fusee_cpp: implement tsec_keygen firmware execution

fusee_cpp/program/program.ld

@@ -19,6 +19,10 @@ SECTIONS
 
 	.text :
 	{
+        KEEP(*(.text._ZN3ams4util15GetMicroSecondsEv))
+        KEEP(*(.text._ZN3ams4util16WaitMicroSecondsEi))
+        KEEP(*(.text._ZN3ams6nxboot14ShowFatalErrorEPKcz))
+        _*.o(SORT(.text*))
 		*(.text.unlikely .text.*_unlikely .text.unlikely.*)
 		*(.text.exit .text.exit.*)
 		*(.text.startup .text.startup.*)

fusee_cpp/program/program_ovl.ld

@@ -23,7 +23,7 @@ SECTIONS {
             BYTE(0x00);
         }
         .ovl_mtc_erista {
-            KEEP(*(.text._ZN3ams6nxboot22DoMemoryTrainingEristaEv))
+            KEEP(*(.text._ZN3ams6nxboot22DoMemoryTrainingEristaEi))
             fusee_mtc_erista.o(.text*);
             fusee_mtc_erista.o(.rodata*);
             fusee_mtc_erista.o(.data*);
@@ -33,7 +33,7 @@ SECTIONS {
             BYTE(0x00);
         }
         .ovl_mtc_mariko {
-            KEEP(*(.text._ZN3ams6nxboot22DoMemoryTrainingMarikoEv))
+            KEEP(*(.text._ZN3ams6nxboot22DoMemoryTrainingMarikoEi))
             fusee_mtc_mariko.o(.text*);
             fusee_mtc_mariko.o(.rodata*);
             fusee_mtc_mariko.o(.data*);

fusee_cpp/program/source/fusee_setup_horizon.cpp

@@ -14,13 +14,40 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 #include <exosphere.hpp>
+#include "fusee_secondary_archive.hpp"
 #include "fusee_setup_horizon.hpp"
 #include "fusee_fatal.hpp"
 
 namespace ams::nxboot {
 
+    namespace {
+
+        void DeriveAllKeys(const fuse::SocType soc_type) {
+            /* If on erista, run the TSEC keygen firmware. */
+            if (soc_type == fuse::SocType_Erista) {
+                clkrst::SetBpmpClockRate(clkrst::BpmpClockRate_408MHz);
+
+                if (!tsec::RunTsecFirmware(GetSecondaryArchive().tsec_keygen, sizeof(GetSecondaryArchive().tsec_keygen))) {
+                    ShowFatalError("Failed to run tsec_keygen firmware!\n");
+                }
+
+                clkrst::SetBpmpClockRate(clkrst::BpmpClockRate_576MHz);
+            }
+
+            ShowFatalError("DeriveAllKeys not fully implemented\n");
+        }
+
+    }
+
     void SetupAndStartHorizon() {
-        /* TODO */
+        /* Get soc/hardware type. */
+        const auto soc_type = fuse::GetSocType();
+        const auto hw_type  = fuse::GetHardwareType();
+
+        /* Derive all keys. */
+        DeriveAllKeys(soc_type);
+
+        AMS_UNUSED(hw_type);
         ShowFatalError("SetupAndStartHorizon not fully implemented\n");
     }
 

fusee_cpp/program/source/mtc/fusee_mtc.cpp

@@ -17,8 +17,8 @@
 
 namespace ams::nxboot {
 
-    void DoMemoryTrainingErista();
+    void DoMemoryTrainingErista(int index);
-    void DoMemoryTrainingMariko();
+    void DoMemoryTrainingMariko(int index);
 
     namespace {
 
@@ -56,16 +56,6 @@ namespace ams::nxboot {
             /* DramId_MarikoAulaSamsung1y8gbX  */ 0x0D,
         };
 
-    }
-
-    void DoMemoryTraining() {
-        if (fuse::GetSocType() == fuse::SocType_Erista) {
-            DoMemoryTrainingErista();
-        } else {
-            DoMemoryTrainingMariko();
-        }
-    }
-
         int GetMemoryTrainingTableIndex() {
             if (const auto dram_id = fuse::GetDramId(); dram_id < util::size(MemoryTrainingTableIndices) && MemoryTrainingTableIndices[dram_id] != MemoryTrainingTableIndex_Invalid) {
                 return static_cast<int>(MemoryTrainingTableIndices[dram_id]);
@@ -75,3 +65,15 @@ namespace ams::nxboot {
         }
 
     }
+
+    void DoMemoryTraining() {
+        const auto index = GetMemoryTrainingTableIndex();
+
+        if (fuse::GetSocType() == fuse::SocType_Erista) {
+            DoMemoryTrainingErista(index);
+        } else {
+            DoMemoryTrainingMariko(index);
+        }
+    }
+
+}

fusee_cpp/program/source/mtc/fusee_mtc.hpp

@@ -20,6 +20,4 @@ namespace ams::nxboot {
 
     void DoMemoryTraining();
 
-    int GetMemoryTrainingTableIndex();
-
 }

fusee_cpp/program/source/mtc/fusee_mtc_erista.cpp

@@ -72,8 +72,7 @@ namespace ams::nxboot {
 
         using EmcDvfsTimingTable = erista::EmcDvfsTimingTable;
 
-        EmcDvfsTimingTable *GetEmcDvfsTimingTables() {
+        EmcDvfsTimingTable *GetEmcDvfsTimingTables(int index) {
-            const auto index = GetMemoryTrainingTableIndex();
             switch (index) {
                 case 0:
                 case 3:
@@ -2830,9 +2829,9 @@ namespace ams::nxboot {
 
     }
 
-    void DoMemoryTrainingErista() {
+    void DoMemoryTrainingErista(int index) {
         /* Get timing tables. */
-        auto *timing_tables     = GetEmcDvfsTimingTables();
+        auto *timing_tables = GetEmcDvfsTimingTables(index);
         auto *src_timing    = timing_tables + 0;
         auto *dst_timing    = timing_tables + 1;
 

fusee_cpp/program/source/mtc/fusee_mtc_mariko.cpp

@@ -27,9 +27,7 @@ namespace ams::nxboot {
 
         using EmcDvfsTimingTable = mariko::EmcDvfsTimingTable;
 
-        EmcDvfsTimingTable *GetEmcDvfsTimingTables() {
+        EmcDvfsTimingTable *GetEmcDvfsTimingTables(int index) {
-            const auto index = GetMemoryTrainingTableIndex();
-
             /* Get the compressed table. */
             u8 *cmp_table;
             size_t cmp_table_size;
@@ -65,9 +63,9 @@ namespace ams::nxboot {
 
     }
 
-    void DoMemoryTrainingMariko() {
+    void DoMemoryTrainingMariko(int index) {
         /* Get timing tables. */
-        auto *timing_tables     = GetEmcDvfsTimingTables();
+        auto *timing_tables     = GetEmcDvfsTimingTables(index);
         auto *src_timing_tables = timing_tables + 0;
         auto *dst_timing_tables = timing_tables + 1;
 

libraries/libexosphere/arm.mk

@@ -149,7 +149,7 @@ $(OFILES)	:	$(GCH_FILES)
 $(OFILES_SRC)	: $(HFILES_BIN)
 
 libc.o: CFLAGS += -fno-builtin -fno-lto
-libgcc_division.arch.arm.o: CFLAGS += -fno-builtin -fno-lto
+util_api.o: CXXFLAGS += -fno-lto
 
 #---------------------------------------------------------------------------------
 %_bin.h %.bin.o	:	%.bin

libraries/libexosphere/source/kfuse/kfuse_registers.hpp

@@ -0,0 +1,32 @@
+/*
+ * Copyright (c) 2018-2020 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public LicenKFUSE,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be uKFUSEful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOKFUSE.  KFUSEe the GNU General Public LicenKFUSE for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public LicenKFUSE
+ * along with this program.  If not, KFUSEe <http://www.gnu.org/licenKFUSEs/>.
+ */
+#include <exosphere.hpp>
+
+#define KFUSE_STATE (0x080)
+
+#define KFUSE_REG_BITS_MASK(NAME)                                      REG_NAMED_BITS_MASK    (KFUSE, NAME)
+#define KFUSE_REG_BITS_VALUE(NAME, VALUE)                              REG_NAMED_BITS_VALUE   (KFUSE, NAME, VALUE)
+#define KFUSE_REG_BITS_ENUM(NAME, ENUM)                                REG_NAMED_BITS_ENUM    (KFUSE, NAME, ENUM)
+#define KFUSE_REG_BITS_ENUM_KFUSEL(NAME, __COND__, TRUE_ENUM, FALKFUSE_ENUM) REG_NAMED_BITS_ENUM_KFUSEL(KFUSE, NAME, __COND__, TRUE_ENUM, FALKFUSE_ENUM)
+
+#define DEFINE_KFUSE_REG(NAME, __OFFKFUSET__, __WIDTH__)                                                                                                                  REG_DEFINE_NAMED_REG           (KFUSE, NAME, __OFFKFUSET__, __WIDTH__)
+#define DEFINE_KFUSE_REG_BIT_ENUM(NAME, __OFFKFUSET__, ZERO, ONE)                                                                                                         REG_DEFINE_NAMED_BIT_ENUM      (KFUSE, NAME, __OFFKFUSET__, ZERO, ONE)
+#define DEFINE_KFUSE_REG_TWO_BIT_ENUM(NAME, __OFFKFUSET__, ZERO, ONE, TWO, THREE)                                                                                         REG_DEFINE_NAMED_TWO_BIT_ENUM  (KFUSE, NAME, __OFFKFUSET__, ZERO, ONE, TWO, THREE)
+#define DEFINE_KFUSE_REG_THREE_BIT_ENUM(NAME, __OFFKFUSET__, ZERO, ONE, TWO, THREE, FOUR, FIVE, SIX, KFUSEVEN)                                                               REG_DEFINE_NAMED_THREE_BIT_ENUM(KFUSE, NAME, __OFFKFUSET__, ZERO, ONE, TWO, THREE, FOUR, FIVE, SIX, KFUSEVEN)
+#define DEFINE_KFUSE_REG_FOUR_BIT_ENUM(NAME, __OFFKFUSET__, ZERO, ONE, TWO, THREE, FOUR, FIVE, SIX, KFUSEVEN, EIGHT, NINE, TEN, ELEVEN, TWELVE, THIRTEEN, FOURTEEN, FIFTEEN) REG_DEFINE_NAMED_FOUR_BIT_ENUM (KFUSE, NAME, __OFFKFUSET__, ZERO, ONE, TWO, THREE, FOUR, FIVE, SIX, KFUSEVEN, EIGHT, NINE, TEN, ELEVEN, TWELVE, THIRTEEN, FOURTEEN, FIFTEEN)
+
+DEFINE_KFUSE_REG_BIT_ENUM(STATE_DONE, 16, NOT_DONE, DONE);
+DEFINE_KFUSE_REG_BIT_ENUM(STATE_CRCPASS, 17, FAIL, PASS);

libraries/libexosphere/source/tsec/tsec_api.cpp

@@ -14,17 +14,94 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 #include <exosphere.hpp>
+#include "tsec_registers.hpp"
+#include "../kfuse/kfuse_registers.hpp"
 
 namespace ams::tsec {
 
     namespace {
 
-        enum TsecResult {
+        constexpr inline const uintptr_t KFUSE = 0x7000FC00;
+        constexpr inline const uintptr_t TSEC  = 0x54500000;
+
+        enum TsecResult : u32 {
             TsecResult_Success = 0xB0B0B0B0,
             TsecResult_Failure = 0xD0D0D0D0,
         };
 
-        bool RunFirmwareImpl(const void *fw, size_t fw_size) {
+        enum TsecMemory {
+            TsecMemory_Imem,
+            TsecMemory_Dmem,
+        };
+
+        bool WaitForKfuseReady() {
+            constexpr auto KfuseTimeout = 10 * 1000; /* 10 ms. */
+
+            const u32 end_time = util::GetMicroSeconds() + KfuseTimeout;
+
+            /* Wait for STATE_DONE. */
+            while (!reg::HasValue(KFUSE + KFUSE_STATE, KFUSE_REG_BITS_ENUM(STATE_DONE, DONE))) {
+                if (util::GetMicroSeconds() >= end_time) {
+                    return false;
+                }
+            }
+
+            /* Check for STATE_CRCPASS. */
+            return reg::HasValue(KFUSE + KFUSE_STATE, KFUSE_REG_BITS_ENUM(STATE_CRCPASS, PASS));
+        }
+
+        void WaitForDmaIdle() {
+            constexpr auto DmaTimeout = 10 * 1000 * 1000; /* 10 Seconds. */
+
+            u32 cur_time = util::GetMicroSeconds();
+            const u32 end_time = cur_time + DmaTimeout;
+
+            while (cur_time <= end_time) {
+                if (reg::HasValue(TSEC + TSEC_FALCON_DMATRFCMD, TSEC_REG_BITS_ENUM(FALCON_DMATRFCMD_BUSY, IDLE))) {
+                    return;
+                }
+
+                cur_time = util::GetMicroSeconds();
+            }
+
+            AMS_ABORT("tsec dma timeout");
+        }
+
+        void WaitForTsecIdle() {
+            constexpr auto TsecTimeout = 2 * 1000 * 1000; /* 2 Seconds. */
+
+            u32 cur_time = util::GetMicroSeconds();
+            const u32 end_time = cur_time + TsecTimeout;
+
+            while (cur_time <= end_time) {
+                if (reg::HasValue(TSEC + TSEC_FALCON_CPUCTL, TSEC_REG_BITS_ENUM(FALCON_CPUCTL_HALTED, TRUE))) {
+                    return;
+                }
+
+                cur_time = util::GetMicroSeconds();
+            }
+
+            AMS_ABORT("tsec timeout");
+        }
+
+        void DoDma256(TsecMemory memory, u32 dst_offset, u32 src_offset) {
+            reg::Write(TSEC + TSEC_FALCON_DMATRFMOFFS, TSEC_REG_BITS_VALUE(FALCON_DMATRFMOFFS_OFFSET, dst_offset));
+            reg::Write(TSEC + TSEC_FALCON_DMATRFFBOFFS, src_offset);
+
+            if (memory == TsecMemory_Imem) {
+                reg::Write(TSEC + TSEC_FALCON_DMATRFCMD, TSEC_REG_BITS_ENUM(FALCON_DMATRFCMD_TO,   IMEM),
+                                                         TSEC_REG_BITS_ENUM(FALCON_DMATRFCMD_SIZE,   4B));
+            } else {
+                reg::Write(TSEC + TSEC_FALCON_DMATRFCMD, TSEC_REG_BITS_ENUM(FALCON_DMATRFCMD_TO,    DMEM),
+                                                         TSEC_REG_BITS_ENUM(FALCON_DMATRFCMD_SIZE,  256B));
+            }
+
+            WaitForDmaIdle();
+        }
+
+    }
+
+    bool RunTsecFirmware(const void *fw, size_t fw_size) {
         /* Enable relevant clocks. */
         clkrst::EnableHost1xClock();
         clkrst::EnableTsecClock();
@@ -43,17 +120,48 @@ namespace ams::tsec {
             clkrst::DisableKfuseClock();
         };
 
-            /* TODO */
+        /* Wait for kfuse to be ready. */
-            AMS_UNUSED(fw, fw_size);
+        if (!WaitForKfuseReady()) {
-            return true;
+            return false;
         }
 
+        /* Configure falcon. */
+        reg::Write(TSEC + TSEC_FALCON_DMACTL, 0);
+        reg::Write(TSEC + TSEC_FALCON_IRQMSET, 0xFFF2);
+        reg::Write(TSEC + TSEC_FALCON_IRQDEST, 0xFFF0);
+        reg::Write(TSEC + TSEC_FALCON_ITFEN, 0x3);
+
+        /* Wait for TSEC dma to be idle. */
+        WaitForDmaIdle();
+
+        /* Set the base address for transfers. */
+        reg::Write(TSEC + TSEC_FALCON_DMATRFBASE, reinterpret_cast<uintptr_t>(fw) >> 8);
+
+        /* Transfer all data to TSEC imem. */
+        for (size_t i = 0; i < fw_size; i += 0x100) {
+            DoDma256(TsecMemory_Imem, i, i);
         }
 
-    bool RunTsecFirmware(const void *fw, size_t fw_size) {
+        /* Write the magic value to host1x syncpoint 160. */
-        /* TODO */
+        reg::Write(0x50003300, 0x34C2E1DA);
-        AMS_UNUSED(fw, fw_size);
+
-        return RunFirmwareImpl(fw, fw_size);
+        /* Execute the firmware. */
+        reg::Write(TSEC + TSEC_FALCON_MAILBOX0, 0);
+        reg::Write(TSEC + TSEC_FALCON_MAILBOX1, 0);
+        reg::Write(TSEC + TSEC_FALCON_BOOTVEC, 0);
+        reg::Write(TSEC + TSEC_FALCON_CPUCTL, TSEC_REG_BITS_ENUM(FALCON_CPUCTL_STARTCPU, TRUE));
+
+        /* Wait for TSEC dma to be idle. */
+        WaitForDmaIdle();
+
+        /* Wait for TSEC to complete. */
+        WaitForTsecIdle();
+
+        /* Clear magic value from host1x syncpoint 160. */
+        reg::Write(0x50003300, 0);
+
+        /* Return whether the tsec firmware succeeded. */
+        return reg::Read(TSEC + TSEC_FALCON_MAILBOX1) == TsecResult_Success;
     }
 
     void Lock() {

libraries/libexosphere/source/tsec/tsec_registers.hpp

@@ -0,0 +1,49 @@
+/*
+ * Copyright (c) 2018-2020 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public LicenTSEC,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be uTSECful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOTSEC.  TSECe the GNU General Public LicenTSEC for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public LicenTSEC
+ * along with this program.  If not, TSECe <http://www.gnu.org/licenTSECs/>.
+ */
+#include <exosphere.hpp>
+
+#define TSEC_FALCON_IRQMSET      (0x1010)
+#define TSEC_FALCON_IRQDEST      (0x101C)
+#define TSEC_FALCON_MAILBOX0     (0x1040)
+#define TSEC_FALCON_MAILBOX1     (0x1044)
+#define TSEC_FALCON_ITFEN        (0x1048)
+#define TSEC_FALCON_CPUCTL       (0x1100)
+#define TSEC_FALCON_BOOTVEC      (0x1104)
+#define TSEC_FALCON_DMACTL       (0x110C)
+#define TSEC_FALCON_DMATRFBASE   (0x1110)
+#define TSEC_FALCON_DMATRFMOFFS  (0x1114)
+#define TSEC_FALCON_DMATRFCMD    (0x1118)
+#define TSEC_FALCON_DMATRFFBOFFS (0x111C)
+
+#define TSEC_REG_BITS_MASK(NAME)                                      REG_NAMED_BITS_MASK    (TSEC, NAME)
+#define TSEC_REG_BITS_VALUE(NAME, VALUE)                              REG_NAMED_BITS_VALUE   (TSEC, NAME, VALUE)
+#define TSEC_REG_BITS_ENUM(NAME, ENUM)                                REG_NAMED_BITS_ENUM    (TSEC, NAME, ENUM)
+#define TSEC_REG_BITS_ENUM_TSECL(NAME, __COND__, TRUE_ENUM, FALTSEC_ENUM) REG_NAMED_BITS_ENUM_TSECL(TSEC, NAME, __COND__, TRUE_ENUM, FALTSEC_ENUM)
+
+#define DEFINE_TSEC_REG(NAME, __OFFTSECT__, __WIDTH__)                                                                                                                  REG_DEFINE_NAMED_REG           (TSEC, NAME, __OFFTSECT__, __WIDTH__)
+#define DEFINE_TSEC_REG_BIT_ENUM(NAME, __OFFTSECT__, ZERO, ONE)                                                                                                         REG_DEFINE_NAMED_BIT_ENUM      (TSEC, NAME, __OFFTSECT__, ZERO, ONE)
+#define DEFINE_TSEC_REG_TWO_BIT_ENUM(NAME, __OFFTSECT__, ZERO, ONE, TWO, THREE)                                                                                         REG_DEFINE_NAMED_TWO_BIT_ENUM  (TSEC, NAME, __OFFTSECT__, ZERO, ONE, TWO, THREE)
+#define DEFINE_TSEC_REG_THREE_BIT_ENUM(NAME, __OFFTSECT__, ZERO, ONE, TWO, THREE, FOUR, FIVE, SIX, TSECVEN)                                                               REG_DEFINE_NAMED_THREE_BIT_ENUM(TSEC, NAME, __OFFTSECT__, ZERO, ONE, TWO, THREE, FOUR, FIVE, SIX, TSECVEN)
+#define DEFINE_TSEC_REG_FOUR_BIT_ENUM(NAME, __OFFTSECT__, ZERO, ONE, TWO, THREE, FOUR, FIVE, SIX, TSECVEN, EIGHT, NINE, TEN, ELEVEN, TWELVE, THIRTEEN, FOURTEEN, FIFTEEN) REG_DEFINE_NAMED_FOUR_BIT_ENUM (TSEC, NAME, __OFFTSECT__, ZERO, ONE, TWO, THREE, FOUR, FIVE, SIX, TSECVEN, EIGHT, NINE, TEN, ELEVEN, TWELVE, THIRTEEN, FOURTEEN, FIFTEEN)
+
+DEFINE_TSEC_REG_BIT_ENUM(FALCON_CPUCTL_STARTCPU, 1, FALSE, TRUE);
+DEFINE_TSEC_REG_BIT_ENUM(FALCON_CPUCTL_HALTED, 4, FALSE, TRUE);
+
+DEFINE_TSEC_REG(FALCON_DMATRFMOFFS_OFFSET, 0, 16);
+
+DEFINE_TSEC_REG_BIT_ENUM(FALCON_DMATRFCMD_BUSY, 1, BUSY, IDLE);
+DEFINE_TSEC_REG_BIT_ENUM(FALCON_DMATRFCMD_TO, 4, DMEM, IMEM);
+DEFINE_TSEC_REG_THREE_BIT_ENUM(FALCON_DMATRFCMD_SIZE, 8, 4B, 8B, 16B, 32B, 64B, 128B, 256B, RSVD7);