Yaya48/QEMU-S5L8950X
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

hw/arm: add authenticated A6 IMG3 boot lab

Browse Source 
Model the A6 crypto, interrupt, USB, and platform blocks needed to boot SecureROM through iBSS into iBEC Recovery.

Add local lab identity, IMG3, and APTicket tooling, patched macOS recovery utilities, UART and GDB access, and English end-user documentation.
This commit is contained in:
Yaya48
2026-09-01 09:51:49 -07:00
parent 47977dd34a
commit 5d9a60a926
45 changed files with 6002 additions and 265 deletions
Download Patch File Download Diff File Expand all files Collapse all files
windows/include/qemu_a6_usb_protocol.h
+19
View File
@@ -6,13 +6,21 @@
#define QA6_USB_PROTOCOL_VERSION 1u
#define QA6_USB_MESSAGE_REQUEST 1u
#define QA6_USB_MESSAGE_RESPONSE 2u
#define QA6_USB_MESSAGE_INFO_REQUEST 3u
#define QA6_USB_MESSAGE_INFO_RESPONSE 4u
#define QA6_USB_MESSAGE_BULK_REQUEST 5u
#define QA6_USB_MESSAGE_BULK_RESPONSE 6u
#define QA6_USB_MESSAGE_RESET_REQUEST 7u
#define QA6_USB_MESSAGE_RESET_RESPONSE 8u
#define QA6_USB_STATUS_SUCCESS 0
#define QA6_USB_STATUS_STALL -1
#define QA6_USB_STATUS_DISCONNECTED -2
#define QA6_USB_STATUS_PROTOCOL -3
#define QA6_USB_STATUS_UNSUPPORTED -4
#define QA6_USB_MAX_PAYLOAD 65535u
#define QA6_USB_SERIAL_MAX 256u
#pragma pack(push, 1)
typedef struct Qa6UsbFrameHeader {
@@ -25,6 +33,17 @@ typedef struct Qa6UsbFrameHeader {
unsigned int transfer_length;
unsigned char setup[8];
} Qa6UsbFrameHeader;
typedef struct Qa6UsbDeviceInfo {
unsigned int generation;
unsigned short vendor_id;
unsigned short product_id;
unsigned char device_class;
unsigned char device_subclass;
unsigned char device_protocol;
unsigned char is_dfu;
char serial[QA6_USB_SERIAL_MAX];
} Qa6UsbDeviceInfo;
#pragma pack(pop)
#define QA6_USB_HEADER_SIZE ((unsigned int)sizeof(Qa6UsbFrameHeader))