Fixes `[!] GET_CONF response envelope validation failed` and failure to read/write A53 SRAM on firmware 9.40 through 11.20. #2

New issue

Open

opened 2026-09-19 00:42:01 -05:00 by 187rider · 0 comments

187rider commented

2026-09-19 00:42:01 -05:00

(Migrated from github.com)

Root Cause

In commit 1b5c3ad, the hardcoded offsets were replaced by a search loop starting from flags_slot looking for any 1MB-aligned DMAP address.

On FW 9.40–11.20, this loop stopped at mp4sc + 0x570 (a 16KB internal channel buffer at PA 0x09400000 / 0x0ea00000), rather than the actual 2MB coredump aperture at mp4sc + 0x6b8 (PA 0x70000000, size 0x200000).
Because the code overwrote BAR2 registers (0xf8000 and 0xf9000) with the 16KB buffer instead of the kernel's dedicated 2MB coredump aperture (0x70000000), the A53 co-processor did not return DECI5S responses to +0x570, causing envelope validation to fail with magic_at_off=0x00000000.
Furthermore, on 11.20 the live command in mp4sc + 0x164 has an incrementing counter (0x2030xxxx), which caused static command triggers to be ignored.

Solution

Dynamic IOMMU Aperture Matching: Reads the initial iommu physical address from BAR2 register 0xf8000 (0x70000000) and scans mp4sc to locate the descriptor (iommu_match_slot + 8), ensuring the correct 2MB buffer is bound across all firmware revisions.
Dynamic Command Code Tracking: Reads mp4sc + 0x164 for the current command sequence before triggering kicks.
Flexible Buffer Validation: Allows standard 64-bit kernel virtual addresses and page alignments on late firmwares.
Stdout Flushing: Added explicit fflush(stdout) to prevent socket buffering stalls during payload transmission over nc.

Verification

Tested on PS5 retail firmware 11.20 (0x11200000):

GET_CONF parses release string: "cex(1.1.2.01):Oberon-KDE 2025/04/17 02:24 releases/11.20 223898"
PPR 11.20 addresses resolved from exact runtime layout
dynamic Native/PLAINTEXT_NOAUTH patch installed and read back

### Root Cause In commit `1b5c3ad`, the hardcoded offsets were replaced by a search loop starting from `flags_slot` looking for any 1MB-aligned DMAP address. - On FW 9.40–11.20, this loop stopped at `mp4sc + 0x570` (a 16KB internal channel buffer at PA `0x09400000` / `0x0ea00000`), rather than the actual 2MB coredump aperture at `mp4sc + 0x6b8` (PA `0x70000000`, size `0x200000`). - Because the code overwrote BAR2 registers (`0xf8000` and `0xf9000`) with the 16KB buffer instead of the kernel's dedicated 2MB coredump aperture (`0x70000000`), the A53 co-processor did not return DECI5S responses to `+0x570`, causing envelope validation to fail with `magic_at_off=0x00000000`. - Furthermore, on 11.20 the live command in `mp4sc + 0x164` has an incrementing counter (`0x2030xxxx`), which caused static command triggers to be ignored. ### Solution 1. **Dynamic IOMMU Aperture Matching**: Reads the initial `iommu` physical address from BAR2 register `0xf8000` (`0x70000000`) and scans `mp4sc` to locate the descriptor (`iommu_match_slot + 8`), ensuring the correct 2MB buffer is bound across all firmware revisions. 2. **Dynamic Command Code Tracking**: Reads `mp4sc + 0x164` for the current command sequence before triggering kicks. 3. **Flexible Buffer Validation**: Allows standard 64-bit kernel virtual addresses and page alignments on late firmwares. 4. **Stdout Flushing**: Added explicit `fflush(stdout)` to prevent socket buffering stalls during payload transmission over `nc`. ### Verification Tested on PS5 retail firmware 11.20 (`0x11200000`): - `GET_CONF` parses release string: `"cex(1.1.2.01):Oberon-KDE 2025/04/17 02:24 releases/11.20 223898"` - `PPR 11.20 addresses resolved from exact runtime layout` - `dynamic Native/PLAINTEXT_NOAUTH patch installed and read back`