small docs update
This commit is contained in:
parent
33d3d38d5c
commit
5aa1331a52
@ -21,7 +21,7 @@ To extract the sboot.bin file from a samsung firmware file:
|
|||||||
|
|
||||||
Memory Layout
|
Memory Layout
|
||||||
-------------
|
-------------
|
||||||
TODO make memory layout of ROM, IMEM and some devices
|
TODO make memory layout of ROM, IMEM and some devices @JONHE
|
||||||
|
|
||||||
.. figure:: images/memory_layout.drawio.svg
|
.. figure:: images/memory_layout.drawio.svg
|
||||||
|
|
||||||
@ -49,10 +49,44 @@ dldata
|
|||||||
|
|
||||||
This protocol remains *mostly* the same for newer Exynos SoCs.
|
This protocol remains *mostly* the same for newer Exynos SoCs.
|
||||||
|
|
||||||
|
USB Stack
|
||||||
|
=========
|
||||||
|
This information is largely based on the blogpost of Frederic on reversing the `USB stack of the Exynos BootROM <https://fredericb.info/2020/06/reverse-engineer-usb-stack-of-exynos-bootrom.html#reverse-engineer-usb-stack-of-exynos-bootrom>`_. We're looking at the proprietary USB protocol used by the Exynos BootROM.
|
||||||
|
|
||||||
|
The base address of the usb controller (dwusb3) is mapped at 0x1540000, with a size of 0x10000: (can be found at: `Exynos8890 dtsi <https://github.com/LineageOS/android_kernel_samsung_universal8890/tree/lineage-18.1/arch/arm64/boot/dts>`_).
|
||||||
|
|
||||||
|
.. code-block:: dts
|
||||||
|
|
||||||
|
udc: usb@15400000 {
|
||||||
|
compatible = "samsung,exynos8890-dwusb3";
|
||||||
|
clocks = <&clock 700>, <&clock 703>, <&clock 708>, <&clock 709>;
|
||||||
|
clock-names = "aclk", "sclk", "phyclock", "pipe_pclk";
|
||||||
|
reg = <0x0 0x15400000 0x10000>;
|
||||||
|
#address-cells = <2>;
|
||||||
|
#size-cells = <1>;
|
||||||
|
ranges;
|
||||||
|
usb-pm-qos-int = <255000>;
|
||||||
|
status = "disabled";
|
||||||
|
|
||||||
|
usbdrd_dwc3: dwc3 {
|
||||||
|
compatible = "synopsys,dwc3";
|
||||||
|
reg = <0x0 0x15400000 0x10000>;
|
||||||
|
interrupts = <0 213 0>;
|
||||||
|
phys = <&usbdrd_phy0 0>, <&usbdrd_phy0 1>;
|
||||||
|
phy-names = "usb2-phy", "usb3-phy";
|
||||||
|
};
|
||||||
|
};c
|
||||||
|
|
||||||
|
|
||||||
|
This is a basic USB controller, but some functions, that are also present in the linux kernel, should be visible in the bootROM as well. Available functions could be: `linux-kernel-dwc3 <https://android.googlesource.com/kernel/msm/+/android-msm-dory-3.10-kitkat-wear/drivers/usb/dwc3/core.h>`_.
|
||||||
|
|
||||||
Bug 1(Integer underflow)
|
Bug 1(Integer underflow)
|
||||||
------------------------
|
------------------------
|
||||||
@TODO better explain frederick's bug. @JOHER
|
|
||||||
|
https://github.com/LineageOS/android_kernel_samsung_universal8890/blob/lineage-18.1/arch/arm64/boot/dts/exynos8890.dtsi
|
||||||
|
|
||||||
|
@TODO better explain frederick's bug. @JONHE
|
||||||
|
|
||||||
|
|
||||||
Bug 2
|
Bug 2
|
||||||
-----
|
-----
|
||||||
|
4995
source/exploit/exynos8895-reference.dtsi
Normal file
4995
source/exploit/exynos8895-reference.dtsi
Normal file
File diff suppressed because it is too large
Load Diff
Loading…
Reference in New Issue
Block a user