-
-
[原创]内核开发系列2 - 硬件及内核基础知识之Device Tree(设备树)
-
2022-2-7 21:23 14401
-
ios的Device Tree跟的Linux设备树(Devicetree)很类似,Device Tree的内存地址在boot_args的deviceTreeP
typedef struct boot_args { uint16_t revision; /* Revision of boot_args structure */ uint16_t version; /* Version of boot_args structure */ uint64_t virtBase; /* Virtual base of memory */ uint64_t physBase; /* Physical base of memory */ uint64_t memSize; /* Size of memory */ uint64_t topOfKernelData; /* Highest physical address used in kernel data area */ boot_video video; /* Video Information */ uint32_t machineType; /* Machine Type */ void *deviceTreeP; /* Base of flattened device tree */ uint32_t deviceTreeLength; /* Length of flattened tree */ char commandLine[BOOT_LINE_LENGTH]; /* Passed in command line */ uint64_t boot_flags; /* Misc boot flags*/ } boot_args; iPhone8,14.6实例: Revision: 0x2 Version: 0x2 virtBase: 0xfffffff00a7f4000 physBase 0x8007f4000 memSize: 0x7b62c000 物理内存大小2G topOfKernelData: 0x8070a8000 machineType: 0x0 deviceTreeP: 0xfffffff00e90c000 deviceTreeLength: 0x34000
iOS启动初始内存分布:
+==========================+ <-- bottom of RAM (0x8_0000_0000) | Coprocessor carveouts, | | iBoot stuff, etc. | +==========================+ <-- boot_args->phys_base, VM = boot_args->virt_base | kASLR slide gap (<32MiB) | 内核ASLR,(Address Space Layout Randomization ) 地址空间配置随机加载 +==========================+ | Device Tree (ADT) | /chosen/memory-map.DeviceTree +--------------------------+ | Trust Cache | /chosen/memory-map.TrustCache +==========================+ <-- Mach-O lowest vmaddr mapped to here (+ slide!) | Mach-O base (header) | /chosen/memory-map.Kernel-mach_header +-- --+ | Mach-O segments... | /chosen/memory-map.Kernel-(segment ID)... +==========================+ | SEP Firmware | /chosen/memory-map.SEPFW +--------------------------+ <-- boot_args | BootArgs | /chosen/memory-map.BootArgs +==========================+ <-- boot_args->top_of_kdata | | | (Free memory) | | (incl. iBoot trampoline) | | | +==========================+ <-- boot_args->top_of_kdata + boot_args->mem_size | Video memory, SEP | | carveout, and more | +==========================+ <-- 0x8_0000_0000 + boot_args.mem_size_actual
iPhone8,14.6 Device Tree Dump:
device-tree: | regulatory-model-number [32]: A1863 | #address-cells [4]: 0x2 | AAPL,phandle [4]: 0x1 | config-number [64]: (ZERO_FILL) | serial-number [32]: *****(序列号,隐藏) | target-type [4]: D20 | platform-name [32]: t8015 | mlb-serial-number [32]: *****(主板序列号,隐藏) | secure-root-prefix [3]: md | name [12]: device-tree | manufacturer [11]: Apple Inc. | region-info [32]: CH/A 国行 | compatible [26]: 4432304150006950686f6e6531302c31004170706c6541524d |D20AP.iPhone10,1.AppleARM| | model-number [32]: MQ6M2 | time-stamp [28]: Sat May 8 01:21:14 PDT 2021 | clock-frequency [4]: 0x0 | model-config [86]: receiver_1=AAC;wifi_module_vendor=USI;MoPED=0xB3651978EE098EF5F5BB3B021C79773226D4B157 | model [11]: iPhone10,1 | device_type [8]: bootrom | #size-cells [4]: 0x2 + chosen: | | development-cert [4]: 0x0 | | disable-transport-rm [4]: 0x0 | | amfi-only-platform-code [4]: 0x0 | | coverglass-color [16]: < 0x1 0x200000000 > | | consistent-debug-root [8]: 0x0 | | dram-vendor [16]: Samsung | | board-id [4]: 0x2 | | root-matching [256]: <dict><key>IOProviderClass</key><string>IOMedia</string><key>IOPropertyMatch</key><dict><key>Partition ID</key><integer>1</integer></dict></dict> | | unique-chip-id [8]: 0x******(设备id,隐藏) | | dram-vendor-id [4]: 0x1 | | mac-address-bluetooth0 [6]: b*******(蓝牙地址,隐藏) | | software-behavior [16]: 0x141 0x0 | | amfi-allows-trust-cache-load [4]: 0x0 | | mix-n-match-prevention-status [4]: 0x1 | | max-env-var-name-size [4]: 0x3f | | certificate-security-mode [4]: 0x1 | | display-rotation [4]: 0x0 | | crypto-hash-method [9]: sha2-384 | | secure-boot [4]: 0x1 | | housing-color [16]: < 0x1 0x700000000 > | | gid-aes-key [4]: 0x1 | | disable-av-content-protection [4]: 0x0 | | image4-supported [0]: | | boot-nonce [8]: 0x82263873cc27ed5a | | display-corner-radius [4]: 0x0 .... + memory-map: .... | | | name [11]: memory-map | | | kernel-only [5]: true | | | TrustCache [16]: < 0x804194000 0xc000 > | | | DeviceTree [16]: < 0x804160000 0x34000 > | | | SEPFW [16]: < 0x806784000 0x174000 > SEP Firmware内存地址及长度 | | | BootArgs [16]: < 0x8068f8000 0x4000 > 起动参数地址及长度 | | | Kernel-__TEXT [16]: < 0x8041a0000 0x710000 > Kernelcache的__TEXT段内存地址及长度 | | | Kernel-__DATA_CONST [16]: < 0x8048b0000 0x33c000 > | | | Kernel-__TEXT_EXEC [16]: < 0x804bec000 0x17e4000 > | | | Kernel-__KLD [16]: < 0x8063d0000 0x4000 > | | | Kernel-__LAST [16]: < 0x8063d4000 0x4000 > | | | Kernel-__KLDDATA [16]: < 0x8063d8000 0x4000 > | | | Kernel-__DATA [16]: < 0x8063dc000 0x21c000 > | | | Kernel-__BOOTDATA [16]: < 0x8065f8000 0x3c000 > | | | Kernel-__PRELINK_INFO [16]: < 0x806634000 0x12c000 > | | | Kernel-__LINKEDIT [16]: < 0x806760000 0x21730 > | | | Kernel-mach_header [16]: < 0x8041a0000 0x20 > .... + cpus: | | #address-cells [4]: 0x1 | | #size-cells [4]: 0x0 | | name [5]: cpus | | AAPL,phandle [4]: 0xe + cpu0: | | | fixed-frequency [8]: 0x16e3600 | | | coresight-reg [16]: < 0x208010000 0x40000 > | | | cluster-core-id [4]: 0x0 | | | l3-cache-size [4]: 0x800000 | | | clock-frequency [8]: 0x16e3600 | | | state [8]: running | | | l2-cache-size [4]: 0x100000 | | | interrupt-parent [4]: 0x1a | | | function-error_handler [12]: 1900000048727245 | | | interrupts [12]: 800100005b0000008101 | | | timebase-frequency [8]: 0x16e3600 | | | function-ipi_dispatch_other [12]: 1a000000444950498101 | | | cpu-impl-reg [16]: < 0x208050000 0x10000 > | | | function-enable_core [12]: 1c00000065726f4301 | | | cluster-id [4]: 0x0 | | | l2-cache-id [4]: 0x0 | | | memory-frequency [8]: 0x16e3600 | | | cpm-impl-reg [16]: < 0x208e40000 0x10000 > | | | peripheral-frequency [8]: 0x16e3600 | | | AAPL,phandle [4]: 0xf | | | cpu-id [4]: 0x0 | | | name [5]: cpu0 | | | function-ipi_dispatch [12]: 1a000000444950498001 | | | cluster-type [2]: 45 | | | cpu-version [4]: 0x0 | | | device_type [4]: cpu | | | compatible [21]: 6170706c652c6d69737472616c0041524d2c7638 |apple,mistral.ARM,v8| CPU代号mistral(猛烈的风) | | | die-cluster-id [4]: 0x0 | | | reg-private [8]: 0x208010000 | | | reg [4]: 0x0 | | | acc-impl-reg [16]: < 0x208f00000 0x50000 > | | | bus-frequency [8]: 0x16e3600 总线速率 2.4GHz | | | function-cpu_idle [8]: 0x637075490000001c | | | l3-cache-id [4]: 0x0
Device Tree包含了所有设备的信息,跟设备的IO交互,则是通过内存地址的方式进行调用,比如sep
+ arm-io: | | compatible [13]: arm-io,t8015 | | clock-frequencies [396]: 003.... | | soc-generation [4]: H10 | | reg [112]: < 0x208f00000....> | | chip-revision [4]: 0x11 | | AAPL,phandle [4]: 0x19 | | iommu-present [0]: | | acc-impl [16]: < 0x208f00000 0x1000 > | | device_type [9]: t8015-io | | #size-cells [4]: 0x2 | | ranges [48]: < 0x0 0x200000000 0x100000000 0x600000000...> //第2个地址为IOBase:0x200000000(固定) ... + sep: | | | compatible [10]: iop,t8015 | | | clock-ids [4]: 0x14a | | | interrupt-parent [4]: 0x1a | | | aarch64 [0]: | | | interrupts [16]: < 0x790000007a 0x7b0000007c > | | | clock-gates [4]: 0x7e | | | reg [16]: < 0x43000000 0x10000 > SEP的MailBox的地址IOBase+第1个数值:0x43000000+0x8100 | | | self-power-gate [0]: | | | iop-version [4]: 0x1 | | | device_type [4]: sep | | | sika-support [4]: 0x1 | | | AAPL,phandle [4]: 0x3e | | | cpu-ctrl-filtered [0]: | | | power-gates [4]: 0x7e
内核通过MailBox内存地址与SEP进行调用
更多待更新...
---
内核开发系列
[内核开发系列1 - 从越狱隐藏到自定义越狱](https://bbs.pediy.com/thread-270824.htm)
**内核开发系列2-硬件及内核基础知识**
**内核开发系列3-基于QEMU和iBoot泄露源码内核开发调试**
**内核开发系列4-基于Corellium内核开发调试**
[内核开发系列5 - 从checkra1n了解Kernel Patch](https://bbs.pediy.com/thread-270825.htm)
更多待更新...
----
原创内容,转载或内核开发交流可Q: 3#1#0#4#1#9#0#6#2 (倒序)
----
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课
最后于 2022-2-7 21:34
被alice编辑
,原因:
赞赏
他的文章
看原图