Add back transmitter_control.

2026-07-15 21:42:27 +00:00 · 2026-06-30 10:54:41 +02:00
parent 975e57ccd2
commit e727a2fc3b
9 changed files with 69 additions and 34 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,5 @@
 bin/
+shellcode_0607/shellcode_0607.h
 shellcode_kernel/shellcode_kernel.h
 shellcode_hv/shellcode_hv.h
 *.elf
--- a/include/offsets.h
+++ b/include/offsets.h
@@ -44,6 +44,7 @@ typedef struct _offset_list {
  uint64_t KERNEL_CFI_CHECK;
  /* Internal functions to prepare boot */
  uint64_t G_VBIOS;
+  uint64_t FUN_TRANSMITTER_CONTROL;
  uint64_t FUN_MP3_INITIALIZE;
  uint64_t FUN_MP3_INVOKE;
  /* Wifi FW */
--- a/shellcode_0607/shellcode_0607.h
+++ b/shellcode_0607/shellcode_0607.h
@@ -1,34 +0,0 @@
-unsigned char shellcode_0607_bin[] = {
-  0x4c, 0x8b, 0x2c, 0x25, 0xa0, 0xe1, 0x82, 0x62, 0x48, 0x8b, 0x04, 0x25,
-  0xb8, 0xe1, 0x82, 0x62, 0x31, 0xdb, 0x48, 0x8d, 0xb8, 0x60, 0x6e, 0x02,
-  0x00, 0x4c, 0x89, 0xee, 0xe8, 0x9f, 0x00, 0x00, 0x00, 0x48, 0x89, 0xc5,
-  0x66, 0x66, 0x2e, 0x0f, 0x1f, 0x84, 0x00, 0x00, 0x00, 0x00, 0x00, 0x90,
-  0x48, 0x8b, 0x7d, 0x00, 0x4c, 0x89, 0xee, 0xe8, 0x84, 0x00, 0x00, 0x00,
-  0x4c, 0x89, 0xee, 0x48, 0x8b, 0x78, 0x08, 0x49, 0x89, 0xc4, 0xe8, 0x75,
-  0x00, 0x00, 0x00, 0x85, 0xdb, 0x74, 0x19, 0x83, 0xc3, 0x01, 0x48, 0x83,
-  0xa0, 0x90, 0x00, 0x00, 0x00, 0xfe, 0x83, 0xfb, 0x10, 0x74, 0x29, 0x48,
-  0x83, 0xc5, 0x08, 0xeb, 0xcb, 0x0f, 0x1f, 0x00, 0xba, 0x00, 0x09, 0xe0,
-  0xfe, 0x48, 0x83, 0xc5, 0x08, 0xbb, 0x01, 0x00, 0x00, 0x00, 0x49, 0x89,
-  0x94, 0x24, 0xe8, 0x00, 0x00, 0x00, 0x48, 0x83, 0xa0, 0x90, 0x00, 0x00,
-  0x00, 0xfe, 0xeb, 0xa8, 0xbe, 0x00, 0x09, 0xe0, 0xfe, 0xbf, 0x1b, 0x00,
-  0x00, 0x00, 0xe8, 0xc9, 0x00, 0x00, 0x00, 0x48, 0x8b, 0x04, 0x25, 0x20,
-  0xe1, 0x82, 0x62, 0xbf, 0x01, 0x01, 0x00, 0xc0, 0x48, 0x8d, 0xb0, 0x00,
-  0x10, 0x00, 0x00, 0xe8, 0xb0, 0x00, 0x00, 0x00, 0xb8, 0x80, 0x63, 0x80,
-  0x62, 0xff, 0xd0, 0xeb, 0xfe, 0x0f, 0x1f, 0x80, 0x00, 0x00, 0x00, 0x00,
-  0x48, 0x89, 0xf8, 0x81, 0xe6, 0x00, 0xf0, 0xff, 0xff, 0x48, 0xc1, 0xe8,
-  0x27, 0x25, 0xff, 0x01, 0x00, 0x00, 0x48, 0x8b, 0x14, 0xc6, 0x48, 0x89,
-  0xd0, 0x83, 0xe0, 0x01, 0x74, 0x72, 0xb9, 0x1e, 0x00, 0x00, 0x00, 0x31,
-  0xf6, 0x49, 0xb8, 0x00, 0xf0, 0xff, 0xff, 0xff, 0xff, 0x0f, 0x00, 0x48,
-  0x89, 0xf8, 0x4c, 0x21, 0xc2, 0x48, 0xd3, 0xe8, 0x25, 0xff, 0x01, 0x00,
-  0x00, 0x48, 0x8b, 0x14, 0xc2, 0x48, 0x89, 0xd0, 0x83, 0xe0, 0x01, 0x74,
-  0x47, 0x83, 0xfe, 0x02, 0x75, 0x12, 0x4c, 0x21, 0xc2, 0x81, 0xe7, 0xff,
-  0x0f, 0x00, 0x00, 0x48, 0x89, 0xd0, 0x48, 0x09, 0xf8, 0xc3, 0x66, 0x90,
-  0x83, 0xc6, 0x01, 0x83, 0xe9, 0x09, 0xf6, 0xc2, 0x80, 0x74, 0xc4, 0x83,
-  0xfe, 0x01, 0xb9, 0xff, 0xff, 0xff, 0x3f, 0xb8, 0xff, 0xff, 0x1f, 0x00,
-  0x48, 0x0f, 0x44, 0xc1, 0x48, 0xb9, 0x00, 0xf0, 0xff, 0xff, 0xff, 0xff,
-  0x0f, 0x00, 0x48, 0x21, 0xca, 0x48, 0x21, 0xf8, 0x48, 0x09, 0xd0, 0xc3,
-  0xc3, 0x66, 0x66, 0x2e, 0x0f, 0x1f, 0x84, 0x00, 0x00, 0x00, 0x00, 0x00,
-  0x0f, 0x1f, 0x40, 0x00, 0x48, 0x89, 0xf2, 0x48, 0x89, 0xf0, 0x89, 0xf9,
-  0x48, 0xc1, 0xea, 0x20, 0x0f, 0x30, 0xc3
-};
-unsigned int shellcode_0607_bin_len = 367;
--- a/shellcode_kernel/boot_linux.c
+++ b/shellcode_kernel/boot_linux.c
@@ -4,6 +4,12 @@
 #include "../shellcode_hv/shellcode_hv.h"
 #include "utils.h"

+#define DIG1TRANSMITTERCONTROL 0x4c
+
+#define TRANSMITTER_CONTROL_ENABLE 1
+#define TRANSMITTER_CONTROL_SET_VOLTAGE_AND_PREEMPASIS 11
+
+int (*transmitter_control)(int cmd, void *control) = NULL;
 int (*mp3_initialize)(int vmid) = NULL;
 int (*mp3_invoke)(int cmd_id, void *req, void *rsp) = NULL;

@@ -28,6 +34,30 @@ typedef struct {
  uint8_t reserved[64];
 } __attribute__((packed)) SceSblHvShm;

+typedef struct {
+  uint8_t lanenum;
+  uint32_t rate;
+  uint32_t pad;
+  uint32_t lane_setting_1;
+  uint32_t lane_setting_2;
+} transmitter_args;
+
+struct dig_transmitter_control_parameters_v1_6 {
+  uint8_t phyid;
+  uint8_t action;
+  union {
+    uint8_t digmode;
+    uint8_t dplaneset;
+  } mode_laneset;
+  uint8_t lanenum;
+  uint32_t symclk_10khz;
+  uint8_t hpdsel;
+  uint8_t digfe_sel;
+  uint8_t connobj_id;
+  uint8_t reserved;
+  uint32_t reserved1;
+};
+
 static struct linux_info info;

 static int mp3_req[1281], mp3_rsp[1282];
@@ -55,6 +85,20 @@ static uint64_t get_hv_shm(void) {
  return -1;
 }

+static int dp_enable_link_phy(int lanenum, int linkrate) {
+  struct dig_transmitter_control_parameters_v1_6 params = {};
+  params.phyid = 0;
+  params.action = TRANSMITTER_CONTROL_ENABLE;
+  params.mode_laneset.digmode = 0;
+  params.lanenum = lanenum;
+  params.symclk_10khz = 27000 * linkrate / 10;
+  params.hpdsel = 0;
+  params.digfe_sel = 0;
+  params.connobj_id = 0;
+
+  return transmitter_control(DIG1TRANSMITTERCONTROL, &params);
+}
+
 static int mp3_set_hdcp_packet(int be, int mode) {
  mp3_req[0] = be;
  mp3_req[1] = mode;
@@ -132,6 +176,9 @@ void boot_linux(void) {

  memcpy((void *)PHYS_TO_DMAP(0xC0000), (void *)g_vbios, 0x10000);

+  // Enable DP phys link.
+  dp_enable_link_phy(4, 30);
+
  // Initialize hdcp in mp3.
  mp3_initialize(0);
  mp3_set_hdcp_packet(0, 1);
--- a/shellcode_kernel/shellcode_kernel_args.h
+++ b/shellcode_kernel/shellcode_kernel_args.h
@@ -14,6 +14,7 @@ typedef struct {
  uint64_t fun_hv_iommu_wait_completion;
  uint64_t fun_smp_rendezvous;
  uint64_t fun_smp_no_rendevous_barrier;
+  uint64_t fun_transmitter_control;
  uint64_t fun_mp3_initialize;
  uint64_t fun_mp3_invoke;
  uint64_t g_vbios;
--- a/shellcode_kernel/utils.c
+++ b/shellcode_kernel/utils.c
@@ -104,6 +104,7 @@ void init_global_pointers(volatile shellcode_kernel_args *args_ptr) {
  smp_no_rendevous_barrier =
      (void (*)(void *))args.fun_smp_no_rendevous_barrier;

+  transmitter_control = (int (*)(int, void *))args.fun_transmitter_control;
  mp3_initialize = (int (*)(int))args.fun_mp3_initialize;
  mp3_invoke = (int (*)(int, void *, void *))args.fun_mp3_invoke;
  g_vbios = args.g_vbios;
--- a/shellcode_kernel/utils.h
+++ b/shellcode_kernel/utils.h
@@ -8,6 +8,7 @@ extern void (*smp_rendezvous)(void (*setup_func)(void *),
                              void (*action_func)(void *),
                              void (*teardown_func)(void *), void *arg);
 extern void (*smp_no_rendevous_barrier)(void *);
+extern int (*transmitter_control)(int cmd, void *control);
 extern int (*mp3_initialize)(int vmid);
 extern int (*mp3_invoke)(int cmd_id, void *req, void *rsp);
 extern uint64_t g_vbios;
--- a/source/offsets.c
+++ b/source/offsets.c
@@ -19,6 +19,7 @@ offset_list off_0300 = {
    .KERNEL_UART_OVERRIDE = 0x1EB0258,
    .KERNEL_CFI_CHECK = 0x0441DD0,
    .G_VBIOS = 0x0734B5D0,
+    .FUN_TRANSMITTER_CONTROL = 0x0B2A560,
    .FUN_MP3_INITIALIZE = 0x0953890,
    .FUN_MP3_INVOKE = 0x0952670,
    .PS5_WIFI_FW_OFFSET = 0x1274460,
@@ -42,6 +43,7 @@ offset_list off_0310 = {
    .KERNEL_UART_OVERRIDE = 0x1EB0258,
    .KERNEL_CFI_CHECK = 0x0441E10,
    .G_VBIOS = 0x0734B5D0,
+    .FUN_TRANSMITTER_CONTROL = 0x0B2A5A0,
    .FUN_MP3_INITIALIZE = 0x09538D0,
    .FUN_MP3_INVOKE = 0x09526B0,
    .PS5_WIFI_FW_OFFSET = 0x1274490,
@@ -65,6 +67,7 @@ offset_list off_0320 = {
    .KERNEL_UART_OVERRIDE = 0x1EB0258,
    .KERNEL_CFI_CHECK = 0x442160,
    .G_VBIOS = 0x734B5D0,
+    .FUN_TRANSMITTER_CONTROL = 0xB2AA60,
    .FUN_MP3_INITIALIZE = 0x953D30,
    .FUN_MP3_INVOKE = 0x952B10,
    .PS5_WIFI_FW_OFFSET = 0x1274550,
@@ -88,6 +91,7 @@ offset_list off_0321 = {
    .KERNEL_UART_OVERRIDE = 0x1EB0258,
    .KERNEL_CFI_CHECK = 0x442160,
    .G_VBIOS = 0x734B5D0,
+    .FUN_TRANSMITTER_CONTROL = 0xB2AA60,
    .FUN_MP3_INITIALIZE = 0x953D30,
    .FUN_MP3_INVOKE = 0x952B10,
    .PS5_WIFI_FW_OFFSET = 0x1274550,
@@ -111,6 +115,7 @@ offset_list off_0400 = {
    .KERNEL_UART_OVERRIDE = 0x1F522A8,
    .KERNEL_CFI_CHECK = 0x45A170,
    .G_VBIOS = 0x72B7630,
+    .FUN_TRANSMITTER_CONTROL = 0xB5AD50,
    .FUN_MP3_INITIALIZE = 0x9805C0,
    .FUN_MP3_INVOKE = 0x97F3E0,
    .PS5_WIFI_FW_OFFSET = 0x1392FB0,
@@ -134,6 +139,7 @@ offset_list off_0402 = {
    .KERNEL_UART_OVERRIDE = 0x1F522A8,
    .KERNEL_CFI_CHECK = 0x45A170,
    .G_VBIOS = 0x72B7630,
+    .FUN_TRANSMITTER_CONTROL = 0xB5ADA0,
    .FUN_MP3_INITIALIZE = 0x980610,
    .FUN_MP3_INVOKE = 0x97F430,
    .PS5_WIFI_FW_OFFSET = 0x1392FB0,
@@ -157,6 +163,7 @@ offset_list off_0403 = {
    .KERNEL_UART_OVERRIDE = 0x1F522A8,
    .KERNEL_CFI_CHECK = 0x45A170,
    .G_VBIOS = 0x72B7630,
+    .FUN_TRANSMITTER_CONTROL = 0xB5AE30,
    .FUN_MP3_INITIALIZE = 0x9806A0,
    .FUN_MP3_INVOKE = 0x97F4C0,
    .PS5_WIFI_FW_OFFSET = 0x1392FB0,
@@ -180,6 +187,7 @@ offset_list off_0450 = {
    .KERNEL_UART_OVERRIDE = 0x1F522A8,
    .KERNEL_CFI_CHECK = 0x45A1A0,
    .G_VBIOS = 0x72B7630,
+    .FUN_TRANSMITTER_CONTROL = 0xB5AFF0,
    .FUN_MP3_INITIALIZE = 0x980850,
    .FUN_MP3_INVOKE = 0x97F670,
    .PS5_WIFI_FW_OFFSET = 0x1392FC0,
@@ -203,6 +211,7 @@ offset_list off_0451 = {
    .KERNEL_UART_OVERRIDE = 0x1F522A8,
    .KERNEL_CFI_CHECK = 0x45A1A0,
    .G_VBIOS = 0x72B7630,
+    .FUN_TRANSMITTER_CONTROL = 0xB5B420,
    .FUN_MP3_INITIALIZE = 0x980BF0,
    .FUN_MP3_INVOKE = 0x97FA10,
    .PS5_WIFI_FW_OFFSET = 0x1393000,
@@ -243,6 +252,7 @@ offset_list off_0500 = {
    .KERNEL_UART_OVERRIDE = (0xFFFFFFFF82291378 - KERNEL_TEXT),
    .KERNEL_CFI_CHECK = (0xFFFFFFFF80677FB0 - KERNEL_TEXT),
    .G_VBIOS = (0xFFFFFFFF87673A50 - KERNEL_TEXT),
+    .FUN_TRANSMITTER_CONTROL = (0xFFFFFFFF80DA0AB0 - KERNEL_TEXT),
    .FUN_MP3_INITIALIZE = (0xFFFFFFFF80BC0440 - KERNEL_TEXT),
    .FUN_MP3_INVOKE = (0xFFFFFFFF80BBF160 - KERNEL_TEXT),
    .PS5_WIFI_FW_OFFSET = (0xFFFFFFFF8163E2B0 - KERNEL_TEXT),
@@ -283,6 +293,7 @@ offset_list off_0502 = {
    .KERNEL_UART_OVERRIDE = (0xFFFFFFFF82291378 - KERNEL_TEXT),
    .KERNEL_CFI_CHECK = (0xFFFFFFFF80677FB0 - KERNEL_TEXT),
    .G_VBIOS = (0xFFFFFFFF87673A50 - KERNEL_TEXT),
+    .FUN_TRANSMITTER_CONTROL = (0xFFFFFFFF80DA0AB0 - KERNEL_TEXT),
    .FUN_MP3_INITIALIZE = (0xFFFFFFFF80BC0440 - KERNEL_TEXT),
    .FUN_MP3_INVOKE = (0xFFFFFFFF80BBF160 - KERNEL_TEXT),
    .PS5_WIFI_FW_OFFSET = (0xFFFFFFFF8163E2B0 - KERNEL_TEXT),
@@ -323,6 +334,7 @@ offset_list off_0510 = {
    .KERNEL_UART_OVERRIDE = (0xFFFFFFFF82291378 - KERNEL_TEXT),
    .KERNEL_CFI_CHECK = (0xFFFFFFFF80677FB0 - KERNEL_TEXT),
    .G_VBIOS = (0xFFFFFFFF87673A50 - KERNEL_TEXT),
+    .FUN_TRANSMITTER_CONTROL = (0xFFFFFFFF80DA0DE0 - KERNEL_TEXT),
    .FUN_MP3_INITIALIZE = (0xFFFFFFFF80BC0690 - KERNEL_TEXT),
    .FUN_MP3_INVOKE = (0xFFFFFFFF80BBF3B0 - KERNEL_TEXT),
    .PS5_WIFI_FW_OFFSET = (0xFFFFFFFF8163E670 - KERNEL_TEXT),
@@ -363,6 +375,7 @@ offset_list off_0550 = {
    .KERNEL_UART_OVERRIDE = (0xFFFFFFFF82291488 - KERNEL_TEXT),
    .KERNEL_CFI_CHECK = (0xFFFFFFFF80678060 - KERNEL_TEXT),
    .G_VBIOS = (0xFFFFFFFF87673A50 - KERNEL_TEXT),
+    .FUN_TRANSMITTER_CONTROL = (0xFFFFFFFF80DA1BD0 - KERNEL_TEXT),
    .FUN_MP3_INITIALIZE = (0xFFFFFFFF80BC1480 - KERNEL_TEXT),
    .FUN_MP3_INVOKE = (0xFFFFFFFF80BC01A0 - KERNEL_TEXT),
    .PS5_WIFI_FW_OFFSET = (0xFFFFFFFF8163EB30 - KERNEL_TEXT),
@@ -404,6 +417,7 @@ offset_list off_0600 = {
    .KERNEL_UART_OVERRIDE = (0xFFFFFFFF822D25C8 - KERNEL_TEXT),
    .KERNEL_CFI_CHECK = (0xFFFFFFFF806899B0 - KERNEL_TEXT),
    .G_VBIOS = (0xFFFFFFFF875DFA50 - KERNEL_TEXT),
+    .FUN_TRANSMITTER_CONTROL = (0xFFFFFFFF80DCB210 - KERNEL_TEXT),
    .FUN_MP3_INITIALIZE = (0xFFFFFFFF80BE3A40 - KERNEL_TEXT),
    .FUN_MP3_INVOKE = (0xFFFFFFFF80BE27C0 - KERNEL_TEXT),
    .PS5_WIFI_FW_OFFSET = (0xFFFFFFFF81665C00 - KERNEL_TEXT),
@@ -445,6 +459,7 @@ offset_list off_0602 = {
    .KERNEL_UART_OVERRIDE = (0xFFFFFFFF822D25C8 - KERNEL_TEXT),
    .KERNEL_CFI_CHECK = (0xFFFFFFFF806899B0 - KERNEL_TEXT),
    .G_VBIOS = (0xFFFFFFFF875DFA50 - KERNEL_TEXT),
+    .FUN_TRANSMITTER_CONTROL = (0xFFFFFFFF80DCB1F0 - KERNEL_TEXT),
    .FUN_MP3_INITIALIZE = (0xFFFFFFFF80BE3A20 - KERNEL_TEXT),
    .FUN_MP3_INVOKE = (0xFFFFFFFF80BE27A0 - KERNEL_TEXT),
    .PS5_WIFI_FW_OFFSET = (0xFFFFFFFF81665CC0 - KERNEL_TEXT),
@@ -486,6 +501,7 @@ offset_list off_0761 = {
    .KERNEL_UART_OVERRIDE = (0xFFFFFFFF822C33F8 - KERNEL_TEXT),
    .KERNEL_CFI_CHECK = (0xFFFFFFFF806857B0 - KERNEL_TEXT),
    .G_VBIOS = (0xFFFFFFFF83EF7A40 - KERNEL_TEXT),
+    .FUN_TRANSMITTER_CONTROL = (0xFFFFFFFF80DB02D0 - KERNEL_TEXT),
    .FUN_MP3_INITIALIZE = (0xFFFFFFFF80BCC020 - KERNEL_TEXT),
    .FUN_MP3_INVOKE = (0xFFFFFFFF80BCADE0 - KERNEL_TEXT),
    .PS5_WIFI_FW_OFFSET = (0xFFFFFFFF81655800 - KERNEL_TEXT),
--- a/source/prepare_resume.c
+++ b/source/prepare_resume.c
@@ -132,6 +132,7 @@ uint64_t prepare_sck_args(void) {
      ktext + env_offset.FUN_SMP_NO_RENDEVOUS_BARRIER;
  args.g_vbios = ktext + env_offset.G_VBIOS;

+  args.fun_transmitter_control = ktext + env_offset.FUN_TRANSMITTER_CONTROL;
  args.fun_mp3_initialize = ktext + env_offset.FUN_MP3_INITIALIZE;
  args.fun_mp3_invoke = ktext + env_offset.FUN_MP3_INVOKE;