1
/*
2
 * Copyright (c) 2018 naehrwert
3
 * Copyright (c) 2018 st4rk
4
 * Copyright (c) 2018-2025 CTCaer
5
 * Copyright (c) 2018 balika011
6
 *
7
 * This program is free software; you can redistribute it and/or modify it
8
 * under the terms and conditions of the GNU General Public License,
9
 * version 2, as published by the Free Software Foundation.
10
 *
11
 * This program is distributed in the hope it will be useful, but WITHOUT
12
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13
 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
14
 * more details.
15
 *
16
 * You should have received a copy of the GNU General Public License
17
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
18
 */
19

20
#include <string.h>
21
#include <stdlib.h>
22

23
#include <bdk.h>
24

25
#include "hos.h"
26
#include "pkg1.h"
27
#include "../config.h"
28
#include <libs/compr/lz4.h>
29

30
extern hekate_config h_cfg;
31

32
// Secmon package2 signature/hash checks patches for Erista.
33
#define SM_100_ADR 0x4002B020 // Original: 0x40014020.
34
PATCHSET_DEF(_secmon_1_patchset,
35
	// Patch the relocator to be able to run from SM_100_ADR.
36
	{ 0x1E0, _ADRP(0, TZRAM_BASE + 0x3000 - _PAGEOFF(SM_100_ADR)) },
37
	// Patch package2 signature/hash checks.
38
	{ 0x9F0 + 0xADC, _NOP() }
39
);
40

41
PATCHSET_DEF(_secmon_2_patchset,
42
	// Patch package2 signature/hash checks.
43
	{ 0xAC8 + 0xAAC, _NOP() }
44
);
45

46
PATCHSET_DEF(_secmon_3_patchset,
47
	// Patch package2 signature/hash checks.
48
	{ 0xAC8 + 0xA30, _NOP() }
49
);
50

51
PATCHSET_DEF(_secmon_4_patchset,
52
	// Patch package2 signature/hash checks.
53
	{ 0x2300 + 0x5EFC, _NOP() }
54
);
55

56
PATCHSET_DEF(_secmon_5_patchset,
57
	// Patch package2 signature/hash checks.
58
	{ 0xDA8 + 0xC9C, _NOP() }
59
);
60

61
PATCHSET_DEF(_secmon_6_patchset,
62
	// Patch package2 signature/hash checks.
63
	{ 0xDC8 + 0xE90, _NOP() }
64
	// Fix sleep mode for debug.
65
	// { 0x1A68 + 0x3854, 0x94000E45 }, //gpio_config_for_uart.
66
	// { 0x1A68 + 0x3858, 0x97FFFC0F }, //clkrst_reboot_uarta.
67
	// { 0x1A68 + 0x385C, 0x52A00021 }, //MOV W1, #0x10000 ; baudrate.
68
	// { 0x1A68 + 0x3860, 0x2A1F03E0 }, //MOV W0, WZR ; uart_port -> A.
69
	// { 0x1A68 + 0x3864, 0x72984001 }, //MOVK W1, #0xC200 ; baudrate.
70
	// { 0x1A68 + 0x3868, 0x94000C8C }, //uart_configure.
71
	// { 0x1A68 + 0x3A6C, _NOP() }      // warmboot UARTA cfg.
72
);
73

74
PATCHSET_DEF(_secmon_62_patchset,
75
	// Patch package2 signature/hash checks.
76
	{ 0xDC8 + 0xC74, _NOP() }
77
	// Fix sleep mode for debug.
78
	// { 0x2AC8 + 0x3854, 0x94000F42 }, //gpio_config_for_uart.
79
	// { 0x2AC8 + 0x3858, 0x97FFFC0F }, //clkrst_reboot_uarta.
80
	// { 0x2AC8 + 0x385C, 0x52A00021 }, //MOV W1, #0x10000 ; baudrate.
81
	// { 0x2AC8 + 0x3860, 0x2A1F03E0 }, //MOV W0, WZR ; uart_port -> A.
82
	// { 0x2AC8 + 0x3864, 0x72984001 }, //MOVK W1, #0xC200 ; baudrate.
83
	// { 0x2AC8 + 0x3868, 0x94000D89 }, //uart_configure.
84
	// { 0x2AC8 + 0x3A6C, _NOP() }      // warmboot UARTA cfg.
85
);
86

87
// Secmon patches for Mariko.
88
#define TZRAM_PROG_ADDR               (TZRAM_BASE + 0x800)
89
#define TZRAM_COMPR_PROG_OFF          0xE04
90
#define TZRAM_PROG_PK2_SIG_PATCH      (TZRAM_PROG_ADDR + 0xC10)
91
#define TZRAM_PROG_PK2_SIG_PATCH_1000 (TZRAM_PROG_ADDR + 0xD70)
92
PATCHSET_DEF(_secmon_6_mariko_patchset,
93
	// Patch package2 decryption and signature/hash checks.
94
	{ 0xDC8 + 0xE94, _NOP() }
95
);
96

97
PATCHSET_DEF(_secmon_620_mariko_patchset,
98
	// Patch package2 decryption and signature/hash checks.
99
	{ 0xDC8 + 0xC78, _NOP() }
100
);
101

102
// From 7.0.0 and above secmon is compressed.
103
PATCHSET_DEF(_secmon_7_mariko_patchset,
104
	// Patch out decompression of program payload.
105
	{ 0x82C, _NOP() }
106
);
107

108
const u16 _secmon_mariko_prog_comp_size[] = {
109
	0x6B03, // 7.0.0.  Patch offset: 0xC10.
110
	0x6B16, // 7.0.1.  Patch offset: 0xC10.
111
	0x6B23, // 8.0.0.  Patch offset: 0xC10.
112
	0x6B84, // 8.1.0.  Patch offset: 0xC10.
113
	0x6C90, // 9.0.0.  Patch offset: 0xC10.
114
	0x6CE5, // 9.1.0.  Patch offset: 0xC10.
115
	0x6EE9, // 10.0.0. Patch offset: 0xD70.
116
};
117

118
// Erista fuse check warmboot patches.
119
#define _NOPv7() 0xE320F000
120
PATCHSET_DEF(_warmboot_1_patchset,
121
	{ 0x4DC, _NOPv7() } // Fuse check.
122
);
123

124
PATCHSET_DEF(_warmboot_3_patchset,
125
	{ 0x4DC, _NOPv7() }, // Fuse check.
126
	{ 0x4F0, _NOPv7() }  // Segment id check.
127
);
128

129
PATCHSET_DEF(_warmboot_4_patchset,
130
	{ 0x544, _NOPv7() }, // Fuse check.
131
	{ 0x558, _NOPv7() }  // Segment id check.
132
);
133

134
/*
135
 * package1.1 header: <wb, ldr, sm>
136
 * package1.1 layout:
137
 * 1.0:  {sm, ldr, wb} { 2, 1, 0 }
138
 * 2.0+: {wb, ldr, sm} { 0, 1, 2 }
139
 * 4.0+: {ldr, sm, wb} { 1, 2, 0 }
140
 */
141

142
static const u8 sec_map_100[3] = { PK11_SECTION_SM, PK11_SECTION_LD, PK11_SECTION_WB };
143
static const u8 sec_map_2xx[3] = { PK11_SECTION_WB, PK11_SECTION_LD, PK11_SECTION_SM };
144
static const u8 sec_map_4xx[3] = { PK11_SECTION_LD, PK11_SECTION_SM, PK11_SECTION_WB };
145

146
	// Timestamp  KB  FU   TSEC    PK11     SECMON     Warmboot
147
static const pkg1_id_t _pkg1_ids[] = {
148
	{ "20161121",  0,  1, 0x1900, 0x3FE0, SM_100_ADR, 0x8000D000, _secmon_1_patchset }, // 1.0.0 (Patched relocator).
149
	{ "20170210",  0,  2, 0x1900, 0x3FE0, 0x4002D000, 0x8000D000, _secmon_2_patchset }, // 2.0.0 - 2.3.0.
150
	{ "20170519",  1,  3, 0x1A00, 0x3FE0, 0x4002D000, 0x8000D000, _secmon_3_patchset }, // 3.0.0.
151
	{ "20170710",  2,  4, 0x1A00, 0x3FE0, 0x4002D000, 0x8000D000, _secmon_3_patchset }, // 3.0.1 - 3.0.2.
152
	{ "20170921",  3,  5, 0x1800, 0x3FE0, 0x4002B000, 0x4003B000, _secmon_4_patchset }, // 4.0.0 - 4.1.0.
153
	{ "20180220",  4,  6, 0x1900, 0x3FE0, 0x4002B000, 0x4003B000, _secmon_5_patchset }, // 5.0.0 - 5.1.0.
154
	{ "20180802",  5,  7, 0x1900, 0x3FE0, 0x4002B000, 0x4003D800, _secmon_6_patchset }, // 6.0.0 - 6.1.0.
155
	{ "20181107",  6,  8, 0x0E00, 0x6FE0, 0x4002B000, 0x4003D800, _secmon_62_patchset}, // 6.2.0.
156
	{ "20181218",  7,  9, 0x0F00, 0x6FE0, 0x40030000, 0x4003E000, NULL }, //  7.0.0.
157
	{ "20190208",  7,  9, 0x0F00, 0x6FE0, 0x40030000, 0x4003E000, NULL }, //  7.0.1.
158
	{ "20190314",  7,  9, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL }, //  8.0.0 - 8.0.1.
159
	{ "20190531",  8, 10, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL }, //  8.1.0 - 8.1.1.
160
	{ "20190809",  9, 11, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL }, //  9.0.0 - 9.0.1.
161
	{ "20191021", 10, 12, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL }, //  9.1.0 - 9.2.0.
162
	{ "20200303", 10, 13, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL }, // 10.0.0 - 10.2.0.
163
	{ "20201030", 10, 14, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL }, // 11.0.0 - 11.0.1.
164
	{ "20210129", 10, 14, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL }, // 12.0.0 - 12.0.1.
165
	{ "20210422", 10, 15, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL }, // 12.0.2 - 12.0.3.
166
	{ "20210607", 11, 15, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL }, // 12.1.0.
167
	{ "20210805", 12, 15, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL }, // 13.0.0 - 13.2.0.
168
	{ "20220105", 12, 16, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL }, // 13.2.1.
169
	{ "20220209", 13, 16, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL }, // 14.0.0 - 14.1.2.
170
	{ "20220801", 14, 17, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL }, // 15.0.0 - 15.0.1.
171
	{ "20230111", 15, 18, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL }, // 16.0.0 - 16.1.0.
172
	{ "20230906", 16, 19, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL }, // 17.0.0 - 17.0.1.
173
	{ "20240207", 17, 19, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL }, // 18.0.0 - 18.1.0.
174
	{ "20240808", 18, 20, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL }, // 19.0.0 - 19.0.1.
175
	{ "20250206", 19, 21, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL }, // 20.0.0+
176
};
177

178
const pkg1_id_t *pkg1_get_latest()
179
{
180
	return &_pkg1_ids[ARRAY_SIZE(_pkg1_ids) - 1];
181
}
182

183
const pkg1_id_t *pkg1_identify(u8 *pkg1)
184
{
185
	char build_date[15];
186
	pk1_hdr_t *hdr = (pk1_hdr_t *)pkg1;
187

188
	memcpy(build_date, hdr->timestamp, 14);
189
	build_date[14] = 0;
190
	gfx_printf("Found pkg1 ('%s').\n\n", build_date);
191

192
	for (int i = ARRAY_SIZE(_pkg1_ids) - 1; i >= 0; i--)
193
		if (!memcmp(hdr->timestamp, _pkg1_ids[i].id, 8))
194
			return &_pkg1_ids[i];
195

196
	return NULL;
197
}
198

199
int pkg1_decrypt(const pkg1_id_t *id, u8 *pkg1)
200
{
201
	pk11_hdr_t *hdr;
202

203
	// Decrypt package1.
204
	if (!h_cfg.t210b01)
205
	{
206
		u8 *pkg11 = pkg1 + id->pkg11_off;
207
		u32 pkg11_size = *(u32 *)pkg11;
208
		hdr = (pk11_hdr_t *)(pkg11 + 0x20);
209
		se_aes_crypt_ctr(11, hdr, pkg11_size, hdr, pkg11_size, pkg11 + 0x10);
210
	}
211
	else
212
	{
213
		bl_hdr_t210b01_t *oem_hdr = (bl_hdr_t210b01_t *)pkg1;
214
		pkg1 += sizeof(bl_hdr_t210b01_t);
215
		hdr = (pk11_hdr_t *)(pkg1 + id->pkg11_off + 0x20);
216

217
		// Use BEK for T210B01.
218
		// Additionally, skip 0x20 bytes from decryption to maintain the header.
219
		se_aes_iv_clear(13);
220
		se_aes_crypt_cbc(13, DECRYPT, pkg1 + 0x20, oem_hdr->size - 0x20, pkg1 + 0x20, oem_hdr->size - 0x20);
221
	}
222

223
	// Return if header is valid.
224
	return (hdr->magic == PKG1_MAGIC);
225
}
226

227
const u8 *pkg1_unpack(void *wm_dst, u32 *wb_sz, void *sm_dst, void *ldr_dst, const pkg1_id_t *id, u8 *pkg1)
228
{
229
	const u8 *sec_map;
230
	const pk11_hdr_t *hdr = (pk11_hdr_t *)(pkg1 + id->pkg11_off + 0x20);
231

232
	u32 sec_size[3] = { hdr->wb_size, hdr->ldr_size, hdr->sm_size };
233

234
	// Get correct header mapping.
235
	if (id->fuses == 1)                        // 1.0.0.
236
		sec_map = sec_map_100;
237
	else if (id->fuses >= 2 && id->fuses <= 4) // 2.0.0 - 3.0.2.
238
		sec_map = sec_map_2xx;
239
	else                                       // 4.0.0+
240
		sec_map = sec_map_4xx;
241

242
	// Copy secmon, warmboot and nx bootloader payloads.
243
	u8 *pdata = (u8 *)hdr + sizeof(pk11_hdr_t);
244
	for (u32 i = 0; i < 3; i++)
245
	{
246
		u32 ssize = sec_size[sec_map[i]];
247
		switch (sec_map[i])
248
		{
249
		case PK11_SECTION_WB:
250
			if (wm_dst)
251
				memcpy(wm_dst,  pdata, ssize);
252
			if (wb_sz)
253
				*wb_sz = ssize;
254
			break;
255
		case PK11_SECTION_LD:
256
			if (ldr_dst)
257
				memcpy(ldr_dst, pdata, ssize);
258
			break;
259
		case PK11_SECTION_SM:
260
			if (sm_dst)
261
				memcpy(sm_dst,  pdata, ssize);
262
			break;
263
		}
264
		pdata += ssize;
265
	}
266

267
	return sec_map;
268
}
269

270
void pkg1_secmon_patch(void *hos_ctxt, u32 secmon_base, bool t210b01)
271
{
272
	const patch_t *secmon_patchset;
273
	launch_ctxt_t *ctxt = (launch_ctxt_t *)hos_ctxt;
274

275
	// Patch Secmon to allow for an unsigned package2 and patched kernel.
276
	if (!t210b01 && ctxt->pkg1_id->secmon_patchset)
277
	{
278
		// For T210 till 6.2.0 the patching is used as is, because of no compression.
279
		secmon_patchset = ctxt->pkg1_id->secmon_patchset;
280
	}
281
#ifdef HOS_MARIKO_STOCK_SECMON
282
	else if (t210b01)
283
	{
284
		// For T210B01 we patch 6.X.X as is. Otherwise we decompress the program payload.
285
		if (ctxt->pkg1_id->kb == HOS_KB_VERSION_600)
286
			secmon_patchset = _secmon_6_mariko_patchset;
287
		else if (ctxt->pkg1_id->kb == HOS_KB_VERSION_620)
288
			secmon_patchset = _secmon_620_mariko_patchset;
289
		else
290
		{
291
			// Patch uncompress of program payload clear TZRAM.
292
			secmon_patchset = _secmon_7_mariko_patchset;
293
			memset((void *)TZRAM_PROG_ADDR, 0, 0x38800);
294

295
			// Get size of compressed program payload and set patch offset.
296
			u32 idx = ctxt->pkg1_id->kb - HOS_KB_VERSION_700;
297
			u32 patch_offset = TZRAM_PROG_PK2_SIG_PATCH;
298
			if (ctxt->pkg1_id->kb > HOS_KB_VERSION_910 || !memcmp(ctxt->pkg1_id->id, "20200303", 8)) //TODO: Add 11.0.0 support.
299
			{
300
				idx++;
301
				patch_offset = TZRAM_PROG_PK2_SIG_PATCH_1000;
302
			}
303

304
			// Uncompress directly to TZRAM.
305
			LZ4_decompress_fast((const char*)(secmon_base + TZRAM_COMPR_PROG_OFF),
306
				(char *)TZRAM_PROG_ADDR, _secmon_mariko_prog_comp_size[idx]);
307

308
			// Patch package2 signature/hash checks.
309
			*(vu32 *)patch_offset = _NOP();
310
		}
311
	}
312
#endif
313
	else
314
		return;
315

316
	// Patch Secmon.
317
	gfx_printf("%kPatching Secure Monitor%k\n", TXT_CLR_ORANGE, TXT_CLR_DEFAULT);
318
	for (u32 i = 0; secmon_patchset[i].off != 0xFFFFFFFF; i++)
319
		*(vu32 *)(secmon_base + secmon_patchset[i].off) = secmon_patchset[i].val;
320
}
321

322
void pkg1_warmboot_patch(void *hos_ctxt)
323
{
324
	launch_ctxt_t *ctxt = (launch_ctxt_t *)hos_ctxt;
325
	const patch_t *warmboot_patchset;
326

327
	// Patch warmboot on T210 to allow downgrading.
328
	switch (ctxt->pkg1_id->kb)
329
	{
330
	case 0:
331
		warmboot_patchset = _warmboot_1_patchset;
332
		break;
333
	case 1 ... 2:
334
		warmboot_patchset = _warmboot_3_patchset;
335
		break;
336
	default: // 4.0.0 - 6.2.0.
337
		warmboot_patchset = _warmboot_4_patchset;
338
		break;
339
	}
340
	gfx_printf("%kPatching Warmboot%k\n", TXT_CLR_ORANGE, TXT_CLR_DEFAULT);
341
	for (u32 i = 0; warmboot_patchset[i].off != 0xFFFFFFFF; i++)
342
		*(vu32 *)(ctxt->pkg1_id->warmboot_base + warmboot_patchset[i].off) = warmboot_patchset[i].val;
343
}
344

345
static void _warmboot_filename(char *out, u32 fuses)
346
{
347
	if (fuses < 16)
348
	{
349
		out[19] = '0';
350
		itoa(fuses, &out[19 + 1], 16);
351
	}
352
	else
353
		itoa(fuses, &out[19], 16);
354
	strcat(out, ".bin");
355
}
356

357
int pkg1_warmboot_config(void *hos_ctxt, u32 warmboot_base, u32 fuses_fw, u8 kb)
358
{
359
	launch_ctxt_t *ctxt = (launch_ctxt_t *)hos_ctxt;
360
	int res = 1;
361

362
	if (h_cfg.t210b01)
363
	{
364
		u32 pa_id;
365
		u32 fuses_max = 32; // Current ODM7 max.
366
		u8  burnt_fuses = bit_count(fuse_read_odm(7));
367

368
		// Save current warmboot in storage cache (MWS) and check if another one is needed.
369
		if (!ctxt->warmboot)
370
		{
371
			char path[128];
372
			strcpy(path, "warmboot_mariko/wb_");
373
			_warmboot_filename(path, fuses_fw);
374

375
			// Check if warmboot fw exists and save it.
376
			if (ctxt->warmboot_size && f_stat(path, NULL))
377
			{
378
				f_mkdir("warmboot_mariko");
379
				sd_save_to_file((void *)warmboot_base, ctxt->warmboot_size, path);
380
			}
381

382
			// Load warmboot fw from storage (MWS) if not matched.
383
			if (burnt_fuses > fuses_fw)
384
			{
385
				u32 tmp_fuses = burnt_fuses;
386
				while (true)
387
				{
388
					_warmboot_filename(path, burnt_fuses);
389
					if (!f_stat(path, NULL))
390
					{
391
						ctxt->warmboot = sd_file_read(path, &ctxt->warmboot_size);
392
						burnt_fuses = tmp_fuses;
393
						break;
394
					}
395
					if (tmp_fuses >= fuses_max)
396
						break;
397
					tmp_fuses++;
398
				}
399

400
				// Check if proper warmboot firmware was not found.
401
				if (!ctxt->warmboot)
402
					res = 0;
403
			}
404
			else // Replace burnt fuses with higher count.
405
				burnt_fuses = fuses_fw;
406
		}
407

408
		// Configure Warmboot parameters. Anything lower is not supported.
409
		switch (burnt_fuses)
410
		{
411
		case 7 ... 8:
412
			pa_id = 0x21 * (burnt_fuses - 3) + 3;
413
			break;
414
		default: // From 7.0.0 and up PA id is 0x21 multiplied with fuses.
415
			pa_id = 0x21 * burnt_fuses;
416
			break;
417
		}
418

419
		// Set Warmboot Physical Address ID and lock SECURE_SCRATCH32 register.
420
		PMC(APBDEV_PMC_SECURE_SCRATCH32) = pa_id;
421
		PMC(APBDEV_PMC_SEC_DISABLE3) |= BIT(16);
422
	}
423
	else
424
	{
425
		// Set warmboot address in PMC if required.
426
		if (kb <= HOS_KB_VERSION_301)
427
			PMC(APBDEV_PMC_SCRATCH1) = warmboot_base;
428

429
		// Set Warmboot Physical Address ID for 3.0.0 - 3.0.2.
430
		if (kb == HOS_KB_VERSION_300)
431
			PMC(APBDEV_PMC_SECURE_SCRATCH32) = 0xE3;  // Warmboot 3.0.0 PA address id.
432
		else if (kb == HOS_KB_VERSION_301)
433
			PMC(APBDEV_PMC_SECURE_SCRATCH32) = 0x104; // Warmboot 3.0.1/.2 PA address id.
434
	}
435

436
	return res;
437
}
438

439
void pkg1_warmboot_rsa_mod(u32 warmboot_base)
440
{
441
	// Set warmboot binary rsa modulus.
442
	u8 *rsa_mod = (u8 *)malloc(EMMC_BLOCKSIZE);
443

444
	emmc_set_partition(EMMC_BOOT0);
445

446
	u32 sector;
447
	u8  mod0, mod1;
448

449
	// Get the correct RSA modulus byte masks.
450
	nx_emmc_get_autorcm_masks(&mod0, &mod1);
451

452
	// Iterate BCTs.
453
	for (u32 i = 0; i < 4; i++)
454
	{
455
		sector = 1 + (32 * i); // 0x4000 bct + 0x200 offset.
456
		sdmmc_storage_read(&emmc_storage, sector, 1, rsa_mod);
457

458
		// Check if 2nd byte of modulus is correct.
459
		if (rsa_mod[0x11] != mod1)
460
			continue;
461

462
		// Patch AutoRCM out.
463
		rsa_mod[0x10] = mod0;
464

465
		break;
466
	}
467

468
	memcpy((void *)(warmboot_base + 0x10), rsa_mod + 0x10, 0x100);
469
}
470

471