ps5-linux/ps5-linux-loader
1
0
Fork 0
mirror of https://github.com/ps5-linux/ps5-linux-loader.git synced 2026-07-16 10:10:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

some tidy up

Browse Source
This commit is contained in:
Mateico
2026-05-13 09:37:44 +02:00
parent 8e60126031
commit 01436f0a6b
13 changed files with 180 additions and 236 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
shellcode_kernel/kernel_code.c
View File

@@ -9,11 +9,11 @@
#define TRANSMITTER_CONTROL_ENABLE 1
#define TRANSMITTER_CONTROL_SET_VOLTAGE_AND_PREEMPASIS 11
int (*transmitter_control)(int cmd, void *control) = NULL; // Filled by main.c
int (*mp3_initialize)(int vmid) = NULL; // Filled by main.c
int (*mp3_invoke)(int cmd_id, void *req, void *rsp) = NULL; // Filled by main.c
int (*transmitter_control)(int cmd, void *control) = NULL;
int (*mp3_initialize)(int vmid) = NULL;
int (*mp3_invoke)(int cmd_id, void *req, void *rsp) = NULL;
uint64_t g_vbios; // Filled by main.c
uint64_t g_vbios;
typedef struct {
uint8_t lanenum;
@@ -95,39 +95,31 @@ static int mp3_enable_output(int be, int mode) {
static void patch_hv(void) {
// Install identity map for HV
// HV Shellcode 1 it's updating CR3
uint64_t identity_cr3 = cave_hv_paging; // P, RW, US=0
uint64_t identity_pml4_0 =
identity_cr3 +
0x1003ULL; // P, RW, US=0 - 512GB // offset 0 +0x1000 from PML4
uint64_t l40_l3_addr = PAGE_PA(identity_pml4_0); // addr PML4[0]
uint64_t identity_cr3 = cave_hv_paging;
uint64_t identity_pml4_0 = identity_cr3 + 0x1003ULL;
uint64_t l40_l3_addr = PAGE_PA(identity_pml4_0);
uint64_t identity_pml40_l3[] = {
0x0000000000000083, // P, RW, US=0 - 0 GB to 1 GB
0x0000000040000083, // P, RW, US=0 - 1 GB to 2 GB
0x0000000080000083, // P, RW, US=0 - 3 GB to 3 GB
0x00000000C0000083, // P, RW, US=0 - 4 GB to 4 GB
0x0000000100000083 // P, RW, US=0 - 5 GB to 6 GB --> Our paging structure
0x0000000000000083,
0x0000000040000083,
0x0000000080000083,
0x00000000C0000083,
0x0000000100000083
};
uint64_t l3_size = sizeof(identity_pml40_l3) / sizeof(identity_pml40_l3[0]);
// Create the map in memory
*(uint64_t *)PHYS_TO_DMAP(identity_cr3) = identity_pml4_0;
for (uint64_t i = 0; i < l3_size; i++) {
*(uint64_t *)PHYS_TO_DMAP(l40_l3_addr + i * 8) = identity_pml40_l3[i];
}
// Install hv_shellcode 2
memcpy((void *)PHYS_TO_DMAP(cave_hv_code), shellcode_hypervisor,
shellcode_hypervisor_len);
// Jump to shellcode final identity mapping
uint8_t shellcode_jmp[] = {
0x48, 0xC7, 0xC0, 0x00, 0x6F, 0x80, 0x62, // mov rax, 0x62806f00
0xFF, 0xE0, 0xC3, 0xC3, 0xC3, 0xC3, 0xC3, // jmp rax
0x48, 0xC7, 0xC0, 0x00, 0x6F, 0x80, 0x62,
0xFF, 0xE0, 0xC3, 0xC3, 0xC3, 0xC3, 0xC3,
0xC3, 0xC3};
// Update code cave in hv 1:1 region
*(uint32_t *)(&shellcode_jmp[3]) = (uint32_t)args.hv_code_cave_pa;
// Just patch the VMEXIT handler directly, avoiding all checks
@@ -143,12 +135,9 @@ static void patch_hv(void) {
0xFF, 0xE0 // jmp rax
};
// Update CR3 PA (from config)
*(uint64_t *)(&shellcode_identity_and_jmp[2]) = cave_hv_paging;
// Update HV shellcode cave
*(uint64_t *)(&shellcode_identity_and_jmp[15]) = cave_hv_code;
// Install shellcode 1 to update CR3 and jump to main HV shellcode
memcpy((void *)PHYS_TO_DMAP(args.hv_code_cave_pa), shellcode_identity_and_jmp,
sizeof(shellcode_identity_and_jmp));
}