ChanServ changed the topic of #asahi-re to: Asahi Linux: porting Linux to Apple Silicon macs | Hardware / boot process / firmware interface reverse engineering | WARNING: this channel (only) may contain binary reverse engineering discussion | RE policy: https://alx.sh/re (MANDATORY READ) | GitHub: https://alx.sh/g | Wiki: https://alx.sh/w | Logs: https://alx.sh/l/asahi-re
<sven>
there’s dart.ioread or something like that
<sven>
that one just walks the pagetable to find the physical address and then just reads that
chengsun_ has joined #asahi-re
<amarioguy>
ah i see
<amarioguy>
rn i'm just trying to figure out how SEP knows where the gigalocker is because i'm not seeing any shared writes
<amarioguy>
strings on apple sep manager talk about "OOL buffers"
chengsun has quit [Ping timeout: 480 seconds]
<amarioguy>
perhaps those have smth to do with it
<amarioguy>
or maybe i have this all wrong and AP just queries the locker on demand whenever it needs to decrypt it
roxfan has quit [Remote host closed the connection]
roxfan has joined #asahi-re
<amarioguy>
okay so the CRCs that XNU is saying the lockers have don't match up at all with the gigalocker CRCs...
chengsun_ has quit [Ping timeout: 480 seconds]
<amarioguy>
also apparently single user mode data accesses do not trigger SEP - likely because of how it's decrypted on the fly through the storage controller ephemeral key
<amarioguy>
LOL setting a breakpoint while the framebuffer comes on causes snow effects like old TVs
<amarioguy>
(or rather right after SEP changes the lock state)
<amarioguy>
okay so one of the absolute most verbose sep operations is pfk_data_unwrap and it's associated reply in the tracer
<amarioguy>
(yes i am just dumping what i find as i find it how did you know :) )
* amarioguy
sure hopes i'm doing this mmio tracing thing right
<amarioguy>
huh so during the unlock sequence after the first unlock, XNU logs the replies on the AP side with 0xffff in the upper two bytes
<amarioguy>
then it logs as "saving" the xart with a 2 byte crc
<amarioguy>
on the tracer side though, the actual mailbox message has that two byte CRC at the start
<amarioguy>
(the upper two bytes i mean)
<amarioguy>
think i'll want to look at the gigalocker file i have very closely tomorrow
<amarioguy>
to match up the xnu "crc" with the GL CRC
Emantor_ has quit []
Emantor has joined #asahi-re
user982492 has joined #asahi-re
ma has joined #asahi-re
ma4 has quit [Ping timeout: 480 seconds]
user982492 has quit [Quit: My MacBook has gone to sleep. ZZZzzz…]
mini0n has joined #asahi-re
<marcan>
eiln: also you may know this already, but ane1/ane3 are fused off on Max/Ultra devices
<marcan>
I don't know why, but iBoot filters them out
<marcan>
they seem to be hard shut down
<marcan>
my theory is it's either broken silicon or they decided not to implement it due to power envelope reasons
<marcan>
concurrency *should* be used on M1 Ultra for the ANE across each die
<marcan>
macOS has some kind of balancer/dispatcher kext for this
<marcan>
it was probably intended for M1 Max too, I don't think the reason they ditched the second ANE is because it wasn't ready in time, though it could be
<marcan>
and yes, geohot's "research" is, well... yeah what you said tracks
mini0n has quit []
nicolas17 has quit [Ping timeout: 480 seconds]
eiln has joined #asahi-re
SSJ_GZ has joined #asahi-re
<eiln>
ohh I thought max/pros had ane1 enabled
<eiln>
so "device with two neural processor circuits" == just ultra
<eiln>
that makes a lot more sense
<eiln>
marketing speak says "32-core Neural Engine" for ultra
<eiln>
and "16-core Neural Engine" for all else
<eiln>
assuming core == ne*8, that checks out
<eiln>
seems they are pretty set on that decision
<eiln>
my question is why they'd add more cores to ultra if 3 max models had issues with exactly that?
<eiln>
i guess m2+ lines would give the definite answer
<eiln>
h14 firmware is definitely different tho if that signals anything
<eiln>
also what exactly is meant by "iBoot filters them out"?
<eiln>
associated clock/power node doesn't go through?
mattgirv has quit [Server closed connection]
mattgirv_ has joined #asahi-re
eiln has quit [Quit: Page closed]
arekm has quit [Server closed connection]
arekm has joined #asahi-re
n1c has quit [Server closed connection]
n1c has joined #asahi-re
robinp has joined #asahi-re
nuup has quit [Server closed connection]
nuup has joined #asahi-re
<sven>
Iboot removes them from the template device tree iirc
<sven>
and I think marcan tried turning them on in pmgr and that just didn’t work
chengsun has joined #asahi-re
corion has joined #asahi-re
vup has joined #asahi-re
Dcow has quit [Ping timeout: 480 seconds]
Dcow has joined #asahi-re
corion has quit [Quit: Page closed]
goldsoultheory has quit [Quit: My MacBook has gone to sleep. ZZZzzz…]
chadmed_ has joined #asahi-re
yamii has joined #asahi-re
goldsoultheory has joined #asahi-re
<marcan>
eiln: it's 16 cores per neural engine
<marcan>
everything has one functional one per die, Ultra has two dies
<marcan>
ultra is just two max dies
<marcan>
if ane0 works on max then ane2 will work on ultra since it's just two of the same thing
<marcan>
ane1 is the broken one, which means also ane3 on ultra
<marcan>
pro does not have ane1 at all
<marcan>
pro only has one ane
<marcan>
so there is only one die, max, with two anes, and one is always disabled
<marcan>
hence my theory about silicon bug or power delivery issues
goldsoultheory has quit [Quit: My MacBook has gone to sleep. ZZZzzz…]
chadmed_ has quit [Remote host closed the connection]
goldsoultheory has joined #asahi-re
goldsoultheory has quit [Quit: My MacBook has gone to sleep. ZZZzzz…]
SSJ_GZ has quit [Ping timeout: 480 seconds]
SSJ_GZ has joined #asahi-re
corion has joined #asahi-re
user982492 has joined #asahi-re
corion has quit [Quit: Page closed]
Dcow has quit [Remote host closed the connection]
Dcow has joined #asahi-re
os has quit [Server closed connection]
os has joined #asahi-re
paddatrapper_ has quit [Server closed connection]
paddatrapper_ has joined #asahi-re
nicolas17 has joined #asahi-re
goldsoultheory has joined #asahi-re
ChaosPrincess has quit [Quit: WeeChat 3.7.1]
ChaosPrincess has joined #asahi-re
Tom__ has quit [Read error: Connection reset by peer]