v2.3

ipl/hos.c

@@ -378,8 +378,13 @@ int hos_launch(ini_sec_t *cfg)
 	memset(&ctxt, 0, sizeof(launch_ctxt_t));
 	list_init(&ctxt.kip1_list);
 
+	gfx_clear(&gfx_ctxt, 0xFF1B1B1B);
+	gfx_con_setpos(&gfx_con, 0, 0);
+
 	if (cfg && !_config(&ctxt, cfg))
 		return 0;
+        
+	gfx_printf(&gfx_con, "Initializing...\n\n");
 
 	//Read package1 and the correct keyblob.
 	if (!_read_emmc_pkg1(&ctxt))
@@ -393,16 +398,15 @@ int hos_launch(ini_sec_t *cfg)
 	if (!ctxt.warmboot || !ctxt.secmon)
 	{
 		pkg1_decrypt(ctxt.pkg1_id, ctxt.pkg1);
-		pkg1_unpack((void *)0x8000D000, (void *)ctxt.pkg1_id->secmon_base, ctxt.pkg1_id, ctxt.pkg1);
-		//gfx_hexdump(&gfx_con, 0x8000D000, (void *)0x8000D000, 0x100);
-		//gfx_hexdump(&gfx_con, ctxt.pkg1_id->secmon_base, (void *)ctxt.pkg1_id->secmon_base, 0x100);
+		pkg1_unpack((void *)ctxt.pkg1_id->warmboot_base, (void *)ctxt.pkg1_id->secmon_base, ctxt.pkg1_id, ctxt.pkg1);
 		gfx_printf(&gfx_con, "Decrypted and unpacked package1\n");
 	}
 	//Replace 'warmboot.bin' if requested.
 	if (ctxt.warmboot)
-		memcpy((void *)0x8000D000, ctxt.warmboot, ctxt.warmboot_size);
-	//Set warmboot address in PMC.
-	PMC(APBDEV_PMC_SCRATCH1) = 0x8000D000;
+		memcpy((void *)ctxt.pkg1_id->warmboot_base, ctxt.warmboot, ctxt.warmboot_size);
+	//Set warmboot address in PMC if required.
+	if (ctxt.pkg1_id->set_warmboot)
+		PMC(APBDEV_PMC_SCRATCH1) = 0x8000D000;
 	//Replace 'SecureMonitor' if requested.
 	if (ctxt.secmon) {
 		memcpy((void *)ctxt.pkg1_id->secmon_base, ctxt.secmon, ctxt.secmon_size);
@@ -497,7 +501,7 @@ int hos_launch(ini_sec_t *cfg)
 			break;
 	}
 
-	//Clear 'BootConfig'.
+	//Clear 'BootConfig' for retail systems.
 	memset((void *)0x4003D000, 0, 0x3000);
 
 	//pkg2_decrypt((void *)0xA9800000);
@@ -523,6 +527,7 @@ int hos_launch(ini_sec_t *cfg)
 	//*mb_in = 1;
 	//sleep(100);
 
+	//TODO: pkg1.1 locks PMC scratches, we can do that too at some point.
 	/*PMC(0x4) = 0x7FFFF3;
 	PMC(0x2C4) = 0xFFFFFFFF;
 	PMC(0x2D8) = 0xFFAFFFFF;

ipl/main.c

@@ -1025,7 +1025,7 @@ int dump_emmc_part(char *sd_path, sdmmc_storage_t *storage, emmc_part_t *part)
 	if(isSmallSdCard)
 	{
 		f_unlink(partialIdxFilename);
-		gfx_printf(&gfx_con, "%k%K\n\nYou can now join the files\nand get the complete raw eMMC dump.", 0xFFCCCCCC, 0xFF1B1B1B);
+		gfx_printf(&gfx_con, "%k\n\nYou can now join the files\nand get the complete raw eMMC dump.", 0xFFCCCCCC);
 	}
 	gfx_puts(&gfx_con, "\n\n");
 
@@ -1127,10 +1127,10 @@ static void dump_emmc_selected(dumpType_t dumpType)
 	}
 
 	gfx_putc(&gfx_con, '\n');
-	gfx_printf(&gfx_con, "%kTime taken: %d seconds.%k\n", 0xFF00FF96, (get_tmr() - timer) / 1000000, 0xFFCCCCCC);
+	gfx_printf(&gfx_con, "Time taken: %d seconds.\n", (get_tmr() - timer) / 1000000);
 	sdmmc_storage_end(&storage);
 	if (res)
-		gfx_puts(&gfx_con, "\nFinished and verified!\nPress any key.\n");
+		gfx_printf(&gfx_con, "\n%kFinished and verified!%k\nPress any key.\n",0xFF00FF96, 0xFFCCCCCC);
 
 out:;
 	btn_wait();
@@ -1430,7 +1430,7 @@ ment_t ment_top[] = {
 };
 menu_t menu_top = {
 	ment_top,
-	"hekate - ipl (CTCaer mod v2.1)", 0, 0
+	"hekate - ipl (CTCaer mod v2.3)", 0, 0
 };
 
 extern void pivot_stack(u32 stack_top);

ipl/pkg1.c

@@ -90,7 +90,7 @@ PATCHSET_DEF(_kernel_4_patchset,
 );
 
 PATCHSET_DEF(_kernel_5_patchset,
-	{ 0xFFFFFFFF, 0xFFFFFFFF },  // TODO: MISSING
+	{ 0x45E6C, _NOP() },         // Disable SVC verifications
 	{ 0x5513C, _MOVZX(8, 1, 0) } // Enable Debug Patch
 );
 
@@ -106,12 +106,12 @@ PATCHSET_DEF(_kernel_5_patchset,
 */
 
 static const pkg1_id_t _pkg1_ids[] = {
-	{ "20161121183008", 0, 0x1900, 0x3FE0, { 2, 1, 0 }, SM_100_ADR, _secmon_1_patchset, _kernel_1_patchset }, //1.0.0 (Patched relocator)
-	{ "20170210155124", 0, 0x1900, 0x3FE0, { 0, 1, 2 }, 0x4002D000, _secmon_2_patchset, _kernel_2_patchset }, //2.0.0 - 2.3.0
-	{ "20170519101410", 1, 0x1A00, 0x3FE0, { 0, 1, 2 }, 0x4002D000, _secmon_3_patchset, _kernel_3_patchset }, //3.0.0
-	{ "20170710161758", 2, 0x1A00, 0x3FE0, { 0, 1, 2 }, 0x4002D000, _secmon_3_patchset, _kernel_3_patchset }, //3.0.1 - 3.0.2
-	{ "20170921172629", 3, 0x1800, 0x3FE0, { 1, 2, 0 }, 0x4002B000, _secmon_4_patchset, _kernel_4_patchset }, //4.0.0 - 4.1.0
-	{ "20180220163747", 4, 0x1900, 0x3FE0, { 1, 2, 0 }, 0x4002B000, _secmon_5_patchset, _kernel_5_patchset }, //5.0.0 - 5.0.2
+	{ "20161121183008", 0, 0x1900, 0x3FE0, { 2, 1, 0 }, SM_100_ADR, 0x8000D000, 1, _secmon_1_patchset, _kernel_1_patchset }, //1.0.0 (Patched relocator)
+	{ "20170210155124", 0, 0x1900, 0x3FE0, { 0, 1, 2 }, 0x4002D000, 0x8000D000, 1, _secmon_2_patchset, _kernel_2_patchset }, //2.0.0 - 2.3.0
+	{ "20170519101410", 1, 0x1A00, 0x3FE0, { 0, 1, 2 }, 0x4002D000, 0x8000D000, 1, _secmon_3_patchset, _kernel_3_patchset }, //3.0.0
+	{ "20170710161758", 2, 0x1A00, 0x3FE0, { 0, 1, 2 }, 0x4002D000, 0x8000D000, 1, _secmon_3_patchset, _kernel_3_patchset }, //3.0.1 - 3.0.2
+	{ "20170921172629", 3, 0x1800, 0x3FE0, { 1, 2, 0 }, 0x4002B000, 0x4003B000, 0, _secmon_4_patchset, _kernel_4_patchset }, //4.0.0 - 4.1.0
+	{ "20180220163747", 4, 0x1900, 0x3FE0, { 1, 2, 0 }, 0x4002B000, 0x4003B000, 0, _secmon_5_patchset, _kernel_5_patchset }, //5.0.0 - 5.0.2
 	{ NULL, 0, 0, 0, 0 } //End.
 };
 

ipl/pkg1.h

@@ -39,6 +39,8 @@ typedef struct _pkg1_id_t
 	u32 pkg11_off;
 	u32 sec_map[3];
 	u32 secmon_base;
+	u32 warmboot_base;
+	int set_warmboot;
 	patch_t *secmon_patchset;
 	patch_t *kernel_patchset;
 } pkg1_id_t;

ipl/sd.h

@@ -86,6 +86,7 @@
 #define UHS_SDR50_BUS_SPEED		2
 #define UHS_SDR104_BUS_SPEED	3
 #define UHS_DDR50_BUS_SPEED		4
+#define HS400_BUS_SPEED 		5
 
 /*
 * SD_SWITCH mode
@@ -102,6 +103,6 @@
 * SD_SWITCH access modes
 */
 #define SD_SWITCH_ACCESS_DEF	0
-#define SD_SWITCH_ACCESS_HS	1
+#define SD_SWITCH_ACCESS_HS		1
 
 #endif /* LINUX_MMC_SD_H */

ipl/sdmmc_driver.c

@@ -204,32 +204,34 @@ int sdmmc_setup_clock(sdmmc_t *sdmmc, u32 type)
 	case 1:
 	case 5:
 	case 6:
-		sdmmc->regs->hostctl &= 0xFB;
-		sdmmc->regs->hostctl2 &= 0xFFF7;
+		sdmmc->regs->hostctl  &= 0xFB; //Should this be 0xFFFB (~4) ?
+		sdmmc->regs->hostctl2 &= SDHCI_CTRL_VDD_330;
 		break;
 	case 2:
 	case 7:
-		sdmmc->regs->hostctl |= 4;
-		sdmmc->regs->hostctl2 &= 0xFFF7;
+		sdmmc->regs->hostctl  |= 4;
+		sdmmc->regs->hostctl2 &= SDHCI_CTRL_VDD_330;
 		break;
 	case 3:
 	case 11:
 	case 13:
 	case 14:
-		sdmmc->regs->hostctl2 = (sdmmc->regs->hostctl2 & 0xFFF8) | 3;
-		sdmmc->regs->hostctl2 |= 8;
+		sdmmc->regs->hostctl2  = (sdmmc->regs->hostctl2 & SDHCI_CTRL_UHS_MASK) | UHS_SDR104_BUS_SPEED;
+		sdmmc->regs->hostctl2 |= SDHCI_CTRL_VDD_180;
 		break;
 	case 4:
-		sdmmc->regs->hostctl2 = (sdmmc->regs->hostctl2 & 0xFFF8) | 5;
-		sdmmc->regs->hostctl2 |= 8;
+		 //Non standard
+		sdmmc->regs->hostctl2  = (sdmmc->regs->hostctl2 & SDHCI_CTRL_UHS_MASK) | HS400_BUS_SPEED;
+		sdmmc->regs->hostctl2 |= SDHCI_CTRL_VDD_180;
 		break;
 	case 8:
-		sdmmc->regs->hostctl2 = sdmmc->regs->hostctl2 & 0xFFF8;
-		sdmmc->regs->hostctl2 |= 8;
+		sdmmc->regs->hostctl2  = (sdmmc->regs->hostctl2 & SDHCI_CTRL_UHS_MASK) | UHS_SDR12_BUS_SPEED;
+		sdmmc->regs->hostctl2 |= SDHCI_CTRL_VDD_180;
 		break;
 	case 10:
-		sdmmc->regs->hostctl2 = (sdmmc->regs->hostctl2 & 0xFFF8) | 2;
-		sdmmc->regs->hostctl2 |= 8;
+		//T210 Errata for SDR50, the host must be set to SDR104.
+		sdmmc->regs->hostctl2  = (sdmmc->regs->hostctl2 & SDHCI_CTRL_UHS_MASK) | UHS_SDR104_BUS_SPEED;
+		sdmmc->regs->hostctl2 |= SDHCI_CTRL_VDD_180;
 		break;
 	}
 
@@ -551,16 +553,16 @@ int sdmmc_config_tuning(sdmmc_t *sdmmc, u32 type, u32 cmd)
 	sdmmc->regs->field_1C0 = (sdmmc->regs->field_1C0 & 0xFFFF1FFF) | flag;
 	sdmmc->regs->field_1C0 = (sdmmc->regs->field_1C0 & 0xFFFFE03F) | 0x40;
 	sdmmc->regs->field_1C0 |= 0x20000;
-	sdmmc->regs->hostctl2 |= 0x40;
+	sdmmc->regs->hostctl2  |= SDHCI_CTRL_EXEC_TUNING;
 
 	for (u32 i = 0; i < max; i++)
 	{
 		_sdmmc_config_tuning_once(sdmmc, cmd);
-		if (!(sdmmc->regs->hostctl2 & 0x40))
+		if (!(sdmmc->regs->hostctl2 & SDHCI_CTRL_EXEC_TUNING))
 			break;
 	}
 
-	if (sdmmc->regs->hostctl2 & 0x80)
+	if (sdmmc->regs->hostctl2 & SDHCI_CTRL_TUNED_CLK)
 		return 1;
 	return 0;
 }
@@ -577,14 +579,14 @@ static int _sdmmc_enable_internal_clock(sdmmc_t *sdmmc)
 			return 0;
 	}
 
-	sdmmc->regs->hostctl2 &= 0x7FFF;
-	sdmmc->regs->clkcon &= ~TEGRA_MMC_CLKCON_CLKGEN_SELECT;
-	sdmmc->regs->hostctl2 |= 0x1000;
+	sdmmc->regs->hostctl2 &= ~SDHCI_CTRL_PRESET_VAL_EN;
+	sdmmc->regs->clkcon   &= ~TEGRA_MMC_CLKCON_CLKGEN_SELECT;
+	sdmmc->regs->hostctl2 |= SDHCI_HOST_VERSION_4_EN;
 
 	if (!(sdmmc->regs->capareg & 0x10000000))
 		return 0;
 
-	sdmmc->regs->hostctl2 |= 0x2000;
+	sdmmc->regs->hostctl2 |= SDHCI_ADDRESSING_64BIT_EN;
 	sdmmc->regs->hostctl &= 0xE7;
 	sdmmc->regs->timeoutcon = (sdmmc->regs->timeoutcon & 0xF0) | 0xE;
 
@@ -1076,7 +1078,7 @@ int sdmmc_enable_low_voltage(sdmmc_t *sdmmc)
 	_sdmmc_get_clkcon(sdmmc);
 	sleep(5000);
 	
-	if (sdmmc->regs->hostctl2 & 8)
+	if (sdmmc->regs->hostctl2 & SDHCI_CTRL_VDD_180)
 	{
 		sdmmc->regs->clkcon |= TEGRA_MMC_CLKCON_SD_CLOCK_ENABLE;
 		_sdmmc_get_clkcon(sdmmc);

ipl/sdmmc_driver.h

@@ -45,9 +45,28 @@
 #define SDMMC_RSP_TYPE_5 5
 
 /*! SDMMC mask interrupt status. */
-#define SDMMC_MASKINT_MASKED 0
+#define SDMMC_MASKINT_MASKED   0
 #define SDMMC_MASKINT_NOERROR -1
-#define SDMMC_MASKINT_ERROR -2
+#define SDMMC_MASKINT_ERROR   -2
+
+/*! SDMMC host control 2 */
+#define SDHCI_CTRL_UHS_MASK			0xFFF8
+#define SDHCI_CTRL_VDD_330			0xFFF7
+#define SDHCI_CTRL_VDD_180			8
+#define SDHCI_CTRL_EXEC_TUNING		0x40
+#define SDHCI_CTRL_TUNED_CLK		0x80
+#define SDHCI_HOST_VERSION_4_EN		0x1000
+#define SDHCI_ADDRESSING_64BIT_EN	0x2000
+#define SDHCI_CTRL_PRESET_VAL_EN	0x8000
+
+/*! SD bus speeds. */
+#define UHS_SDR12_BUS_SPEED		0
+#define HIGH_SPEED_BUS_SPEED	1
+#define UHS_SDR25_BUS_SPEED		1
+#define UHS_SDR50_BUS_SPEED		2
+#define UHS_SDR104_BUS_SPEED	3
+#define UHS_DDR50_BUS_SPEED		4
+#define HS400_BUS_SPEED 		5
 
 /*! Helper for SWITCH command argument. */
 #define SDMMC_SWITCH(mode, index, value) (((mode) << 24) | ((index) << 16) | ((value) << 8))

ipl/sdram_lp0.c

@@ -23,7 +23,7 @@
  */
 void sdram_lp0_save_params(const void *params)
 {
-	const struct sdram_params *sdram = (const struct sdram_params *)params;
+	struct sdram_params *sdram = (struct sdram_params *)params;
 	struct tegra_pmc_regs *pmc = (struct tegra_pmc_regs *)PMC_BASE;
 
 #define pack(src, src_bits, dst, dst_bits) { \
@@ -44,6 +44,78 @@ void sdram_lp0_save_params(const void *params)
 /* 32 bits version c macro */
 #define c32(value, pmcreg) pmc->pmcreg = value
 
+	//TODO: pkg1.1 reads them from MC.
+	sdram->McGeneralizedCarveout1Bom = 0;
+	sdram->McGeneralizedCarveout1BomHi = 0;
+	sdram->McGeneralizedCarveout1Size128kb = 0;
+	sdram->McGeneralizedCarveout1Access0 = 0;
+	sdram->McGeneralizedCarveout1Access1 = 0;
+	sdram->McGeneralizedCarveout1Access2 = 0;
+	sdram->McGeneralizedCarveout1Access3 = 0;
+	sdram->McGeneralizedCarveout1Access4 = 0;
+	sdram->McGeneralizedCarveout1ForceInternalAccess0 = 0;
+	sdram->McGeneralizedCarveout1ForceInternalAccess1 = 0;
+	sdram->McGeneralizedCarveout1ForceInternalAccess2 = 0;
+	sdram->McGeneralizedCarveout1ForceInternalAccess3 = 0;
+	sdram->McGeneralizedCarveout1ForceInternalAccess4 = 0;
+	sdram->McGeneralizedCarveout1Cfg0 = 0;
+	sdram->McGeneralizedCarveout2Bom = 0x80020000;
+	sdram->McGeneralizedCarveout2BomHi = 0;
+	sdram->McGeneralizedCarveout2Size128kb = 2;
+	sdram->McGeneralizedCarveout2Access0 = 0;
+	sdram->McGeneralizedCarveout2Access1 = 0;
+	sdram->McGeneralizedCarveout2Access2 = 0x3000000;
+	sdram->McGeneralizedCarveout2Access3 = 0;
+	sdram->McGeneralizedCarveout2Access4 = 0x300;
+	sdram->McGeneralizedCarveout2ForceInternalAccess0 = 0;
+	sdram->McGeneralizedCarveout2ForceInternalAccess1 = 0;
+	sdram->McGeneralizedCarveout2ForceInternalAccess2 = 0;
+	sdram->McGeneralizedCarveout2ForceInternalAccess3 = 0;
+	sdram->McGeneralizedCarveout2ForceInternalAccess4 = 0;
+	sdram->McGeneralizedCarveout2Cfg0 = 0x440167E;
+	sdram->McGeneralizedCarveout3Bom = 0;
+	sdram->McGeneralizedCarveout3BomHi = 0;
+	sdram->McGeneralizedCarveout3Size128kb = 0;
+	sdram->McGeneralizedCarveout3Access0 = 0;
+	sdram->McGeneralizedCarveout3Access1 = 0;
+	sdram->McGeneralizedCarveout3Access2 = 0x3000000;
+	sdram->McGeneralizedCarveout3Access3 = 0;
+	sdram->McGeneralizedCarveout3Access4 = 0x300;
+	sdram->McGeneralizedCarveout3ForceInternalAccess0 = 0;
+	sdram->McGeneralizedCarveout3ForceInternalAccess1 = 0;
+	sdram->McGeneralizedCarveout3ForceInternalAccess2 = 0;
+	sdram->McGeneralizedCarveout3ForceInternalAccess3 = 0;
+	sdram->McGeneralizedCarveout3ForceInternalAccess4 = 0;
+	sdram->McGeneralizedCarveout3Cfg0 = 0x4401E7E;
+	sdram->McGeneralizedCarveout4Bom = 0;
+	sdram->McGeneralizedCarveout4BomHi = 0;
+	sdram->McGeneralizedCarveout4Size128kb = 0;
+	sdram->McGeneralizedCarveout4Access0 = 0;
+	sdram->McGeneralizedCarveout4Access1 = 0;
+	sdram->McGeneralizedCarveout4Access2 = 0;
+	sdram->McGeneralizedCarveout4Access3 = 0;
+	sdram->McGeneralizedCarveout4Access4 = 0;
+	sdram->McGeneralizedCarveout4ForceInternalAccess0 = 0;
+	sdram->McGeneralizedCarveout4ForceInternalAccess1 = 0;
+	sdram->McGeneralizedCarveout4ForceInternalAccess2 = 0;
+	sdram->McGeneralizedCarveout4ForceInternalAccess3 = 0;
+	sdram->McGeneralizedCarveout4ForceInternalAccess4 = 0;
+	sdram->McGeneralizedCarveout4Cfg0 = 0x8F;
+	sdram->McGeneralizedCarveout5Bom = 0;
+	sdram->McGeneralizedCarveout5BomHi = 0;
+	sdram->McGeneralizedCarveout5Size128kb = 0;
+	sdram->McGeneralizedCarveout5Access0 = 0;
+	sdram->McGeneralizedCarveout5Access1 = 0;
+	sdram->McGeneralizedCarveout5Access2 = 0;
+	sdram->McGeneralizedCarveout5Access3 = 0;
+	sdram->McGeneralizedCarveout5Access4 = 0;
+	sdram->McGeneralizedCarveout5ForceInternalAccess0 = 0;
+	sdram->McGeneralizedCarveout5ForceInternalAccess1 = 0;
+	sdram->McGeneralizedCarveout5ForceInternalAccess2 = 0;
+	sdram->McGeneralizedCarveout5ForceInternalAccess3 = 0;
+	sdram->McGeneralizedCarveout5ForceInternalAccess4 = 0;
+	sdram->McGeneralizedCarveout5Cfg0 = 0x8F;
+
 	s(EmcClockSource, 7:0, scratch6, 15:8);
 	s(EmcClockSourceDll, 7:0, scratch6, 23:16);
 	s(EmcClockSource, 31:29, scratch6, 26:24);
@@ -715,7 +787,8 @@ void sdram_lp0_save_params(const void *params)
 	s32(EmcBctSpare5, scratch42);
 	s32(EmcBctSpare4, scratch44);
 	s32(SwizzleRankByteEncode, scratch45);
-	s32(EmcBctSpare2, scratch46);
+	//s32(EmcBctSpare2, scratch46);
+	pmc->scratch46 = 0x40000DD8;
 	s32(EmcBctSpare1, scratch47);
 	s32(EmcBctSpare0, scratch48);
 	s32(EmcBctSpare9, scratch50);
@@ -1004,11 +1077,6 @@ void sdram_lp0_save_params(const void *params)
 	s32(McGeneralizedCarveout5ForceInternalAccess2, secure_scratch106);
 	s32(McGeneralizedCarveout5ForceInternalAccess3, secure_scratch107);
 
-	/* Locking PMC secure scratch register (8 ~ 15) for writing */
-	//c(0x5555, sec_disable2, 15:0);
-	/* Locking PMC secure scratch register (4~ 7) for both reading and writing */
-	//c(0xff, sec_disable, 19:12);
-
 	c32(0, scratch2);
 	s(PllMInputDivider, 7:0, scratch2, 7:0);
 	s(PllMFeedbackDivider, 7:0, scratch2, 15:8);

ipl/tui.c

@@ -27,7 +27,7 @@ void tui_pbar(gfx_con_t *con, int x, int y, u32 val, u32 fgcol, u32 bgcol)
 
 	gfx_con_setpos(con, x, y);
 
-	gfx_printf(con, "%k[%3d%%]%k", fgcol, val, bgcol);
+	gfx_printf(con, "%k[%3d%%]%k", fgcol, val, 0xFFCCCCCC);
 
 	x += 7 * con->fntsz;