2018-05-01 06:15:48 +01:00
|
|
|
/*
|
2018-08-05 12:40:32 +01:00
|
|
|
* Copyright (c) 2018 naehrwert
|
|
|
|
* Copyright (c) 2018 st4rk
|
|
|
|
* Copyright (c) 2018 Ced2911
|
2020-04-27 07:41:13 +01:00
|
|
|
* Copyright (c) 2018-2020 CTCaer
|
2018-09-09 23:44:04 +01:00
|
|
|
* Copyright (c) 2018 balika011
|
2018-08-05 12:40:32 +01:00
|
|
|
*
|
|
|
|
* This program is free software; you can redistribute it and/or modify it
|
|
|
|
* under the terms and conditions of the GNU General Public License,
|
|
|
|
* version 2, as published by the Free Software Foundation.
|
|
|
|
*
|
|
|
|
* This program is distributed in the hope it will be useful, but WITHOUT
|
|
|
|
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
|
|
|
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
|
|
|
|
* more details.
|
|
|
|
*
|
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
*/
|
2018-05-01 06:15:48 +01:00
|
|
|
|
|
|
|
#include <string.h>
|
2018-08-05 12:40:32 +01:00
|
|
|
|
2018-05-01 06:15:48 +01:00
|
|
|
#include "hos.h"
|
2018-11-28 19:26:16 +00:00
|
|
|
#include "hos_config.h"
|
2019-02-24 01:03:17 +00:00
|
|
|
#include "sept.h"
|
2018-12-01 18:46:59 +00:00
|
|
|
#include "secmon_exo.h"
|
2020-06-14 14:45:45 +01:00
|
|
|
#include "../config.h"
|
|
|
|
#include <gfx/di.h>
|
|
|
|
#include <gfx_utils.h>
|
|
|
|
#include <mem/heap.h>
|
|
|
|
#include <mem/mc.h>
|
|
|
|
#include <mem/minerva.h>
|
|
|
|
#include <mem/smmu.h>
|
|
|
|
#include <sec/se.h>
|
|
|
|
#include <sec/se_t210.h>
|
|
|
|
#include <sec/tsec.h>
|
|
|
|
#include <soc/bpmp.h>
|
|
|
|
#include <soc/ccplex.h>
|
2020-06-15 15:33:13 +01:00
|
|
|
#include <soc/clock.h>
|
2020-06-14 14:45:45 +01:00
|
|
|
#include <soc/fuse.h>
|
|
|
|
#include <soc/pmc.h>
|
|
|
|
#include <soc/t210.h>
|
2019-06-30 01:24:58 +01:00
|
|
|
#include "../storage/emummc.h"
|
2020-06-14 14:45:45 +01:00
|
|
|
#include <storage/mbr_gpt.h>
|
2018-11-28 19:26:16 +00:00
|
|
|
#include "../storage/nx_emmc.h"
|
2020-06-14 14:45:45 +01:00
|
|
|
#include <storage/nx_sd.h>
|
|
|
|
#include <storage/sdmmc.h>
|
|
|
|
#include <utils/btn.h>
|
|
|
|
#include <utils/util.h>
|
2018-11-30 21:20:15 +00:00
|
|
|
|
2018-08-14 00:30:44 +01:00
|
|
|
extern hekate_config h_cfg;
|
|
|
|
|
2019-04-14 00:30:14 +01:00
|
|
|
//#define DPRINTF(...) gfx_printf(__VA_ARGS__)
|
2018-06-01 17:02:13 +01:00
|
|
|
#define DPRINTF(...)
|
2018-05-13 02:13:17 +01:00
|
|
|
|
2019-07-06 20:08:37 +01:00
|
|
|
#define EHPRINTFARGS(text, args...) \
|
2020-05-05 17:11:39 +01:00
|
|
|
({ gfx_con.mute = false; \
|
2019-07-06 20:08:37 +01:00
|
|
|
gfx_printf("%k"text"%k\n", 0xFFFF0000, args, 0xFFCCCCCC); })
|
|
|
|
|
2019-03-07 22:02:37 +00:00
|
|
|
#define PKG2_LOAD_ADDR 0xA9800000
|
2019-02-24 00:54:32 +00:00
|
|
|
|
2020-07-17 16:00:32 +01:00
|
|
|
#define SECMON_BCT_CFG_ADDR 0x4003D000
|
|
|
|
#define SECMON6_BCT_CFG_ADDR 0x4003F800
|
|
|
|
|
2019-02-24 00:54:32 +00:00
|
|
|
// Secmon mailbox.
|
2020-06-15 08:54:52 +01:00
|
|
|
#define SECMON_MAILBOX_ADDR 0x40002E00
|
|
|
|
#define SECMON7_MAILBOX_ADDR 0x40000000
|
|
|
|
#define SECMON_STATE_OFFSET 0xF8
|
2019-02-24 00:54:32 +00:00
|
|
|
typedef struct _secmon_mailbox_t
|
|
|
|
{
|
|
|
|
// < 4.0.0 Signals - 0: Not ready, 1: BCT ready, 2: DRAM and pkg2 ready, 3: Continue boot.
|
|
|
|
// >= 4.0.0 Signals - 0: Not ready, 1: BCT ready, 2: DRAM ready, 4: pkg2 ready and continue boot.
|
|
|
|
u32 in;
|
|
|
|
// Non-zero: Secmon ready.
|
|
|
|
u32 out;
|
|
|
|
} secmon_mailbox_t;
|
|
|
|
|
2018-06-15 12:28:27 +01:00
|
|
|
static const u8 keyblob_keyseeds[][0x10] = {
|
2020-06-13 23:27:08 +01:00
|
|
|
{ 0xDF, 0x20, 0x6F, 0x59, 0x44, 0x54, 0xEF, 0xDC, 0x70, 0x74, 0x48, 0x3B, 0x0D, 0xED, 0x9F, 0xD3 }, // 1.0.0.
|
|
|
|
{ 0x0C, 0x25, 0x61, 0x5D, 0x68, 0x4C, 0xEB, 0x42, 0x1C, 0x23, 0x79, 0xEA, 0x82, 0x25, 0x12, 0xAC }, // 3.0.0.
|
|
|
|
{ 0x33, 0x76, 0x85, 0xEE, 0x88, 0x4A, 0xAE, 0x0A, 0xC2, 0x8A, 0xFD, 0x7D, 0x63, 0xC0, 0x43, 0x3B }, // 3.0.1.
|
|
|
|
{ 0x2D, 0x1F, 0x48, 0x80, 0xED, 0xEC, 0xED, 0x3E, 0x3C, 0xF2, 0x48, 0xB5, 0x65, 0x7D, 0xF7, 0xBE }, // 4.0.0.
|
|
|
|
{ 0xBB, 0x5A, 0x01, 0xF9, 0x88, 0xAF, 0xF5, 0xFC, 0x6C, 0xFF, 0x07, 0x9E, 0x13, 0x3C, 0x39, 0x80 }, // 5.0.0.
|
|
|
|
{ 0xD8, 0xCC, 0xE1, 0x26, 0x6A, 0x35, 0x3F, 0xCC, 0x20, 0xF3, 0x2D, 0x3B, 0x51, 0x7D, 0xE9, 0xC0 } // 6.0.0.
|
2018-05-01 06:15:48 +01:00
|
|
|
};
|
|
|
|
|
|
|
|
static const u8 cmac_keyseed[0x10] =
|
|
|
|
{ 0x59, 0xC7, 0xFB, 0x6F, 0xBE, 0x9B, 0xBE, 0x87, 0x65, 0x6B, 0x15, 0xC0, 0x53, 0x73, 0x36, 0xA5 };
|
|
|
|
|
2018-05-13 02:13:17 +01:00
|
|
|
static const u8 master_keyseed_retail[0x10] =
|
2018-05-01 06:15:48 +01:00
|
|
|
{ 0xD8, 0xA2, 0x41, 0x0A, 0xC6, 0xC5, 0x90, 0x01, 0xC6, 0x1D, 0x6A, 0x26, 0x7C, 0x51, 0x3F, 0x3C };
|
|
|
|
|
2019-10-18 16:02:06 +01:00
|
|
|
static const u8 master_keyseed_4xx_5xx_610[0x10] =
|
2018-05-04 08:15:29 +01:00
|
|
|
{ 0x2D, 0xC1, 0xF4, 0x8D, 0xF3, 0x5B, 0x69, 0x33, 0x42, 0x10, 0xAC, 0x65, 0xDA, 0x90, 0x46, 0x66 };
|
|
|
|
|
2018-11-30 21:20:15 +00:00
|
|
|
static const u8 master_keyseed_620[0x10] =
|
2019-04-21 15:33:39 +01:00
|
|
|
{ 0x37, 0x4B, 0x77, 0x29, 0x59, 0xB4, 0x04, 0x30, 0x81, 0xF6, 0xE5, 0x8C, 0x6D, 0x36, 0x17, 0x9A };
|
2018-11-30 21:20:15 +00:00
|
|
|
|
2020-07-04 19:13:25 +01:00
|
|
|
static const u8 master_kekseed_t210b01[][0x10] = {
|
|
|
|
{ 0x77, 0x60, 0x5A, 0xD2, 0xEE, 0x6E, 0xF8, 0x3C, 0x3F, 0x72, 0xE2, 0x59, 0x9D, 0xAC, 0x5E, 0x56 }, // 6.0.0.
|
|
|
|
{ 0x1E, 0x80, 0xB8, 0x17, 0x3E, 0xC0, 0x60, 0xAA, 0x11, 0xBE, 0x1A, 0x4A, 0xA6, 0x6F, 0xE4, 0xAE }, // 6.2.0.
|
|
|
|
{ 0x94, 0x08, 0x67, 0xBD, 0x0A, 0x00, 0x38, 0x84, 0x11, 0xD3, 0x1A, 0xDB, 0xDD, 0x8D, 0xF1, 0x8A }, // 7.0.0.
|
|
|
|
{ 0x5C, 0x24, 0xE3, 0xB8, 0xB4, 0xF7, 0x00, 0xC2, 0x3C, 0xFD, 0x0A, 0xCE, 0x13, 0xC3, 0xDC, 0x23 }, // 8.1.0.
|
|
|
|
{ 0x86, 0x69, 0xF0, 0x09, 0x87, 0xC8, 0x05, 0xAE, 0xB5, 0x7B, 0x48, 0x74, 0xDE, 0x62, 0xA6, 0x13 }, // 9.0.0.
|
|
|
|
{ 0x0E, 0x44, 0x0C, 0xED, 0xB4, 0x36, 0xC0, 0x3F, 0xAA, 0x1D, 0xAE, 0xBF, 0x62, 0xB1, 0x09, 0x82 }, // 9.1.0.
|
|
|
|
};
|
|
|
|
|
2020-07-17 16:00:32 +01:00
|
|
|
static const u8 console_keyseed[0x10] =
|
|
|
|
{ 0x4F, 0x02, 0x5F, 0x0E, 0xB6, 0x6D, 0x11, 0x0E, 0xDC, 0x32, 0x7D, 0x41, 0x86, 0xC2, 0xF4, 0x78 };
|
|
|
|
|
2019-10-18 16:02:06 +01:00
|
|
|
static const u8 console_keyseed_4xx_5xx[0x10] =
|
2018-05-04 08:15:29 +01:00
|
|
|
{ 0x0C, 0x91, 0x09, 0xDB, 0x93, 0x93, 0x07, 0x81, 0x07, 0x3C, 0xC4, 0x16, 0x22, 0x7C, 0x6C, 0x28 };
|
|
|
|
|
2020-07-17 16:00:32 +01:00
|
|
|
const u8 package2_keyseed[0x10] =
|
|
|
|
{ 0xFB, 0x8B, 0x6A, 0x9C, 0x79, 0x00, 0xC8, 0x49, 0xEF, 0xD2, 0x4D, 0x85, 0x4D, 0x30, 0xA0, 0xC7 };
|
|
|
|
|
2019-09-12 21:08:38 +01:00
|
|
|
static void _hos_crit_error(const char *text)
|
|
|
|
{
|
|
|
|
gfx_con.mute = false;
|
|
|
|
gfx_printf("%k%s%k\n", 0xFFFF0000, text, 0xFFCCCCCC);
|
|
|
|
}
|
2018-05-04 08:15:29 +01:00
|
|
|
|
2018-11-30 21:20:15 +00:00
|
|
|
static void _se_lock(bool lock_se)
|
2018-05-01 06:15:48 +01:00
|
|
|
{
|
2018-11-30 21:20:15 +00:00
|
|
|
if (lock_se)
|
|
|
|
{
|
|
|
|
for (u32 i = 0; i < 16; i++)
|
2019-12-04 15:18:16 +00:00
|
|
|
se_key_acc_ctrl(i, SE_KEY_TBL_DIS_KEYREAD_FLAG | SE_KEY_TBL_DIS_OIVREAD_FLAG | SE_KEY_TBL_DIS_UIVREAD_FLAG);
|
2018-05-01 06:15:48 +01:00
|
|
|
|
2018-11-30 21:20:15 +00:00
|
|
|
for (u32 i = 0; i < 2; i++)
|
2019-12-04 15:18:16 +00:00
|
|
|
se_rsa_acc_ctrl(i, SE_RSA_KEY_TBL_DIS_KEYREAD_FLAG);
|
|
|
|
SE(SE_TZRAM_SECURITY_0) = 0; // Make SE TZRAM secure only.
|
2018-11-30 21:20:15 +00:00
|
|
|
SE(SE_KEY_TABLE_ACCESS_LOCK_OFFSET) = 0; // Make all key access regs secure only.
|
|
|
|
SE(SE_RSA_KEYTABLE_ACCESS_LOCK_OFFSET) = 0; // Make all RSA access regs secure only.
|
|
|
|
SE(SE_SECURITY_0) &= 0xFFFFFFFB; // Make access lock regs secure only.
|
|
|
|
}
|
2018-05-01 06:15:48 +01:00
|
|
|
|
2018-12-16 14:52:38 +00:00
|
|
|
memset((void *)IPATCH_BASE, 0, 14 * sizeof(u32));
|
2019-09-09 14:56:37 +01:00
|
|
|
SB(SB_CSR) = SB_CSR_PIROM_DISABLE;
|
2018-05-01 06:15:48 +01:00
|
|
|
|
2018-07-10 14:59:03 +01:00
|
|
|
// This is useful for documenting the bits in the SE config registers, so we can keep it around.
|
2019-04-14 00:30:14 +01:00
|
|
|
/*gfx_printf("SE(SE_SECURITY_0) = %08X\n", SE(SE_SECURITY_0));
|
|
|
|
gfx_printf("SE(0x4) = %08X\n", SE(0x4));
|
|
|
|
gfx_printf("SE(SE_KEY_TABLE_ACCESS_LOCK_OFFSET) = %08X\n", SE(SE_KEY_TABLE_ACCESS_LOCK_OFFSET));
|
|
|
|
gfx_printf("SE(SE_RSA_KEYTABLE_ACCESS_LOCK_OFFSET) = %08X\n", SE(SE_RSA_KEYTABLE_ACCESS_LOCK_OFFSET));
|
2018-05-01 06:15:48 +01:00
|
|
|
for(u32 i = 0; i < 16; i++)
|
2019-04-14 00:30:14 +01:00
|
|
|
gfx_printf("%02X ", SE(SE_KEY_TABLE_ACCESS_REG_OFFSET + i * 4) & 0xFF);
|
|
|
|
gfx_putc('\n');
|
2018-05-01 06:15:48 +01:00
|
|
|
for(u32 i = 0; i < 2; i++)
|
2019-04-14 00:30:14 +01:00
|
|
|
gfx_printf("%02X ", SE(SE_RSA_KEYTABLE_ACCESS_REG_OFFSET + i * 4) & 0xFF);
|
|
|
|
gfx_putc('\n');
|
|
|
|
gfx_hexdump(SE_BASE, (void *)SE_BASE, 0x400);*/
|
2018-05-01 06:15:48 +01:00
|
|
|
}
|
|
|
|
|
2018-09-24 21:22:19 +01:00
|
|
|
void _pmc_scratch_lock(u32 kb)
|
|
|
|
{
|
|
|
|
switch (kb)
|
|
|
|
{
|
|
|
|
case KB_FIRMWARE_VERSION_100_200:
|
|
|
|
case KB_FIRMWARE_VERSION_300:
|
|
|
|
case KB_FIRMWARE_VERSION_301:
|
2019-04-21 15:33:39 +01:00
|
|
|
PMC(APBDEV_PMC_SEC_DISABLE) = 0x7FFFF3;
|
2018-09-24 21:22:19 +01:00
|
|
|
PMC(APBDEV_PMC_SEC_DISABLE2) = 0xFFFFFFFF;
|
|
|
|
PMC(APBDEV_PMC_SEC_DISABLE3) = 0xFFAFFFFF;
|
|
|
|
PMC(APBDEV_PMC_SEC_DISABLE4) = 0xFFFFFFFF;
|
|
|
|
PMC(APBDEV_PMC_SEC_DISABLE5) = 0xFFFFFFFF;
|
|
|
|
PMC(APBDEV_PMC_SEC_DISABLE6) = 0xFFFFFFFF;
|
|
|
|
PMC(APBDEV_PMC_SEC_DISABLE7) = 0xFFFFFFFF;
|
|
|
|
PMC(APBDEV_PMC_SEC_DISABLE8) = 0xFFAAFFFF;
|
|
|
|
break;
|
2019-02-24 00:54:32 +00:00
|
|
|
default:
|
2018-09-24 21:22:19 +01:00
|
|
|
PMC(APBDEV_PMC_SEC_DISABLE2) |= 0x3FCFFFF;
|
|
|
|
PMC(APBDEV_PMC_SEC_DISABLE4) |= 0x3F3FFFFF;
|
|
|
|
PMC(APBDEV_PMC_SEC_DISABLE5) = 0xFFFFFFFF;
|
|
|
|
PMC(APBDEV_PMC_SEC_DISABLE6) |= 0xF3FFC00F;
|
|
|
|
PMC(APBDEV_PMC_SEC_DISABLE7) |= 0x3FFFFF;
|
|
|
|
PMC(APBDEV_PMC_SEC_DISABLE8) |= 0xFF;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2018-11-30 21:20:15 +00:00
|
|
|
void _sysctr0_reset()
|
2018-05-01 06:15:48 +01:00
|
|
|
{
|
2018-11-30 21:20:15 +00:00
|
|
|
SYSCTR0(SYSCTR0_CNTCR) = 0;
|
|
|
|
SYSCTR0(SYSCTR0_COUNTERID0) = 0;
|
|
|
|
SYSCTR0(SYSCTR0_COUNTERID1) = 0;
|
|
|
|
SYSCTR0(SYSCTR0_COUNTERID2) = 0;
|
|
|
|
SYSCTR0(SYSCTR0_COUNTERID3) = 0;
|
|
|
|
SYSCTR0(SYSCTR0_COUNTERID4) = 0;
|
|
|
|
SYSCTR0(SYSCTR0_COUNTERID5) = 0;
|
|
|
|
SYSCTR0(SYSCTR0_COUNTERID6) = 0;
|
|
|
|
SYSCTR0(SYSCTR0_COUNTERID7) = 0;
|
|
|
|
SYSCTR0(SYSCTR0_COUNTERID8) = 0;
|
|
|
|
SYSCTR0(SYSCTR0_COUNTERID9) = 0;
|
|
|
|
SYSCTR0(SYSCTR0_COUNTERID10) = 0;
|
|
|
|
SYSCTR0(SYSCTR0_COUNTERID11) = 0;
|
|
|
|
}
|
|
|
|
|
2020-05-05 17:11:39 +01:00
|
|
|
bool hos_eks_rw_try(u8 *buf, bool write)
|
|
|
|
{
|
|
|
|
for (u32 i = 0; i < 3; i++)
|
|
|
|
{
|
|
|
|
if (!write)
|
|
|
|
{
|
2020-06-14 11:42:48 +01:00
|
|
|
if (sdmmc_storage_read(&sd_storage, 0, 1, buf))
|
|
|
|
return true;
|
2020-05-05 17:11:39 +01:00
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
2020-06-14 11:42:48 +01:00
|
|
|
if (sdmmc_storage_write(&sd_storage, 0, 1, buf))
|
2020-05-05 17:11:39 +01:00
|
|
|
return true;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
2020-04-30 01:43:29 +01:00
|
|
|
void hos_eks_get()
|
|
|
|
{
|
2020-07-04 19:21:48 +01:00
|
|
|
// Check if Erista based unit.
|
|
|
|
if (h_cfg.t210b01)
|
|
|
|
return;
|
|
|
|
|
2020-04-30 01:43:29 +01:00
|
|
|
// Check if EKS already found and parsed.
|
|
|
|
if (!h_cfg.eks)
|
|
|
|
{
|
|
|
|
// Read EKS blob.
|
2020-05-05 17:11:39 +01:00
|
|
|
u8 *mbr = calloc(512 , 1);
|
|
|
|
if (!hos_eks_rw_try(mbr, false))
|
|
|
|
goto out;
|
2020-04-30 01:43:29 +01:00
|
|
|
|
|
|
|
// Decrypt EKS blob.
|
2020-07-17 16:00:32 +01:00
|
|
|
hos_eks_mbr_t *eks = (hos_eks_mbr_t *)(mbr + 0x80);
|
2020-04-30 01:43:29 +01:00
|
|
|
se_aes_crypt_ecb(14, 0, eks, sizeof(hos_eks_mbr_t), eks, sizeof(hos_eks_mbr_t));
|
|
|
|
|
|
|
|
// Check if valid and for this unit.
|
2020-06-14 11:42:48 +01:00
|
|
|
if (eks->magic == HOS_EKS_MAGIC &&
|
2020-11-15 11:43:22 +00:00
|
|
|
eks->lot0 == FUSE(FUSE_OPT_LOT_CODE_0))
|
2020-04-30 01:43:29 +01:00
|
|
|
{
|
|
|
|
h_cfg.eks = eks;
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2020-05-05 17:11:39 +01:00
|
|
|
out:
|
2020-04-30 01:43:29 +01:00
|
|
|
free(mbr);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
void hos_eks_save(u32 kb)
|
|
|
|
{
|
2020-07-04 19:21:48 +01:00
|
|
|
// Check if Erista based unit.
|
|
|
|
if (h_cfg.t210b01)
|
|
|
|
return;
|
|
|
|
|
2020-04-30 01:43:29 +01:00
|
|
|
if (kb >= KB_FIRMWARE_VERSION_700)
|
|
|
|
{
|
2020-06-14 11:42:48 +01:00
|
|
|
u32 key_idx = 0;
|
|
|
|
if (kb >= KB_FIRMWARE_VERSION_810)
|
|
|
|
key_idx = 1;
|
2020-04-30 01:43:29 +01:00
|
|
|
|
2020-05-05 17:11:39 +01:00
|
|
|
bool new_eks = false;
|
2020-04-30 01:43:29 +01:00
|
|
|
if (!h_cfg.eks)
|
2020-05-05 17:11:39 +01:00
|
|
|
{
|
2020-04-30 01:43:29 +01:00
|
|
|
h_cfg.eks = calloc(512 , 1);
|
2020-05-05 17:11:39 +01:00
|
|
|
new_eks = true;
|
|
|
|
}
|
2020-04-30 01:43:29 +01:00
|
|
|
|
|
|
|
// If matching blob doesn't exist, create it.
|
2020-06-14 11:42:48 +01:00
|
|
|
bool update_eks = key_idx ? (h_cfg.eks->enabled[key_idx] < kb) : !h_cfg.eks->enabled[0];
|
|
|
|
if (update_eks)
|
2020-04-30 01:43:29 +01:00
|
|
|
{
|
2020-05-05 17:11:39 +01:00
|
|
|
// Read EKS blob.
|
|
|
|
u8 *mbr = calloc(512 , 1);
|
|
|
|
if (!hos_eks_rw_try(mbr, false))
|
|
|
|
{
|
|
|
|
if (new_eks)
|
|
|
|
{
|
|
|
|
free(h_cfg.eks);
|
|
|
|
h_cfg.eks = NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
goto out;
|
|
|
|
}
|
|
|
|
|
2020-04-30 01:43:29 +01:00
|
|
|
// Get keys.
|
|
|
|
u8 *keys = (u8 *)calloc(0x1000, 1);
|
|
|
|
se_get_aes_keys(keys + 0x800, keys, 0x10);
|
|
|
|
|
2020-10-20 09:53:28 +01:00
|
|
|
// Set SBK back.
|
|
|
|
if (FUSE(FUSE_PRIVATE_KEY0) == 0xFFFFFFFF)
|
|
|
|
se_aes_key_set(14, keys + 14 * 0x10, 0x10);
|
|
|
|
|
2020-04-30 01:43:29 +01:00
|
|
|
// Set magic and personalized info.
|
|
|
|
h_cfg.eks->magic = HOS_EKS_MAGIC;
|
2020-06-14 11:42:48 +01:00
|
|
|
h_cfg.eks->enabled[key_idx] = kb;
|
2020-11-15 11:43:22 +00:00
|
|
|
h_cfg.eks->lot0 = FUSE(FUSE_OPT_LOT_CODE_0);
|
2020-04-30 01:43:29 +01:00
|
|
|
|
|
|
|
// Copy new keys.
|
2020-06-14 11:42:48 +01:00
|
|
|
memcpy(h_cfg.eks->dkg, keys + 10 * 0x10, 0x10);
|
|
|
|
memcpy(h_cfg.eks->dkk, keys + 15 * 0x10, 0x10);
|
|
|
|
|
2020-06-14 11:53:21 +01:00
|
|
|
if (!h_cfg.aes_slots_new)
|
|
|
|
{
|
|
|
|
memcpy(h_cfg.eks->keys[key_idx].mkk, keys + 12 * 0x10, 0x10);
|
|
|
|
memcpy(h_cfg.eks->keys[key_idx].fdk, keys + 13 * 0x10, 0x10);
|
|
|
|
}
|
|
|
|
else // New sept slots.
|
|
|
|
{
|
|
|
|
memcpy(h_cfg.eks->keys[key_idx].mkk, keys + 13 * 0x10, 0x10);
|
|
|
|
memcpy(h_cfg.eks->keys[key_idx].fdk, keys + 12 * 0x10, 0x10);
|
|
|
|
}
|
2020-04-30 01:43:29 +01:00
|
|
|
|
2020-05-05 17:11:39 +01:00
|
|
|
// Encrypt EKS blob.
|
2020-04-30 01:43:29 +01:00
|
|
|
u8 *eks = calloc(512 , 1);
|
|
|
|
memcpy(eks, h_cfg.eks, sizeof(hos_eks_mbr_t));
|
|
|
|
se_aes_crypt_ecb(14, 1, eks, sizeof(hos_eks_mbr_t), eks, sizeof(hos_eks_mbr_t));
|
|
|
|
|
2020-05-05 17:11:39 +01:00
|
|
|
// Write EKS blob to SD.
|
2020-07-17 16:00:32 +01:00
|
|
|
memcpy(mbr + 0x80, eks, sizeof(hos_eks_mbr_t));
|
2020-05-05 17:11:39 +01:00
|
|
|
hos_eks_rw_try(mbr, true);
|
|
|
|
|
2020-04-30 01:43:29 +01:00
|
|
|
|
|
|
|
free(eks);
|
|
|
|
free(keys);
|
2020-05-05 17:11:39 +01:00
|
|
|
out:
|
|
|
|
free(mbr);
|
2020-04-30 01:43:29 +01:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
void hos_eks_clear(u32 kb)
|
|
|
|
{
|
2020-07-04 19:21:48 +01:00
|
|
|
// Check if Erista based unit.
|
|
|
|
if (h_cfg.t210b01)
|
|
|
|
return;
|
|
|
|
|
2020-04-30 01:43:29 +01:00
|
|
|
if (h_cfg.eks && kb >= KB_FIRMWARE_VERSION_700)
|
|
|
|
{
|
2020-06-14 11:42:48 +01:00
|
|
|
u32 key_idx = 0;
|
|
|
|
if (kb >= KB_FIRMWARE_VERSION_810)
|
|
|
|
key_idx = 1;
|
|
|
|
|
2020-04-30 01:43:29 +01:00
|
|
|
// Check if Current Master key is enabled.
|
2020-06-14 11:42:48 +01:00
|
|
|
if (h_cfg.eks->enabled[key_idx])
|
2020-04-30 01:43:29 +01:00
|
|
|
{
|
2020-05-05 17:11:39 +01:00
|
|
|
// Read EKS blob.
|
|
|
|
u8 *mbr = calloc(512 , 1);
|
|
|
|
if (!hos_eks_rw_try(mbr, false))
|
|
|
|
goto out;
|
|
|
|
|
2020-04-30 01:43:29 +01:00
|
|
|
// Disable current Master key version.
|
2020-06-14 11:42:48 +01:00
|
|
|
h_cfg.eks->enabled[key_idx] = 0;
|
2020-04-30 01:43:29 +01:00
|
|
|
|
2020-05-05 17:11:39 +01:00
|
|
|
// Encrypt EKS blob.
|
2020-04-30 01:43:29 +01:00
|
|
|
u8 *eks = calloc(512 , 1);
|
|
|
|
memcpy(eks, h_cfg.eks, sizeof(hos_eks_mbr_t));
|
|
|
|
se_aes_crypt_ecb(14, 1, eks, sizeof(hos_eks_mbr_t), eks, sizeof(hos_eks_mbr_t));
|
|
|
|
|
2020-05-05 17:11:39 +01:00
|
|
|
// Write EKS blob to SD.
|
2020-07-17 16:00:32 +01:00
|
|
|
memcpy(mbr + 0x80, eks, sizeof(hos_eks_mbr_t));
|
2020-05-05 17:11:39 +01:00
|
|
|
hos_eks_rw_try(mbr, true);
|
2020-04-30 01:43:29 +01:00
|
|
|
|
2020-06-14 11:42:48 +01:00
|
|
|
EMC(EMC_SCRATCH0) &= ~EMC_SEPT_RUN;
|
|
|
|
h_cfg.sept_run = false;
|
|
|
|
|
2020-04-30 01:43:29 +01:00
|
|
|
free(eks);
|
2020-05-05 17:11:39 +01:00
|
|
|
out:
|
2020-04-30 01:43:29 +01:00
|
|
|
free(mbr);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-07-04 19:13:25 +01:00
|
|
|
int hos_keygen_t210b01(u32 kb)
|
|
|
|
{
|
|
|
|
// Use SBK as Device key 4x unsealer and KEK for mkey in T210B01 units.
|
|
|
|
se_aes_unwrap_key(10, 14, console_keyseed_4xx_5xx);
|
|
|
|
|
|
|
|
// Derive master key.
|
|
|
|
se_aes_unwrap_key(7, 12, &master_kekseed_t210b01[kb - KB_FIRMWARE_VERSION_600]);
|
|
|
|
se_aes_unwrap_key(7, 7, master_keyseed_retail);
|
|
|
|
|
|
|
|
// Derive latest pkg2 key.
|
|
|
|
se_aes_unwrap_key(8, 7, package2_keyseed);
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
2020-04-30 01:43:29 +01:00
|
|
|
int hos_keygen(u8 *keyblob, u32 kb, tsec_ctxt_t *tsec_ctxt, launch_ctxt_t *hos_ctxt)
|
2018-11-30 21:20:15 +00:00
|
|
|
{
|
2020-06-14 11:45:01 +01:00
|
|
|
u8 tmp[0x30];
|
2018-11-30 21:20:15 +00:00
|
|
|
u32 retries = 0;
|
|
|
|
|
2018-06-15 12:28:27 +01:00
|
|
|
if (kb > KB_FIRMWARE_VERSION_MAX)
|
|
|
|
return 0;
|
|
|
|
|
2020-07-04 19:13:25 +01:00
|
|
|
if (h_cfg.t210b01)
|
|
|
|
return hos_keygen_t210b01(kb);
|
|
|
|
|
2019-02-24 00:54:32 +00:00
|
|
|
if (kb <= KB_FIRMWARE_VERSION_600)
|
|
|
|
tsec_ctxt->size = 0xF00;
|
|
|
|
else if (kb == KB_FIRMWARE_VERSION_620)
|
2018-11-30 21:20:15 +00:00
|
|
|
tsec_ctxt->size = 0x2900;
|
2019-06-30 01:29:46 +01:00
|
|
|
else if (kb == KB_FIRMWARE_VERSION_700)
|
2019-02-24 00:54:32 +00:00
|
|
|
tsec_ctxt->size = 0x3000;
|
2019-06-30 01:29:46 +01:00
|
|
|
else
|
|
|
|
tsec_ctxt->size = 0x3300;
|
2019-02-24 00:54:32 +00:00
|
|
|
|
|
|
|
// Prepare smmu tsec page for 6.2.0.
|
|
|
|
if (kb == KB_FIRMWARE_VERSION_620)
|
|
|
|
{
|
2018-11-30 21:20:15 +00:00
|
|
|
u8 *tsec_paged = (u8 *)page_alloc(3);
|
|
|
|
memcpy(tsec_paged, (void *)tsec_ctxt->fw, tsec_ctxt->size);
|
|
|
|
tsec_ctxt->fw = tsec_paged;
|
|
|
|
}
|
2018-05-01 06:15:48 +01:00
|
|
|
|
2019-02-24 00:54:32 +00:00
|
|
|
// Get TSEC key.
|
|
|
|
if (kb <= KB_FIRMWARE_VERSION_620)
|
2018-11-30 21:20:15 +00:00
|
|
|
{
|
2019-02-24 00:54:32 +00:00
|
|
|
while (tsec_query(tmp, kb, tsec_ctxt) < 0)
|
2018-12-16 14:55:56 +00:00
|
|
|
{
|
2019-02-24 00:54:32 +00:00
|
|
|
memset(tmp, 0x00, 0x20);
|
|
|
|
retries++;
|
|
|
|
|
|
|
|
// We rely on racing conditions, make sure we cover even the unluckiest cases.
|
|
|
|
if (retries > 15)
|
|
|
|
{
|
2019-09-12 21:08:38 +01:00
|
|
|
_hos_crit_error("\nFailed to get TSEC keys. Please try again.");
|
2019-02-24 00:54:32 +00:00
|
|
|
return 0;
|
|
|
|
}
|
2018-12-16 14:55:56 +00:00
|
|
|
}
|
2018-11-30 21:20:15 +00:00
|
|
|
}
|
2018-05-13 02:13:17 +01:00
|
|
|
|
2019-02-24 00:58:15 +00:00
|
|
|
if (kb >= KB_FIRMWARE_VERSION_700)
|
2020-04-30 01:43:29 +01:00
|
|
|
{
|
|
|
|
// Use HOS EKS if it exists.
|
2020-06-14 11:42:48 +01:00
|
|
|
u32 key_idx = 0;
|
|
|
|
if (kb >= KB_FIRMWARE_VERSION_810)
|
|
|
|
key_idx = 1;
|
|
|
|
|
|
|
|
if (h_cfg.eks && h_cfg.eks->enabled[key_idx] >= kb)
|
2020-04-30 01:43:29 +01:00
|
|
|
{
|
|
|
|
// Set Device keygen key to slot 10.
|
2020-06-14 11:42:48 +01:00
|
|
|
se_aes_key_set(10, h_cfg.eks->dkg, 0x10);
|
|
|
|
// Set Device key to slot 15.
|
|
|
|
se_aes_key_set(15, h_cfg.eks->dkk, 0x10);
|
2020-04-30 01:43:29 +01:00
|
|
|
|
2020-06-14 11:53:21 +01:00
|
|
|
if (!h_cfg.aes_slots_new)
|
|
|
|
{
|
|
|
|
// Set Master key to slot 12.
|
|
|
|
se_aes_key_set(12, h_cfg.eks->keys[key_idx].mkk, 0x10);
|
|
|
|
// Set FW Device key key to slot 13.
|
|
|
|
se_aes_key_set(13, h_cfg.eks->keys[key_idx].fdk, 0x10);
|
|
|
|
// Lock FDK.
|
|
|
|
se_key_acc_ctrl(13, SE_KEY_TBL_DIS_KEYREAD_FLAG | SE_KEY_TBL_DIS_OIVREAD_FLAG | SE_KEY_TBL_DIS_UIVREAD_FLAG);
|
|
|
|
}
|
|
|
|
else // New exosphere.
|
|
|
|
{
|
|
|
|
// Set Master key to slot 13.
|
|
|
|
se_aes_key_set(13, h_cfg.eks->keys[key_idx].mkk, 0x10);
|
|
|
|
// Set FW Device key key to slot 12.
|
|
|
|
se_aes_key_set(12, h_cfg.eks->keys[key_idx].fdk, 0x10);
|
|
|
|
// Lock FDK.
|
|
|
|
se_key_acc_ctrl(12, SE_KEY_TBL_DIS_KEYREAD_FLAG | SE_KEY_TBL_DIS_OIVREAD_FLAG | SE_KEY_TBL_DIS_UIVREAD_FLAG);
|
|
|
|
}
|
2020-04-30 01:43:29 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
se_aes_key_clear(8);
|
2020-06-14 11:53:21 +01:00
|
|
|
se_aes_unwrap_key(8, !h_cfg.aes_slots_new ? 12 : 13, package2_keyseed);
|
2020-04-30 01:43:29 +01:00
|
|
|
}
|
2019-02-24 00:58:15 +00:00
|
|
|
else if (kb == KB_FIRMWARE_VERSION_620)
|
2018-11-30 21:20:15 +00:00
|
|
|
{
|
|
|
|
// Set TSEC key.
|
|
|
|
se_aes_key_set(12, tmp, 0x10);
|
|
|
|
// Set TSEC root key.
|
|
|
|
se_aes_key_set(13, tmp + 0x10, 0x10);
|
|
|
|
|
2019-07-06 20:10:23 +01:00
|
|
|
if (!(emu_cfg.enabled && !h_cfg.emummc_force_disable) && hos_ctxt->stock)
|
|
|
|
{
|
|
|
|
// Package2 key.
|
|
|
|
se_aes_key_set(8, tmp + 0x10, 0x10);
|
|
|
|
se_aes_unwrap_key(8, 8, master_keyseed_620);
|
|
|
|
se_aes_unwrap_key(8, 8, master_keyseed_retail);
|
|
|
|
se_aes_unwrap_key(8, 8, package2_keyseed);
|
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
|
|
|
// Decrypt keyblob and set keyslots
|
|
|
|
se_aes_crypt_block_ecb(12, 0, tmp + 0x20, keyblob_keyseeds[0]);
|
|
|
|
se_aes_unwrap_key(15, 14, tmp + 0x20);
|
2020-06-14 11:45:01 +01:00
|
|
|
se_aes_unwrap_key(10, 15, console_keyseed_4xx_5xx);
|
2019-07-06 20:10:23 +01:00
|
|
|
se_aes_unwrap_key(15, 15, console_keyseed);
|
|
|
|
|
|
|
|
se_aes_unwrap_key(13, 13, master_keyseed_620);
|
2020-06-14 11:53:21 +01:00
|
|
|
|
|
|
|
if (!h_cfg.aes_slots_new)
|
|
|
|
{
|
|
|
|
se_aes_unwrap_key(14, 13, master_keyseed_4xx_5xx_610);
|
|
|
|
se_aes_unwrap_key(12, 13, master_keyseed_retail);
|
|
|
|
}
|
|
|
|
else // New exosphere.
|
|
|
|
{
|
|
|
|
se_aes_unwrap_key(12, 13, master_keyseed_4xx_5xx_610);
|
|
|
|
se_aes_unwrap_key(13, 13, master_keyseed_retail);
|
|
|
|
}
|
2019-10-18 16:02:06 +01:00
|
|
|
|
2019-07-06 20:10:23 +01:00
|
|
|
// Package2 key.
|
2020-06-14 11:53:21 +01:00
|
|
|
se_aes_unwrap_key(8, !h_cfg.aes_slots_new ? 12 : 13, package2_keyseed);
|
2019-07-06 20:10:23 +01:00
|
|
|
|
|
|
|
h_cfg.se_keygen_done = 1;
|
|
|
|
}
|
2018-11-30 21:20:15 +00:00
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
2019-12-04 15:18:16 +00:00
|
|
|
se_key_acc_ctrl(13, SE_KEY_TBL_DIS_KEYREAD_FLAG | SE_KEY_TBL_DIS_OIVREAD_FLAG | SE_KEY_TBL_DIS_UIVREAD_FLAG);
|
|
|
|
se_key_acc_ctrl(14, SE_KEY_TBL_DIS_KEYREAD_FLAG | SE_KEY_TBL_DIS_OIVREAD_FLAG | SE_KEY_TBL_DIS_UIVREAD_FLAG);
|
2018-05-01 06:15:48 +01:00
|
|
|
|
2018-11-30 21:20:15 +00:00
|
|
|
// Set TSEC key.
|
|
|
|
se_aes_key_set(13, tmp, 0x10);
|
2018-05-01 06:15:48 +01:00
|
|
|
|
2018-11-30 21:20:15 +00:00
|
|
|
// Derive keyblob keys from TSEC+SBK.
|
|
|
|
se_aes_crypt_block_ecb(13, 0, tmp, keyblob_keyseeds[0]);
|
|
|
|
se_aes_unwrap_key(15, 14, tmp);
|
|
|
|
se_aes_crypt_block_ecb(13, 0, tmp, keyblob_keyseeds[kb]);
|
|
|
|
se_aes_unwrap_key(13, 14, tmp);
|
2018-05-04 08:15:29 +01:00
|
|
|
|
2018-11-30 21:20:15 +00:00
|
|
|
// Clear SBK.
|
|
|
|
se_aes_key_clear(14);
|
2018-05-04 08:15:29 +01:00
|
|
|
|
2018-11-30 21:20:15 +00:00
|
|
|
//TODO: verify keyblob CMAC.
|
|
|
|
//se_aes_unwrap_key(11, 13, cmac_keyseed);
|
|
|
|
//se_aes_cmac(tmp, 0x10, 11, keyblob + 0x10, 0xA0);
|
|
|
|
//if (!memcmp(keyblob, tmp, 0x10))
|
|
|
|
// return 0;
|
2018-05-04 08:15:29 +01:00
|
|
|
|
2018-11-30 21:20:15 +00:00
|
|
|
se_aes_crypt_block_ecb(13, 0, tmp, cmac_keyseed);
|
|
|
|
se_aes_unwrap_key(11, 13, cmac_keyseed);
|
|
|
|
|
|
|
|
// Decrypt keyblob and set keyslots.
|
|
|
|
se_aes_crypt_ctr(13, keyblob + 0x20, 0x90, keyblob + 0x20, 0x90, keyblob + 0x10);
|
|
|
|
se_aes_key_set(11, keyblob + 0x20 + 0x80, 0x10); // Package1 key.
|
|
|
|
se_aes_key_set(12, keyblob + 0x20, 0x10);
|
|
|
|
se_aes_key_set(13, keyblob + 0x20, 0x10);
|
|
|
|
|
|
|
|
se_aes_crypt_block_ecb(12, 0, tmp, master_keyseed_retail);
|
|
|
|
|
2020-06-14 11:53:21 +01:00
|
|
|
if (!h_cfg.aes_slots_new)
|
|
|
|
{
|
|
|
|
switch (kb)
|
|
|
|
{
|
|
|
|
case KB_FIRMWARE_VERSION_100_200:
|
|
|
|
case KB_FIRMWARE_VERSION_300:
|
|
|
|
case KB_FIRMWARE_VERSION_301:
|
|
|
|
se_aes_unwrap_key(13, 15, console_keyseed);
|
|
|
|
se_aes_unwrap_key(12, 12, master_keyseed_retail);
|
|
|
|
break;
|
|
|
|
case KB_FIRMWARE_VERSION_400:
|
|
|
|
se_aes_unwrap_key(13, 15, console_keyseed_4xx_5xx);
|
|
|
|
se_aes_unwrap_key(15, 15, console_keyseed);
|
|
|
|
se_aes_unwrap_key(14, 12, master_keyseed_4xx_5xx_610);
|
|
|
|
se_aes_unwrap_key(12, 12, master_keyseed_retail);
|
|
|
|
break;
|
|
|
|
case KB_FIRMWARE_VERSION_500:
|
|
|
|
case KB_FIRMWARE_VERSION_600:
|
|
|
|
se_aes_unwrap_key(10, 15, console_keyseed_4xx_5xx);
|
|
|
|
se_aes_unwrap_key(15, 15, console_keyseed);
|
|
|
|
se_aes_unwrap_key(14, 12, master_keyseed_4xx_5xx_610);
|
|
|
|
se_aes_unwrap_key(12, 12, master_keyseed_retail);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
else // New exosphere.
|
2018-11-30 21:20:15 +00:00
|
|
|
{
|
|
|
|
se_aes_unwrap_key(10, 15, console_keyseed_4xx_5xx);
|
|
|
|
se_aes_unwrap_key(15, 15, console_keyseed);
|
2020-06-14 11:53:21 +01:00
|
|
|
se_aes_unwrap_key(13, 12, master_keyseed_retail);
|
|
|
|
se_aes_unwrap_key(12, 12, master_keyseed_4xx_5xx_610);
|
2018-11-30 21:20:15 +00:00
|
|
|
}
|
2018-05-13 02:13:17 +01:00
|
|
|
|
2018-11-30 21:20:15 +00:00
|
|
|
// Package2 key.
|
2019-12-04 15:18:16 +00:00
|
|
|
se_key_acc_ctrl(8, SE_KEY_TBL_DIS_KEYREAD_FLAG | SE_KEY_TBL_DIS_OIVREAD_FLAG | SE_KEY_TBL_DIS_UIVREAD_FLAG);
|
2020-06-14 11:53:21 +01:00
|
|
|
se_aes_unwrap_key(8, !h_cfg.aes_slots_new ? 12 : 13, package2_keyseed);
|
2018-11-30 21:20:15 +00:00
|
|
|
}
|
2018-06-08 10:42:24 +01:00
|
|
|
|
|
|
|
return 1;
|
2018-05-01 06:15:48 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
static int _read_emmc_pkg1(launch_ctxt_t *ctxt)
|
|
|
|
{
|
2020-08-15 10:30:18 +01:00
|
|
|
static const u32 BOOTLOADER_SIZE = 0x40000;
|
|
|
|
static const u32 BOOTLOADER_MAIN_OFFSET = 0x100000;
|
|
|
|
static const u32 BOOTLOADER_BACKUP_OFFSET = 0x140000;
|
|
|
|
static const u32 HOS_KEYBLOBS_OFFSET = 0x180000;
|
|
|
|
|
2020-07-04 19:32:36 +01:00
|
|
|
u32 pk1_offset = h_cfg.t210b01 ? sizeof(bl_hdr_t210b01_t) : 0; // Skip T210B01 OEM header.
|
2020-08-15 10:30:18 +01:00
|
|
|
u32 bootloader_offset = BOOTLOADER_MAIN_OFFSET;
|
|
|
|
ctxt->pkg1 = (void *)malloc(BOOTLOADER_SIZE);
|
|
|
|
|
|
|
|
try_load:
|
2018-07-10 14:59:03 +01:00
|
|
|
// Read package1.
|
2020-06-14 00:13:18 +01:00
|
|
|
emummc_storage_set_mmc_partition(&emmc_storage, EMMC_BOOT0);
|
2020-08-15 10:30:18 +01:00
|
|
|
emummc_storage_read(&emmc_storage, bootloader_offset / NX_EMMC_BLOCKSIZE, BOOTLOADER_SIZE / NX_EMMC_BLOCKSIZE, ctxt->pkg1);
|
|
|
|
|
2020-07-04 19:32:36 +01:00
|
|
|
ctxt->pkg1_id = pkg1_identify(ctxt->pkg1 + pk1_offset);
|
2018-05-01 06:15:48 +01:00
|
|
|
if (!ctxt->pkg1_id)
|
|
|
|
{
|
2019-09-12 21:08:38 +01:00
|
|
|
_hos_crit_error("Unknown pkg1 version.");
|
2020-08-15 10:30:18 +01:00
|
|
|
EPRINTFARGS("HOS version not supported!%s",
|
2020-05-05 17:11:39 +01:00
|
|
|
(emu_cfg.enabled && !h_cfg.emummc_force_disable) ? "\nOr emuMMC corrupt!" : "");
|
2020-08-15 10:30:18 +01:00
|
|
|
|
|
|
|
// Try backup bootloader.
|
|
|
|
if (bootloader_offset != BOOTLOADER_BACKUP_OFFSET)
|
|
|
|
{
|
|
|
|
EPRINTF("Trying backup bootloader...");
|
|
|
|
bootloader_offset = BOOTLOADER_BACKUP_OFFSET;
|
|
|
|
goto try_load;
|
|
|
|
}
|
|
|
|
|
2020-06-14 00:13:18 +01:00
|
|
|
return 0;
|
2018-05-01 06:15:48 +01:00
|
|
|
}
|
2020-07-17 16:00:32 +01:00
|
|
|
gfx_printf("Identified pkg1 and mkey %d\n\n", ctxt->pkg1_id->kb);
|
2018-05-01 06:15:48 +01:00
|
|
|
|
2018-07-10 14:59:03 +01:00
|
|
|
// Read the correct keyblob.
|
2018-07-07 16:36:18 +01:00
|
|
|
ctxt->keyblob = (u8 *)calloc(NX_EMMC_BLOCKSIZE, 1);
|
2020-08-15 10:30:18 +01:00
|
|
|
emummc_storage_read(&emmc_storage, HOS_KEYBLOBS_OFFSET / NX_EMMC_BLOCKSIZE + ctxt->pkg1_id->kb, 1, ctxt->keyblob);
|
2018-05-01 06:15:48 +01:00
|
|
|
|
2020-06-14 00:13:18 +01:00
|
|
|
return 1;
|
2018-05-01 06:15:48 +01:00
|
|
|
}
|
|
|
|
|
2018-09-18 22:28:13 +01:00
|
|
|
static u8 *_read_emmc_pkg2(launch_ctxt_t *ctxt)
|
2018-05-01 06:15:48 +01:00
|
|
|
{
|
2018-09-18 22:28:13 +01:00
|
|
|
u8 *bctBuf = NULL;
|
2019-12-04 15:46:12 +00:00
|
|
|
|
2020-06-14 00:13:18 +01:00
|
|
|
emummc_storage_set_mmc_partition(&emmc_storage, EMMC_GPP);
|
2018-05-01 06:15:48 +01:00
|
|
|
|
2018-07-10 14:59:03 +01:00
|
|
|
// Parse eMMC GPT.
|
2018-05-01 06:15:48 +01:00
|
|
|
LIST_INIT(gpt);
|
2020-06-14 00:13:18 +01:00
|
|
|
nx_emmc_gpt_parse(&gpt, &emmc_storage);
|
2019-09-12 21:08:38 +01:00
|
|
|
DPRINTF("Parsed GPT\n");
|
2018-07-10 14:59:03 +01:00
|
|
|
// Find package2 partition.
|
2018-05-01 06:15:48 +01:00
|
|
|
emmc_part_t *pkg2_part = nx_emmc_part_find(&gpt, "BCPKG2-1-Normal-Main");
|
|
|
|
if (!pkg2_part)
|
|
|
|
goto out;
|
|
|
|
|
2018-07-10 14:59:03 +01:00
|
|
|
// Read in package2 header and get package2 real size.
|
2018-09-18 22:28:13 +01:00
|
|
|
static const u32 BCT_SIZE = 0x4000;
|
|
|
|
bctBuf = (u8 *)malloc(BCT_SIZE);
|
2020-06-14 00:13:18 +01:00
|
|
|
nx_emmc_part_read(&emmc_storage, pkg2_part, BCT_SIZE / NX_EMMC_BLOCKSIZE, 1, bctBuf);
|
2018-09-18 22:28:13 +01:00
|
|
|
u32 *hdr = (u32 *)(bctBuf + 0x100);
|
2018-05-01 06:15:48 +01:00
|
|
|
u32 pkg2_size = hdr[0] ^ hdr[2] ^ hdr[3];
|
2019-09-12 21:08:38 +01:00
|
|
|
DPRINTF("pkg2 size on emmc is %08X\n", pkg2_size);
|
2018-09-18 22:28:13 +01:00
|
|
|
|
|
|
|
// Read in Boot Config.
|
|
|
|
memset(bctBuf, 0, BCT_SIZE);
|
2020-06-14 00:13:18 +01:00
|
|
|
nx_emmc_part_read(&emmc_storage, pkg2_part, 0, BCT_SIZE / NX_EMMC_BLOCKSIZE, bctBuf);
|
2018-09-18 22:28:13 +01:00
|
|
|
|
2018-08-05 12:40:32 +01:00
|
|
|
// Read in package2.
|
2018-05-01 06:15:48 +01:00
|
|
|
u32 pkg2_size_aligned = ALIGN(pkg2_size, NX_EMMC_BLOCKSIZE);
|
2019-09-12 21:08:38 +01:00
|
|
|
DPRINTF("pkg2 size aligned is %08X\n", pkg2_size_aligned);
|
2018-05-01 06:15:48 +01:00
|
|
|
ctxt->pkg2 = malloc(pkg2_size_aligned);
|
|
|
|
ctxt->pkg2_size = pkg2_size;
|
2020-06-14 00:13:18 +01:00
|
|
|
nx_emmc_part_read(&emmc_storage, pkg2_part, BCT_SIZE / NX_EMMC_BLOCKSIZE,
|
2018-05-01 06:15:48 +01:00
|
|
|
pkg2_size_aligned / NX_EMMC_BLOCKSIZE, ctxt->pkg2);
|
2020-06-13 23:27:08 +01:00
|
|
|
out:
|
2018-05-01 06:15:48 +01:00
|
|
|
nx_emmc_gpt_free(&gpt);
|
2018-11-20 19:32:54 +00:00
|
|
|
|
2018-09-18 22:28:13 +01:00
|
|
|
return bctBuf;
|
2018-05-01 06:15:48 +01:00
|
|
|
}
|
|
|
|
|
2018-07-07 16:36:18 +01:00
|
|
|
static void _free_launch_components(launch_ctxt_t *ctxt)
|
|
|
|
{
|
|
|
|
free(ctxt->keyblob);
|
|
|
|
free(ctxt->pkg1);
|
|
|
|
free(ctxt->pkg2);
|
|
|
|
free(ctxt->warmboot);
|
|
|
|
free(ctxt->secmon);
|
|
|
|
free(ctxt->kernel);
|
2018-07-22 21:22:10 +01:00
|
|
|
free(ctxt->kip1_patches);
|
2018-07-07 16:36:18 +01:00
|
|
|
}
|
|
|
|
|
2020-06-14 11:58:03 +01:00
|
|
|
static bool _get_fs_exfat_compatible(link_t *info, bool *fs_is_510)
|
2020-04-27 07:41:13 +01:00
|
|
|
{
|
|
|
|
u32 fs_idx;
|
|
|
|
u32 fs_ids_cnt;
|
|
|
|
u32 sha_buf[32 / sizeof(u32)];
|
|
|
|
kip1_id_t *kip_ids;
|
|
|
|
|
|
|
|
LIST_FOREACH_ENTRY(pkg2_kip1_info_t, ki, info, link)
|
|
|
|
{
|
|
|
|
if (strncmp((const char*)ki->kip1->name, "FS", 2))
|
|
|
|
continue;
|
|
|
|
|
2020-06-13 16:32:40 +01:00
|
|
|
if (!se_calc_sha256_oneshot(sha_buf, ki->kip1, ki->size))
|
2020-04-27 07:41:13 +01:00
|
|
|
break;
|
|
|
|
|
|
|
|
pkg2_get_ids(&kip_ids, &fs_ids_cnt);
|
|
|
|
|
|
|
|
for (fs_idx = 0; fs_idx < fs_ids_cnt; fs_idx++)
|
2020-09-15 17:07:16 +01:00
|
|
|
{
|
2020-04-27 07:41:13 +01:00
|
|
|
if (!memcmp(sha_buf, kip_ids[fs_idx].hash, 8))
|
2020-09-15 17:07:16 +01:00
|
|
|
{
|
|
|
|
// Check if it's 5.1.0.
|
|
|
|
if ((fs_idx & ~1) == 16)
|
|
|
|
*fs_is_510 = true;
|
2020-04-27 07:41:13 +01:00
|
|
|
|
2020-09-15 17:07:16 +01:00
|
|
|
// Check if FAT32-only.
|
|
|
|
if (fs_ids_cnt <= fs_idx && !(fs_idx & 1))
|
|
|
|
return false;
|
2020-06-14 11:58:03 +01:00
|
|
|
|
2020-09-15 17:07:16 +01:00
|
|
|
// FS is FAT32 + exFAT.
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
2020-04-27 07:41:13 +01:00
|
|
|
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
2020-09-15 17:07:16 +01:00
|
|
|
// Hash didn't match or FAT32 + exFAT.
|
2020-04-27 07:41:13 +01:00
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2018-05-01 06:15:48 +01:00
|
|
|
int hos_launch(ini_sec_t *cfg)
|
|
|
|
{
|
2020-06-13 23:27:08 +01:00
|
|
|
u8 kb;
|
2020-06-14 12:00:07 +01:00
|
|
|
u32 secmon_base;
|
|
|
|
u32 warmboot_base;
|
2018-05-01 06:15:48 +01:00
|
|
|
launch_ctxt_t ctxt;
|
2020-06-14 11:57:11 +01:00
|
|
|
bool exo_new = false;
|
2018-11-30 21:20:15 +00:00
|
|
|
tsec_ctxt_t tsec_ctxt;
|
2020-06-13 23:27:08 +01:00
|
|
|
volatile secmon_mailbox_t *secmon_mailbox;
|
2018-06-08 12:07:25 +01:00
|
|
|
|
2020-06-13 23:27:08 +01:00
|
|
|
minerva_change_freq(FREQ_1600);
|
2018-05-01 06:15:48 +01:00
|
|
|
memset(&ctxt, 0, sizeof(launch_ctxt_t));
|
2019-03-07 22:02:37 +00:00
|
|
|
memset(&tsec_ctxt, 0, sizeof(tsec_ctxt_t));
|
2018-05-01 06:15:48 +01:00
|
|
|
list_init(&ctxt.kip1_list);
|
|
|
|
|
2019-03-09 18:49:00 +00:00
|
|
|
ctxt.cfg = cfg;
|
|
|
|
|
2018-06-23 05:07:53 +01:00
|
|
|
if (!gfx_con.mute)
|
2019-04-14 00:30:14 +01:00
|
|
|
gfx_clear_grey(0x1B);
|
|
|
|
gfx_con_setpos(0, 0);
|
2018-06-03 07:07:03 +01:00
|
|
|
|
2020-06-13 23:27:08 +01:00
|
|
|
gfx_puts("Initializing...\n\n");
|
2018-05-01 06:15:48 +01:00
|
|
|
|
2020-06-14 00:13:18 +01:00
|
|
|
// Initialize eMMC/emuMMC.
|
|
|
|
int res = emummc_storage_init_mmc(&emmc_storage, &emmc_sdmmc);
|
|
|
|
if (res)
|
|
|
|
{
|
|
|
|
if (res == 2)
|
|
|
|
_hos_crit_error("Failed to init eMMC");
|
|
|
|
else
|
|
|
|
_hos_crit_error("Failed to init emuMMC");
|
|
|
|
|
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
|
2018-07-01 03:03:17 +01:00
|
|
|
// Read package1 and the correct keyblob.
|
2018-05-01 06:15:48 +01:00
|
|
|
if (!_read_emmc_pkg1(&ctxt))
|
2020-06-14 00:13:18 +01:00
|
|
|
goto error;
|
2018-05-01 06:15:48 +01:00
|
|
|
|
2020-06-14 11:45:01 +01:00
|
|
|
kb = ctxt.pkg1_id->kb;
|
|
|
|
|
2019-03-09 18:49:00 +00:00
|
|
|
// Try to parse config if present.
|
|
|
|
if (ctxt.cfg && !parse_boot_config(&ctxt))
|
|
|
|
{
|
2019-09-12 21:08:38 +01:00
|
|
|
_hos_crit_error("Wrong ini cfg or missing files!");
|
2020-06-14 00:13:18 +01:00
|
|
|
goto error;
|
2019-03-09 18:49:00 +00:00
|
|
|
}
|
|
|
|
|
2020-07-17 16:00:32 +01:00
|
|
|
bool emummc_enabled = emu_cfg.enabled && !h_cfg.emummc_force_disable;
|
|
|
|
|
2019-06-30 01:24:58 +01:00
|
|
|
// Enable emummc patching.
|
2020-07-17 16:00:32 +01:00
|
|
|
if (emummc_enabled)
|
2019-07-06 20:30:22 +01:00
|
|
|
{
|
|
|
|
if (ctxt.stock)
|
|
|
|
{
|
2019-09-12 21:08:38 +01:00
|
|
|
_hos_crit_error("Stock emuMMC is not supported yet!");
|
2020-06-14 00:13:18 +01:00
|
|
|
goto error;
|
2019-07-06 20:30:22 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
ctxt.atmosphere = true; // Set atmosphere patching in case of Stock emuMMC and no fss0.
|
2019-06-30 01:24:58 +01:00
|
|
|
config_kip1patch(&ctxt, "emummc");
|
2019-07-06 20:30:22 +01:00
|
|
|
}
|
2020-04-27 07:44:06 +01:00
|
|
|
else if (!emu_cfg.enabled && ctxt.emummc_forced)
|
|
|
|
{
|
|
|
|
_hos_crit_error("emuMMC is forced but not enabled!");
|
2020-06-14 00:13:18 +01:00
|
|
|
goto error;
|
2020-04-27 07:44:06 +01:00
|
|
|
}
|
2019-06-30 01:24:58 +01:00
|
|
|
|
2019-09-12 21:53:46 +01:00
|
|
|
// Check if fuses lower than 4.0.0 or 9.0.0 and if yes apply NO Gamecard patch.
|
|
|
|
// Additionally check if running emuMMC and disable GC if v3 fuses are burnt and HOS is <= 8.1.0.
|
2020-04-30 14:15:49 +01:00
|
|
|
if (!ctxt.stock)
|
|
|
|
{
|
|
|
|
u32 fuses = fuse_read_odm(7);
|
|
|
|
if ((h_cfg.autonogc &&
|
2020-06-13 23:27:08 +01:00
|
|
|
((!(fuses & ~0xF) && (kb >= KB_FIRMWARE_VERSION_400)) || // LAFW v2.
|
|
|
|
(!(fuses & ~0x3FF) && (kb >= KB_FIRMWARE_VERSION_900)))) // LAFW v3.
|
2020-07-17 16:00:32 +01:00
|
|
|
|| ((emummc_enabled) &&
|
2020-06-13 23:27:08 +01:00
|
|
|
((fuses & 0x400) && (kb <= KB_FIRMWARE_VERSION_810))))
|
2020-04-30 14:15:49 +01:00
|
|
|
config_kip1patch(&ctxt, "nogc");
|
|
|
|
}
|
2019-02-23 23:06:24 +00:00
|
|
|
|
2020-06-13 23:27:08 +01:00
|
|
|
gfx_puts("Loaded config, pkg1 and keyblob\n");
|
2018-06-08 12:07:25 +01:00
|
|
|
|
2020-06-14 11:57:11 +01:00
|
|
|
// Check if secmon is new exosphere.
|
|
|
|
if (ctxt.secmon)
|
|
|
|
exo_new = !memcmp((void *)((u8 *)ctxt.secmon + ctxt.secmon_size - 4), "LENY", 4);
|
2020-06-14 12:00:07 +01:00
|
|
|
const pkg1_id_t *pk1_latest = pkg1_get_latest();
|
|
|
|
secmon_base = exo_new ? pk1_latest->secmon_base : ctxt.pkg1_id->secmon_base;
|
|
|
|
warmboot_base = exo_new ? pk1_latest->warmboot_base : ctxt.pkg1_id->warmboot_base;
|
2020-06-14 11:57:11 +01:00
|
|
|
h_cfg.aes_slots_new = exo_new;
|
|
|
|
|
2018-07-01 03:03:17 +01:00
|
|
|
// Generate keys.
|
2019-04-23 01:38:35 +01:00
|
|
|
if (!h_cfg.se_keygen_done)
|
2018-07-07 16:36:18 +01:00
|
|
|
{
|
2018-11-30 21:20:15 +00:00
|
|
|
tsec_ctxt.fw = (u8 *)ctxt.pkg1 + ctxt.pkg1_id->tsec_off;
|
|
|
|
tsec_ctxt.pkg1 = ctxt.pkg1;
|
|
|
|
tsec_ctxt.pkg11_off = ctxt.pkg1_id->pkg11_off;
|
2020-06-14 12:00:07 +01:00
|
|
|
tsec_ctxt.secmon_base = secmon_base;
|
2018-11-30 21:20:15 +00:00
|
|
|
|
2020-06-13 23:27:08 +01:00
|
|
|
if (kb >= KB_FIRMWARE_VERSION_700 && !h_cfg.sept_run)
|
2019-02-24 01:03:17 +00:00
|
|
|
{
|
2019-09-12 21:08:38 +01:00
|
|
|
_hos_crit_error("Failed to run sept");
|
2020-06-14 00:13:18 +01:00
|
|
|
goto error;
|
2019-02-24 01:03:17 +00:00
|
|
|
}
|
|
|
|
|
2020-06-13 23:27:08 +01:00
|
|
|
if (!hos_keygen(ctxt.keyblob, kb, &tsec_ctxt, &ctxt))
|
2020-06-14 00:13:18 +01:00
|
|
|
goto error;
|
2020-06-13 23:27:08 +01:00
|
|
|
gfx_puts("Generated keys\n");
|
|
|
|
if (kb <= KB_FIRMWARE_VERSION_600)
|
2019-04-23 01:38:35 +01:00
|
|
|
h_cfg.se_keygen_done = 1;
|
2018-07-07 16:36:18 +01:00
|
|
|
}
|
2018-06-08 12:07:25 +01:00
|
|
|
|
2018-07-01 03:03:17 +01:00
|
|
|
// Decrypt and unpack package1 if we require parts of it.
|
2018-05-01 06:15:48 +01:00
|
|
|
if (!ctxt.warmboot || !ctxt.secmon)
|
|
|
|
{
|
2020-07-04 19:32:36 +01:00
|
|
|
// Decrypt PK1 or PK11.
|
|
|
|
if (kb <= KB_FIRMWARE_VERSION_600 || h_cfg.t210b01)
|
|
|
|
{
|
|
|
|
if (!pkg1_decrypt(ctxt.pkg1_id, ctxt.pkg1))
|
|
|
|
{
|
|
|
|
_hos_crit_error("Pkg1 decryption failed!");
|
|
|
|
if (h_cfg.t210b01)
|
|
|
|
EPRINTF("Is BEK missing?");
|
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
}
|
2018-11-30 21:20:15 +00:00
|
|
|
|
2020-07-04 19:32:36 +01:00
|
|
|
// Unpack PK11.
|
|
|
|
if (h_cfg.t210b01 || (kb <= KB_FIRMWARE_VERSION_620 && !emummc_enabled))
|
2019-02-24 00:54:32 +00:00
|
|
|
{
|
2020-07-04 19:32:36 +01:00
|
|
|
// Skip T210B01 OEM header.
|
|
|
|
u32 pk1_offset = 0;
|
|
|
|
if (h_cfg.t210b01)
|
|
|
|
pk1_offset = sizeof(bl_hdr_t210b01_t);
|
|
|
|
|
|
|
|
pkg1_unpack((void *)warmboot_base, &ctxt.warmboot_size,
|
|
|
|
!exo_new ? (void *)ctxt.pkg1_id->secmon_base : NULL, NULL,
|
|
|
|
ctxt.pkg1_id, ctxt.pkg1 + pk1_offset);
|
|
|
|
|
2020-06-13 23:27:08 +01:00
|
|
|
gfx_puts("Decrypted & unpacked pkg1\n");
|
2019-02-24 00:54:32 +00:00
|
|
|
}
|
|
|
|
else
|
2019-03-07 22:02:37 +00:00
|
|
|
{
|
2019-09-12 21:08:38 +01:00
|
|
|
_hos_crit_error("No mandatory secmon or warmboot provided!");
|
2020-06-14 00:13:18 +01:00
|
|
|
goto error;
|
2019-03-07 22:02:37 +00:00
|
|
|
}
|
2018-05-01 06:15:48 +01:00
|
|
|
}
|
2018-06-08 12:07:25 +01:00
|
|
|
|
2020-07-04 19:43:34 +01:00
|
|
|
// Configure and manage Warmboot binary.
|
|
|
|
pkg1_warmboot_config(&ctxt, kb, warmboot_base);
|
|
|
|
|
2018-07-01 03:03:17 +01:00
|
|
|
// Replace 'warmboot.bin' if requested.
|
2018-05-01 06:15:48 +01:00
|
|
|
if (ctxt.warmboot)
|
2020-06-14 12:00:07 +01:00
|
|
|
memcpy((void *)warmboot_base, ctxt.warmboot, ctxt.warmboot_size);
|
2020-07-04 19:43:34 +01:00
|
|
|
else if (!h_cfg.t210b01)
|
2018-12-15 21:16:06 +00:00
|
|
|
{
|
2020-07-17 16:00:32 +01:00
|
|
|
// Patch warmboot on T210 to allow downgrading.
|
2020-06-13 23:27:08 +01:00
|
|
|
if (kb >= KB_FIRMWARE_VERSION_700)
|
2019-02-24 00:58:15 +00:00
|
|
|
{
|
2019-09-12 21:08:38 +01:00
|
|
|
_hos_crit_error("No warmboot provided!");
|
2020-06-14 00:13:18 +01:00
|
|
|
goto error;
|
2019-02-24 00:58:15 +00:00
|
|
|
}
|
2020-07-04 19:44:39 +01:00
|
|
|
|
|
|
|
pkg1_warmboot_patch((void *)&ctxt);
|
2018-12-15 21:16:06 +00:00
|
|
|
}
|
2018-06-08 12:07:25 +01:00
|
|
|
|
2020-07-17 16:00:32 +01:00
|
|
|
// Replace 'SecureMonitor' if requested or patch Pkg2 checks if needed.
|
2018-06-08 12:07:25 +01:00
|
|
|
if (ctxt.secmon)
|
2020-06-14 12:00:07 +01:00
|
|
|
memcpy((void *)secmon_base, ctxt.secmon, ctxt.secmon_size);
|
2020-07-04 19:58:21 +01:00
|
|
|
else
|
|
|
|
pkg1_secmon_patch((void *)&ctxt, secmon_base, h_cfg.t210b01);
|
2018-06-05 00:04:08 +01:00
|
|
|
|
2020-06-13 23:27:08 +01:00
|
|
|
gfx_puts("Loaded warmboot and secmon\n");
|
2018-05-13 02:13:17 +01:00
|
|
|
|
2018-07-01 03:03:17 +01:00
|
|
|
// Read package2.
|
2018-09-18 22:28:13 +01:00
|
|
|
u8 *bootConfigBuf = _read_emmc_pkg2(&ctxt);
|
|
|
|
if (!bootConfigBuf)
|
2020-05-05 17:11:39 +01:00
|
|
|
{
|
|
|
|
_hos_crit_error("Pkg2 read failed!");
|
2020-06-14 00:13:18 +01:00
|
|
|
goto error;
|
2020-05-05 17:11:39 +01:00
|
|
|
}
|
2018-05-13 02:13:17 +01:00
|
|
|
|
2020-06-13 23:27:08 +01:00
|
|
|
gfx_puts("Read pkg2\n");
|
2018-05-13 02:13:17 +01:00
|
|
|
|
2018-07-01 03:03:17 +01:00
|
|
|
// Decrypt package2 and parse KIP1 blobs in INI1 section.
|
2020-06-13 23:27:08 +01:00
|
|
|
pkg2_hdr_t *pkg2_hdr = pkg2_decrypt(ctxt.pkg2, kb);
|
2018-12-16 14:52:38 +00:00
|
|
|
if (!pkg2_hdr)
|
|
|
|
{
|
2019-09-12 21:08:38 +01:00
|
|
|
_hos_crit_error("Pkg2 decryption failed!");
|
2020-10-17 21:16:16 +01:00
|
|
|
EPRINTFARGS("Is hekate%s updated?", kb >= KB_FIRMWARE_VERSION_700 ? " or Sept" : "");
|
2020-04-30 01:43:29 +01:00
|
|
|
|
2020-10-17 21:16:16 +01:00
|
|
|
// Clear EKS slot, in case something went wrong with sept keygen.
|
|
|
|
if (kb >= KB_FIRMWARE_VERSION_700)
|
2020-06-13 23:27:08 +01:00
|
|
|
hos_eks_clear(kb);
|
2020-06-14 00:13:18 +01:00
|
|
|
goto error;
|
2018-12-16 14:52:38 +00:00
|
|
|
}
|
2020-06-13 23:27:08 +01:00
|
|
|
else if (kb >= KB_FIRMWARE_VERSION_700)
|
|
|
|
hos_eks_save(kb); // Save EKS slot if it doesn't exist.
|
2018-05-13 02:13:17 +01:00
|
|
|
|
2018-06-08 12:07:25 +01:00
|
|
|
LIST_INIT(kip1_info);
|
2020-04-14 15:40:41 +01:00
|
|
|
if (!pkg2_parse_kips(&kip1_info, pkg2_hdr, &ctxt.new_pkg2))
|
|
|
|
{
|
|
|
|
_hos_crit_error("INI1 parsing failed!");
|
2020-06-14 00:13:18 +01:00
|
|
|
goto error;
|
2020-04-14 15:40:41 +01:00
|
|
|
}
|
2018-06-08 12:07:25 +01:00
|
|
|
|
2020-06-13 23:27:08 +01:00
|
|
|
gfx_puts("Parsed ini1\n");
|
2018-05-01 06:15:48 +01:00
|
|
|
|
2018-07-01 03:03:17 +01:00
|
|
|
// Use the kernel included in package2 in case we didn't load one already.
|
2018-06-08 12:07:25 +01:00
|
|
|
if (!ctxt.kernel)
|
|
|
|
{
|
|
|
|
ctxt.kernel = pkg2_hdr->data;
|
|
|
|
ctxt.kernel_size = pkg2_hdr->sec_size[PKG2_SEC_KERNEL];
|
|
|
|
|
2019-03-09 18:49:00 +00:00
|
|
|
if (!ctxt.stock && (ctxt.svcperm || ctxt.debugmode || ctxt.atmosphere))
|
2018-06-08 12:07:25 +01:00
|
|
|
{
|
2019-04-23 16:17:55 +01:00
|
|
|
// Hash only Kernel when it embeds INI1.
|
2020-07-17 16:00:32 +01:00
|
|
|
u8 kernel_hash[0x20];
|
2019-04-21 15:37:12 +01:00
|
|
|
if (!ctxt.new_pkg2)
|
2020-06-13 16:32:40 +01:00
|
|
|
se_calc_sha256_oneshot(kernel_hash, ctxt.kernel, ctxt.kernel_size);
|
2019-04-21 15:37:12 +01:00
|
|
|
else
|
2020-06-13 16:32:40 +01:00
|
|
|
se_calc_sha256_oneshot(kernel_hash, ctxt.kernel + PKG2_NEWKERN_START,
|
2019-09-12 21:37:00 +01:00
|
|
|
pkg2_newkern_ini1_start - PKG2_NEWKERN_START);
|
2019-04-21 15:37:12 +01:00
|
|
|
|
2019-04-23 16:17:55 +01:00
|
|
|
ctxt.pkg2_kernel_id = pkg2_identify(kernel_hash);
|
2019-06-30 01:15:46 +01:00
|
|
|
if (!ctxt.pkg2_kernel_id)
|
|
|
|
{
|
2019-09-12 21:08:38 +01:00
|
|
|
_hos_crit_error("Failed to identify kernel!");
|
2019-12-04 15:46:12 +00:00
|
|
|
|
2020-06-14 00:13:18 +01:00
|
|
|
goto error;
|
2019-06-30 01:15:46 +01:00
|
|
|
}
|
|
|
|
|
2018-07-01 03:03:17 +01:00
|
|
|
// In case a kernel patch option is set; allows to disable SVC verification or/and enable debug mode.
|
|
|
|
kernel_patch_t *kernel_patchset = ctxt.pkg2_kernel_id->kernel_patchset;
|
2018-06-08 12:07:25 +01:00
|
|
|
if (kernel_patchset != NULL)
|
|
|
|
{
|
2019-04-14 00:30:14 +01:00
|
|
|
gfx_printf("%kPatching kernel%k\n", 0xFFFFBA00, 0xFFCCCCCC);
|
2018-07-01 03:03:17 +01:00
|
|
|
u32 *temp;
|
|
|
|
for (u32 i = 0; kernel_patchset[i].id != 0xFFFFFFFF; i++)
|
|
|
|
{
|
|
|
|
if ((ctxt.svcperm && kernel_patchset[i].id == SVC_VERIFY_DS)
|
2018-12-01 18:46:59 +00:00
|
|
|
|| (ctxt.debugmode && kernel_patchset[i].id == DEBUG_MODE_EN && !(ctxt.atmosphere && ctxt.secmon))
|
2018-07-01 03:03:17 +01:00
|
|
|
|| (ctxt.atmosphere && kernel_patchset[i].id == ATM_GEN_PATCH))
|
|
|
|
*(vu32 *)(ctxt.kernel + kernel_patchset[i].off) = kernel_patchset[i].val;
|
|
|
|
else if (ctxt.atmosphere && kernel_patchset[i].id == ATM_ARR_PATCH)
|
|
|
|
{
|
|
|
|
temp = (u32 *)kernel_patchset[i].ptr;
|
|
|
|
for (u32 j = 0; j < kernel_patchset[i].val; j++)
|
|
|
|
*(vu32 *)(ctxt.kernel + kernel_patchset[i].off + (j << 2)) = temp[j];
|
|
|
|
}
|
2019-02-11 22:36:24 +00:00
|
|
|
else if (kernel_patchset[i].id < SVC_VERIFY_DS)
|
|
|
|
*(vu32 *)(ctxt.kernel + kernel_patchset[i].off) = kernel_patchset[i].val;
|
2018-07-01 03:03:17 +01:00
|
|
|
}
|
2018-06-08 12:07:25 +01:00
|
|
|
}
|
2018-05-04 08:15:29 +01:00
|
|
|
}
|
2018-05-01 06:15:48 +01:00
|
|
|
}
|
2018-06-08 12:07:25 +01:00
|
|
|
|
2018-07-01 03:03:17 +01:00
|
|
|
// Merge extra KIP1s into loaded ones.
|
2018-06-08 12:07:25 +01:00
|
|
|
LIST_FOREACH_ENTRY(merge_kip_t, mki, &ctxt.kip1_list, link)
|
|
|
|
pkg2_merge_kip(&kip1_info, (pkg2_kip1_t *)mki->kip1);
|
|
|
|
|
2020-06-14 11:58:03 +01:00
|
|
|
// Check if FS is compatible with exFAT and if 5.1.0.
|
|
|
|
if (!ctxt.stock && (sd_fs.fs_type == FS_EXFAT || kb == KB_FIRMWARE_VERSION_500))
|
2020-04-27 07:41:13 +01:00
|
|
|
{
|
2020-06-14 11:58:03 +01:00
|
|
|
bool exfat_compat = _get_fs_exfat_compatible(&kip1_info, &ctxt.exo_ctx.fs_is_510);
|
2020-04-27 07:41:13 +01:00
|
|
|
|
2020-06-14 11:58:03 +01:00
|
|
|
if (sd_fs.fs_type == FS_EXFAT && !exfat_compat)
|
|
|
|
{
|
|
|
|
_hos_crit_error("SD Card is exFAT and installed HOS driver\nonly supports FAT32!");
|
|
|
|
|
|
|
|
_free_launch_components(&ctxt);
|
|
|
|
goto error;
|
|
|
|
}
|
2020-04-27 07:41:13 +01:00
|
|
|
}
|
|
|
|
|
2018-08-05 12:40:32 +01:00
|
|
|
// Patch kip1s in memory if needed.
|
2020-07-04 19:43:34 +01:00
|
|
|
gfx_printf("%kPatching kips%k\n", 0xFFFFBA00, 0xFFCCCCCC);
|
2018-07-22 21:22:10 +01:00
|
|
|
const char* unappliedPatch = pkg2_patch_kips(&kip1_info, ctxt.kip1_patches);
|
|
|
|
if (unappliedPatch != NULL)
|
|
|
|
{
|
2019-07-06 20:08:37 +01:00
|
|
|
EHPRINTFARGS("Failed to apply '%s'!", unappliedPatch);
|
2019-02-11 22:34:35 +00:00
|
|
|
|
2020-10-17 20:11:21 +01:00
|
|
|
bool emmc_patch_failed = !strcmp(unappliedPatch, "emummc");
|
|
|
|
if (!emmc_patch_failed)
|
|
|
|
{
|
2020-10-14 18:37:36 +01:00
|
|
|
gfx_puts("\nPress POWER to continue.\nPress VOL to go to the menu.\n");
|
2020-10-17 20:11:21 +01:00
|
|
|
display_backlight_brightness(h_cfg.backlight, 1000);
|
|
|
|
}
|
2020-10-14 18:37:36 +01:00
|
|
|
|
2020-10-17 20:11:21 +01:00
|
|
|
if (emmc_patch_failed || !(btn_wait() & BTN_POWER))
|
2020-06-14 11:47:47 +01:00
|
|
|
{
|
|
|
|
_free_launch_components(&ctxt);
|
|
|
|
goto error; // MUST stop here, because if user requests 'nogc' but it's not applied, their GC controller gets updated!
|
|
|
|
}
|
2018-07-22 21:22:10 +01:00
|
|
|
}
|
|
|
|
|
2018-07-01 03:03:17 +01:00
|
|
|
// Rebuild and encrypt package2.
|
2020-10-17 21:16:16 +01:00
|
|
|
pkg2_build_encrypt((void *)PKG2_LOAD_ADDR, &ctxt, &kip1_info);
|
2018-11-30 21:20:15 +00:00
|
|
|
|
2020-06-13 23:27:08 +01:00
|
|
|
gfx_puts("Rebuilt & loaded pkg2\n");
|
2018-06-08 12:07:25 +01:00
|
|
|
|
2019-04-14 00:30:14 +01:00
|
|
|
gfx_printf("\n%kBooting...%k\n", 0xFF96FF00, 0xFFCCCCCC);
|
2018-06-01 17:22:11 +01:00
|
|
|
|
2020-06-13 23:27:08 +01:00
|
|
|
// Set initial mailbox values.
|
2018-12-01 18:46:59 +00:00
|
|
|
int bootStateDramPkg2 = 0;
|
|
|
|
int bootStatePkg2Continue = 0;
|
2019-10-18 16:02:06 +01:00
|
|
|
|
2020-10-20 08:32:32 +01:00
|
|
|
// Clear pkg1/pkg2 keys.
|
|
|
|
se_aes_key_clear(8);
|
|
|
|
se_aes_key_clear(11);
|
|
|
|
|
2020-06-14 11:57:11 +01:00
|
|
|
// Finalize per firmware key access. Skip access control if new exosphere.
|
|
|
|
switch (kb | (exo_new << 7))
|
2018-06-08 12:07:25 +01:00
|
|
|
{
|
|
|
|
case KB_FIRMWARE_VERSION_100_200:
|
|
|
|
case KB_FIRMWARE_VERSION_300:
|
|
|
|
case KB_FIRMWARE_VERSION_301:
|
2019-12-04 15:18:16 +00:00
|
|
|
se_key_acc_ctrl(12, SE_KEY_TBL_DIS_KEY_ACCESS_FLAG | SE_KEY_TBL_DIS_KEY_LOCK_FLAG);
|
|
|
|
se_key_acc_ctrl(13, SE_KEY_TBL_DIS_KEY_ACCESS_FLAG | SE_KEY_TBL_DIS_KEY_LOCK_FLAG);
|
2018-06-08 12:07:25 +01:00
|
|
|
bootStateDramPkg2 = 2;
|
|
|
|
bootStatePkg2Continue = 3;
|
|
|
|
break;
|
|
|
|
case KB_FIRMWARE_VERSION_400:
|
|
|
|
case KB_FIRMWARE_VERSION_500:
|
2018-09-18 01:08:05 +01:00
|
|
|
case KB_FIRMWARE_VERSION_600:
|
2019-12-04 15:18:16 +00:00
|
|
|
se_key_acc_ctrl(12, SE_KEY_TBL_DIS_KEY_ACCESS_FLAG | SE_KEY_TBL_DIS_KEY_LOCK_FLAG);
|
|
|
|
se_key_acc_ctrl(15, SE_KEY_TBL_DIS_KEY_ACCESS_FLAG | SE_KEY_TBL_DIS_KEY_LOCK_FLAG);
|
2019-02-24 00:54:32 +00:00
|
|
|
default:
|
2018-06-08 12:07:25 +01:00
|
|
|
bootStateDramPkg2 = 2;
|
|
|
|
bootStatePkg2Continue = 4;
|
|
|
|
break;
|
2018-05-29 00:11:22 +01:00
|
|
|
}
|
2018-05-01 06:15:48 +01:00
|
|
|
|
2018-09-18 22:28:13 +01:00
|
|
|
// Clear BCT area for retail units and copy it over if dev unit.
|
2020-06-14 11:57:11 +01:00
|
|
|
if (kb <= KB_FIRMWARE_VERSION_500 && !exo_new)
|
2018-09-18 22:28:13 +01:00
|
|
|
{
|
2020-07-17 16:00:32 +01:00
|
|
|
memset((void *)SECMON_BCT_CFG_ADDR, 0, 0x3000);
|
2018-09-18 22:28:13 +01:00
|
|
|
if ((fuse_read_odm(4) & 3) == 3)
|
2020-07-17 16:00:32 +01:00
|
|
|
memcpy((void *)SECMON_BCT_CFG_ADDR, bootConfigBuf, 0x1000);
|
2018-09-18 22:28:13 +01:00
|
|
|
}
|
2018-09-18 01:08:05 +01:00
|
|
|
else
|
2018-09-18 22:28:13 +01:00
|
|
|
{
|
2020-07-17 16:00:32 +01:00
|
|
|
memset((void *)SECMON6_BCT_CFG_ADDR, 0, 0x800);
|
2018-09-18 22:28:13 +01:00
|
|
|
if ((fuse_read_odm(4) & 3) == 3)
|
2020-07-17 16:00:32 +01:00
|
|
|
memcpy((void *)SECMON6_BCT_CFG_ADDR, bootConfigBuf, 0x800);
|
2018-09-18 22:28:13 +01:00
|
|
|
}
|
|
|
|
free(bootConfigBuf);
|
2018-07-01 03:03:17 +01:00
|
|
|
|
2018-12-01 18:46:59 +00:00
|
|
|
// Config Exosphère if booting full Atmosphère.
|
|
|
|
if (ctxt.atmosphere && ctxt.secmon)
|
2020-06-15 08:57:15 +01:00
|
|
|
config_exosphere(&ctxt, warmboot_base, exo_new);
|
2019-02-24 00:34:04 +00:00
|
|
|
|
2020-06-14 00:13:18 +01:00
|
|
|
// Unmount SD card and eMMC.
|
2020-06-13 16:32:40 +01:00
|
|
|
sd_end();
|
2020-06-14 00:13:18 +01:00
|
|
|
sdmmc_storage_end(&emmc_storage);
|
2020-05-01 18:30:17 +01:00
|
|
|
|
2018-11-20 19:32:54 +00:00
|
|
|
// Finalize MC carveout.
|
2020-06-22 10:04:49 +01:00
|
|
|
if (kb <= KB_FIRMWARE_VERSION_301 && !exo_new)
|
2018-11-20 19:32:54 +00:00
|
|
|
mc_config_carveout();
|
|
|
|
|
2018-12-01 18:46:59 +00:00
|
|
|
// Lock SE before starting 'SecureMonitor' if < 6.2.0, otherwise lock bootrom and ipatches.
|
2020-06-14 11:57:11 +01:00
|
|
|
_se_lock(kb <= KB_FIRMWARE_VERSION_600 && !exo_new);
|
2018-12-01 18:46:59 +00:00
|
|
|
|
|
|
|
// Reset sysctr0 counters.
|
2020-06-13 23:27:08 +01:00
|
|
|
if (kb >= KB_FIRMWARE_VERSION_620)
|
2018-11-30 21:20:15 +00:00
|
|
|
_sysctr0_reset();
|
2018-05-01 06:15:48 +01:00
|
|
|
|
2018-11-28 19:26:16 +00:00
|
|
|
// < 4.0.0 pkg1.1 locks PMC scratches.
|
2020-06-13 23:27:08 +01:00
|
|
|
//_pmc_scratch_lock(kb);
|
2018-09-24 21:22:19 +01:00
|
|
|
|
2020-06-15 08:54:52 +01:00
|
|
|
// Set secmon mailbox address and clear it.
|
2020-06-14 11:57:11 +01:00
|
|
|
if (kb >= KB_FIRMWARE_VERSION_700 || exo_new)
|
2020-06-15 08:54:52 +01:00
|
|
|
{
|
|
|
|
memset((void *)SECMON7_MAILBOX_ADDR, 0, 0x200);
|
|
|
|
secmon_mailbox = (secmon_mailbox_t *)(SECMON7_MAILBOX_ADDR + SECMON_STATE_OFFSET);
|
|
|
|
}
|
2019-02-24 00:54:32 +00:00
|
|
|
else
|
2020-06-15 08:54:52 +01:00
|
|
|
{
|
|
|
|
if (kb <= KB_FIRMWARE_VERSION_301)
|
|
|
|
memset((void *)SECMON_MAILBOX_ADDR, 0, 0x200);
|
|
|
|
secmon_mailbox = (secmon_mailbox_t *)(SECMON_MAILBOX_ADDR + SECMON_STATE_OFFSET);
|
|
|
|
}
|
2018-05-01 06:15:48 +01:00
|
|
|
|
2019-02-24 00:54:32 +00:00
|
|
|
// Start from DRAM ready signal and reset outgoing value.
|
2020-06-13 23:27:08 +01:00
|
|
|
secmon_mailbox->in = bootStateDramPkg2;
|
|
|
|
secmon_mailbox->out = 0;
|
2019-02-24 00:54:32 +00:00
|
|
|
|
2018-08-13 10:12:53 +01:00
|
|
|
// Disable display. This must be executed before secmon to provide support for all fw versions.
|
|
|
|
display_end();
|
2018-07-22 13:18:30 +01:00
|
|
|
|
2019-02-24 01:03:17 +00:00
|
|
|
// Clear EMC_SCRATCH0.
|
|
|
|
EMC(EMC_SCRATCH0) = 0;
|
|
|
|
|
2020-08-15 10:31:44 +01:00
|
|
|
// Hold USBD, USB2, AHBDMA and APBDMA in reset for SoC state validation on sleep.
|
2020-07-19 21:10:21 +01:00
|
|
|
CLOCK(CLK_RST_CONTROLLER_RST_DEV_L_SET) = BIT(CLK_L_USBD);
|
2020-08-15 10:31:44 +01:00
|
|
|
CLOCK(CLK_RST_CONTROLLER_RST_DEV_H_SET) = BIT(CLK_H_AHBDMA) | BIT(CLK_H_APBDMA) | BIT(CLK_H_USB2);
|
2020-06-15 15:33:13 +01:00
|
|
|
|
2019-06-30 01:55:19 +01:00
|
|
|
// Flush cache and disable MMU.
|
|
|
|
bpmp_mmu_disable();
|
|
|
|
bpmp_clk_rate_set(BPMP_CLK_NORMAL);
|
2019-06-30 01:49:33 +01:00
|
|
|
|
2019-08-28 00:39:43 +01:00
|
|
|
// emuMMC: Some cards (Sandisk U1), do not like a fast power cycle. Wait min 100ms.
|
|
|
|
sdmmc_storage_init_wait_sd();
|
|
|
|
|
2020-07-17 16:00:32 +01:00
|
|
|
// Launch secmon.
|
2018-11-30 21:20:15 +00:00
|
|
|
if (smmu_is_used())
|
|
|
|
smmu_exit();
|
2019-04-21 15:33:39 +01:00
|
|
|
else
|
2020-06-14 12:00:07 +01:00
|
|
|
ccplex_boot_cpu0(secmon_base);
|
2020-07-17 16:00:32 +01:00
|
|
|
|
|
|
|
// Wait for secmon to get ready.
|
2020-06-13 23:27:08 +01:00
|
|
|
while (!secmon_mailbox->out)
|
2020-07-17 16:00:32 +01:00
|
|
|
;
|
2018-05-01 06:15:48 +01:00
|
|
|
|
2018-07-09 20:13:56 +01:00
|
|
|
// Signal pkg2 ready and continue boot.
|
2020-06-13 23:27:08 +01:00
|
|
|
secmon_mailbox->in = bootStatePkg2Continue;
|
2018-05-01 06:15:48 +01:00
|
|
|
|
2018-07-09 20:13:56 +01:00
|
|
|
// Halt ourselves in waitevent state and resume if there's JTAG activity.
|
2019-02-24 00:54:32 +00:00
|
|
|
while (true)
|
2019-08-28 00:39:43 +01:00
|
|
|
bpmp_halt();
|
2018-05-01 06:15:48 +01:00
|
|
|
|
2020-06-14 00:13:18 +01:00
|
|
|
error:
|
|
|
|
sdmmc_storage_end(&emmc_storage);
|
2020-06-14 11:53:21 +01:00
|
|
|
h_cfg.aes_slots_new = false;
|
2018-05-01 06:15:48 +01:00
|
|
|
return 0;
|
|
|
|
}
|