wiiu-nanddumper-payload/ios_kernel/source/kernel_patches.c

/***************************************************************************
 * Copyright (C) 2016
 * by Dimok
 *
 * This software is provided 'as-is', without any express or implied
 * warranty. In no event will the authors be held liable for any
 * damages arising from the use of this software.
 *
 * Permission is granted to anyone to use this software for any
 * purpose, including commercial applications, and to alter it and
 * redistribute it freely, subject to the following restrictions:
 *
 * 1. The origin of this software must not be misrepresented; you
 * must not claim that you wrote the original software. If you use
 * this software in a product, an acknowledgment in the product
 * documentation would be appreciated but is not required.
 *
 * 2. Altered source versions must be plainly marked as such, and
 * must not be misrepresented as being the original software.
 *
 * 3. This notice may not be removed or altered from any source
 * distribution.
 ***************************************************************************/
#include "types.h"
#include "elf_patcher.h"
#include "ios_mcp_patches.h"
#include "ios_fs_patches.h"
#include "ios_bsp_patches.h"
#include "kernel_patches.h"
#include "exception_handler.h"
#include "fsa.h"
#include "config.h"
#include "utils.h"

extern void __KERNEL_CODE_START(void);
extern void __KERNEL_CODE_END(void);

extern const patch_table_t kernel_patches_table[];
extern const patch_table_t kernel_patches_table_end[];

static u8 otp_buffer[0x400];

static const u32 mcpIoMappings_patch[] =
{
    // vaddr    paddr       size        ?           ?           ?
    0x0D000000, 0x0D000000, 0x001C0000, 0x00000000, 0x00000003, 0x00000000,   // mapping 1
    0x0D800000, 0x0D800000, 0x001C0000, 0x00000000, 0x00000003, 0x00000000,   // mapping 2
    0x0C200000, 0x0C200000, 0x00100000, 0x00000000, 0x00000003, 0x00000000    // mapping 3
};

static const u32 KERNEL_MCP_IOMAPPINGS_STRUCT[] =
{
	(u32)mcpIoMappings_patch,   // ptr to iomapping structs
	0x00000003,                 // number of iomappings
	0x00000001                  // pid (MCP)
};

static u32 kernel_syscall_0x81(u32 address)
{
    return *(volatile u32*)address;
}

static int kernel_read_otp_internal(int index, void* out_buf, u32 size)
{
    kernel_memcpy(out_buf, otp_buffer + (index << 2), size);
    return 0;
}

int kernel_init_otp_buffer(u32 sd_sector, int dumpFound)
{
    int res;

    if(dumpFound)
    {
        res = FSA_SDReadRawSectors(otp_buffer, sd_sector, 2);
    }
    else
    {
        int (*orig_kernel_read_otp_internal)(int index, void* out_buf, u32 size) = (void*)0x08120248;
        res = orig_kernel_read_otp_internal(0, otp_buffer, 0x400);
    }

    if((res == 0) && (dumpFound == 0))
    {
        FSA_SDWriteRawSectors(otp_buffer, sd_sector, 2);
    }
    return res;
}

void kernel_launch_ios(u32 launch_address, u32 L, u32 C, u32 H)
{
    void (*kernel_launch_bootrom)(u32 launch_address, u32 L, u32 C, u32 H) = (void*)0x0812A050;

    if(*(u32*)(launch_address - 0x300 + 0x1AC) == 0x00DFD000)
    {
        int level = disable_interrupts();
        unsigned int control_register = disable_mmu();

        u32 ios_elf_start = launch_address + 0x804 - 0x300;

        //! try to keep the order of virt. addresses to reduce the memmove amount
        mcp_run_patches(ios_elf_start);
        kernel_run_patches(ios_elf_start);

        //if(cfw_config.redNAND)
        //{
        fs_run_patches(ios_elf_start);

        //    if(cfw_config.seeprom_red)
        //        bsp_run_patches(ios_elf_start);
        //}

        restore_mmu(control_register);
        enable_interrupts(level);
    }

    kernel_launch_bootrom(launch_address, L, C, H);
}

void kernel_run_patches(u32 ios_elf_start)
{
    section_write(ios_elf_start, (u32)__KERNEL_CODE_START, __KERNEL_CODE_START, __KERNEL_CODE_END - __KERNEL_CODE_START);
    section_write_word(ios_elf_start, 0x0812A120, ARM_BL(0x0812A120, kernel_launch_ios));

    section_write(ios_elf_start, 0x08140DE0, KERNEL_MCP_IOMAPPINGS_STRUCT, sizeof(KERNEL_MCP_IOMAPPINGS_STRUCT));

    section_write_word(ios_elf_start, 0x0812A134, ARM_BL(0x0812A134, crash_handler_prefetch));
    section_write_word(ios_elf_start, 0x0812A1AC, ARM_BL(0x0812A1AC, crash_handler_data));
    section_write_word(ios_elf_start, 0x08129E50, ARM_BL(0x08129E50, crash_handler_undef_instr));

    section_write_word(ios_elf_start, 0x0812CD2C, ARM_B(0x0812CD2C, kernel_syscall_0x81));

    /*if(cfw_config.redNAND && cfw_config.otp_red)
    {
        section_write(ios_elf_start, (u32)otp_buffer, otp_buffer, 0x400);
        section_write_word(ios_elf_start, 0x08120248, ARM_B(0x08120248, kernel_read_otp_internal));
    }*/

    u32 patch_count = (u32)(((u8*)kernel_patches_table_end) - ((u8*)kernel_patches_table)) / sizeof(patch_table_t);
    patch_table_entries(ios_elf_start, kernel_patches_table, patch_count);
}