Memory layout - Revision history

Mako at 18:06, 31 July 2024

2024-07-31T16:06:38Z

← Older revision		Revision as of 20:06, 31 July 2024
Line 27:		Line 27:

	== ASLR Implementation ==		== ASLR Implementation ==
	The kernel uses a MT19937 random number generator, seeded by [[SMC#~~GetRandomBytes~~\|~~smcGetRandomBytes~~]].		The kernel uses a MT19937 random number generator, seeded by [[SMC#GenerateRandomBytes\|smcGenerateRandomBytes]].

	=== 1.0.0 ===		=== 1.0.0 ===

2024-07-02T18:30:50Z

IRAM

← Older revision		Revision as of 22:30, 2 July 2024
Line 1,285:		Line 1,285:
	= IRAM =		= IRAM =
	== BIT ==		== BIT ==
	During boot, the BootROM saves the BCT in IRAM at address 0x40000100. The preceding 0x100 bytes (IRAM memory range from 0x40000000 to 0x40000100) contain a structure called BIT (Boot Info Table) which encapsulates the BCT in IRAM and is initialized by the BootROM as follows:		During boot, the BootROM saves the [[BCT]] in IRAM at address 0x40000100 with Erista, and 0x40000464 with Mariko. The preceding 0x100 bytes (IRAM memory range from 0x40000000 to 0x40000100) contain a structure called BIT (Boot Info Table) which encapsulates the BCT in IRAM and is initialized by the BootROM as follows:

	=== Erista ===		=== Erista ===

2020-06-11T14:33:52Z

Mariko

2019-08-26T17:53:37Z

2019-08-26T16:45:58Z

2019-08-26T03:23:49Z

GSC5

← Older revision		Revision as of 07:23, 26 August 2019
Line 1,740:		Line 1,740:
	</pre>		</pre>

	It can be further configured using [[SMC#ConfigureCarveout\|smcConfigureCarveout]]~~, but it's currently unused~~.		It can be further configured using [[SMC#ConfigureCarveout\|smcConfigureCarveout]].

2019-08-25T18:00:15Z

2019-08-23T18:51:38Z

@@ Line 27: / Line 27: @@
 == ASLR Implementation ==
-The kernel uses a MT19937 random number generator, seeded by a [[SMC#GetRandomBytes|smcGetRandomBytes]]
+The kernel uses a MT19937 random number generator, seeded by [[SMC#GetRandomBytes|smcGetRandomBytes]].
 === 1.0.0 ===
@@ Line 68: / Line 69: @@
 KASLR is being used since [[5.0.0]], but not before, with the following pseudocode (might contains some errors):
-<code><pre>
+<pre>
 DRAM crt0 mapping (ttbr1): offsets DRAM with (rand64ViaSmc() % 0x3FFF0 << 21), allocates exactly (end - _start) + 1GB.
 This is a "linear" mapping. Permissions are set properly.
@@ Line 111: / Line 112: @@
 Map(RandomizePageBoundary(GuardPage + KCoreContext * 4)) -> NextFreePages(4)
-</pre></code>
+</pre>
 == 1.0.0 ==
@@ Line 315: / Line 316: @@
 = Secure Monitor =
 Unless otherwise mentionned, block descriptors (in our case, the one uses for the DRAM identity mapping) are all ORRed by 0x401 and page descriptors by 0x403.
 == [[1.0.0]] ==
 {| class="wikitable" border="1"
 |-
@@ Line 1,521: / Line 1,520: @@
 |  Must be empty.
 |}
 = Notes =

2019-08-14T07:07:21Z

electric boogaloo

← Older revision		Revision as of 11:07, 14 August 2019
Line 848:		Line 848:
	\| 0x2000		\| 0x2000
	\| 0x40000000000304		\| 0x40000000000304
	\| ~~Undocumented/Not~~ Present (Security Engine ~~for Mariko?)~~		\| Erista: Nothing Present, Mariko: Security Engine 2
	\|-		\|-
	\| 0x1F0092000		\| 0x1F0092000
Line 1,083:		Line 1,083:
	\| 0x2000		\| 0x2000
	\| 0x40000000000304		\| 0x40000000000304
	\| ~~Undocumented/Not~~ Present (Security Engine ~~for Mariko?)~~		\| Erista: Nothing Present, Mariko: Security Engine 2
	\|-		\|-
	\| 0x1F0092000		\| 0x1F0092000

2019-07-29T16:22:30Z

IRAM