Ultra

[ornate jasper]

by default all uefi services, including runtime services, are in an identity map. setvirtualaddressmap allows you to tell them where in virtual memory the physical memory theyre in is going to end up so all the runtime services pointers get relocated and you can call runtime services after killing the identity map

[sinful river]

or pfndb I forgot

[prime wraith]

what do u use runtime services for?

[ornate jasper]

RTC on != x86

and also maybe on x86 because its easy tbh

[sinful river]

u could use them for suspend

[ornate jasper]

also uefi variables - any time you use a thing to set the efi boot order from an os it needs that

also reboot and shutdown but not suspend

uefi runtime services dont do suspend but they do reboot and shutdown

[sinful river]

ah that

mb

[ornate jasper]

you can also upload firmware updates from runtime services

you can get the high 32 bits of a system-wide monotonic counter for some reason

i really dont understand that one lmao

the main things are ResetSystem, Get/SetTime, Get/SetWakeupTime, and the variables stuff tho

oh i understand the monotonic count thing now

theres a boot services thing to get a 64-bit monotonic counter

the low 32 bits reset on boot but the upper 32 bits are nonvolatile

so the runtime service for the upper 32 bits lets you increment that if you want to keep using it at runtime and have the upper 32 bits persist

(the upper 32 bits also increment on reboot in addition to overflow from the low 32 bits at boot services time or when you call the runtime service)

i still dont really get why youd want that but good to know ig

you can also use runtime services to set a flag saying to go into an os-defined recovery mode on reboot

which i imagine is how windows does that feature

the big one for runtime services is still RTC though

because sometimes the firmware says fuck you and excises all mention of the RTC from acpi tables and/or devicetrees and insists that you use uefi services (or hardcode it)

as an example of firmware doing that: OVMF on aarch64 lmao

slash i think edk2 in general on aarch64

[stuck agate]

Its supposedly the number of times the system has been reset.

But for me it usually reads zero, even if I used ResetSystem()

Ah ok, it does more than that

The platform’s monotonic counter is comprised of two 32-bit quantities: the high 32 bits and the low 32 bits. During boot service time the low 32-bit value is volatile: it is reset to zero on every system reset and is increased by 1 on every call to GetNextMonotonicCount(). The high 32-bit value is nonvolatile and is increased by 1 whenever the system resets, whenever GetNextHighMonotonicCount() is called, or whenever the low 32-bit count (returned by GetNextMonoticCount()) overflows.

[ornate jasper]

#1385970208631427173 message i figured that out a bit later lol

[stuck agate]

Oh lol my bad

[ornate jasper]

nw lol

i still dont really understand the use of it but shrug

[stuck agate]

Yeah neither, I print it for fun bit thats it

[ornate jasper]

fair lol

[carmine token]

It's to prevent replay attacks in cryptographic protocols

at least, that's one use of it

say, your system boots, reads some pre-generated entropy from disk and generates a private key from that

[ornate jasper]

oh that makes sense

[stuck agate]

Yeah, interesting

[carmine token]

w/o any per-boot input, the private key will always be identical if you can for example crash the machine before it writes back new entropy to disk

but you can take the increasing integer and hash it together with the entropy to prevent this attack (it doesn't matter that the boot counter has low entropy for this to work)

[stuck agate]

How is this normally exposed to userspace? er, nvm

[haughty notch]

You don't have to have a pre kernel to do that either

[eternal sparrow]

How much would I be doing in assembly to be able to properly do the full thing to setup paging and load the elf 😭

[haughty notch]

My kernel is bootable with limine, ultra and mb2 with the same binary

[haughty notch]

mb2 loads the elf in memory for you, you just have to build the page tables

Like since you're probably rebuilding the page tables later anyway, you can just map from kernel start to kernel end with RWX permissions to jump to higher half

Though I parse and map the ELF in assembly

[eternal sparrow]

Tbf in a pre boot environent that's not that bad

[haughty notch]

Ultra and limine are easy to support at the same time, you just need to normalize e820, and limine gives you the entry point request, which gives you a separate entry point for it (and mb2 as well)

[eternal sparrow]

Though I wonder how I'd want to allocate the memory for the HHDM and page tables 😭

Unless I switch to recursive

[haughty notch]

Just reserve it in bss

I've tried to filter e820 in assembly, but was too big of a pita

If you limit yourself to a 4GB bootstrap direct map, then you know how much memory you need for page tables (about 2MB)

(iirc)

[eternal sparrow]

I can also just do recursive page tables and avoid a direct map

Then only BSS enough to map the kernel image

But that wouldn't work on riscv

Which is fine with it not doing mb2

[haughty notch]

I don't think it's enough

Or rather you probably would have to do a lot of trickery?

Also there's no mb2 on risc-v

[eternal sparrow]

Yeah that's my point

[haughty notch]

I mean my kernel then just maps itself + temporary mapper area and that's enough to initialize the pfndb/pmm and vmem

[eternal sparrow]

In theory you could bump allocate off the memory map after cleaning with just a recursive map

[haughty notch]

Idk, I don't like recursive maps

[ornate jasper]

why not, out of curiosity?

[haughty notch]

I had used it and there were too many tlb flushes involved

I know that you can optimize it, but still

[ornate jasper]

ah

[prime wraith]

yeah, thanks vscode, this is exactly what i wanted

[ornate jasper]

lol

you doing aarch64 now? thought you didnt like it

[prime wraith]

nah, still fixing hyper, it has supported aarch64 since forever

[ornate jasper]

ahh

[prime wraith]

and im definitely going to support aarch64 in ultra, probably not any time soon tho

[ornate jasper]

fair enough

[carmine token]

does it support VHE though?

[prime wraith]

yep, it supports el2 only if vhe is supported

[carmine token]

does it enable VHE if it's supported but disabled?

the enable sequence from uefi is quite painful

[ornate jasper]

you plan to support/use uefi for aarch64? if so, you going to hardcode the address of the RTC for a given board setup or use uefi/setvirtualaddressmap stuff for rtc?

[prime wraith]

I mean i think so:

    // Complete all prior memory accesses before touching the MMU
    dsb sy
    isb

    /*
     * Disable the MMU while we reprogram the translation registers, then (at
     * EL2) switch to VHE. The current regime's MMU is controlled by SCTLR_EL2
     * at EL2 with E2H still 0, and by SCTLR_EL1 at EL1, so pick the right one.
     * Once E2H is set the _EL1 register names below redirect to their _EL2
     * counterparts, and setting E2H with the MMU already off avoids
     * reinterpreting a live SCTLR_EL2/TCR_EL2 in the EL1 (VHE) format.
     */
    cbz w6, .disable_el1

    mrs x13, sctlr_el2
    bic x13, x13, #SCTLR_M
    msr sctlr_el2, x13
    isb

    mrs x13, hcr_el2
    orr x13, x13, #HCR_E2H
    orr x13, x13, #HCR_TGE
    msr hcr_el2, x13
    isb
    b .mmu_disabled

.disable_el1:
    mrs x13, sctlr_el1
    bic x13, x13, #SCTLR_M
    msr sctlr_el1, x13
    isb

.mmu_disabled:
    msr mair_el1, x3
    msr tcr_el1, x4
    msr ttbr0_el1, x1
    msr ttbr1_el1, x2

    // Ensure the writes are observed by the table walker, then flush the TLB
    dsb ish
    tlbi vmalle1
    dsb ish
    isb

    // Re-enable the MMU with data + instruction caches on
    mrs x14, sctlr_el1
    orr x14, x14, x5
    msr sctlr_el1, x14
    isb

    // Set up the kernel stack
    msr spsel, #SPSEL_ELX
    mov sp, x7

    /*
     * Jump to the higher-half copy of the code below so we can drop the lower
     * half from under our own feet if requested
     */
    adr x13, .higher_half
    add x13, x13, x9
    br x13

.higher_half:

[prime wraith]

Yeah, i've already added code for propagating the UEFI memory map + runtime service stuff to the kernel

[carmine token]

that doesn't flush the cache

before disabling the mmu

which is needed because the currently executing binary may have dirty cache lines

[ornate jasper]

do you relocate it in loader or just propagate and let the kernel do it? if the latter, i assume you leave the 0-base identity map in the page tables passed to the kernel for the runtime services to use before/during the relocation?

[carmine token]

and after disabling the mmu you'd read stale data or code

[prime wraith]

hmm yeah ig

[prime wraith]

i just propagate it as is, i think the kernel should build a separate page table for the runtime services and then switch to it dynamically

like linux does

[ornate jasper]

👍

[carmine token]

does linux switch to an identity map for uefi runtime services?

[ornate jasper]

i still think relocating to high mem and using setvirtualaddressmap is better than giving uefi its own page tables but ig that works

[prime wraith]

it walks the uefi map and checks what regions are needed for the runtime services (via an attribute bit), only those are mapped

i think yeah its an ID map

[prime wraith]

probably a defense for crappy firmware?

[ornate jasper]

i guess? windows doesnt do that but idk

[prime wraith]

fair

idk, ill take a deeper look when I need it in my kernel

[carmine token]

actually that's probably saner than passing the virtual map to uefi

i never thought about this possibility

[prime wraith]

yeah i think thats pretty nice, uefi cant corrupt any of your mappings that way

[ornate jasper]

shrug

[carmine token]

it's also less complicated

[ornate jasper]

i feel like swapping page tables whenever you go to uefi is more complex than doing a single call during init once and never touching it again personally

[prime wraith]

https://elixir.bootlin.com/linux/v7.1.2/source/arch/x86/platform/efi/efi_64.c#L307

it does some weird stuff here, so it's not always identity map

only in mixed mode apparently

[ornate jasper]

and they have a thunk for setvirtualaddressmap

[prime wraith]

I think most of the complexity is from supporting mixed mode

[carmine token]

what is mixed mode?

[prime wraith]

Aka 64 bit kernel booted from 32 bit UEFI

in non-mixed mode it does this apparently

/*
 * We allocate runtime services regions top-down, starting from -4G, i.e.
 * 0xffff_ffff_0000_0000 and limit EFI VA mapping space to 64G.
 */
static u64 efi_va = EFI_VA_START;

[ornate jasper]

oh hey thats what i do too

albeit a different start

[prime wraith]

yeah

although yeah as i said theres a separate efi_mm

Thats actually a big issue with the limine proto i think, it doesnt tell you the bitness of the uefi firmware anywhere(?)

[prime wraith]

fable said this: https://pastebin.com/nm0hpu29
Is that wrong?

[sinful river]

https://klipy.com/gifs/hydrogen-bomb-vs-baby

[carmine token]

• Instruction fetches during the window aren't a problem either: with M=0, I=1 they're Write-Through cacheable, and the trampoline code hasn't been modified since it started executing, so the I-side is coherent with memory regardless.
  I'd double check this, idr it w/o looking it up

I do remember that it didn't work consistently w/o flushes on real hw

and Linux also flushes

[prime wraith]

Ill tell the agi to check linux sources and explain why it does that then

[carmine token]

Linux does not do a set/way flush

btw

that'd be overkill

set/way flushes are rather complicated on ARM as well

it's must easier to just flush the trampoline region

[prime wraith]

Can you link the file where u saw it flushing

[carmine token]

it's in some early boot file

[prime wraith]

Does it only flush the trampoline also?

[carmine token]

search for dcache in head.S, there are multiple code paths

    /*
     * If we entered with the MMU and caches on, clean the ID mapped part
     * of the primary boot code to the PoC so we can safely execute it with
     * the MMU off.
     */

[prime wraith]

Thanks

[carmine token]

Maybe your code is indeed correct because it doesn't touch any data

For data / stack whatever accesses, it'd definitely be broken

[prime wraith]

Yeah but for example this talks about the instruction cache

And I never cleaned the trampoline to the poc

[carmine token]

Yeah, poc != pou

You can assume that it's cleared to pou by uefi / your loader but not to poc

But this probably doesn't make a difference if the argument that claude gave is correct

Because there can (obviously) be no writes though the instructions stream

[prime wraith]

Yeah clanker caved after i pointed it at the linux source https://pastebin.com/g3VUdC8E

[carmine token]

ah so it matches what i remembered

and also the code in eir is correct and i didn't hallucinate that it ran into real hw issues before i added flushes

[prime wraith]

I wouldnt expect that to repro on real hardware, how does the icache not end up evicting that code later on anyway?

or is the amount of code that it runs so tiny it never does that

[carmine token]

unsure

[prime wraith]

Its crazy even fable is kind of shit at understanding exactly what arm arm wants

[carmine token]

well

I think the ARMARM is a particularly hard case but also fable is not infallible

[prime wraith]

yeah

[carmine token]

the ARMARM also doesn't fit into its context window, so it can only read parts of it

[prime wraith]

maybe if i did max effort

it was at high

[prime wraith]

yeah, its a 120mb pdf

that it converted to text also

but its a lot of duplications for aarch32 vs aarch64

[eternal sparrow]

Even crappy LLMs that I use can sift through the loongarch manual with its partly broken English 😭

I've heard many things about arm

And none have been good

[prime wraith]

I mean the LLM can probably read the original chinese spec

[eternal sparrow]

And people that don't know computer architecture never listen to me about CISC/RISC being stupid and that arm is basically becoming CISC with its ISA feature set and x86 is RISC internally after the decoder

People keep trying to push arm in the desktop space when riscv would probably be better to push it even la64 potentially if it could expand a bit more proper

[prime wraith]

I mean arm is the only one where there are already relatively fast cpus u can at least use

[eternal sparrow]

I mean of course but there are alot of other factors with things

And they also tried to say the windows scheduler was bad and its memory management was bad

💀

[prime wraith]

Who did?

[eternal sparrow]

Oh this was other place crap with people who don't do osdev as much

[prime wraith]

ah

[wide ether]

that happens a lot

i should add hyper support to zinnia

[sinful river]

the problem is using vscode and not emacs

no such bullshit in emacs

[wide ether]

helix*

[ornate jasper]

notepad*

(++)

[eternal sparrow]

Kate*

[wide ether]

kate be like: what's a good lsp

[eternal sparrow]

Hey the LSP works

Mostly

[sinful river]

yeah i fw that too

as long as it's not corpo slop it's fine

[inland wave]

I forgor about helix :p

[sinful river]

meanwhile zig:

(ZLS is either completely useless or crashes instantly)

[eternal sparrow]

[wide ether]

no

it miscolors some types entirely

(they don't update)

[eternal sparrow]

I haven't noticed that somehow?

[wide ether]

in rust?

[eternal sparrow]

Ah I haven't used it for much rust yet

[wide ether]

bad lsp is a dealbreaker for me

it makes me quicker because i can easier tell code apart

(and with rust this is necessary for let bindings)

[prime wraith]

[331578.845086] Out of memory: Killed process 319906 (clangd.main) total-vm:11723156kB, anon-rss:7617680kB, file-rss:8kB, shmem-rss:1408kB, UID:1000 pgtables:15392kB oom_score_adj:100

you need how much memory

[wide ether]

[prime wraith]

my laptop literally hung for like 10 seconds and music stopped playing

[cosmic ibex]

how greedy is clang

😭

[prime wraith]

the funny part is i wasnt even doing anything, not building nor editing source

[cosmic ibex]

its a daemon/service just realized

😭😭

makes it even more weird

[prime wraith]

indeed

[obtuse sparrow]

Considering it's from GNOME it was probably leaking memory

[twilit geode]

who needs lsp anyways

get on with the times just write it using ai and if compile errors happen just ask the ai to fix it on a loop

[carmine token]

Need the type of a variable? Just ask ai to tell you

[eternal sparrow]

Using a non LLM assisting debugger?

get llmdb today

[prime wraith]

Its rare for a clanker to make a syntax error anyway especially for common languages

[prime wraith]

https://www.youtube.com/watch?v=BwBIoXNDsRo

@errant temple leo did u see this one yet?

[prime wraith]

i thought all they had was some dev demo, but this seems to just work for the most part

[latent geode]

cool

[prime wraith]

not that it matters for me because i'll just use the proprietary nvidia userspace impl

[latent geode]

wdym? I don't know much about graphics stuff

[prime wraith]

u know how nvidia made the open source driver

[latent geode]

yes

nvidia-open

are you planning to port it?

[prime wraith]

that one is a simple shim for the most part, that just calls methods on the gpu firmware basically

[latent geode]

ah

[prime wraith]

its trivial to port but it does nothing on its own

you need a huge userspace part thats still proprietary

there have been efforts to make an oss impl using this new nvidia kernel driver in mesa

and as u can see it works in haiku

but nvidia wants you to use its proprietary libgl.so etc

[latent geode]

but that won't be an issue with linux compat :^)

[prime wraith]

exactly

[prime wraith]

well trivial with an asterisk ofc

because it requires all of drm implemeneted and a fully mature kernel

its not uacpi with mostly dog simple kernel api

[latent geode]

well I still have a long way to go before I can start thinking about accelerated graphics

[prime wraith]

same

[carmine token]

It's not a simple shim, right? It's still a lot of code

Like many hundreds of source files

Iirc the driver is a 70M binary on Managarm

Maybe you're thinking of the old closed source nvidia driver that had just a simple gpl2 shim module

Nvidia open has actual logic in the kernel

It's true that it uses the gsp for actual mode setting etc but it still has a lot of code in the kernel

[sinful river]

How does it work? Do you have a Linux kernel API shim?

[carmine token]

No, we implement their HAL

The driver is OS generic with HALs for different OSes

[sinful river]

Ah cool

[carmine token]

https://github.com/NVIDIA/open-gpu-kernel-modules/blob/main/src/nvidia-modeset/kapi/interface/nvkms-kapi.h

[wicked juniper]

this doesn't even look that bad if it's the only thing to edit for a port

[eternal sparrow]

That's all the things you need to implement

[carmine token]

There may be stuff in other header files, not sure. You can take a look at Managarm's implementation

[wicked juniper]

gg

[prime wraith]

Yeye, maybe not a simple shim but that thing doesn't contain any actual gpu logic, only setting the queues and stuff to send commands to the actual firmware to dispatch

[carmine token]

it still contains 2M sloc

it does contain gpu logic, just not direct register manipulation

[prime wraith]

Yes

[carmine token]

the small shim that just forwards userspace to the gpu was the old proprietary driver

[twilit geode]

at some point someone gotta just /goal codex or claude into getting the nvidia open source driver working with nvo

[prime wraith]

start with /goal implement drm for astral & make virtio-gpu work

[twilit geode]

talk is cheap send tokens

[prime wraith]

Lol

[pearl meteor]

tokens are expensive...

[ember reef]

cheap is talk tokens send

[wide ether]

@errant temple

[errant temple]

point the clanker at https://github.com/no92/mesa-nvk-on-nvo

[prime wraith]

whatever you do DONT write a fucking bios bootloader

bought a $10 netbook for fun for ultra stuff

hyper triple faults on boot

after 10 hours of debugging sessions and 99999 reflashes with test boot sectors

upper halves of gp registers are corrupted after int13

[pearl meteor]

💀 💀 💀

[prime wraith]

cursed pos

[pearl meteor]

dont you do pushad/popad?

[prime wraith]

in the pmod bios_call variant yeah, but the early boot sector that loads stage2 didnt unconditionally preserve all registers (since it's not really a requirement(?))

[pearl meteor]

i see

[prime wraith]

the funny part is it was reaching the C code and even running a few lines, but then exploding

so it wasnt as obvious at all

since the first few reads survived

and the test boot secotrs i made worked flawlessly (obv because they didnt use extended regs at all)

[ember reef]

windows bootloader is probably built like a tank

[prime wraith]

yeah

or the bios firmware that ships is built around the windows bootloader

[ember reef]

openfirmware bootloader (theyre supposed to be architecture independent forth scripts but everybody just appends an executable to the script and has the script just jump to its entrypoint asap instead)

[prime wraith]

Finally ffs

Its an atom n455

[pearl meteor]

looks goofy

[prime wraith]

the screen is tiny res i think

[prime wraith]

google says the cpu freq is 1.66Ghz, look how correct my calibration code is

[eternal sparrow]

Can you overclock it by uhhh 30mhz?

[prime wraith]

lol

[prime wraith]

im also a bit of a retard and did try out that theory fairly early on, but without the d suffix so it only pushed the small registers

so obv that didnt work

[pearl meteor]

[prime wraith]

the res is apparently 1024 x 600

It's a Samsung NF110

[thorny kelp]

looool

[prime wraith]

this is my favorite activity now

[latent geode]

what model is that?

[prime wraith]

This one is fable 5

[cosmic ibex]

"unfuck it" lmao

[cosmic ibex]

isnt gpt 5.6 sol basically the same

:P

[prime wraith]

dont have a codex subscription unfortunately

[latent geode]

is it any good?

have they achieved agi?

[cosmic ibex]

in some countries like mine they give a 1 month free plus trial, i cant get it cuz i dont have a card

(not an ad btw)

[prime wraith]

it's quite good actually, it was able to instantly crack a few complex bugs by just looking at like 2 lines of logs

[latent geode]

damn

[cosmic ibex]

i have a terminal bug so complex

i bet it cant even fix it

[prime wraith]

I can tell you that doesnt include my country

[cosmic ibex]

use a vpn

[prime wraith]

fair

[cosmic ibex]

im turk btw so maybe u have a vpn that has turk servers?

[prime wraith]

one example is i had a bug in the test kernel where it was treating huge pages as a nested pte level, fable was able to detect it from just looking at the corrupted output and realizing its actually the page table flags

it also instantly pinpointed the thing that produced that incorrect pt format etc

[prime wraith]

isnt discord banned in turkey btw

[cosmic ibex]

i use a dns

my provider supports it

[prime wraith]

lol

[cosmic ibex]

[latent geode]

I'm pretty sure everyone on internet uses a DNS :^)

[cosmic ibex]

not the google dns

[latent geode]

I know

[cosmic ibex]

i mean something like cloudflare

[prime wraith]

im assuming their ISP "blocked" discord by just removing DNS entries for it

[cosmic ibex]

most ISPs in our country just block custom dns'

[dusky kraken]

dns over tls/https 🤔

[latent geode]

DoT my beloved

[prime wraith]

DotA my beloved

[latent geode]

what's that?

[prime wraith]

Dota 2 the game

[latent geode]

ah

[prime wraith]

But I don't play it I was just trolling lol

[cosmic ibex]

i finally fixed the terminal issue

-_-

[sinful river]

i was able to scam sam altman and get two months for free

[cosmic ibex]

lmao

[latent geode]

sam scam altman

[prime wraith]

finally reviewed & merged a pull request unfucking a lot of long standing issues in hyper and adding PXE support, also added a shit ton of new features, like uefi info passthrough, proper boot partition detecton, infinite cmdline length support, module description support, proper video mode selection etc

i can now get back to ultra (after I draft this release ofc )

this was like a 3 week detour or smth

also tested on my auto real hw ci with 3 laptops

oh also clanker helped increase the test coverage probably x10, now pretty much all boot variants are covered by integration tests with full handover info validation etc

[pearl meteor]

based

[prime wraith]

thanks

https://github.com/UltraOS/Hyper/releases/tag/v0.11.0

[pearl meteor]

what is soft reserved and unaccepted

[prime wraith]

soft reserved is a relatively modern thing, it's how they mark CXL memory iirc

or any other memory that may have side effects if treated as normal ram

either it will be slow or degrade etc

unaccepted is for SEV i think

memory that must be accepted by the kernel to be used

[pearl meteor]

i see

actually, no hobby os for now takes into account the cxl memery

when is ultra going to be cxl native

[prime wraith]

yeah

i chose not to support NUMA or CXL

at this stage

[pearl meteor]

based

[prime wraith]

i want to focus on GPU and overall driver support instead

[pearl meteor]

yeah

i decided to support numa from the beginning and it has been a bit annoying

it's not just "oh okay, let tasks have preferences"

you also have to take into account what happens with early allocations, kernel allocations, etc

also try and make node local stuff

[prime wraith]

yeah, it basically makes its way into every subsystem

[pearl meteor]

this is still a todo lmao

i allocate all from node 0 by default

ig that the good thing about having numa is that in virtual environments you can "compartmentalize" memory easily

for example, say you want to have an entire hotplug region, and you want to force some program to be located there

you can tell qemu to make a memory node which only has that hotplug region, and in your os you just use the numa api