Add some reverse engineering notes

notes.md

@@ -0,0 +1,42 @@
+# Loader notes
+
+## Modinfo
+Loader must provide modinfo to kernel, a TLV structure
+
+* Dump from normal FreeBSD with `sysctl debug.dump_modinfo`
+* Tag is `MODINFO_*` or `MODINFO_METADATA | MODINFOMD_*`
+* Tag and length are 4 bytes native endian
+* Value is padded to align to `sizeof(size_t)`
+* Strings are null-terminated
+* Encodes multiple modules in sequence, separated by `MODINFO_NAME` string
+
+### Fields
+* `MODINFO_NAME`: string with path to file if available
+* `MODINFO_TYPE`: string with type, like `elf kernel`
+* `MODINFO_ADDR`: usize with base virtual address of object
+* `MODINFO_SIZE`: usize with size of object, for elf based on end of final load section
+* `MODINFOMD_EFI_MAP`: UEFI memory map, as comes from `GetMemoryMap`
+* `MODINFOMD_EFI_FB`: Some structure describing UEFI framebuffer
+* `MODINFOMD_KEYBUF`: `struct keybuf` object with cached keys, don't really need it
+* `MODINFOMD_FW_HANDLE`: physical address of RuntimeServices system table
+* `MODINFOMD_MODULEP`: Base physical address of modinfo, probably
+* `MODINFOMD_KERNEND`: Last physical address of kernel, should be free after
+* `MODINFOMD_HOWTO`: u32 with a bunch of bitflags that start with `RB_` in `sys/sys/reboot.h`
+* `MODINFOMD_ELFHDR`: copy of the elf header
+* `MODINFOMD_DYNAMIC`: base virtual address of `PT_DYNAMIC` segment
+* `MODINFOMD_SSYM`: start virtual address of symtab/strtab
+    * symtab is section with `SHT_SYMTAB`, strtab is linked section
+    * Both have length prepended (as usize) and are aligned to usize
+* `MODINFOMD_ESYM`: end virtual address of symbols
+* `MODINFOMD_SHDR`: the section header table
+
+## Kernel
+Kernel must be loaded into memory at offset divisible by 2 MiB
+* yes, the loader zeroes bss
+
+## Architecture specific
+Tons of arch-specific restrictions
+### `x86_64`
+* Pointers are passed as 32-bit, must be within the first 4G
+* First 4G of virtual memory must be identity mapped
+* Kernel virtual address must also be mapped to kernel (normally `0xffff_ffff_8000_0000`)