1
/*
2
 * Copyright (c) 2018 naehrwert
3
 * Copyright (c) 2022-2024 CTCaer
4
 *
5
 * This program is free software; you can redistribute it and/or modify it
6
 * under the terms and conditions of the GNU General Public License,
7
 * version 2, as published by the Free Software Foundation.
8
 *
9
 * This program is distributed in the hope it will be useful, but WITHOUT
10
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11
 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
12
 * more details.
13
 *
14
 * You should have received a copy of the GNU General Public License
15
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
16
 */
17

18
#ifndef _PKG1_H_
19
#define _PKG1_H_
20

21
#include <bdk.h>
22

23
#define PKG1_MAGIC 0x31314B50
24

25
#define PK11_SECTION_WB 0
26
#define PK11_SECTION_LD 1
27
#define PK11_SECTION_SM 2
28

29
#define PKG1_BOOTLOADER_SIZE          SZ_256K
30
#define PKG1_BOOTLOADER_MAIN_OFFSET   0x100000
31
#define PKG1_BOOTLOADER_BACKUP_OFFSET 0x140000
32
#define PKG1_HOS_KEYBLOBS_OFFSET      0x180000
33

34
#define PKG1_ERISTA_ON_MARIKO_MAGIC 0xE59FD00C // For 4.0.0 Erista and up.
35
#define PKG1_MARIKO_ON_ERISTA_MAGIC 0x40010040 // Mariko pkg1 entrypoint.
36

37
typedef struct _patch_t
38
{
39
	u32 off;
40
	u32 val;
41
} patch_t;
42

43
#define PATCHSET_DEF(name, ...) \
44
	const patch_t name[] = { \
45
		__VA_ARGS__, \
46
		{ 0xFFFFFFFF, 0xFFFFFFFF } \
47
	}
48

49
typedef struct _bl_hdr_t210b01_t
50
{
51
/* 0x000 */	u8  aes_mac[0x10];
52
/* 0x010 */	u8  rsa_sig[0x100];
53
/* 0x110 */	u8  salt[0x20];
54
/* 0x130 */	u8  sha256[0x20];
55
/* 0x150 */	u32 version;
56
/* 0x154 */	u32 size;
57
/* 0x158 */	u32 load_addr;
58
/* 0x15C */	u32 entrypoint;
59
/* 0x160 */	u8  rsvd[0x10];
60
} bl_hdr_t210b01_t;
61

62
typedef struct _pk1_hdr_t
63
{
64
/* 0x00 */	u32 si_sha256; // Secure Init.
65
/* 0x04 */	u32 sm_sha256; // Secure Monitor.
66
/* 0x08 */	u32 sl_sha256; // Secure Loader.
67
/* 0x0C */	u32 unk;       // what's this? It's not warmboot.
68
/* 0x10 */	char timestamp[14];
69
/* 0x1E */	u8 keygen;
70
/* 0x1F */	u8 version;
71
} pk1_hdr_t;
72

73
typedef struct _pkg1_id_t
74
{
75
	const char *id;
76
	u16 kb;
77
	u16 fuses;
78
	u16 tsec_off;
79
	u16 pkg11_off;
80
	u32 secmon_base;
81
	u32 warmboot_base;
82
	const patch_t *secmon_patchset;
83
} pkg1_id_t;
84

85
typedef struct _pk11_hdr_t
86
{
87
	u32 magic;
88
	u32 wb_size;
89
	u32 wb_off;
90
	u32 pad;
91
	u32 ldr_size;
92
	u32 ldr_off;
93
	u32 sm_size;
94
	u32 sm_off;
95
} pk11_hdr_t;
96

97
const pkg1_id_t *pkg1_get_latest();
98
const pkg1_id_t *pkg1_identify(u8 *pkg1);
99
int  pkg1_decrypt(const pkg1_id_t *id, u8 *pkg1);
100
const u8 *pkg1_unpack(void *wm_dst, u32 *wb_sz, void *sm_dst, void *ldr_dst, const pkg1_id_t *id, u8 *pkg1);
101
void pkg1_secmon_patch(void *hos_ctxt, u32 secmon_base, bool t210b01);
102
void pkg1_warmboot_patch(void *hos_ctxt);
103
int  pkg1_warmboot_config(void *hos_ctxt, u32 warmboot_base, u32 fuses_fw, u8 kb);
104
void pkg1_warmboot_rsa_mod(u32 warmboot_base);
105

106
#endif
107

108