diff --git a/.gitignore b/.gitignore index 1a85b78..ef61b4d 100644 --- a/.gitignore +++ b/.gitignore @@ -1,4 +1,5 @@ bin/ +shellcode_0607/shellcode_0607.h shellcode_kernel/shellcode_kernel.h shellcode_hv/shellcode_hv.h *.elf diff --git a/include/offsets.h b/include/offsets.h index 70beb67..8a2998f 100644 --- a/include/offsets.h +++ b/include/offsets.h @@ -44,6 +44,7 @@ typedef struct _offset_list { uint64_t KERNEL_CFI_CHECK; /* Internal functions to prepare boot */ uint64_t G_VBIOS; + uint64_t FUN_TRANSMITTER_CONTROL; uint64_t FUN_MP3_INITIALIZE; uint64_t FUN_MP3_INVOKE; /* Wifi FW */ diff --git a/shellcode_0607/shellcode_0607.h b/shellcode_0607/shellcode_0607.h deleted file mode 100644 index f3bb52d..0000000 --- a/shellcode_0607/shellcode_0607.h +++ /dev/null @@ -1,34 +0,0 @@ -unsigned char shellcode_0607_bin[] = { - 0x4c, 0x8b, 0x2c, 0x25, 0xa0, 0xe1, 0x82, 0x62, 0x48, 0x8b, 0x04, 0x25, - 0xb8, 0xe1, 0x82, 0x62, 0x31, 0xdb, 0x48, 0x8d, 0xb8, 0x60, 0x6e, 0x02, - 0x00, 0x4c, 0x89, 0xee, 0xe8, 0x9f, 0x00, 0x00, 0x00, 0x48, 0x89, 0xc5, - 0x66, 0x66, 0x2e, 0x0f, 0x1f, 0x84, 0x00, 0x00, 0x00, 0x00, 0x00, 0x90, - 0x48, 0x8b, 0x7d, 0x00, 0x4c, 0x89, 0xee, 0xe8, 0x84, 0x00, 0x00, 0x00, - 0x4c, 0x89, 0xee, 0x48, 0x8b, 0x78, 0x08, 0x49, 0x89, 0xc4, 0xe8, 0x75, - 0x00, 0x00, 0x00, 0x85, 0xdb, 0x74, 0x19, 0x83, 0xc3, 0x01, 0x48, 0x83, - 0xa0, 0x90, 0x00, 0x00, 0x00, 0xfe, 0x83, 0xfb, 0x10, 0x74, 0x29, 0x48, - 0x83, 0xc5, 0x08, 0xeb, 0xcb, 0x0f, 0x1f, 0x00, 0xba, 0x00, 0x09, 0xe0, - 0xfe, 0x48, 0x83, 0xc5, 0x08, 0xbb, 0x01, 0x00, 0x00, 0x00, 0x49, 0x89, - 0x94, 0x24, 0xe8, 0x00, 0x00, 0x00, 0x48, 0x83, 0xa0, 0x90, 0x00, 0x00, - 0x00, 0xfe, 0xeb, 0xa8, 0xbe, 0x00, 0x09, 0xe0, 0xfe, 0xbf, 0x1b, 0x00, - 0x00, 0x00, 0xe8, 0xc9, 0x00, 0x00, 0x00, 0x48, 0x8b, 0x04, 0x25, 0x20, - 0xe1, 0x82, 0x62, 0xbf, 0x01, 0x01, 0x00, 0xc0, 0x48, 0x8d, 0xb0, 0x00, - 0x10, 0x00, 0x00, 0xe8, 0xb0, 0x00, 0x00, 0x00, 0xb8, 0x80, 0x63, 0x80, - 0x62, 0xff, 0xd0, 0xeb, 0xfe, 0x0f, 0x1f, 0x80, 0x00, 0x00, 0x00, 0x00, - 0x48, 0x89, 0xf8, 0x81, 0xe6, 0x00, 0xf0, 0xff, 0xff, 0x48, 0xc1, 0xe8, - 0x27, 0x25, 0xff, 0x01, 0x00, 0x00, 0x48, 0x8b, 0x14, 0xc6, 0x48, 0x89, - 0xd0, 0x83, 0xe0, 0x01, 0x74, 0x72, 0xb9, 0x1e, 0x00, 0x00, 0x00, 0x31, - 0xf6, 0x49, 0xb8, 0x00, 0xf0, 0xff, 0xff, 0xff, 0xff, 0x0f, 0x00, 0x48, - 0x89, 0xf8, 0x4c, 0x21, 0xc2, 0x48, 0xd3, 0xe8, 0x25, 0xff, 0x01, 0x00, - 0x00, 0x48, 0x8b, 0x14, 0xc2, 0x48, 0x89, 0xd0, 0x83, 0xe0, 0x01, 0x74, - 0x47, 0x83, 0xfe, 0x02, 0x75, 0x12, 0x4c, 0x21, 0xc2, 0x81, 0xe7, 0xff, - 0x0f, 0x00, 0x00, 0x48, 0x89, 0xd0, 0x48, 0x09, 0xf8, 0xc3, 0x66, 0x90, - 0x83, 0xc6, 0x01, 0x83, 0xe9, 0x09, 0xf6, 0xc2, 0x80, 0x74, 0xc4, 0x83, - 0xfe, 0x01, 0xb9, 0xff, 0xff, 0xff, 0x3f, 0xb8, 0xff, 0xff, 0x1f, 0x00, - 0x48, 0x0f, 0x44, 0xc1, 0x48, 0xb9, 0x00, 0xf0, 0xff, 0xff, 0xff, 0xff, - 0x0f, 0x00, 0x48, 0x21, 0xca, 0x48, 0x21, 0xf8, 0x48, 0x09, 0xd0, 0xc3, - 0xc3, 0x66, 0x66, 0x2e, 0x0f, 0x1f, 0x84, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x0f, 0x1f, 0x40, 0x00, 0x48, 0x89, 0xf2, 0x48, 0x89, 0xf0, 0x89, 0xf9, - 0x48, 0xc1, 0xea, 0x20, 0x0f, 0x30, 0xc3 -}; -unsigned int shellcode_0607_bin_len = 367; diff --git a/shellcode_kernel/boot_linux.c b/shellcode_kernel/boot_linux.c index 8b356b0..c452067 100644 --- a/shellcode_kernel/boot_linux.c +++ b/shellcode_kernel/boot_linux.c @@ -4,6 +4,12 @@ #include "../shellcode_hv/shellcode_hv.h" #include "utils.h" +#define DIG1TRANSMITTERCONTROL 0x4c + +#define TRANSMITTER_CONTROL_ENABLE 1 +#define TRANSMITTER_CONTROL_SET_VOLTAGE_AND_PREEMPASIS 11 + +int (*transmitter_control)(int cmd, void *control) = NULL; int (*mp3_initialize)(int vmid) = NULL; int (*mp3_invoke)(int cmd_id, void *req, void *rsp) = NULL; @@ -28,6 +34,30 @@ typedef struct { uint8_t reserved[64]; } __attribute__((packed)) SceSblHvShm; +typedef struct { + uint8_t lanenum; + uint32_t rate; + uint32_t pad; + uint32_t lane_setting_1; + uint32_t lane_setting_2; +} transmitter_args; + +struct dig_transmitter_control_parameters_v1_6 { + uint8_t phyid; + uint8_t action; + union { + uint8_t digmode; + uint8_t dplaneset; + } mode_laneset; + uint8_t lanenum; + uint32_t symclk_10khz; + uint8_t hpdsel; + uint8_t digfe_sel; + uint8_t connobj_id; + uint8_t reserved; + uint32_t reserved1; +}; + static struct linux_info info; static int mp3_req[1281], mp3_rsp[1282]; @@ -55,6 +85,20 @@ static uint64_t get_hv_shm(void) { return -1; } +static int dp_enable_link_phy(int lanenum, int linkrate) { + struct dig_transmitter_control_parameters_v1_6 params = {}; + params.phyid = 0; + params.action = TRANSMITTER_CONTROL_ENABLE; + params.mode_laneset.digmode = 0; + params.lanenum = lanenum; + params.symclk_10khz = 27000 * linkrate / 10; + params.hpdsel = 0; + params.digfe_sel = 0; + params.connobj_id = 0; + + return transmitter_control(DIG1TRANSMITTERCONTROL, ¶ms); +} + static int mp3_set_hdcp_packet(int be, int mode) { mp3_req[0] = be; mp3_req[1] = mode; @@ -132,6 +176,9 @@ void boot_linux(void) { memcpy((void *)PHYS_TO_DMAP(0xC0000), (void *)g_vbios, 0x10000); + // Enable DP phys link. + dp_enable_link_phy(4, 30); + // Initialize hdcp in mp3. mp3_initialize(0); mp3_set_hdcp_packet(0, 1); diff --git a/shellcode_kernel/shellcode_kernel_args.h b/shellcode_kernel/shellcode_kernel_args.h index a269da2..40cfd8f 100644 --- a/shellcode_kernel/shellcode_kernel_args.h +++ b/shellcode_kernel/shellcode_kernel_args.h @@ -14,6 +14,7 @@ typedef struct { uint64_t fun_hv_iommu_wait_completion; uint64_t fun_smp_rendezvous; uint64_t fun_smp_no_rendevous_barrier; + uint64_t fun_transmitter_control; uint64_t fun_mp3_initialize; uint64_t fun_mp3_invoke; uint64_t g_vbios; diff --git a/shellcode_kernel/utils.c b/shellcode_kernel/utils.c index 3a693d3..e3bd0f4 100644 --- a/shellcode_kernel/utils.c +++ b/shellcode_kernel/utils.c @@ -104,6 +104,7 @@ void init_global_pointers(volatile shellcode_kernel_args *args_ptr) { smp_no_rendevous_barrier = (void (*)(void *))args.fun_smp_no_rendevous_barrier; + transmitter_control = (int (*)(int, void *))args.fun_transmitter_control; mp3_initialize = (int (*)(int))args.fun_mp3_initialize; mp3_invoke = (int (*)(int, void *, void *))args.fun_mp3_invoke; g_vbios = args.g_vbios; diff --git a/shellcode_kernel/utils.h b/shellcode_kernel/utils.h index e57113e..a5480f1 100644 --- a/shellcode_kernel/utils.h +++ b/shellcode_kernel/utils.h @@ -8,6 +8,7 @@ extern void (*smp_rendezvous)(void (*setup_func)(void *), void (*action_func)(void *), void (*teardown_func)(void *), void *arg); extern void (*smp_no_rendevous_barrier)(void *); +extern int (*transmitter_control)(int cmd, void *control); extern int (*mp3_initialize)(int vmid); extern int (*mp3_invoke)(int cmd_id, void *req, void *rsp); extern uint64_t g_vbios; diff --git a/source/offsets.c b/source/offsets.c index 2c07548..52765fb 100644 --- a/source/offsets.c +++ b/source/offsets.c @@ -19,6 +19,7 @@ offset_list off_0300 = { .KERNEL_UART_OVERRIDE = 0x1EB0258, .KERNEL_CFI_CHECK = 0x0441DD0, .G_VBIOS = 0x0734B5D0, + .FUN_TRANSMITTER_CONTROL = 0x0B2A560, .FUN_MP3_INITIALIZE = 0x0953890, .FUN_MP3_INVOKE = 0x0952670, .PS5_WIFI_FW_OFFSET = 0x1274460, @@ -42,6 +43,7 @@ offset_list off_0310 = { .KERNEL_UART_OVERRIDE = 0x1EB0258, .KERNEL_CFI_CHECK = 0x0441E10, .G_VBIOS = 0x0734B5D0, + .FUN_TRANSMITTER_CONTROL = 0x0B2A5A0, .FUN_MP3_INITIALIZE = 0x09538D0, .FUN_MP3_INVOKE = 0x09526B0, .PS5_WIFI_FW_OFFSET = 0x1274490, @@ -65,6 +67,7 @@ offset_list off_0320 = { .KERNEL_UART_OVERRIDE = 0x1EB0258, .KERNEL_CFI_CHECK = 0x442160, .G_VBIOS = 0x734B5D0, + .FUN_TRANSMITTER_CONTROL = 0xB2AA60, .FUN_MP3_INITIALIZE = 0x953D30, .FUN_MP3_INVOKE = 0x952B10, .PS5_WIFI_FW_OFFSET = 0x1274550, @@ -88,6 +91,7 @@ offset_list off_0321 = { .KERNEL_UART_OVERRIDE = 0x1EB0258, .KERNEL_CFI_CHECK = 0x442160, .G_VBIOS = 0x734B5D0, + .FUN_TRANSMITTER_CONTROL = 0xB2AA60, .FUN_MP3_INITIALIZE = 0x953D30, .FUN_MP3_INVOKE = 0x952B10, .PS5_WIFI_FW_OFFSET = 0x1274550, @@ -111,6 +115,7 @@ offset_list off_0400 = { .KERNEL_UART_OVERRIDE = 0x1F522A8, .KERNEL_CFI_CHECK = 0x45A170, .G_VBIOS = 0x72B7630, + .FUN_TRANSMITTER_CONTROL = 0xB5AD50, .FUN_MP3_INITIALIZE = 0x9805C0, .FUN_MP3_INVOKE = 0x97F3E0, .PS5_WIFI_FW_OFFSET = 0x1392FB0, @@ -134,6 +139,7 @@ offset_list off_0402 = { .KERNEL_UART_OVERRIDE = 0x1F522A8, .KERNEL_CFI_CHECK = 0x45A170, .G_VBIOS = 0x72B7630, + .FUN_TRANSMITTER_CONTROL = 0xB5ADA0, .FUN_MP3_INITIALIZE = 0x980610, .FUN_MP3_INVOKE = 0x97F430, .PS5_WIFI_FW_OFFSET = 0x1392FB0, @@ -157,6 +163,7 @@ offset_list off_0403 = { .KERNEL_UART_OVERRIDE = 0x1F522A8, .KERNEL_CFI_CHECK = 0x45A170, .G_VBIOS = 0x72B7630, + .FUN_TRANSMITTER_CONTROL = 0xB5AE30, .FUN_MP3_INITIALIZE = 0x9806A0, .FUN_MP3_INVOKE = 0x97F4C0, .PS5_WIFI_FW_OFFSET = 0x1392FB0, @@ -180,6 +187,7 @@ offset_list off_0450 = { .KERNEL_UART_OVERRIDE = 0x1F522A8, .KERNEL_CFI_CHECK = 0x45A1A0, .G_VBIOS = 0x72B7630, + .FUN_TRANSMITTER_CONTROL = 0xB5AFF0, .FUN_MP3_INITIALIZE = 0x980850, .FUN_MP3_INVOKE = 0x97F670, .PS5_WIFI_FW_OFFSET = 0x1392FC0, @@ -203,6 +211,7 @@ offset_list off_0451 = { .KERNEL_UART_OVERRIDE = 0x1F522A8, .KERNEL_CFI_CHECK = 0x45A1A0, .G_VBIOS = 0x72B7630, + .FUN_TRANSMITTER_CONTROL = 0xB5B420, .FUN_MP3_INITIALIZE = 0x980BF0, .FUN_MP3_INVOKE = 0x97FA10, .PS5_WIFI_FW_OFFSET = 0x1393000, @@ -243,6 +252,7 @@ offset_list off_0500 = { .KERNEL_UART_OVERRIDE = (0xFFFFFFFF82291378 - KERNEL_TEXT), .KERNEL_CFI_CHECK = (0xFFFFFFFF80677FB0 - KERNEL_TEXT), .G_VBIOS = (0xFFFFFFFF87673A50 - KERNEL_TEXT), + .FUN_TRANSMITTER_CONTROL = (0xFFFFFFFF80DA0AB0 - KERNEL_TEXT), .FUN_MP3_INITIALIZE = (0xFFFFFFFF80BC0440 - KERNEL_TEXT), .FUN_MP3_INVOKE = (0xFFFFFFFF80BBF160 - KERNEL_TEXT), .PS5_WIFI_FW_OFFSET = (0xFFFFFFFF8163E2B0 - KERNEL_TEXT), @@ -283,6 +293,7 @@ offset_list off_0502 = { .KERNEL_UART_OVERRIDE = (0xFFFFFFFF82291378 - KERNEL_TEXT), .KERNEL_CFI_CHECK = (0xFFFFFFFF80677FB0 - KERNEL_TEXT), .G_VBIOS = (0xFFFFFFFF87673A50 - KERNEL_TEXT), + .FUN_TRANSMITTER_CONTROL = (0xFFFFFFFF80DA0AB0 - KERNEL_TEXT), .FUN_MP3_INITIALIZE = (0xFFFFFFFF80BC0440 - KERNEL_TEXT), .FUN_MP3_INVOKE = (0xFFFFFFFF80BBF160 - KERNEL_TEXT), .PS5_WIFI_FW_OFFSET = (0xFFFFFFFF8163E2B0 - KERNEL_TEXT), @@ -323,6 +334,7 @@ offset_list off_0510 = { .KERNEL_UART_OVERRIDE = (0xFFFFFFFF82291378 - KERNEL_TEXT), .KERNEL_CFI_CHECK = (0xFFFFFFFF80677FB0 - KERNEL_TEXT), .G_VBIOS = (0xFFFFFFFF87673A50 - KERNEL_TEXT), + .FUN_TRANSMITTER_CONTROL = (0xFFFFFFFF80DA0DE0 - KERNEL_TEXT), .FUN_MP3_INITIALIZE = (0xFFFFFFFF80BC0690 - KERNEL_TEXT), .FUN_MP3_INVOKE = (0xFFFFFFFF80BBF3B0 - KERNEL_TEXT), .PS5_WIFI_FW_OFFSET = (0xFFFFFFFF8163E670 - KERNEL_TEXT), @@ -363,6 +375,7 @@ offset_list off_0550 = { .KERNEL_UART_OVERRIDE = (0xFFFFFFFF82291488 - KERNEL_TEXT), .KERNEL_CFI_CHECK = (0xFFFFFFFF80678060 - KERNEL_TEXT), .G_VBIOS = (0xFFFFFFFF87673A50 - KERNEL_TEXT), + .FUN_TRANSMITTER_CONTROL = (0xFFFFFFFF80DA1BD0 - KERNEL_TEXT), .FUN_MP3_INITIALIZE = (0xFFFFFFFF80BC1480 - KERNEL_TEXT), .FUN_MP3_INVOKE = (0xFFFFFFFF80BC01A0 - KERNEL_TEXT), .PS5_WIFI_FW_OFFSET = (0xFFFFFFFF8163EB30 - KERNEL_TEXT), @@ -404,6 +417,7 @@ offset_list off_0600 = { .KERNEL_UART_OVERRIDE = (0xFFFFFFFF822D25C8 - KERNEL_TEXT), .KERNEL_CFI_CHECK = (0xFFFFFFFF806899B0 - KERNEL_TEXT), .G_VBIOS = (0xFFFFFFFF875DFA50 - KERNEL_TEXT), + .FUN_TRANSMITTER_CONTROL = (0xFFFFFFFF80DCB210 - KERNEL_TEXT), .FUN_MP3_INITIALIZE = (0xFFFFFFFF80BE3A40 - KERNEL_TEXT), .FUN_MP3_INVOKE = (0xFFFFFFFF80BE27C0 - KERNEL_TEXT), .PS5_WIFI_FW_OFFSET = (0xFFFFFFFF81665C00 - KERNEL_TEXT), @@ -445,6 +459,7 @@ offset_list off_0602 = { .KERNEL_UART_OVERRIDE = (0xFFFFFFFF822D25C8 - KERNEL_TEXT), .KERNEL_CFI_CHECK = (0xFFFFFFFF806899B0 - KERNEL_TEXT), .G_VBIOS = (0xFFFFFFFF875DFA50 - KERNEL_TEXT), + .FUN_TRANSMITTER_CONTROL = (0xFFFFFFFF80DCB1F0 - KERNEL_TEXT), .FUN_MP3_INITIALIZE = (0xFFFFFFFF80BE3A20 - KERNEL_TEXT), .FUN_MP3_INVOKE = (0xFFFFFFFF80BE27A0 - KERNEL_TEXT), .PS5_WIFI_FW_OFFSET = (0xFFFFFFFF81665CC0 - KERNEL_TEXT), @@ -486,6 +501,7 @@ offset_list off_0761 = { .KERNEL_UART_OVERRIDE = (0xFFFFFFFF822C33F8 - KERNEL_TEXT), .KERNEL_CFI_CHECK = (0xFFFFFFFF806857B0 - KERNEL_TEXT), .G_VBIOS = (0xFFFFFFFF83EF7A40 - KERNEL_TEXT), + .FUN_TRANSMITTER_CONTROL = (0xFFFFFFFF80DB02D0 - KERNEL_TEXT), .FUN_MP3_INITIALIZE = (0xFFFFFFFF80BCC020 - KERNEL_TEXT), .FUN_MP3_INVOKE = (0xFFFFFFFF80BCADE0 - KERNEL_TEXT), .PS5_WIFI_FW_OFFSET = (0xFFFFFFFF81655800 - KERNEL_TEXT), diff --git a/source/prepare_resume.c b/source/prepare_resume.c index d1634e5..9f15dbf 100644 --- a/source/prepare_resume.c +++ b/source/prepare_resume.c @@ -132,6 +132,7 @@ uint64_t prepare_sck_args(void) { ktext + env_offset.FUN_SMP_NO_RENDEVOUS_BARRIER; args.g_vbios = ktext + env_offset.G_VBIOS; + args.fun_transmitter_control = ktext + env_offset.FUN_TRANSMITTER_CONTROL; args.fun_mp3_initialize = ktext + env_offset.FUN_MP3_INITIALIZE; args.fun_mp3_invoke = ktext + env_offset.FUN_MP3_INVOKE;