mirror of
https://github.com/ps5-linux/ps5-linux-loader.git
synced 2026-10-22 19:12:27 -05:00
150e33182d
* Add firmware 11.60 support (regular PS5) 11.60 is picked at runtime from the firmware version like the other firmwares, and is part of the normal ps5-linux-loader.elf build. - off_1160 offset table. set_offsets only accepts the retail 11.60 build (0x11600005) and refuses the PS5 Pro before anything is written. - shellcode_kernel_1160: the shared wake shellcode built with FW_1160 as a position-independent blob, plus the 11.60 display-op table. It reserves 0x980000000-0xa00000000 through tmrs, like the HV in the 13.60 stock wake blob. - shellcode_break_hv: the startup-AP payload, based on Byepervisor, built from source with a 0x800 size limit and no absolute relocations. - hv_defeat_1160: a DR0 startup-AP carrier that turns off nested paging, then the same #GP/#SX transfer into the wake blob as 13.60. - loader_staging_1160: checked PID 1 alias staging with rollback. It keeps the page tables, the wake code and the #SX stack out of the range the wake blob copies Linux into, and takes the #SX stack page together with the page under it. If a later step fails the loader holds, because PID 1 still points at pages this process owns. The shared HV, default, 13xx and 0607 blobs build byte-identical to upstream. Booted on a regular PS5 (CFI-1115B) on 11.60 with the official CachyOS image and with a CachyOS 7.3 image. * Add support for all 11.xx firmware Extend the 11.60 carrier/defeat path to 11.00, 11.20 and 11.40: - per-firmware offset tables off_1100, off_1120 and off_1140, derived from the decrypted retail kernels; 11.60 values are unchanged - exact raw build gates and routing in set_offsets, main, prepare_resume and hv_defeat; HV code-cave/handler PAs are checked before arming - wake argument validator accepts all four versions - 29-op display tables and runtime dispatcher for each version - WLAN firmware offsets and sizes: 11.00/11.20 0x1586110, 11.40 0x15860D0, 11.60 0x1585D90, all size 0x799BC; confirmed against both retail and devkit kernels Tested on a devkit: 11.00, 11.20 and 11.40 all boot Linux 7.2.3 with display output. The 11.60 path is inherited from the base branch. Co-Authored-By: Claude Code <noreply@anthropic.com> * e820: apply Pro I/O fix Reserve the non-RAM Pro windows 0x47f300000-0x8e0000000, 0x8e0000000-0x8e2000000 and 0x8e2000000-0x900000000, matching PR #61. Co-Authored-By: Claude Code <noreply@anthropic.com> --------- Co-authored-by: Gabe Zimbric <10481275+gzimbric@users.noreply.github.com> Co-authored-by: Claude Code <noreply@anthropic.com>
113 lines
3.0 KiB
C
113 lines
3.0 KiB
C
#ifndef OFFSETS_H
|
|
#define OFFSETS_H
|
|
|
|
#include <stdint.h>
|
|
|
|
typedef struct _offset_list {
|
|
/* Loader utils */
|
|
uint64_t IOMMU_SOFTC;
|
|
uint64_t VMSPACE_VM_VMID;
|
|
uint64_t VMSPACE_VM_PMAP;
|
|
uint64_t DATA_BASE_GVMSPACE;
|
|
/* Offsets for 5.00-6.02 hv exploit */
|
|
uint64_t ACPIGBL_FACS;
|
|
uint64_t IDT;
|
|
uint64_t COMMON_TSS;
|
|
uint64_t STOPPED_CPUS;
|
|
uint64_t FUN_STOP_CPUS;
|
|
uint64_t FUN_AS_LAPIC_EOI;
|
|
uint64_t FUN_HV_UNMAP_PT_TMR;
|
|
uint64_t FUN_MEMCPY;
|
|
uint64_t GAD_ADD_RSP_28_POP_RBP_RET;
|
|
uint64_t GAD_IRETQ;
|
|
uint64_t GAD_POP_RAX_RET;
|
|
uint64_t GAD_POP_RDI_RET;
|
|
uint64_t GAD_POP_RSI_RET;
|
|
uint64_t GAD_POP_RDX_RET;
|
|
uint64_t GAD_POP_RCX_RET;
|
|
uint64_t GAD_POP_RSP_RET;
|
|
uint64_t GAD_WRMSR_RET;
|
|
uint64_t GAD_MOV_QWORD_PTR_RDI_RSI_POP_RBP_RET;
|
|
/* Shellcode Kernel */
|
|
uint64_t HOOK_ACPI_WAKEUP_MACHDEP;
|
|
uint64_t KERNEL_CODE_CAVE;
|
|
uint64_t FUN_PRINTF;
|
|
uint64_t FUN_HV_IOMMU_SET_BUFFERS;
|
|
uint64_t FUN_HV_IOMM_WAIT_COMPLETION;
|
|
uint64_t FUN_SMP_RENDEZVOUS;
|
|
uint64_t FUN_SMP_NO_RENDEVOUS_BARRIER;
|
|
/* Shellcode HV */
|
|
uint64_t HV_CODE_CAVE_PA;
|
|
uint64_t HV_HANDLE_VMEXIT_PA;
|
|
/* Patches on Kernel */
|
|
uint64_t KERNEL_UART_OVERRIDE;
|
|
uint64_t KERNEL_CFI_CHECK;
|
|
/* Internal functions to prepare boot */
|
|
uint64_t G_VBIOS;
|
|
uint64_t FUN_TRANSMITTER_CONTROL;
|
|
uint64_t FUN_MP3_INITIALIZE;
|
|
uint64_t FUN_MP3_INVOKE;
|
|
/* Wifi FW */
|
|
uint64_t PS5_WIFI_FW_OFFSET;
|
|
uint64_t PS5_WIFI_FW_SIZE;
|
|
|
|
uint64_t HV_MP_STARTUP_CALL;
|
|
uint64_t MP_STARTUP_INIT_VECTOR;
|
|
uint64_t DATA_CAVE;
|
|
uint64_t GAD_PIVOT_ADD_RSP28_RET;
|
|
uint64_t GAD_POP_R8_RET;
|
|
uint64_t GAD_STORE_RCX_R8_RET;
|
|
uint64_t GAD_STORE_RDI8_RCX_RET;
|
|
uint64_t GAD_OR_RCX_EAX_RET;
|
|
uint64_t GAD_SET_DR7_RET;
|
|
uint64_t GAD_STORE_RCX_RDX_RET;
|
|
uint64_t GAD_STORE_RCX_RAX_RET;
|
|
uint64_t GAD_MOV_RAX_RSI_RET;
|
|
uint64_t GAD_MOV_RAX_RDI_RET;
|
|
uint64_t GAD_REP_MOVSB_RET;
|
|
uint64_t GAD_CLD_RET;
|
|
uint64_t GAD_RET_TRAMP;
|
|
uint64_t GAD_DBREG_RESUME;
|
|
uint64_t RESERVED_56;
|
|
uint64_t RESERVED_57;
|
|
uint64_t NVS_SIGNATURE;
|
|
uint64_t HV_EFI_MAP_ROOT;
|
|
} offset_list;
|
|
|
|
_Static_assert(sizeof(offset_list) == 0x1E0,
|
|
"offset_list must match the 13.60 60-qword table");
|
|
|
|
extern offset_list off_0300;
|
|
extern offset_list off_0310;
|
|
extern offset_list off_0320;
|
|
extern offset_list off_0321;
|
|
extern offset_list off_0400;
|
|
extern offset_list off_0402;
|
|
extern offset_list off_0403;
|
|
extern offset_list off_0450;
|
|
extern offset_list off_0451;
|
|
extern offset_list off_0500;
|
|
extern offset_list off_0502;
|
|
extern offset_list off_0510;
|
|
extern offset_list off_0550;
|
|
extern offset_list off_0600;
|
|
extern offset_list off_0602;
|
|
extern offset_list off_0650;
|
|
extern offset_list off_0700;
|
|
extern offset_list off_0701;
|
|
extern offset_list off_0720;
|
|
extern offset_list off_0740;
|
|
extern offset_list off_0760;
|
|
extern offset_list off_0761;
|
|
extern offset_list off_1100;
|
|
extern offset_list off_1120;
|
|
extern offset_list off_1140;
|
|
extern offset_list off_1160;
|
|
extern offset_list off_1300;
|
|
extern offset_list off_1320;
|
|
extern offset_list off_1340;
|
|
extern offset_list off_1342;
|
|
extern offset_list off_1360;
|
|
|
|
#endif
|