Cmep registers: Difference between revisions
CelesteBlue (talk | contribs) No edit summary |
Tag: Undo |
||
(61 intermediate revisions by 4 users not shown) | |||
Line 1: | Line 1: | ||
= 0xE0000000: Cmep/ | = 0xE0000000: Mailbox = | ||
The mailbox is used for communication between ARM [[TrustZone]] and [[Cmep]] ([[Second Loader]] and [[Secure Kernel]]), and with the debugger. Communication seems to go through some sort of FIFO register. | |||
== Messages == | |||
Messages are sent by Cmep to ARM [[TrustZone]] using the lower 16-bits at 0xE0000000. When ARM [[TrustZone]] has read it, the register is set to 0. | |||
ARM [[TrustZone]] can write a 32-bit response to 0xE0000010. For ARM to Cmep, bit0 is used to indicate that the message has been written by ARM [[TrustZone]]. | |||
<pre> | |||
1 = Request succeeded | |||
4 = Debug string | |||
0x101 = Main init started | |||
0x102 = Sm can be loaded/resumed | |||
0x103 = Sm resumed successfully | |||
0x104 = Sm was shut down | |||
0x106 = Main shutting down | |||
0x107 = Suspend beginning | |||
0x108 = Ready for suspending, when using the async version. | |||
0x8016 = Error: Invalid address range | |||
0x802F = Error: Failed to init E003, E006. | |||
</pre> | |||
== 0xE0000000: MailboxCmepToArm == | == 0xE0000000: MailboxCmepToArm == | ||
Response to ARM is written here. | Response to ARM is written here. To read, get a double word from physical address <code>0xE0000000</code>. If it returns 0, no data is available. Otherwise, acknowledge that the data has been read by ARM [[TrustZone]] by putting the same data into <code>0xE0000000</code>. | ||
{| class="wikitable" | |||
|- | |||
! Address !! RW permissions !! Use !! Description | |||
|- | |||
| 0xE0000000 || RW || Status || Read for status. | |||
|- | |||
| 0xE0000004 || RW || Result || Cmep to ARM. 1: success. 3: command not found. 5: Invalid arguments. Used by SMC 0x12d, 0x136, 0x137, 0x13B, interrupt 0xC8. | |||
|- | |||
| 0xE0000008 || RW || ? || Used by SMC 0x12d, 0x136, 0x137, 0x13B, interrupt 0xC8. | |||
|- | |||
| 0xE000000C || RW || ? || Used by SMC 0x12d, 0x136, 0x137, 0x13B, interrupt 0xC8. | |||
|} | |||
== 0xE0000010: MailboxArmToCmep == | == 0xE0000010: MailboxArmToCmep == | ||
Request from ARM is written here. | Request from ARM is written here. To write, put the double word into physical address <code>0xE0000010</code>. Next read <code>0xE0000010</code> until it returns 0, which indicates the data was read by Cmep. | ||
{| class="wikitable" | |||
|- | |||
! Address !! RW permissions !! Use !! Description | |||
|- | |||
| 0xE0000010 || RW || Command || ARM to Cmep. Send a command to Cmep. | |||
|- | |||
| 0xE0000014 || RW || Arguments || ARM to Cmep. (PA & 1) == 1: valid arguments. See [[#Executing Secure Module functions|Executing Secure Module functions]]. | |||
|- | |||
| 0xE0000018 || RW || ? || See [[#Executing Secure Module functions|Executing Secure Module functions]]. | |||
|- | |||
| 0xE000001C || RW || ? || See [[#Executing Secure Module functions|Executing Secure Module functions]]. | |||
|} | |||
== 0xE0000020: MailboxCmepToDebugger == | == 0xE0000020: MailboxCmepToDebugger == | ||
Size: 2 * | Size: 2 * DWORD. | ||
== 0xE0000028: MailboxDebuggerToCmep == | == 0xE0000028: MailboxDebuggerToCmep == | ||
Size: 2 * DWORD. | Size: 2 * DWORD. | ||
== 0xE0000054: unknown == | |||
{| class="wikitable" | |||
|- | |||
! Address !! RW permissions !! Use !! Description | |||
|- | |||
| 0xE0000054 || RW || ? || Used by SMC 0x12d, 0x135, 0x13B, interrupt 0xC8. | |||
|- | |||
| 0xE0000058 || RW || ? || Used by SMC 0x12d, 0x135, 0x13B, interrupt 0xC8. | |||
|- | |||
| 0xE000005C || RW || ? || Used by SMC 0x12d, 0x135, 0x13B, interrupt 0xC8. | |||
|} | |||
== 0xE0000060: MailboxDebuggerToCmep2 == | == 0xE0000060: MailboxDebuggerToCmep2 == | ||
Line 29: | Line 90: | ||
| 0xE0010000 || 4 || TZ sets it to 1 then 0 and it appears cmep resets. | | 0xE0010000 || 4 || TZ sets it to 1 then 0 and it appears cmep resets. | ||
|- | |- | ||
| 0xE0010004 || 4 || Read by second_loader, checked against mask (& 5) and (& 8). Read by TZ after setting reset, checked if flag 0x80000000 is set. Ex: 0x80000005. Writing values to it from cmep does nothing. | | 0xE0010004 || 4 || crySboot. Read by second_loader, checked against mask (& 5) and (& 8). Read by TZ after setting reset, checked if flag 0x80000000 is set. Ex: 0x80000005. Writing values to it from cmep does nothing. | ||
|} | |} | ||
== 0xE0010000: CmepReset == | == 0xE0010000: CmepReset == | ||
Bit0: Hangs. ARM uses this to reset the | 0xE0010000: 00 00 00 00 05 00 00 80 00 00 00 00 00 00 00 00 | ||
Bit0: Hangs. ARM uses this to reset the Cmep subsystem. Used by Cmep command 0 to prepare Cmep to receive an address that contains the secure_kernel.enp. RW. | |||
== 0xE0010004: CmepStatus == | == 0xE0010004: CmepStatus == | ||
Line 41: | Line 104: | ||
Bit0-2: ? | Bit0-2: ? | ||
Used by Cmep command 0 to check if the value written in <code>0xE0010000</code> is okay (it should return a value <= 0). Read allowed, maybe not write. | |||
= | |||
== 0xE0010010: Device disable == | |||
Each bit corresponds to a different secure device | |||
This functionality is only present on SoC v3.2+ | |||
= 0xE0020000: Cmep 0xE0020000 = | = 0xE0020000: Cmep 0xE0020000 = | ||
Line 61: | Line 117: | ||
! Address !! Length !! Description | ! Address !! Length !! Description | ||
|- | |- | ||
| 0xE0020000 || 4 || second_loader sets it to 0x30003. secure_kernel sets it to 0x2000F | | 0xE0020000 || 4 || second_loader sets it to 0x30003 after ?clearing keys?. secure_kernel sets it to 0x2000F. | ||
|- | |- | ||
| 0xE0020004 || 4 || | | 0xE0020004 || 4 || cryAio. Read by second_loader, checked against 0x8000001F. Also set to ?0? by second_loader when setting 0x30003 at 0xE0020000. | ||
|- | |- | ||
| 0xE0020020 || 4 || Checked for 0 by second_loader. | | 0xE0020020 || 4 || Used in bignum powmod worker. Checked for 0 by second_loader. May be a kind of timer or working state. | ||
|- | |- | ||
| 0xE0020040 || 0x10 || [[ReadAs|Read As]] | | 0xE0020040 || 0x10 || [[ReadAs|Read As]] | ||
|- | |- | ||
| 0xE0020100 || 0x20 || 256 bit key from keyring 0x602 is copied here by second_loader. | | 0xE0020100 || 0x20 || Per-console 256-bit key from keyring 0x602 is copied here by second_loader. | ||
|} | |} | ||
== 0xE0020000 | == 0xE0020000 flags == | ||
Bit0: Reboot when cleared. | Bit0: Reboot when cleared. | ||
Bit1: Hang when cleared. | Bit1: Makes first_loader load secure_kernel. Hang when cleared and unrecoverable. | ||
Bit2: No hang when cleared. | Bit2: No hang when cleared. | ||
Bit3: No hang when cleared. | Bit3: No hang when cleared. | ||
Bit4: | Bit4: ? | ||
Bit5: | Bit5: ? | ||
Bit16: No hang when cleared. | Bit16: Allows ARM to reset Cmep. No hang when cleared. | ||
Bit17: | Bit17: ? | ||
= 0xE0030000: Bigmac Keyring controller = | = 0xE0030000: Bigmac Keyring controller = | ||
This device is mapped to ScePervasiveResetReg at offset 0x190 for controlling reset and enabling mask writing. | |||
This device is mapped to ScePervasiveResetReg | |||
<source lang="C"> | <source lang="C"> | ||
typedef struct BigmacKeyringControllerRegs { // 0xE0030000 | typedef struct BigmacKeyringControllerRegs { // physical address 0xE0030000 | ||
SceUInt32 | SceUInt32 keyring_new_value[8]; | ||
SceUInt32 keyring_set_value_trigger; | |||
SceUInt32 keyring_clear_flags; | |||
SceUInt32 keyring_query_flags_request; | |||
SceUInt32 keyring_query_flags_response; | |||
SceUInt32 | |||
SceUInt32 | |||
SceUInt32 | |||
SceUInt32 | |||
} BigmacKeyringControllerRegs; | } BigmacKeyringControllerRegs; | ||
</source> | </source> | ||
== 0xE0030000 | == 0xE0030000: KeyringNewValue == | ||
Size: 8 * DWORD. | Size: 8 * DWORD. | ||
Line 152: | Line 159: | ||
== 0xE0030020: KeyringSetValueTrigger == | == 0xE0030020: KeyringSetValueTrigger == | ||
Write a keyring to this address, and the Bigmac Keyring Controller will write value | Write value to a keyring. Requires the keyring to be enabled and WriteByCmepAllowed flag to be set. | ||
Write a keyring to this address, and the Bigmac Keyring Controller will write value from physical address 0xE0030000 to the keyring. | |||
== 0xE0030024: KeyringClearFlags == | |||
Note that there is no known way to set some keyrings flags in any way (doing keyring_flags |= or_flags), even though the opposite (clearing flags) is doable for some flags. | |||
Writing <code>((flags_mask<<16)|keyring_id)</code> to <code>keyring_clear_flags</code> clear flags for this keyring. | |||
Bit0-15: | Bit0-15: KeyringId | ||
Bit16-31: | Bit16-31: KeyringClearFlagsMask | ||
== 0xE0030028: KeyringQueryFlags == | == 0xE0030028: KeyringQueryFlags == | ||
Writing <code>keyring_id</code> to <code>keyring_query_flags_request</code> returns current flags in <code>keyring_query_flags_response</code>. | |||
Bit0-15: KeyringId | Bit0-15: KeyringId | ||
== 0xE003002C: | == 0xE003002C: KeyringQueryFlagsResponse == | ||
A | Bit Mask value Clearable Description | ||
0 (0x0000 0001): N/A | KeyringExists | |||
1 (0x0000 0002): N/A | KeyringEnabled. You cannot use the keyring if this is not set. | |||
2 (0x0000 0004): N/A | Unknown | |||
16 (0x0001 0000): Clearable | AesEncryptAllowed (CTR+CBC+ECB, any key size) | |||
17 (0x0002 0000): Clearable | AesDecryptAllowed (CTR+CBC+ECB, any key size) | |||
18 (0x0004 0000): Clearable | ShaHmacAllowed (SHA1+SHA256) | |||
19 (0x0008 0000): Clearable | AesCmacAllowed | |||
20 (0x0010 0000): Clearable | Master keyring can target memory. | |||
21 (0x0020 0000): Fixed | IsMaster. Master keyring can target slave keyring (based on Mask Group below). | |||
22 (0x0040 0000): Fixed | MemberOfGroup0. Keyring Pairing Lock Mask Group 0 (master keyrings 0x204-0x205 and slave keyrings 0-7). | |||
23 (0x0080 0000): Fixed | MemberOfGroup1. Keyring Pairing Lock Mask Group 1 (master keyrings 0x206-0x20D and slave keyrings 8-0xF). | |||
24 (0x0100 0000): Fixed | MemberOfGroup2. Keyring Pairing Lock Mask Group 2 (master keyrings 0x340-0x343 and slave keyrings 0x10-0x1F). | |||
25 (0x0200 0000): Fixed | MemberOfGroup3. Keyring Pairing Lock Mask Group 3 (master keyrings 0x344-0x353 and slave keyrings 0x20-0x2F). | |||
26 (0x0400 0000): Clearable | ?WriteByBigmacAllowed?. ?Locked keyring can target Cmep memory.? | |||
27 (0x0800 0000): Clearable | WriteByCmepAllowed. Can be written directly by Cmep. | |||
28 (0x1000 0000): Clearable | ReadByCmepAllowed. Can be read directly by Cmep. | |||
A | A normal keyring is a keyring that do not belong to any group (bit21-25 are all zeroes). It can be written by slaves of groups, and also by normal non-keyring operations. They can write to ?a normal keyring or to external memory?. | ||
A master keyring can only write into a slave keyring belonging to the same group(s) as itself. A master keyring cannot write into a non-slave keyring or external memory. | |||
A slave keyring can write | A slave keyring can write to a normal keyring or to external memory, but not to a master keyring. | ||
VULN!! If a keyring has AesDecryptAllowed, it is possible to encrypt arbitrary AES blocks without AesEncryptAllowed by using AES CTR mode. | VULN!! If a keyring has AesDecryptAllowed flag, it is possible to encrypt arbitrary AES blocks without AesEncryptAllowed flag by using AES CTR mode. | ||
= SceBignum controller = | = SceBignum controller = | ||
== | == 0xE0040000 == | ||
0x1000 config * 0x10 = 0x10000-bytes | |||
status bits | |||
<source> | |||
0x2000000 : error | |||
0x4000000 : busy for vEX (exponent) | |||
0x8000000 : still need vEX (exponent) | |||
0x80000000 : busy | |||
</source> | |||
= Bigmac Crypto Controller = | = Bigmac Crypto Controller = | ||
Line 238: | Line 243: | ||
} BigmacOp; | } BigmacOp; | ||
</source> | </source> | ||
When Keyring is set to src, only slots with the 0x1000 flag can be targeted. Selecting a slot that does not have 0x1000 will only read zeros. | |||
== 0xE005000C: Bigmac crypto controller function == | == 0xE005000C: Bigmac crypto controller function == | ||
There is usage of higher bits in the commands that do not seem to have much affect. For the encryption examples, 0xC002000 is also set on the command upper bits. | |||
Also some bits seem to affect the ARM cache. | |||
Bits Mask Value Description | |||
0~2 | 0x00000007 | Algorithm | |||
3~5 | 0x00000038 | Mode | |||
6 | 0x00000040 | DES | |||
7 | 0x00000080 | Use external key (a key placed at 0xE0050200 is used instead of the key in the keyring) | |||
8~9 | 0x00000300 | Key size for AES and DES functions. 0x000: 64-bits, 0x100: 128-bits, 0x200: 192-bits, 0x300: 256-bits | |||
10~11 | 0x00000C00 | Hash transform flags. 0x400: hashUpdate, 0x800: hashFinalize | |||
12 | 0x00001000 | Unknown. Used by sceDmacMemcpy/sceDmacMemset. | |||
13 | 0x00002000 | Unknown. Some common option. | |||
14~23 | 0x00FFC000 | Unknown | |||
24~25 | 0x03000000 | Some address callback. Used by sceDmacMemcpy/sceDmacMemset. If set, need to call sceKernelSysrootDisableAutoClockDownForDriver. Setting this bit with an AES function triggers hang. | |||
26~27 | 0x0C000000 | Unknown | |||
28 | 0x10000000 | Is destination a keyring | |||
29~31 | 0xE0000000 | Unknown | |||
Functions list: | |||
* 0x00000000 Copy | |||
* 0x00000001 Encrypt. Default algorithm is AES. Default mode is ECB. | |||
* 0x00000002 Decrypt. Default algorithm is AES. Default mode is ECB. | |||
* 0x00000003 Hash. Default algorithm is SHA-1. | |||
* 0x00000004 RNG | |||
* 0x00000008 CBC mode | |||
* 0x0000000B Sha224 | |||
* 0x0000000C Memset | |||
* 0x00000010 CTR mode | |||
* 0x00000013 Sha256 | |||
* 0x00000020 HMAC-Sha | |||
* 0x0000003B CBC-MAC (The size written to dst is always 16-bytes) | |||
* 0x00000040 DES | |||
Functions examples: | |||
* 0x00000001 AesEcbEncrypt | |||
* 0x00000009 AesCbcEncrypt | |||
* 0x00000011 AesCtrEncrypt | |||
* 0x00000002 AesEcbDecrypt | |||
* 0x0000000A AesCbcDecrypt | |||
* 0x00000012 AesCtrDecrypt | |||
* 0x00000041 DesEcbEncrypt | |||
* 0x00000042 DesEcbDecrypt | |||
* 0x00000049 DesCbcEncrypt | |||
* 0x0000004A DesCbcDecrypt | |||
* 0x00000003 SHA1 | |||
* 0x0000000B SHA224 | |||
* 0x00000013 SHA256 | |||
* 0x00000023 HmacSha1 | |||
* 0x0000002B HmacSha224 | |||
* 0x00000033 HmacSha256 | |||
* 0x0000003B AesCmac/AES-CBC-MAC-64 (CMAC, OMAC1) | |||
* 0x00000004 RNG | |||
* 0x0000000C Memset (ch is written to MacDevice offset 0x104. On FW 3.600.011, the ch is at offset 0x34) | |||
Unlike for [[DMAC#DMAC5|Dmac5]], DES is not supported by Bigmac and it triggers hang up (to confirm). Note that if keysize is 128 or 192, DES is in fact 3DES. If both DES and SHA bits are set, DES bit is ignored and SHA command is executed. | |||
The following are known to be able to write keyrings: | Key sizes examples: | ||
* 0x00000101 Aes128EcbEncrypt | |||
* 0x00000102 Aes128EcbDecrypt | |||
* 0x00000201 Aes192EcbEncrypt | |||
* 0x00000202 Aes192EcbDecrypt | |||
* 0x00000301 Aes256EcbEncrypt | |||
* 0x00000302 Aes256EcbDecrypt | |||
* 0x00000109 Aes128CbcEncrypt | |||
* 0x0000010A Aes128CbcDecrypt | |||
* 0x00000209 Aes192CbcEncrypt | |||
* 0x0000020A Aes192CbcDecrypt | |||
* 0x00000309 Aes256CbcEncrypt | |||
* 0x0000030A Aes256CbcDecrypt | |||
* 0x0000013B Aes128Cmac/AES-CBC-MAC-128 (CMAC, OMAC1) | |||
* 0x0000023B Aes192Cmac/AES-CBC-MAC-192 (CMAC, OMAC1) | |||
* 0x0000033B Aes256Cmac/AES-CBC-MAC-256 (CMAC, OMAC1) | |||
The following commands are known to be able to write to keyrings: | |||
* AesEcbEncrypt/Decrypt: | * AesEcbEncrypt/Decrypt: | ||
Size is rounded up to multiple of 4. | Size is rounded up to multiple of 4. | ||
If size > 16, size = 16. | If size > 16, size = 16. | ||
Read |size| bytes from |src| into HW state. | Read |size| bytes from |src| into HW state. | ||
The remaining 16-|size| bytes of state *ARE KEPT FROM RESULT OF PREVIOUS AES OPERATION*. | The remaining 16-|size| bytes of state *ARE KEPT FROM RESULT OF PREVIOUS AES OPERATION*. | ||
VULN! This allows key recovery of all slave keyrings during boot. | VULN! This allows key recovery of all slave keyrings during boot. | ||
The key written to keyring is always 16 bytes long, padded with 00's. | The key written to keyring is always 16 bytes long, padded with 00's. | ||
* AesCbcEncrypt/Decrypt: Size is rounded up to multiple of 4. | * AesCbcEncrypt/Decrypt: Size is rounded up to multiple of 4. | ||
* AesCtrEncrypt/Decrypt: Size is rounded up to multiple of 4. | * AesCtrEncrypt/Decrypt: Size is rounded up to multiple of 4. | ||
Line 312: | Line 349: | ||
VULN! Any SHA with length==0 produces an output of all zeroes! | VULN! Any SHA with length==0 produces an output of all zeroes! | ||
== 0xE0050024: Stat == | |||
Bit Mask Value Description | |||
0 | 0x00000001 | Busy | |||
1 | 0x00000002 | DMAC transfer is aborted | |||
15 | 0x00008000 | Some error status | |||
16 | 0x00010000 | DMAC transfer error: read error | |||
17 | 0x00020000 | DMAC transfer error: write error | |||
18 | 0x00040000 | DMAC error: illegal configuration | |||
19 | 0x00080000 | DMAC transfer error: tag error | |||
20 | 0x00100000 | DMAC transfer error: zero byte error | |||
== 0xE005003C: Bigmac Rng == | == 0xE005003C: Bigmac Rng == | ||
Line 317: | Line 366: | ||
Reads a random value. | Reads a random value. | ||
== | == 0xE0050104: Busy bigmac channels == | ||
RW Bitfield: bit0 - channel0 busy, bit1 - channel1 busy | |||
== 0xE0050108: Disabled bigmac channels == | |||
RO Bitfield: bit0 - channel0 disabled, bit1 - channel1 disabled | |||
== 0xE005011C: Bigmac exception status == | |||
* 0xE0050118: optional exception data such as illegal addr, RO | |||
* 0xE005011C: exception bitfield (eg bit8 illegal read, bit9 illegal write, higher bits are OPids - interface, cmd, internal etc) | |||
Once an exception occurs and the bitfield is set, you must ack by clearing it otherwise no further exceptions will be logged. | |||
== 0xE0050200: Bigmac External Key == | == 0xE0050200: Bigmac External Key == | ||
Line 327: | Line 385: | ||
= Bigmac Key Ring Base = | = Bigmac Key Ring Base = | ||
See [[ | See [[Cmep Key Ring Base]]. | ||
All keyrings flags are reset when Cmep is reset. | |||
Keyrings lock list | |||
Location Keyring Clear When | |||
first_loader | 0xA | 0x1C1F | decrypt_enc_body | |||
0x20 | 0x1C1F | update_slsk_metadata_keys | |||
0x207 | 0x1C1F | remove_slsk_personalization | |||
0x208~0x20D | 0x1C1F | update_slsk_metadata_keys | |||
0x20F | 0x1C0F | set first eMMC key | |||
0x501 | 0x0800 | update_bigmac_key_0x501 | |||
0x700~0x7FF | 0x1000 | slsk_header_rsa_check | |||
Any keyring | 0x1C1F | disable_bigmac_keys_by_header | |||
second_loader | 0x20E | 0x1FEF | set second eMMC key | |||
secure_kernel | 0x8 | 0x1FFE | on TZS communication | |||
0x2~ 0x7 | 0x1FFF | on TZS communication | |||
0x9~ 0xF | 0x1FFF | on TZS communication | |||
0x11~ 0x21 | 0x1FFF | on TZS communication | |||
0x25~ 0x2F | 0x1FFF | on TZS communication | |||
0x35~ 0x7F | 0x1FFF | on TZS communication | |||
0x101~0x17F | 0x1FFF | on TZS communication | |||
0x200~0x203 | 0x1FFF | on TZS communication | |||
0x206~0x20D | 0x1FFF | on TZS communication | |||
0x20E~0x20F | 0x1FEF | on TZS communication | |||
0x210~0x211 | 0x1FFF | on TZS communication | |||
0x214~0x215 | 0x1FFF | on TZS communication | |||
0x217 | 0x1FFF | on TZS communication | |||
0x300~0x33F | 0x1FFF | on TZS communication | |||
0x341~0x344 | 0x1FFF | on TZS communication | |||
0x349~0x3FF | 0x1FFF | on TZS communication | |||
0x400~0x47F | 0x1FFF | on TZS communication | |||
0x50E | 0x0800 | on TZS communication | |||
0x51C~0x57F | 0x1FFF | on TZS communication | |||
0x605~0x607 | 0x1FFF | on TZS communication | |||
0x700~0x7FF | 0x1FFF | on TZS communication | |||
== 0xE0058000: Bigmac KeyRings == | == 0xE0058000: Bigmac KeyRings == | ||
Size: 0x10000 bytes. | Size: 0x10000 bytes. | ||
= 0xE0070000: SceEmmcController = | = 0xE0070000: SceEmmcController = | ||
Line 391: | Line 434: | ||
| 0xE0070000 || 4 || Ex: 1. Set to 0, then 1 after writing to 0xE0070008. | | 0xE0070000 || 4 || Ex: 1. Set to 0, then 1 after writing to 0xE0070008. | ||
|- | |- | ||
| 0xE0070008 || 4 || Set to 0x020E020F in second_loader. | | 0xE0070008 || 4 || Set to 0x020E020F in second_loader. Probably also set to 0x020E020F in first_loader. | ||
|- | |- | ||
| 0xE007000C || 4 || Ex: 2. | | 0xE007000C || 4 || Ex: 2. | ||
Line 398: | Line 441: | ||
|} | |} | ||
== 0xE0070000: EmmcCrypto Toggle | == 0xE0070000: EmmcCrypto Toggle == | ||
Toggle: Set to 1. | Toggle: Set to 1 to enable eMMC crypto, 0 to disable. | ||
== 0xE0070004: EmmcCrypto availability status == | |||
bit0 (& 1): <code>boot device status</code> - if set, [[Second Loader]] aborts. | |||
== 0xE0070008: EmmcCrypto keyrings indexes == | |||
There are two 16-bit keyrings indexes. | |||
Ex: 0x020E020F (set in 1.69-3.740.011 second_loader): keyrings 0x20E and 0x20F. | |||
Only writeable. | |||
If set to an invalid keyring, eMMC crypto is disabled. | |||
== 0xE007000C: Unknown == | == 0xE007000C: Unknown == | ||
Line 418: | Line 463: | ||
Read value example: 2 | Read value example: 2 | ||
= 0xE00C0000 = | = 0xE00C0000 - Cmep XBar = | ||
[[Category: | [[Category:Cmep]] | ||
[[Category:ARM]] | |||
[[Category:MMIO]] |
Latest revision as of 16:32, 9 August 2024
0xE0000000: Mailbox
The mailbox is used for communication between ARM TrustZone and Cmep (Second Loader and Secure Kernel), and with the debugger. Communication seems to go through some sort of FIFO register.
Messages
Messages are sent by Cmep to ARM TrustZone using the lower 16-bits at 0xE0000000. When ARM TrustZone has read it, the register is set to 0.
ARM TrustZone can write a 32-bit response to 0xE0000010. For ARM to Cmep, bit0 is used to indicate that the message has been written by ARM TrustZone.
1 = Request succeeded 4 = Debug string 0x101 = Main init started 0x102 = Sm can be loaded/resumed 0x103 = Sm resumed successfully 0x104 = Sm was shut down 0x106 = Main shutting down 0x107 = Suspend beginning 0x108 = Ready for suspending, when using the async version. 0x8016 = Error: Invalid address range 0x802F = Error: Failed to init E003, E006.
0xE0000000: MailboxCmepToArm
Response to ARM is written here. To read, get a double word from physical address 0xE0000000
. If it returns 0, no data is available. Otherwise, acknowledge that the data has been read by ARM TrustZone by putting the same data into 0xE0000000
.
Address | RW permissions | Use | Description |
---|---|---|---|
0xE0000000 | RW | Status | Read for status. |
0xE0000004 | RW | Result | Cmep to ARM. 1: success. 3: command not found. 5: Invalid arguments. Used by SMC 0x12d, 0x136, 0x137, 0x13B, interrupt 0xC8. |
0xE0000008 | RW | ? | Used by SMC 0x12d, 0x136, 0x137, 0x13B, interrupt 0xC8. |
0xE000000C | RW | ? | Used by SMC 0x12d, 0x136, 0x137, 0x13B, interrupt 0xC8. |
0xE0000010: MailboxArmToCmep
Request from ARM is written here. To write, put the double word into physical address 0xE0000010
. Next read 0xE0000010
until it returns 0, which indicates the data was read by Cmep.
Address | RW permissions | Use | Description |
---|---|---|---|
0xE0000010 | RW | Command | ARM to Cmep. Send a command to Cmep. |
0xE0000014 | RW | Arguments | ARM to Cmep. (PA & 1) == 1: valid arguments. See Executing Secure Module functions. |
0xE0000018 | RW | ? | See Executing Secure Module functions. |
0xE000001C | RW | ? | See Executing Secure Module functions. |
0xE0000020: MailboxCmepToDebugger
Size: 2 * DWORD.
0xE0000028: MailboxDebuggerToCmep
Size: 2 * DWORD.
0xE0000054: unknown
Address | RW permissions | Use | Description |
---|---|---|---|
0xE0000054 | RW | ? | Used by SMC 0x12d, 0x135, 0x13B, interrupt 0xC8. |
0xE0000058 | RW | ? | Used by SMC 0x12d, 0x135, 0x13B, interrupt 0xC8. |
0xE000005C | RW | ? | Used by SMC 0x12d, 0x135, 0x13B, interrupt 0xC8. |
0xE0000060: MailboxDebuggerToCmep2
Size: 2 * DWORD.
0xE0010000: Cmep controller
Address | Length | Description |
---|---|---|
0xE0010000 | 4 | TZ sets it to 1 then 0 and it appears cmep resets. |
0xE0010004 | 4 | crySboot. Read by second_loader, checked against mask (& 5) and (& 8). Read by TZ after setting reset, checked if flag 0x80000000 is set. Ex: 0x80000005. Writing values to it from cmep does nothing. |
0xE0010000: CmepReset
0xE0010000: 00 00 00 00 05 00 00 80 00 00 00 00 00 00 00 00
Bit0: Hangs. ARM uses this to reset the Cmep subsystem. Used by Cmep command 0 to prepare Cmep to receive an address that contains the secure_kernel.enp. RW.
0xE0010004: CmepStatus
Bit31: IsCmepAlive Bit0-2: ?
Used by Cmep command 0 to check if the value written in 0xE0010000
is okay (it should return a value <= 0). Read allowed, maybe not write.
0xE0010010: Device disable
Each bit corresponds to a different secure device This functionality is only present on SoC v3.2+
0xE0020000: Cmep 0xE0020000
Address | Length | Description |
---|---|---|
0xE0020000 | 4 | second_loader sets it to 0x30003 after ?clearing keys?. secure_kernel sets it to 0x2000F. |
0xE0020004 | 4 | cryAio. Read by second_loader, checked against 0x8000001F. Also set to ?0? by second_loader when setting 0x30003 at 0xE0020000. |
0xE0020020 | 4 | Used in bignum powmod worker. Checked for 0 by second_loader. May be a kind of timer or working state. |
0xE0020040 | 0x10 | Read As |
0xE0020100 | 0x20 | Per-console 256-bit key from keyring 0x602 is copied here by second_loader. |
0xE0020000 flags
Bit0: Reboot when cleared. Bit1: Makes first_loader load secure_kernel. Hang when cleared and unrecoverable. Bit2: No hang when cleared. Bit3: No hang when cleared. Bit4: ? Bit5: ? Bit16: Allows ARM to reset Cmep. No hang when cleared. Bit17: ?
0xE0030000: Bigmac Keyring controller
This device is mapped to ScePervasiveResetReg at offset 0x190 for controlling reset and enabling mask writing.
typedef struct BigmacKeyringControllerRegs { // physical address 0xE0030000 SceUInt32 keyring_new_value[8]; SceUInt32 keyring_set_value_trigger; SceUInt32 keyring_clear_flags; SceUInt32 keyring_query_flags_request; SceUInt32 keyring_query_flags_response; } BigmacKeyringControllerRegs;
0xE0030000: KeyringNewValue
Size: 8 * DWORD.
0xE0030020: KeyringSetValueTrigger
Write value to a keyring. Requires the keyring to be enabled and WriteByCmepAllowed flag to be set.
Write a keyring to this address, and the Bigmac Keyring Controller will write value from physical address 0xE0030000 to the keyring.
0xE0030024: KeyringClearFlags
Note that there is no known way to set some keyrings flags in any way (doing keyring_flags |= or_flags), even though the opposite (clearing flags) is doable for some flags.
Writing ((flags_mask<<16)|keyring_id)
to keyring_clear_flags
clear flags for this keyring.
Bit0-15: KeyringId Bit16-31: KeyringClearFlagsMask
0xE0030028: KeyringQueryFlags
Writing keyring_id
to keyring_query_flags_request
returns current flags in keyring_query_flags_response
.
Bit0-15: KeyringId
0xE003002C: KeyringQueryFlagsResponse
Bit Mask value Clearable Description 0 (0x0000 0001): N/A | KeyringExists 1 (0x0000 0002): N/A | KeyringEnabled. You cannot use the keyring if this is not set. 2 (0x0000 0004): N/A | Unknown 16 (0x0001 0000): Clearable | AesEncryptAllowed (CTR+CBC+ECB, any key size) 17 (0x0002 0000): Clearable | AesDecryptAllowed (CTR+CBC+ECB, any key size) 18 (0x0004 0000): Clearable | ShaHmacAllowed (SHA1+SHA256) 19 (0x0008 0000): Clearable | AesCmacAllowed 20 (0x0010 0000): Clearable | Master keyring can target memory. 21 (0x0020 0000): Fixed | IsMaster. Master keyring can target slave keyring (based on Mask Group below). 22 (0x0040 0000): Fixed | MemberOfGroup0. Keyring Pairing Lock Mask Group 0 (master keyrings 0x204-0x205 and slave keyrings 0-7). 23 (0x0080 0000): Fixed | MemberOfGroup1. Keyring Pairing Lock Mask Group 1 (master keyrings 0x206-0x20D and slave keyrings 8-0xF). 24 (0x0100 0000): Fixed | MemberOfGroup2. Keyring Pairing Lock Mask Group 2 (master keyrings 0x340-0x343 and slave keyrings 0x10-0x1F). 25 (0x0200 0000): Fixed | MemberOfGroup3. Keyring Pairing Lock Mask Group 3 (master keyrings 0x344-0x353 and slave keyrings 0x20-0x2F). 26 (0x0400 0000): Clearable | ?WriteByBigmacAllowed?. ?Locked keyring can target Cmep memory.? 27 (0x0800 0000): Clearable | WriteByCmepAllowed. Can be written directly by Cmep. 28 (0x1000 0000): Clearable | ReadByCmepAllowed. Can be read directly by Cmep.
A normal keyring is a keyring that do not belong to any group (bit21-25 are all zeroes). It can be written by slaves of groups, and also by normal non-keyring operations. They can write to ?a normal keyring or to external memory?.
A master keyring can only write into a slave keyring belonging to the same group(s) as itself. A master keyring cannot write into a non-slave keyring or external memory.
A slave keyring can write to a normal keyring or to external memory, but not to a master keyring.
VULN!! If a keyring has AesDecryptAllowed flag, it is possible to encrypt arbitrary AES blocks without AesEncryptAllowed flag by using AES CTR mode.
SceBignum controller
0xE0040000
0x1000 config * 0x10 = 0x10000-bytes
status bits
0x2000000 : error 0x4000000 : busy for vEX (exponent) 0x8000000 : still need vEX (exponent) 0x80000000 : busy
Bigmac Crypto Controller
// base: 0xE0050000 (channel0), 0xE0050080 (channel1) typedef struct BigmacOp { const void *src; union { void *dst; SceUInt32 dst_keyring_id; }; SceSize len; int func; // operation SceUInt32 work_keyring_id; void *iv; void *next; int ready; // Writing 1 here starts the operation. int status; int res; // Set when invalid keyring (0xFFF). Bit18: Set when keyring is not allowed to perform operation. } BigmacOp;
When Keyring is set to src, only slots with the 0x1000 flag can be targeted. Selecting a slot that does not have 0x1000 will only read zeros.
0xE005000C: Bigmac crypto controller function
There is usage of higher bits in the commands that do not seem to have much affect. For the encryption examples, 0xC002000 is also set on the command upper bits.
Also some bits seem to affect the ARM cache.
Bits Mask Value Description 0~2 | 0x00000007 | Algorithm 3~5 | 0x00000038 | Mode 6 | 0x00000040 | DES 7 | 0x00000080 | Use external key (a key placed at 0xE0050200 is used instead of the key in the keyring) 8~9 | 0x00000300 | Key size for AES and DES functions. 0x000: 64-bits, 0x100: 128-bits, 0x200: 192-bits, 0x300: 256-bits 10~11 | 0x00000C00 | Hash transform flags. 0x400: hashUpdate, 0x800: hashFinalize 12 | 0x00001000 | Unknown. Used by sceDmacMemcpy/sceDmacMemset. 13 | 0x00002000 | Unknown. Some common option. 14~23 | 0x00FFC000 | Unknown 24~25 | 0x03000000 | Some address callback. Used by sceDmacMemcpy/sceDmacMemset. If set, need to call sceKernelSysrootDisableAutoClockDownForDriver. Setting this bit with an AES function triggers hang. 26~27 | 0x0C000000 | Unknown 28 | 0x10000000 | Is destination a keyring 29~31 | 0xE0000000 | Unknown
Functions list:
- 0x00000000 Copy
- 0x00000001 Encrypt. Default algorithm is AES. Default mode is ECB.
- 0x00000002 Decrypt. Default algorithm is AES. Default mode is ECB.
- 0x00000003 Hash. Default algorithm is SHA-1.
- 0x00000004 RNG
- 0x00000008 CBC mode
- 0x0000000B Sha224
- 0x0000000C Memset
- 0x00000010 CTR mode
- 0x00000013 Sha256
- 0x00000020 HMAC-Sha
- 0x0000003B CBC-MAC (The size written to dst is always 16-bytes)
- 0x00000040 DES
Functions examples:
- 0x00000001 AesEcbEncrypt
- 0x00000009 AesCbcEncrypt
- 0x00000011 AesCtrEncrypt
- 0x00000002 AesEcbDecrypt
- 0x0000000A AesCbcDecrypt
- 0x00000012 AesCtrDecrypt
- 0x00000041 DesEcbEncrypt
- 0x00000042 DesEcbDecrypt
- 0x00000049 DesCbcEncrypt
- 0x0000004A DesCbcDecrypt
- 0x00000003 SHA1
- 0x0000000B SHA224
- 0x00000013 SHA256
- 0x00000023 HmacSha1
- 0x0000002B HmacSha224
- 0x00000033 HmacSha256
- 0x0000003B AesCmac/AES-CBC-MAC-64 (CMAC, OMAC1)
- 0x00000004 RNG
- 0x0000000C Memset (ch is written to MacDevice offset 0x104. On FW 3.600.011, the ch is at offset 0x34)
Unlike for Dmac5, DES is not supported by Bigmac and it triggers hang up (to confirm). Note that if keysize is 128 or 192, DES is in fact 3DES. If both DES and SHA bits are set, DES bit is ignored and SHA command is executed.
Key sizes examples:
- 0x00000101 Aes128EcbEncrypt
- 0x00000102 Aes128EcbDecrypt
- 0x00000201 Aes192EcbEncrypt
- 0x00000202 Aes192EcbDecrypt
- 0x00000301 Aes256EcbEncrypt
- 0x00000302 Aes256EcbDecrypt
- 0x00000109 Aes128CbcEncrypt
- 0x0000010A Aes128CbcDecrypt
- 0x00000209 Aes192CbcEncrypt
- 0x0000020A Aes192CbcDecrypt
- 0x00000309 Aes256CbcEncrypt
- 0x0000030A Aes256CbcDecrypt
- 0x0000013B Aes128Cmac/AES-CBC-MAC-128 (CMAC, OMAC1)
- 0x0000023B Aes192Cmac/AES-CBC-MAC-192 (CMAC, OMAC1)
- 0x0000033B Aes256Cmac/AES-CBC-MAC-256 (CMAC, OMAC1)
The following commands are known to be able to write to keyrings:
* AesEcbEncrypt/Decrypt: Size is rounded up to multiple of 4. If size > 16, size = 16. Read |size| bytes from |src| into HW state. The remaining 16-|size| bytes of state *ARE KEPT FROM RESULT OF PREVIOUS AES OPERATION*. VULN! This allows key recovery of all slave keyrings during boot. The key written to keyring is always 16 bytes long, padded with 00's. * AesCbcEncrypt/Decrypt: Size is rounded up to multiple of 4. * AesCtrEncrypt/Decrypt: Size is rounded up to multiple of 4. * AesCmac Puts the 16 byte hash into keyring. Bytes 16-31 are *FORCED* 0. * Sha1: Puts the 20 byte hash into keyring. Bytes 20-31 are *FORCED* 0. * Sha224: Puts the 28 byte hash into keyring. Bytes 28-31 are *FORCED* 0. * Sha256: Puts the 32 byte hash into keyring. * HmacSha1 Probably same as Sha1. * HmacSha256 Probably same as Sha256. * Rng
AesCtrEncrypt when having a keyring dst, still reads from src.
VULN! Any SHA with length==0 produces an output of all zeroes!
0xE0050024: Stat
Bit Mask Value Description 0 | 0x00000001 | Busy 1 | 0x00000002 | DMAC transfer is aborted 15 | 0x00008000 | Some error status 16 | 0x00010000 | DMAC transfer error: read error 17 | 0x00020000 | DMAC transfer error: write error 18 | 0x00040000 | DMAC error: illegal configuration 19 | 0x00080000 | DMAC transfer error: tag error 20 | 0x00100000 | DMAC transfer error: zero byte error
0xE005003C: Bigmac Rng
Reads a random value.
0xE0050104: Busy bigmac channels
RW Bitfield: bit0 - channel0 busy, bit1 - channel1 busy
0xE0050108: Disabled bigmac channels
RO Bitfield: bit0 - channel0 disabled, bit1 - channel1 disabled
0xE005011C: Bigmac exception status
* 0xE0050118: optional exception data such as illegal addr, RO * 0xE005011C: exception bitfield (eg bit8 illegal read, bit9 illegal write, higher bits are OPids - interface, cmd, internal etc)
Once an exception occurs and the bitfield is set, you must ack by clearing it otherwise no further exceptions will be logged.
0xE0050200: Bigmac External Key
Size: 0x20 bytes
VULN! Allows partial overwrite. However when using keyring crypto, this key remains unaffected thus it cannot be used to recover keyring keys.
Bigmac Key Ring Base
See Cmep Key Ring Base.
All keyrings flags are reset when Cmep is reset.
Keyrings lock list Location Keyring Clear When first_loader | 0xA | 0x1C1F | decrypt_enc_body 0x20 | 0x1C1F | update_slsk_metadata_keys 0x207 | 0x1C1F | remove_slsk_personalization 0x208~0x20D | 0x1C1F | update_slsk_metadata_keys 0x20F | 0x1C0F | set first eMMC key 0x501 | 0x0800 | update_bigmac_key_0x501 0x700~0x7FF | 0x1000 | slsk_header_rsa_check Any keyring | 0x1C1F | disable_bigmac_keys_by_header second_loader | 0x20E | 0x1FEF | set second eMMC key secure_kernel | 0x8 | 0x1FFE | on TZS communication 0x2~ 0x7 | 0x1FFF | on TZS communication 0x9~ 0xF | 0x1FFF | on TZS communication 0x11~ 0x21 | 0x1FFF | on TZS communication 0x25~ 0x2F | 0x1FFF | on TZS communication 0x35~ 0x7F | 0x1FFF | on TZS communication 0x101~0x17F | 0x1FFF | on TZS communication 0x200~0x203 | 0x1FFF | on TZS communication 0x206~0x20D | 0x1FFF | on TZS communication 0x20E~0x20F | 0x1FEF | on TZS communication 0x210~0x211 | 0x1FFF | on TZS communication 0x214~0x215 | 0x1FFF | on TZS communication 0x217 | 0x1FFF | on TZS communication 0x300~0x33F | 0x1FFF | on TZS communication 0x341~0x344 | 0x1FFF | on TZS communication 0x349~0x3FF | 0x1FFF | on TZS communication 0x400~0x47F | 0x1FFF | on TZS communication 0x50E | 0x0800 | on TZS communication 0x51C~0x57F | 0x1FFF | on TZS communication 0x605~0x607 | 0x1FFF | on TZS communication 0x700~0x7FF | 0x1FFF | on TZS communication
0xE0058000: Bigmac KeyRings
Size: 0x10000 bytes.
0xE0070000: SceEmmcController
Address | Length | Description |
---|---|---|
0xE0070000 | 4 | Ex: 1. Set to 0, then 1 after writing to 0xE0070008. |
0xE0070008 | 4 | Set to 0x020E020F in second_loader. Probably also set to 0x020E020F in first_loader. |
0xE007000C | 4 | Ex: 2. |
0xE0070014 | 4 | Set to 6 under some condition in second_loader. |
0xE0070000: EmmcCrypto Toggle
Toggle: Set to 1 to enable eMMC crypto, 0 to disable.
0xE0070004: EmmcCrypto availability status
bit0 (& 1): boot device status
- if set, Second Loader aborts.
0xE0070008: EmmcCrypto keyrings indexes
There are two 16-bit keyrings indexes.
Ex: 0x020E020F (set in 1.69-3.740.011 second_loader): keyrings 0x20E and 0x20F.
Only writeable.
If set to an invalid keyring, eMMC crypto is disabled.
0xE007000C: Unknown
Read value example: 2