--- title: Reverse-engineering the Mali G78 | daily.dev description: Collabora reverse-engineered the Valhall instruction set used in the Arm Mali G78 GPU, releasing a PDF specification, XML architecture description, assembler,... canonical: https://daily.dev/posts/reverse-engineering-the-mali-g78-btzqmphav twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Reverse-engineering the Mali G78 | daily.dev og:description: Collabora reverse-engineered the Valhall instruction set used in the Arm Mali G78 GPU, releasing a PDF specification, XML architecture description, assembler,... og:url: https://daily.dev/posts/reverse-engineering-the-mali-g78-btzqmphav og:image: https://api.daily.dev/og/posts/btzqMPHaV.png og:image:alt: Reverse-engineering the Mali G78 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Reverse-engineering the Mali G78 **[Collabora Blog](https://daily.dev/sources/collabora)** · 12 min read · 0 upvotes · 0 comments ## Summary Collabora reverse-engineered the Valhall instruction set used in the Arm Mali G78 GPU, releasing a PDF specification, XML architecture description, assembler, and disassembler. The post details the methodology: intercepting GPU memory on Android via a wrapper library, locating shader binaries using the ARM_mali_program_binary extension, and iteratively building a disassembler. Key findings include Valhall's 8-byte fixed-width instruction encoding, its hardware dynamic scheduling replacing Bifrost's VLIW clause-based static scheduling, and a reduced dependency slot count (3 general-purpose vs. 6 in Bifrost). The post also covers reverse-engineering the CLPER subgroup instruction by injecting custom shader binaries into a running proprietary driver context. The goal is enabling open-source Panfrost/Mesa drivers for Valhall-based devices. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the instruction size for the Arm Mali Valhall GPU architecture? Valhall instructions are 8 bytes (64 bits) each. This was derived from the 16KB instruction cache holding 2048 instructions: 16384 bytes divided by 2048 gives exactly 8 bytes per instruction. Valhall uses a regular fixed-width encoding, unlike the variable-length clause-based encoding of its predecessor Bifrost. _Engineers working on GPU driver support or shader tooling track Mali architecture details on daily.dev._ ### How does Valhall's dependency scheduling differ from Bifrost's scoreboarding system? Valhall uses hardware dynamic scheduling instead of Bifrost's compiler-managed static scoreboarding. Bifrost groups up to 16 instructions into clauses with explicit dependency slots (8 slots, 6 general-purpose) specified in clause headers. Valhall embeds dependency waits directly inside individual instructions and reduces slots to 4-5 total (3 general-purpose), saving 4 bits per instruction and eliminating clause encoding overhead. _Developers building compilers or shader backends for Mali GPUs find architecture deep-dives like this on daily.dev._ ### How can I inject custom shader binaries into a proprietary Mali driver on Android for reverse-engineering? A wrapper library can intercept Mali ioctl() calls to dump and modify GPU memory before the driver submits work to hardware. By identifying the shader program descriptor pointer chain, you can overwrite the shader binary in-place. Running an OpenCL application under the proprietary driver then executes your injected shader, letting you test arbitrary Valhall assembly without reimplementing the full GPU submission stack. _GPU reverse-engineering techniques and open-source driver progress for Mali and other hardware surface regularly on daily.dev._ ## Similar posts on daily.dev - [KRAID Being Developed As New Compiler For Modern Arm Mali Graphics](https://daily.dev/posts/kraid-being-developed-as-new-compiler-for-modern-arm-mali-graphics-lbqgb3uje) · Phoronix · 0 upvotes · 0 comments - [Arm Posts Initial Open-Source Driver Patches For New Mali-G1 GPUs](https://daily.dev/posts/arm-posts-initial-open-source-driver-patches-for-new-mali-g1-gpus-tcm2wklus) · Phoronix · 0 upvotes · 0 comments - [AMD GPU Debugger · Abdelhadi](https://daily.dev/posts/amd-gpu-debugger-abdelhadi-w0hrtlkje) · Hacker News · 0 upvotes · 0 comments - [vLLM on the DGX Spark: Architecture, Configuration, and Local Evaluation](https://daily.dev/posts/vllm-on-the-dgx-spark-architecture-configuration-and-local-evaluation-ql8stxezr) · vLLM · 0 upvotes · 0 comments - [PanVK Mali Vulkan Driver Lands In-Memory Cache & On-Disk Shader Cache Support](https://daily.dev/posts/panvk-mali-vulkan-driver-lands-in-memory-cache-on-disk-shader-cache-support-y2z1wbliv) · Phoronix · 0 upvotes · 0 comments --- Tags: [#reverse-engineering](https://daily.dev/tags/reverse-engineering), [#mesa](https://daily.dev/tags/mesa) [View this post on daily.dev](https://daily.dev/posts/reverse-engineering-the-mali-g78-btzqmphav) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Reverse-engineering the Mali G78","url":"https://daily.dev/posts/reverse-engineering-the-mali-g78-btzqmphav","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/reverse-engineering-the-mali-g78-btzqmphav"},"datePublished":"2026-08-11T08:56:14.955Z","dateModified":"2026-08-11T09:36:03.611Z","description":"Collabora reverse-engineered the Valhall instruction set used in the Arm Mali G78 GPU, releasing a PDF specification, XML architecture description, assembler,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5f5a649c68b6011e84266953e256d0e4?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5f5a649c68b6011e84266953e256d0e4?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collabora Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collabora Blog","logo":"https://media.daily.dev/image/upload/s--ZGZ0FjqS--/f_auto,q_auto/v1786438306/logos/collabora?_a=BAMAMicg0","url":"https://daily.dev/sources/collabora"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/reverse-engineering-the-mali-g78-btzqmphav","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"reverse-engineering,mesa","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collabora Blog","item":"https://daily.dev/sources/collabora"},{"@type":"ListItem","position":3,"name":"Reverse-engineering the Mali G78"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/reverse-engineering-the-mali-g78-btzqmphav#faq","mainEntity":[{"@type":"Question","name":"What is the instruction size for the Arm Mali Valhall GPU architecture?","acceptedAnswer":{"@type":"Answer","text":"Valhall instructions are 8 bytes (64 bits) each. This was derived from the 16KB instruction cache holding 2048 instructions: 16384 bytes divided by 2048 gives exactly 8 bytes per instruction. Valhall uses a regular fixed-width encoding, unlike the variable-length clause-based encoding of its predecessor Bifrost. Engineers working on GPU driver support or shader tooling track Mali architecture details on daily.dev."}},{"@type":"Question","name":"How does Valhall's dependency scheduling differ from Bifrost's scoreboarding system?","acceptedAnswer":{"@type":"Answer","text":"Valhall uses hardware dynamic scheduling instead of Bifrost's compiler-managed static scoreboarding. Bifrost groups up to 16 instructions into clauses with explicit dependency slots (8 slots, 6 general-purpose) specified in clause headers. Valhall embeds dependency waits directly inside individual instructions and reduces slots to 4-5 total (3 general-purpose), saving 4 bits per instruction and eliminating clause encoding overhead. Developers building compilers or shader backends for Mali GPUs find architecture deep-dives like this on daily.dev."}},{"@type":"Question","name":"How can I inject custom shader binaries into a proprietary Mali driver on Android for reverse-engineering?","acceptedAnswer":{"@type":"Answer","text":"A wrapper library can intercept Mali ioctl() calls to dump and modify GPU memory before the driver submits work to hardware. By identifying the shader program descriptor pointer chain, you can overwrite the shader binary in-place. Running an OpenCL application under the proprietary driver then executes your injected shader, letting you test arbitrary Valhall assembly without reimplementing the full GPU submission stack. GPU reverse-engineering techniques and open-source driver progress for Mali and other hardware surface regularly on daily.dev."}}]} ```