket: socket: %d\n", errno);
		return -1;
	}

	address.sin_family = AF_INET;
	address.sin_addr.s_addr = inet_addr(server_ip);
	address.sin_port = htons((short)port);

	if (net_connect(sock, (struct sockaddr *)&address, sizeof(address)) < 0) {
		printf("open_udp_socket: connect: %d\n", errno);
		return -1;
	}

	return 1;
}

//---------------------------------------------------------------------------------
// devoptab_t write
//---------------------------------------------------------------------------------
int netudp_write(struct _reent *r, void *fd, const char *ptr, size_t len)
{
    int ret;

    if (!devoptab_is_enabled)
        return -1;

    ret = bba_printf("%s", ptr);

    return ret;
}

[shazz]

Ok I have a working version but the fact to set my devoptab to the devoptab_list deactivates the libogc2 console printf obviously.. except modifying the libogc2 console I guess there is no way to keep both right ?

devoptab_list[STD_OUT] = &dotab_stdudp;
devoptab_list[STD_ERR] = &dotab_stdudp;

Ok found out... printf => stdout, kprintf -> stderr :)

[shazz]

Now working on the gcloader, what's the easiest way to read a file from the SD card inserted in the GCLoader ?