Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #!/usr/bin/env python3
- # SPDX-License-Identifier: MIT
- import sys, pathlib, time
- sys.path.append(str(pathlib.Path(__file__).resolve().parents[1]))
- from m1n1.setup import *
- from m1n1.hw.dart import DART
- from m1n1.shell import run_shell
- #from m1n1.hw.isp import *
- from m1n1.fw.common import *
- import struct
- from construct import *
- p.pmgr_adt_clocks_enable("/arm-io/isp")
- p.pmgr_adt_clocks_enable("/arm-io/dart-isp")
- dart = DART.from_adt(u, "arm-io/dart-isp")
- dart.initialize()
- def w_tun_a():
- p.mask32(0x22a000000, 0x10, 0x10)
- p.mask32(0x22a000040, 0xffff, 0x50030)
- p.mask32(0x22a000044, 0xffff, 0xa0040)
- p.mask32(0x22a000400, 0x4, 0x40000001)
- p.mask32(0x22a000600, 0x0, 0x1ffffff)
- p.mask32(0x22a000738, 0x1ff01ff, 0x2)
- p.mask32(0x22a000798, 0x1ff01ff, 0x300008)
- p.mask32(0x22a0007f8, 0x1ff01ff, 0x880020)
- p.mask32(0x22a000858, 0x1ff01ff, 0x200080)
- p.mask32(0x22a000900, 0x1, 0x101)
- p.mask32(0x22a000410, 0x100, 0x1100)
- p.mask32(0x22a000420, 0x100, 0x1100)
- p.mask32(0x22a000430, 0x100, 0x1100)
- p.mask32(0x22a008000, 0x0, 0x9)
- p.mask32(0x22a008000, 0x0, 0x9)
- p.mask32(0x22a000920, 0x0, 0x80)
- p.write32(0x22a008008, 0x7)
- p.write32(0x22a008014, 0x1)
- p.mask32(0x22a008018, 0x0, 0x1)
- p.mask32(0x22a0007a8, 0x0, 0x1)
- p.write32(0x22a008208, 0x5)
- p.write32(0x22a008280, 0x20)
- p.write32(0x22a008288, 0x3)
- p.write32(0x22a00828c, 0xc)
- p.write32(0x22a008290, 0x18)
- p.write32(0x22a008294, 0x30)
- p.write32(0x22a008298, 0x78)
- p.write32(0x22a00829c, 0xff)
- p.mask32(0x22a0082b8, 0x0, 0x1)
- p.write32(0x22a0082bc, 0x1)
- p.mask32(0x22a0082c0, 0x0, 0x1)
- p.mask32(0x22a000748, 0x0, 0x1)
- p.write32(0x22a00820c, 0x3)
- p.write32(0x22a008284, 0x20)
- p.write32(0x22a0082a0, 0x3)
- p.write32(0x22a0082a4, 0xc)
- p.write32(0x22a0082a8, 0x18)
- p.write32(0x22a0082ac, 0x30)
- p.write32(0x22a0082b0, 0x78)
- p.write32(0x22a0082b4, 0xff)
- p.mask32(0x22a0082b8, 0x1, 0x3)
- p.write32(0x22a0082bc, 0x2)
- p.mask32(0x22a0082c0, 0x1, 0x3)
- p.write32(0x22a008210, 0x0)
- p.write32(0x22a008408, 0x3)
- p.write32(0x22a008418, 0x3)
- p.write32(0x22a00841c, 0x0)
- p.write32(0x22a008420, 0xffffffff)
- p.write32(0x22a008424, 0x0)
- p.write32(0x22a008428, 0xfff)
- p.mask32(0x22a0082b8, 0x3, 0x7)
- p.write32(0x22a0082bc, 0x4)
- p.mask32(0x22a0082c0, 0x3, 0x7)
- def w_tun_b():
- p.write32(0x22c0e0080, 0x1)
- p.mask32(0x22c0f0020, 0x0, 0x80000000)
- p.mask32(0x22c0f8020, 0x0, 0x80000000)
- def w_tun_c():
- p.write32(0x22c0ec004, 0x1)
- p.write32(0x22c0ec008, 0x9e8000)
- p.write32(0x22c0ec00c, 0x8)
- p.write32(0x22c0ec010, 0x139bfff)
- p.write32(0x22c0ec014, 0x8)
- p.write32(0x22c0ec000, 0x11)
- p.write32(0x22c0ec044, 0x1)
- p.write32(0x22c0ec048, 0x0)
- p.write32(0x22c0ec04c, 0xf)
- p.write32(0x22c0ec050, 0xffffffff)
- p.write32(0x22c0ec054, 0xf)
- p.write32(0x22c0ec040, 0x33)
- p.write32(0x22c0ec084, 0x1)
- p.write32(0x22c0ec088, 0x3b704000)
- p.write32(0x22c0ec08c, 0x2)
- p.write32(0x22c0ec090, 0x3b704063)
- p.write32(0x22c0ec094, 0x2)
- p.write32(0x22c0ec080, 0x31)
- p.write32(0x22c0ec0c4, 0x1)
- p.write32(0x22c0ec0c8, 0x3b738000)
- p.write32(0x22c0ec0cc, 0x2)
- p.write32(0x22c0ec0d0, 0x3b73bfff)
- p.write32(0x22c0ec0d4, 0x2)
- p.write32(0x22c0ec0c0, 0x31)
- p.write32(0x22c0ec104, 0x1)
- p.write32(0x22c0ec108, 0x3c260000)
- p.write32(0x22c0ec10c, 0x2)
- p.write32(0x22c0ec110, 0x3c26006b)
- p.write32(0x22c0ec114, 0x2)
- p.write32(0x22c0ec100, 0x31)
- p.write32(0x22c0ec144, 0x1)
- p.write32(0x22c0ec148, 0x3c280000)
- p.write32(0x22c0ec14c, 0x2)
- p.write32(0x22c0ec150, 0x3c2830b3)
- p.write32(0x22c0ec154, 0x2)
- p.write32(0x22c0ec140, 0x31)
- p.write32(0x22c0ec184, 0x1)
- p.write32(0x22c0ec188, 0x3c290000)
- p.write32(0x22c0ec18c, 0x2)
- p.write32(0x22c0ec190, 0x3c2930b3)
- p.write32(0x22c0ec194, 0x2)
- p.write32(0x22c0ec180, 0x31)
- p.write32(0x22c0ec1c4, 0x1)
- p.write32(0x22c0ec1c8, 0x3c2a0000)
- p.write32(0x22c0ec1cc, 0x2)
- p.write32(0x22c0ec1d0, 0x3c2a30b3)
- p.write32(0x22c0ec1d4, 0x2)
- p.write32(0x22c0ec1c0, 0x31)
- p.write32(0x22c0ec204, 0x1)
- p.write32(0x22c0ec208, 0x3bc3c000)
- p.write32(0x22c0ec20c, 0x2)
- p.write32(0x22c0ec210, 0x3bc3c003)
- p.write32(0x22c0ec214, 0x2)
- p.write32(0x22c0ec200, 0x31)
- p.write32(0x22c0ec244, 0x1)
- p.write32(0x22c0ec248, 0x4a42c000)
- p.write32(0x22c0ec24c, 0x2)
- p.write32(0x22c0ec250, 0x4a42c003)
- p.write32(0x22c0ec254, 0x2)
- p.write32(0x22c0ec240, 0x31)
- p.write32(0x22c0ec284, 0x1)
- p.write32(0x22c0ec288, 0x4a448000)
- p.write32(0x22c0ec28c, 0x2)
- p.write32(0x22c0ec290, 0x4a448003)
- p.write32(0x22c0ec294, 0x2)
- p.write32(0x22c0ec280, 0x31)
- p.write32(0x22c0ec2c4, 0x1)
- p.write32(0x22c0ec2c8, 0x6b460000)
- p.write32(0x22c0ec2cc, 0x2)
- p.write32(0x22c0ec2d0, 0x6b460003)
- p.write32(0x22c0ec2d4, 0x2)
- p.write32(0x22c0ec2c0, 0x31)
- p.write32(0x22c0ec304, 0x1)
- p.write32(0x22c0ec308, 0x14000)
- p.write32(0x22c0ec30c, 0x2)
- p.write32(0x22c0ec310, 0x163fb)
- p.write32(0x22c0ec314, 0x2)
- p.write32(0x22c0ec300, 0x31)
- p.write32(0x22c0ec344, 0x1)
- p.write32(0x22c0ec348, 0x54000)
- p.write32(0x22c0ec34c, 0x2)
- p.write32(0x22c0ec350, 0x563fb)
- p.write32(0x22c0ec354, 0x2)
- p.write32(0x22c0ec340, 0x31)
- p.write32(0x22c0ec384, 0x1)
- p.write32(0x22c0ec388, 0x94000)
- p.write32(0x22c0ec38c, 0x2)
- p.write32(0x22c0ec390, 0x963fb)
- p.write32(0x22c0ec394, 0x2)
- p.write32(0x22c0ec380, 0x31)
- p.write32(0x22c0ec3c4, 0x1)
- p.write32(0x22c0ec3c8, 0xd4000)
- p.write32(0x22c0ec3cc, 0x2)
- p.write32(0x22c0ec3d0, 0xd63fb)
- p.write32(0x22c0ec3d4, 0x2)
- p.write32(0x22c0ec3c0, 0x31)
- def w_tun_d():
- p.write32(0x22c0e8100, 0x80) # TCR[0] = 0x80
- p.write32(0x22c0e813c, 0x100) # TCR[0] = 0x80
- p.write32(0x22c0f40fc, 0x1)
- p.write32(0x22c0f4200, dart.dart.regs.TTBR[0, 0].val)
- p.write32(0x22c0f42f0, 0x0)
- p.write32(0x22c0f4034, 0xffffffff)
- p.write32(0x22c0f4020, 0x100000)
- p.mask32(0x22c0f4060, 0x10000, 0x80016100)
- p.mask32(0x22c0f4068, 0x20202, 0xf0f0f)
- p.mask32(0x22c0f406c, 0x0, 0x80808)
- p.write32(0x22c0f4100, 0x80)
- p.write32(0x22c0f413c, 0x20000)
- p.write32(0x22c0fc0fc, 0x1)
- p.write32(0x22c0fc200, dart.dart.regs.TTBR[0, 0].val)
- p.write32(0x22c0fc2f0, 0x0)
- p.write32(0x22c0fc034, 0xffffffff)
- p.write32(0x22c0fc020, 0x100000)
- p.mask32(0x22c0fc060, 0x10000, 0x80016100)
- p.mask32(0x22c0fc068, 0x20202, 0xf0f0f)
- p.mask32(0x22c0fc06c, 0x0, 0x80808)
- p.write32(0x22c0fc100, 0x80)
- p.write32(0x22c0fc13c, 0x20000)
- def w_tun():
- w_tun_a()
- w_tun_b()
- w_tun_c()
- w_tun_d()
- def power_on():
- p.pmgr_adt_clocks_enable("/arm-io/isp")
- p.pmgr_adt_clocks_enable("/arm-io/dart-isp")
- base = 0x23b700000
- p.write32(base + 0x4000, 0xf)
- p.write32(base + 0x4008, 0xf)
- p.write32(base + 0x4010, 0xf)
- p.write32(base + 0x4018, 0xf)
- p.write32(base + 0x4020, 0xf)
- p.write32(base + 0x4028, 0xf)
- p.write32(base + 0x4030, 0xf)
- p.write32(base + 0x4038, 0xf)
- p.write32(base + 0x4040, 0xf)
- p.write32(base + 0x4048, 0xf)
- p.write32(base + 0x4050, 0xf)
- p.write32(base + 0x4058, 0xf)
- p.write32(base + 0x4060, 0xf)
- def power_off():
- base = 0x23b700000
- p.write32(base + 0x4060, 0x0)
- p.write32(base + 0x4058, 0x0)
- p.write32(base + 0x4050, 0x0)
- p.write32(base + 0x4048, 0x0)
- p.write32(base + 0x4040, 0x0)
- p.write32(base + 0x4038, 0x0)
- p.write32(base + 0x4030, 0x0)
- p.write32(base + 0x4028, 0x0)
- p.write32(base + 0x4020, 0x0)
- p.write32(base + 0x4018, 0x0)
- p.write32(base + 0x4010, 0xf0017ff)
- p.write32(base + 0x4008, 0xf0017ff)
- p.write32(base + 0x4000, 0x7ff)
- p.write32(base + 0x4010, 0x0)
- p.write32(base + 0x4008, 0x0)
- p.write32(base + 0x4000, 0x0)
- p.write32(0x22c508000, 0x103)
- p.mask32(0x22c504000, 0xc01, 0xc03)
- p.write32(0x22a008014, 0x1)
- p.write32(0x22a0082bc, 0x1)
- p.write32(0x22a0082bc, 0x2)
- p.write32(0x22a0082bc, 0x4)
- def load_fw():
- text_phys = 0x8009e8000
- text_virt = 0x0
- text_size = 0x9b4000
- data_phys = 0x8019b8000
- data_virt = 0x9b4000
- data_size = 0x41c000
- dart.iomap_at(0, text_virt, text_phys, text_size)
- dart.iomap_at(0, data_virt, data_phys, data_size)
- heap_virt = 0xdd0000
- heap_size = 0xa30000
- heap_phys = u.heap.memalign(0x4000, heap_size)
- p.memset32(heap_phys, 0, heap_size)
- dart.iomap_at(0, heap_virt, heap_phys, heap_size)
- p.write32(0x22c0f4200, dart.dart.regs.TTBR[0, 0].val)
- p.write32(0x22c0fc200, dart.dart.regs.TTBR[0, 0].val)
- power_on()
- w_tun()
- load_fw()
- def power_gating_disabled_reset():
- base = 0x22a000000
- p.write32(base + 0x1010310, 0x2) # ANE_H11_ASC_CPU_EDPRCR
- p.write32(base + 0x738, 0xff00ff)
- p.write32(base + 0x798, 0xff00ff)
- p.write32(base + 0x7f8, 0xff00ff)
- p.write32(base + 0x1400a00, 0xffffffff)
- p.write32(base + 0x1400a04, 0xffffffff)
- p.write32(base + 0x1400a08, 0xffffffff)
- p.write32(base + 0x1400a0c, 0xffffffff)
- p.write32(base + 0x1400a10, 0xffffffff)
- p.write32(base + 0x1400a14, 0xffffffff)
- power_gating_disabled_reset()
- time.sleep(0.1)
- def get_asc_status():
- base = 0x22a000000
- status = p.read32(base + 0x1400048) # ASCWRAP_IDLE_STATUS
- print("asc status: 0x%x" % status)
- if (status & 3) == 0:
- # can't be 0x28, 0x2c
- print("ANECPU not in WFI")
- return 0
- print("ANECPU in WFI")
- return 1
- # it should be wfi for now
- assert(get_asc_status())
- def gpio_seq():
- p.read32(0x22c0fc2f0)
- p.write32(0x22c104190, 0x1)
- p.write32(0x22c104170, 0x0)
- p.write32(0x22c104174, 0x0)
- p.write32(0x22c104178, 0x0)
- p.write32(0x22c10417c, 0x0)
- p.write32(0x22c104180, 0x0)
- p.write32(0x22c104184, 0x0)
- p.write32(0x22c104188, 0x0)
- p.write32(0x22c10418c, 0x0)
- p.write32(0x22b400044, 0x0) # asc turn on
- p.write32(0x22b400044, 0x10)
- p.write32(0x22c10418c, 0x0) # init call
- gpio_seq()
- time.sleep(0.1)
- for n in range(10):
- val = p.read32(0x22c10418c)
- print('val is: 0x%x' % val)
- if (val == 0x8042006):
- print('MAGIC; BOOT PT1 SUCCESS')
- break
- time.sleep(0.1)
- ipc_chan_count = p.read32(0x22c104170) # 0x7; channel count; < 0x21
- ipc_queue_size = p.read32(0x22c104174) # 0xef40
- unk_2 = p.read32(0x22c104178) # 0x1;
- unk_3 = p.read32(0x22c104180) # 0x0
- extra_heap_size = p.read32(0x22c10417c) # 0x2200000
- print('ISP_GPIO0: IPC_CHAN_COUNT: %d' % ipc_chan_count)
- print('ISP_GPIO1: IPC_QUEUE_SIZE: 0x%x' % ipc_queue_size)
- print('ISP_GPIO3: fw requested extra heap size: 0x%x' % extra_heap_size)
- #----------------------------------------------------------------------------------------------
- def prep_ipc():
- # prep shared ipc buf
- ipc_virt = 0x1804000
- ipc_size = 0x1c000
- ipc_phys = u.heap.memalign(0x4000, ipc_size)
- p.memset32(ipc_phys, 0, ipc_size)
- dart.iomap_at(0, ipc_virt, ipc_phys, ipc_size)
- """
- 00003380: 00000000 00000000 00704000 00000000 .........@p.....
- 00003390: 00700000 00000000 0f900000 00000000 ..p.............
- 000033a0: 00748000 00000000 01800000 00000000 ..t.............
- 000033d0: 00040000 00000000 00000000 00000000 ................
- 000033e0: 00000000 00000000 00000040 00000004 ........@.......
- ipc_msg_buf = IPCMsg.build(dict(
- ipc_base=ipc_virt,
- ctrr_size=CTRR_FW_SIZE, ctrr_size2=0x10000000-CTRR_FW_SIZE,
- shared_base=SHARED_HEAP_BASE, shared_size=SHARED_HEAP_SIZE,
- ipc_size=ipc_size, unk0=0x40, unk1=0x0))
- """
- ipc_data = open("ipc.bin", "rb").read()
- dart.iowrite(0, ipc_virt, ipc_data)
- def fw_requested_heap_alloc():
- extra_heap_virt = 0x1824000
- extra_heap_phys = u.heap.memalign(0x4000, extra_heap_size)
- p.memset32(extra_heap_phys, 0, extra_heap_size)
- dart.iomap_at(0, extra_heap_virt, extra_heap_phys, extra_heap_size)
- IPCChanTableEntry = Struct(
- "name" / PaddedString(0x40, "utf8"),
- "type" / Int32ul,
- "idx" / Int32ul,
- "size" / Int32ul,
- "pad" / Int32ul,
- "iova" / Hex(Int32ul),
- "pad" / Default(Int32ul, 0),
- "pad" / Default(Int32ul, 0),
- "pad" / Default(Int32ul, 0),
- "pad" / Padding(0xa0),
- )
- class ISPChannel:
- def __init__(self, name, type_, idx, size, iova):
- self.name = name
- self.type = type_
- self.idx = idx
- self.size = size
- self.iova = iova
- class ISPChannelTable:
- def __init__(self, terminal, io, debug, buf_h2t, buf_t2h, sharedmalloc, io_t2h):
- self.terminal = terminal
- self.io = io
- self.debug = debug
- self.buf_h2t = buf_h2t
- self.buf_t2h = buf_t2h
- self.sharedmalloc = sharedmalloc
- self.io_t2h = io_t2h
- def stage2():
- prep_ipc()
- fw_requested_heap_alloc()
- p.write32(0x22c104170, 0x1812f80) # IPC_WIRED_BASE + ipc_msg_offset 0x1812f80
- p.write32(0x22c104174, 0x0)
- p.write32(0x22c10418c, 0xf7fbdff9) # signal to fw
- for n in range(10):
- val = p.read32(0x22c10418c)
- print('ISP_GPIO7: 0x%x' % val)
- if (val == 0x8042006):
- print('MAGIC; BOOT PT2 SUCCESS')
- break
- time.sleep(0.1)
- unk_0 = p.read32(0x22c104170) # 0x1804000
- unk_1 = p.read32(0x22c104174) # 0x0
- print('ISP_GPIO0: 0x%x' % unk_0)
- print('ISP_GPIO1: 0x%x' % unk_1)
- print("channel description table at iova 0x%x" % unk_0)
- ipc_width = IPCChanTableEntry.sizeof() # 0x100
- chan_table_data = dart.ioread(0, unk_0, ipc_chan_count*ipc_width)
- channels = []
- for n in range(ipc_chan_count):
- chan_data = chan_table_data[n*ipc_width:(n+1)*ipc_width]
- parsed = IPCChanTableEntry.parse(chan_data)
- print(parsed)
- chan = ISPChannel(parsed.name, parsed.type, parsed.idx, parsed.size, parsed.iova)
- channels.append(chan)
- table = ISPChannelTable(*channels)
- p.write32(0x22c10417c, 0x8042006)
- for n in range(10):
- val = p.read32(0x22c10417c)
- print('ISP_GPIO6: 0x%x' % val)
- if (val == 0x0):
- print('MAGIC; BOOT PT3 SUCCESS')
- break
- time.sleep(0.1)
- print('irq: 0x%x 0x%x' % (p.read32(0x22c104000), p.read32(0x22c104004)))
- p.write32(0x22c104004, 0xf)
- p.write32(0x22c1043f0, 0x2)
- print('irq: 0x%x 0x%x' % (p.read32(0x22c104000), p.read32(0x22c104004)))
- p.write32(0x22c1043fc, 0x8)
- p.write32(0x22c1043f0, 0x8)
- print('irq: 0x%x 0x%x' % (p.read32(0x22c104000), p.read32(0x22c104004)))
- stage2()
- power_off()
- #run_shell(globals(), msg="Have fun!")
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
