hashirama/AppleSilicon
hashirama/AppleSilicon
Watch
1
0
Fork
You've already forked AppleSilicon
 0
mirror of https://github.com/yaelliethy/orchard.git synced 2026-10-29 18:29:57 +00:00
Code Issues Projects Releases Wiki Activity

prepare-aux: the 0xa00000 NVRAM bank is 0x80000 long, not 0x2000

Browse source 
On the pristine tart aux the bank's stored adler32 only matches over
0x80000, and it is the live bank. With 0x2000 the script wrote an invalid
checksum there, so iBoot fell back to the bank without the boot-args.

Signed-off-by: awaiiro <332003006+awaiiro@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
awaiiro 2026-09-24 04:51:42 +00:00
commit b0ea0eb549
2 changed files with 8 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

2
TECHNICAL.md
View file

@ -56,7 +56,7 @@ rather than corrupted.
### Boot arguments
There is no `-append` on this path: boot-args come from NVRAM. The aux holds two
CHRP banks (at `0xa00000` length `0x2000`, and `0xa80000` length `0x80000`),
CHRP banks (at `0xa00000` and `0xa80000`, both of length `0x80000`),
each with an adler32 over `[base+0x14, base+banklen)` stored LE at `base+0x10`.
The live one is the bank with the higher generation.

11
scripts/prepare-aux.py
View file

@ -3,9 +3,12 @@
Why it is this careful:
The aux holds two CHRP NVRAM banks, at 0xa00000 (length 0x2000) and 0xa80000
(length 0x80000); the one with the higher generation is live. Each bank stores
an adler32 over `[base+0x14, base+banklen)` little-endian at `base+0x10`.
The aux holds two CHRP NVRAM banks, at 0xa00000 and 0xa80000, both 0x80000
long; the one with the higher generation is live. Each bank stores an adler32
over `[base+0x14, base+banklen)` little-endian at `base+0x10`. On the pristine
tart aux the stored checksum of *both* banks matches only over 0x80000 bytes
(over 0x2000 neither does), and the 0xa00000 bank is the live one (generation
45 against 44).
**Append-only works; re-serialising the entry list does not.** Rewriting the
list makes iBoot reject the NVRAM, set `iboot-failure-reason=0x65` and
@ -26,7 +29,7 @@ import shutil
import sys
import zlib
BANKS = ((0xA00000, 0x2000), (0xA80000, 0x80000))
BANKS = ((0xA00000, 0x80000), (0xA80000, 0x80000))
GEN_OFF = 0x14 # generation counter, LE u32, first word of the payload
CKSUM_OFF = 0x10 # adler32 of [base+0x14, base+banklen), LE u32