Linux kernel - The Hypervisor Weak Point?

[MIPs]

I mentioned this in the xbox360 thread aswell but just in case you missed it. The Cell BE Handbook CH. 11 talks about Logical Partitioning(LPAR) and the Hypervisor. It pretty much tells you that the hypervisor is part of the Cell hardware and not the PS3 OS. It's the work of IBM. This particular chapter is 23 pages of low level Hypervisor information. Explains all the registers and the different levels that programs run in. It sheds alot of light on the 360 exploit.

[zefie]

from kboot: other-os-flash-util -s /dev/sdb

[MIPs]

Originally Posted by zefie from kboot: other-os-flash-util -s /dev/sdb

Be more specific... What's the difference between running that from kboot and running it from the linux command prompt?

[hacked2123]

+ * The HV virtual address space (vas) allows for hotplug memory regions. + * Memory regions can be created and destroyed in the vas at runtime. + * @rm: real mode (bootmem) region + * @r1: hotplug memory region(s) + * + * ps3pf addresses + * virt_addr: a cpu 'translated' effective address + * phys_addr: an address in what Linux thinks is the physical address space + * lpar_addr: an address in the HV virtual address space + * bus_addr: an io controller 'translated' address on a device bus + */

+ * ps3pf_mm_phys_to_lpar - translate a linux physical address to lpar address + * @phys_addr: linux physical address

+ * dma_lpar_to_bus - Translate an lpar address to ioc mapped bus address. + * @r: pointer to dma region structure + * @lpar_addr: HV lpar address

Aren't these all the level's of code on the PS3? Can't we use these command to pass what we want into it, and get what we want out of it? Like the Hypervisor addresses for the bluray, the physical address of the bluray, the "real" address of the bluray? (the UUID found earlier?)

[MIPs]

What file is that from? That looks really interesting....

[hacked2123]

Originally Posted by MIPs What file is that from? That looks really interesting....

i think it was mm.c or .h or something... i'm sure it will show in google... but i got to run right now...ill check in 4 hours

sorry...yea...just type
+ * dma_lpar_to_bus - Translate an lpar address to ioc mapped bus address.
into the search engine of choice...and it'll be there...interestingly i just saw a line that commented pvr video4linux driver in the source...can't believe i didn't see that before

Last edited by hacked2123; 03-17-2007 at 07:19 AM. Reason: Automerged Doublepost

[MIPs]

NP ^_^......thnx for the info. Linux is probably our best bet at seeing how actual calls are made to the HV and trying to make some calls ourselves. I'm hoping developers left some useful debug strings in the games. Might be some interesting stuff in there aswell.

[hacked2123]

Originally Posted by MIPs NP ^_^......thnx for the info. Linux is probably our best bet at seeing how actual calls are made to the HV and trying to make some calls ourselves. I'm hoping developers left some useful debug strings in the games. Might be some interesting stuff in there aswell.

Debug strings... that's why i check the patches... only thing they have to be "signed off"... wondering if that gets in the way of us seeing the debug lines

[MagikRevolver]

Has anyone yet worked on the eboot.bin side of things for the ps3?

I'm trying to figure some things out just by the parameters etc... of the blu ray disc itself. I'm hoping to find a back door this way, like you guys, that redirects the reading procedure to the hardrive through a boot disc.