Skip to content

Commit

Permalink
m1n1: Handle BootArgs revisions 1, 2 and 3
Browse files Browse the repository at this point in the history
Handle revision 0 as revision 1.

Signed-off-by: Janne Grunau <j@jannau.net>
  • Loading branch information
jannau committed Nov 22, 2024
1 parent 62ff43f commit 2a09166
Show file tree
Hide file tree
Showing 5 changed files with 79 additions and 8 deletions.
7 changes: 6 additions & 1 deletion proxyclient/m1n1/hv/__init__.py
Original file line number Diff line number Diff line change
Expand Up @@ -1757,7 +1757,12 @@ def load_raw(self, image, entryoffset=0x800, use_xnu_symbols=False, vmin=0):
if use_xnu_symbols == True:
self.sym_offset = vmin - guest_base + self.tba.phys_base - self.tba.virt_base

self.iface.writemem(guest_base + self.bootargs_off, BootArgs.build(self.tba))
if self.tba.revision <= 1:
self.iface.writemem(guest_base + self.bootargs_off, BootArgs_r1.build(self.tba))
elif self.tba.revision == 2:
self.iface.writemem(guest_base + self.bootargs_off, BootArgs_r2.build(self.tba))
elif self.tba.revision == 3:
self.iface.writemem(guest_base + self.bootargs_off, BootArgs_r3.build(self.tba))

print("Setting secondary CPU RVBARs...")
rvbar = self.entry & ~0xfff
Expand Down
4 changes: 4 additions & 0 deletions proxyclient/m1n1/proxy.py
Original file line number Diff line number Diff line change
Expand Up @@ -721,6 +721,10 @@ def reload(self, addr, *args, el1=False):
self.request(self.P_CALL, addr, *args, reboot=True)
def get_bootargs(self):
return self.request(self.P_GET_BOOTARGS)
def get_bootargs_rev(self):
ba_addr = self.request(self.P_GET_BOOTARGS)
rev = self.read16(ba_addr)
return (ba_addr, rev)
def get_base(self):
return self.request(self.P_GET_BASE)
def set_baud(self, baudrate):
Expand Down
11 changes: 8 additions & 3 deletions proxyclient/m1n1/proxyutils.py
Original file line number Diff line number Diff line change
Expand Up @@ -44,9 +44,14 @@ def __init__(self, p, heap_size=1024 * 1024 * 1024):
self.iface = p.iface
self.proxy = p
self.base = p.get_base()
self.ba_addr = p.get_bootargs()

self.ba = self.iface.readstruct(self.ba_addr, BootArgs)
(self.ba_addr, self.ba_rev) = p.get_bootargs_rev()

if self.ba_rev <= 1:
self.ba = self.iface.readstruct(self.ba_addr, BootArgs_r1)
elif self.ba_rev == 2:
self.ba = self.iface.readstruct(self.ba_addr, BootArgs_r2)
elif self.ba_rev == 3:
self.ba = self.iface.readstruct(self.ba_addr, BootArgs_r3)

# We allocate a 128MB heap, 128MB after the m1n1 heap, without telling it about it.
# This frees up from having to coordinate memory management or free stuff after a Python
Expand Down
56 changes: 54 additions & 2 deletions proxyclient/m1n1/tgtypes.py
Original file line number Diff line number Diff line change
@@ -1,9 +1,35 @@
# SPDX-License-Identifier: MIT
from construct import *

__all__ = ["BootArgs"]
__all__ = ["BootArgs_r1", "BootArgs_r2", "BootArgs_r3"]

BootArgs = Struct(
BootArgs_r1 = Struct(
"revision" / Hex(Int16ul),
"version" / Hex(Int16ul),
Padding(4),
"virt_base" / Hex(Int64ul),
"phys_base" / Hex(Int64ul),
"mem_size" / Hex(Int64ul),
"top_of_kernel_data" / Hex(Int64ul),
"video" / Struct(
"base" / Hex(Int64ul),
"display" / Hex(Int64ul),
"stride" / Hex(Int64ul),
"width" / Hex(Int64ul),
"height" / Hex(Int64ul),
"depth" / Hex(Int64ul),
),
"machine_type" / Hex(Int32ul),
Padding(4),
"devtree" / Hex(Int64ul),
"devtree_size" / Hex(Int32ul),
"cmdline" / PaddedString(256, "ascii"),
Padding(4),
"boot_flags" / Hex(Int64ul),
"mem_size_actual" / Hex(Int64ul),
)

BootArgs_r2 = Struct(
"revision" / Hex(Int16ul),
"version" / Hex(Int16ul),
Padding(4),
Expand All @@ -28,3 +54,29 @@
"boot_flags" / Hex(Int64ul),
"mem_size_actual" / Hex(Int64ul),
)

BootArgs_r3 = Struct(
"revision" / Hex(Int16ul),
"version" / Hex(Int16ul),
Padding(4),
"virt_base" / Hex(Int64ul),
"phys_base" / Hex(Int64ul),
"mem_size" / Hex(Int64ul),
"top_of_kernel_data" / Hex(Int64ul),
"video" / Struct(
"base" / Hex(Int64ul),
"display" / Hex(Int64ul),
"stride" / Hex(Int64ul),
"width" / Hex(Int64ul),
"height" / Hex(Int64ul),
"depth" / Hex(Int64ul),
),
"machine_type" / Hex(Int32ul),
Padding(4),
"devtree" / Hex(Int64ul),
"devtree_size" / Hex(Int32ul),
"cmdline" / PaddedString(1024, "ascii"),
Padding(4),
"boot_flags" / Hex(Int64ul),
"mem_size_actual" / Hex(Int64ul),
)
9 changes: 7 additions & 2 deletions proxyclient/tools/chainload.py
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@
args = parser.parse_args()

from m1n1.setup import *
from m1n1.tgtypes import BootArgs
from m1n1.tgtypes import BootArgs_r1, BootArgs_r2, BootArgs_r3
from m1n1.macho import MachO
from m1n1 import asm

Expand Down Expand Up @@ -113,7 +113,12 @@
tba.virt_base = 0xfffffe0010000000 + (tba.phys_base & (32 * 1024 * 1024 - 1))
tba.devtree = u.ba.devtree - u.ba.virt_base + tba.virt_base

iface.writemem(image_addr + bootargs_off, BootArgs.build(tba))
if tba.revision <= 1:
iface.writemem(image_addr + bootargs_off, BootArgs_r1.build(tba))
elif tba.revision == 2:
iface.writemem(image_addr + bootargs_off, BootArgs_r2.build(tba))
elif tba.revision == 3:
iface.writemem(image_addr + bootargs_off, BootArgs_r3.build(tba))

print(f"Copying stub...")

Expand Down

0 comments on commit 2a09166

Please sign in to comment.