diff --git a/bootloader/hos/hos.c b/bootloader/hos/hos.c index 6589438..b6183c1 100644 --- a/bootloader/hos/hos.c +++ b/bootloader/hos/hos.c @@ -785,16 +785,26 @@ int hos_launch(ini_sec_t *cfg) goto error; } - // Check if fuses lower than 4.0.0 or 9.0.0 and if yes apply NO Gamecard patch. - // Additionally check if running emuMMC and disable GC if v3 fuses are burnt and HOS is <= 8.1.0. + // Check if fuses lower than 4.0.0 or 9.0.0 or 11.0.0 and if yes apply NO Gamecard patch. + // Additionally check if running emuMMC and disable GC if v3/v4 fuses are burnt and HOS is <= 8.1.0 or != 11.0.0. + //TODO: Add better checks for 11.0.0 in case mkey doesn't change. if (!ctxt.stock) { u32 fuses = fuse_read_odm(7); + bool is_hos_11000 = !memcmp(ctxt.pkg1_id->id, "20201030110855", 8); if ((h_cfg.autonogc && - ((!(fuses & ~0xF) && (kb >= KB_FIRMWARE_VERSION_400)) || // LAFW v2. - (!(fuses & ~0x3FF) && (kb >= KB_FIRMWARE_VERSION_900)))) // LAFW v3. - || ((emummc_enabled) && - ((fuses & 0x400) && (kb <= KB_FIRMWARE_VERSION_810)))) + ( + (!(fuses & ~0xF) && (kb >= KB_FIRMWARE_VERSION_400)) || // LAFW v2. + (!(fuses & ~0x3FF) && (kb >= KB_FIRMWARE_VERSION_900)) || // LAFW v3. + (!(fuses & ~0x1FFF) && is_hos_11000) // LAFW v4. + ) + ) + || ((emummc_enabled) && + ( + ((fuses & 0x400) && (kb <= KB_FIRMWARE_VERSION_810)) || // HOS 9.0.0 fuses burnt. + ((fuses & 0x2000) && !is_hos_11000) // HOS 11.0.0 fuses burnt. + ) + )) config_kip1patch(&ctxt, "nogc"); } diff --git a/bootloader/hos/pkg1.c b/bootloader/hos/pkg1.c index 2176184..b432a24 100644 --- a/bootloader/hos/pkg1.c +++ b/bootloader/hos/pkg1.c @@ -169,6 +169,7 @@ static const pkg1_id_t _pkg1_ids[] = { { "20190809135709", 9, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL, NULL }, // 9.0.0 - 9.0.1. { "20191021113848", 10, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL, NULL }, // 9.1.0. { "20200303104606", 10, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL, NULL }, // 10.0.0. + { "20201030110855", 10, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL, NULL }, // 11.0.0. { NULL } // End. }; @@ -281,7 +282,7 @@ void pkg1_secmon_patch(void *hos_ctxt, u32 secmon_base, bool t210b01) // Get size of compressed program payload and set patch offset. u32 idx = ctxt->pkg1_id->kb - KB_FIRMWARE_VERSION_700; u32 patch_offset = TZRAM_PROG_PK2_SIG_PATCH; - if (ctxt->pkg1_id->kb > KB_FIRMWARE_VERSION_910 || !memcmp(ctxt->pkg1_id->id, "20200303104606", 8)) + if (ctxt->pkg1_id->kb > KB_FIRMWARE_VERSION_910 || !memcmp(ctxt->pkg1_id->id, "20200303104606", 8)) //TODO: Add 11.0.0 support. { idx++; patch_offset = TZRAM_PROG_PK2_SIG_PATCH_1000; @@ -340,12 +341,15 @@ void pkg1_warmboot_config(void *hos_ctxt, u32 kb, u32 warmboot_base) { u32 pa_id; u32 fuses_fw = kb + 2; - u32 fuses_max = KB_FIRMWARE_VERSION_MAX + 3; + u32 fuses_max = 32; // Current ODM7 max. u8 burnt_fuses = fuse_count_burnt(fuse_read_odm(7)); // Add one more fuse for high versions. - if (kb > KB_FIRMWARE_VERSION_910 || !memcmp(ctxt->pkg1_id->id, "20200303104606", 8)) + //TODO: Add better checks for 10.0.0 and up in case mkey doesn't change. + if (kb > KB_FIRMWARE_VERSION_910 || !memcmp(ctxt->pkg1_id->id, "20200303104606", 8)) // 10.0.0. fuses_fw++; + if (!memcmp(ctxt->pkg1_id->id, "20201030110855", 8)) // 11.0.0. + fuses_fw += 2; // Save current warmboot in storage cache and check if another one is needed. if (!ctxt->warmboot) diff --git a/bootloader/hos/pkg2.c b/bootloader/hos/pkg2.c index ab362c3..9757c37 100644 --- a/bootloader/hos/pkg2.c +++ b/bootloader/hos/pkg2.c @@ -63,6 +63,7 @@ u32 pkg2_newkern_ini1_end; #define FREE_CODE_OFF_1ST_800 0x607F0 #define FREE_CODE_OFF_1ST_900 0x65780 #define FREE_CODE_OFF_1ST_1000 0x67790 +#define FREE_CODE_OFF_1ST_1100 0x49EE8 #define ID_SND_OFF_100 0x23CC0 #define ID_SND_OFF_200 0x3F134 @@ -75,6 +76,7 @@ u32 pkg2_newkern_ini1_end; #define ID_SND_OFF_800 0x2F1FC #define ID_SND_OFF_900 0x329A0 #define ID_SND_OFF_1000 0x34404 +#define ID_SND_OFF_1100 0x245B4 #define ID_RCV_OFF_100 0x219F0 #define ID_RCV_OFF_200 0x3D1A8 @@ -87,6 +89,7 @@ u32 pkg2_newkern_ini1_end; #define ID_RCV_OFF_800 0x2D424 #define ID_RCV_OFF_900 0x309B4 #define ID_RCV_OFF_1000 0x322F8 +#define ID_RCV_OFF_1100 0x22B24 static u32 PRC_ID_SND_100[] = { @@ -208,6 +211,20 @@ static u32 PRC_ID_RCV_1000[] = 0xD63F0100, 0xA8C127E8, 0xAA0003E8, 0xA8C12FEA, 0xAA0803E0 }; +static u32 PRC_ID_SND_1100[] = +{ + 0xA9BF2FEA, 0xF94043EB, 0x5280006A, 0xD37EF54A, 0xF86A696A, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9, + 0x8A09014A, 0xD2FFFFC9, 0xEB09015F, 0x54000100, 0xA9BF27E8, 0xF94002A8, 0xF9401D08, 0xAA1503E0, + 0xD63F0100, 0xA8C127E8, 0xAA0003E8, 0xA8C12FEA, 0xAA0803E0 +}; +#define FREE_CODE_OFF_2ND_1100 (FREE_CODE_OFF_1ST_1100 + sizeof(PRC_ID_SND_1100) + sizeof(u32)) +static u32 PRC_ID_RCV_1100[] = +{ + 0xA9BF2FEA, 0xF94073EB, 0x5280006A, 0xD37EF54A, 0xF86A696A, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9, + 0x8A09014A, 0xD2FFFFC9, 0xEB09015F, 0x54000100, 0xA9BF27E8, 0xF9400308, 0xF9401D08, 0xAA1803E0, + 0xD63F0100, 0xA8C127E8, 0xAA0003E8, 0xA8C12FEA, 0xAA0803E0 +}; + // Include kernel patches here, so we can utilize pkg1 id KERNEL_PATCHSET_DEF(_kernel_1_patchset, { SVC_VERIFY_DS, 0x3764C, _NOP(), NULL }, // Disable SVC verifications @@ -375,21 +392,38 @@ KERNEL_PATCHSET_DEF(_kernel_10_patchset, _B(FREE_CODE_OFF_2ND_1000 + sizeof(PRC_ID_RCV_1000), ID_RCV_OFF_1000 + sizeof(u32) * 4), NULL} ); +KERNEL_PATCHSET_DEF(_kernel_11_patchset, + { SVC_GENERIC, 0x2FCE0, _NOP(), NULL }, // Allow same process on svcControlCodeMemory. + { SVC_VERIFY_DS, 0x39194, _NOP(), NULL }, // Disable SVC verifications. + { DEBUG_MODE_EN, 0x460C0, _MOVZX(8, 1, 0), NULL }, // Enable Debug Patch. + // Atmosphère kernel patches. + { ATM_SYSM_INCR, 0x490C4, _MOVZW(21, 0x1D80, LSL16), NULL }, // System memory pool increase. + { ATM_GEN_PATCH, ID_SND_OFF_1100, _B(ID_SND_OFF_1100, FREE_CODE_OFF_1ST_1100), NULL}, // Send process id branch. + { ATM_ARR_PATCH, FREE_CODE_OFF_1ST_1100, sizeof(PRC_ID_SND_1100) >> 2, PRC_ID_SND_1100}, // Send process id code. + { ATM_GEN_PATCH, FREE_CODE_OFF_1ST_1100 + sizeof(PRC_ID_SND_1100), // Branch back and skip 4 instructions. + _B(FREE_CODE_OFF_1ST_1100 + sizeof(PRC_ID_SND_1100), ID_SND_OFF_1100 + sizeof(u32) * 4), NULL}, + { ATM_GEN_PATCH, ID_RCV_OFF_1100, _B(ID_RCV_OFF_1100, FREE_CODE_OFF_2ND_1100), NULL}, // Receive process id branch. + { ATM_ARR_PATCH, FREE_CODE_OFF_2ND_1100, sizeof(PRC_ID_RCV_1100) >> 2, PRC_ID_RCV_1100}, // Receive process id code. + { ATM_GEN_PATCH, FREE_CODE_OFF_2ND_1100 + sizeof(PRC_ID_RCV_1100), // Branch back and skip 4 instructions. + _B(FREE_CODE_OFF_2ND_1100 + sizeof(PRC_ID_RCV_1100), ID_RCV_OFF_1100 + sizeof(u32) * 4), NULL} +); + // Kernel sha256 hashes. static const pkg2_kernel_id_t _pkg2_kernel_ids[] = { - { "\xb8\xc5\x0c\x68\x25\xa9\xb9\x5b", _kernel_1_patchset }, //1.0.0 - { "\x64\x0b\x51\xff\x28\x01\xb8\x30", _kernel_2_patchset }, //2.0.0 - 2.3.0 - { "\x50\x84\x23\xac\x6f\xa1\x5d\x3b", _kernel_3_patchset }, //3.0.0 - 3.0.1 - { "\x81\x9d\x08\xbe\xe4\x5e\x1f\xbb", _kernel_302_patchset }, //3.0.2 - { "\xe6\xc0\xb7\xe3\x2f\xf9\x44\x51", _kernel_4_patchset }, //4.0.0 - 4.1.0 - { "\xb2\x38\x61\xa8\xe1\xe2\xe4\xe4", _kernel_5_patchset }, //5.0.0 - 5.1.0 - { "\x85\x97\x40\xf6\xc0\x3e\x3d\x44", _kernel_6_patchset }, //6.0.0 - 6.2.0 - { "\xa2\x5e\x47\x0c\x8e\x6d\x2f\xd7", _kernel_7_patchset }, //7.0.0 - 7.0.1 - { "\xf1\x5e\xc8\x34\xfd\x68\xf0\xf0", _kernel_8_patchset }, //8.0.0 - 8.1.0. Kernel only. - { "\x69\x00\x39\xdf\x21\x56\x70\x6b", _kernel_9_patchset }, //9.0.0 - 9.1.0. Kernel only. - { "\xa2\xe3\xad\x1c\x98\xd8\x7a\x62", _kernel_9_patchset }, //9.2.0. Kernel only. - { "\x21\xc1\xd7\x24\x8e\xcd\xbd\xa8", _kernel_10_patchset }, //10.0.0. Kernel only. + { "\xb8\xc5\x0c\x68\x25\xa9\xb9\x5b", _kernel_1_patchset }, // 1.0.0 + { "\x64\x0b\x51\xff\x28\x01\xb8\x30", _kernel_2_patchset }, // 2.0.0 - 2.3.0 + { "\x50\x84\x23\xac\x6f\xa1\x5d\x3b", _kernel_3_patchset }, // 3.0.0 - 3.0.1 + { "\x81\x9d\x08\xbe\xe4\x5e\x1f\xbb", _kernel_302_patchset }, // 3.0.2 + { "\xe6\xc0\xb7\xe3\x2f\xf9\x44\x51", _kernel_4_patchset }, // 4.0.0 - 4.1.0 + { "\xb2\x38\x61\xa8\xe1\xe2\xe4\xe4", _kernel_5_patchset }, // 5.0.0 - 5.1.0 + { "\x85\x97\x40\xf6\xc0\x3e\x3d\x44", _kernel_6_patchset }, // 6.0.0 - 6.2.0 + { "\xa2\x5e\x47\x0c\x8e\x6d\x2f\xd7", _kernel_7_patchset }, // 7.0.0 - 7.0.1 + { "\xf1\x5e\xc8\x34\xfd\x68\xf0\xf0", _kernel_8_patchset }, // 8.0.0 - 8.1.0. Kernel only. + { "\x69\x00\x39\xdf\x21\x56\x70\x6b", _kernel_9_patchset }, // 9.0.0 - 9.1.0. Kernel only. + { "\xa2\xe3\xad\x1c\x98\xd8\x7a\x62", _kernel_9_patchset }, // 9.2.0. Kernel only. + { "\x21\xc1\xd7\x24\x8e\xcd\xbd\xa8", _kernel_10_patchset }, // 10.0.0. Kernel only. + { "\xD5\xD0\xBA\x5D\x52\xB9\x77\x85", _kernel_11_patchset }, // 11.0.0. Kernel only. }; enum kip_offset_section @@ -618,6 +652,21 @@ static kip1_patchset_t _fs_patches_1020[] = { NULL, NULL } }; +static kip1_patch_t _fs_nogc_1100[] = +{ + { KPS(KIP_TEXT) | 0x1398B4, 8, "\xF4\x4F\xBE\xA9\xFD\x7B\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" }, + { KPS(KIP_TEXT) | 0x156EB8, 4, "\x14\x40\x80\x52", "\x14\x80\x80\x52" }, + { 0, 0, NULL, NULL } +}; + +static kip1_patchset_t _fs_patches_1100[] = +{ + { "nogc", _fs_nogc_1100 }, + { "emummc", _fs_emummc }, + { NULL, NULL } +}; + + // SHA256 hashes. static kip1_id_t _kip_ids[] = { @@ -657,6 +706,8 @@ static kip1_id_t _kip_ids[] = { "FS", "\x81\x7E\xA2\xB0\xB7\x02\xC1\xF3", _fs_patches_1000 }, // FS 10.0.0 exfat { "FS", "\xA9\x52\xB6\x57\xAD\xF9\xC2\xBA", _fs_patches_1020 }, // FS 10.2.0 { "FS", "\x16\x0D\x3E\x10\x4E\xAD\x61\x76", _fs_patches_1020 }, // FS 10.2.0 exfat + { "FS", "\xE3\x99\x15\x6E\x84\x4E\xB0\xAA", _fs_patches_1100 }, // FS 11.0.0 + { "FS", "\x0B\xA1\x5B\xB3\x04\xB5\x05\x63", _fs_patches_1100 }, // FS 11.0.0 exfat }; static kip1_id_t *_kip_id_sets = _kip_ids; diff --git a/bootloader/hos/secmon_exo.c b/bootloader/hos/secmon_exo.c index 518955d..a3720bb 100644 --- a/bootloader/hos/secmon_exo.c +++ b/bootloader/hos/secmon_exo.c @@ -174,9 +174,11 @@ void config_exosphere(launch_ctxt_t *ctxt, u32 warmboot_base, bool exo_new) default: exoFwNo = kb + 1; if (!memcmp(ctxt->pkg1_id->id, "20190314172056", 8) || (kb >= KB_FIRMWARE_VERSION_810)) - exoFwNo++; // ATM_TARGET_FW_800/810/900/910. + exoFwNo++; // ATM_TARGET_FW_800 and up. if (!memcmp(ctxt->pkg1_id->id, "20200303104606", 8)) - exoFwNo++; // ATM_TARGET_FW_1000. + exoFwNo++; // ATM_TARGET_FW_1000. + else if (!memcmp(ctxt->pkg1_id->id, "20201030110855", 8)) //TODO: Add better checks in case mkey doesn't change. + exoFwNo += 2; // ATM_TARGET_FW_1100. break; } @@ -220,6 +222,9 @@ void config_exosphere(launch_ctxt_t *ctxt, u32 warmboot_base, bool exo_new) case 13: exoFwNo = EXO_FW_VER(10, 0, 0); break; + case 14: + exoFwNo = EXO_FW_VER(11, 0, 0); + break; } } diff --git a/nyx/nyx_gui/hos/pkg1.c b/nyx/nyx_gui/hos/pkg1.c index d115791..260106c 100644 --- a/nyx/nyx_gui/hos/pkg1.c +++ b/nyx/nyx_gui/hos/pkg1.c @@ -57,6 +57,7 @@ static const pkg1_id_t _pkg1_ids[] = { { "20190809135709", 9, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000 }, // 9.0.0 - 9.0.1. { "20191021113848", 10, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000 }, // 9.1.0. { "20200303104606", 10, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000 }, // 10.0.0. + { "20201030110855", 10, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000 }, // 11.0.0. { NULL } //End. };