<p><pre><code> > In order to read the NVMe, I therefor developped a PCIe card with a Zero
> Insertion Force reader. I brought the JTAG part to 20pin header. The hard
> pard in here is the signal integrity of the differential pairs. In order
> to do so, I had to use multi layer PCB, and have the impedence match by
> knowing the stackup, materials used for prepeg and so on..
</code></pre>
Posts like this are very humbling. They serve as a good reminder that no matter how far I've come and how much I've learned, there will always be someone out there who knows vastly more than me like the back of their hand.
The gold is at the bottom:<p><pre><code> The idea here would be to see if it was possible to control the NVMe
over jtag in order to ask it to perform a DMA read over the PCIe Bus.
In order to do so, the PCI_COMMAND_BUS_MASTER has to be set to 1. We
can assume that since the chip is using remote RAM, it is allowed to
act as a master over PCIe. Here is a snippet of the probing function
of the kernel driver.
</code></pre>
(code)<p><pre><code> Our goal here is to force the DMA to happen just by controlling the
ARM of the NVMe over JTAG, in order to ask it to dump the region we
alloc'd in kernel and see if we get the data out of it.
</code></pre>
In other words, full root exploit of the phone from the NVMe JTAG pins.
>It looks like to reduce the size needed, the NVMe core uses the host DDR in order to work. Therefor, apple is not strictly following the specification regarding the initialisation.<p>Yikes.