Xrpc call list

From t-hack.com - Hack X300T / X301T
(Difference between revisions)
Jump to: navigation, search
 
Line 10: Line 10:
 
| serial number [0..31](LSB) || [32..63] || [64..91] || [92..127](MSB) || 0
 
| serial number [0..31](LSB) || [32..63] || [64..91] || [92..127](MSB) || 0
 
|}
 
|}
 +
  
 
== XRPC_ID_GETRANDOM (2) ==
 
== XRPC_ID_GETRANDOM (2) ==
Line 22: Line 23:
 
| Random Number || 0 || 0 || 0 || 0
 
| Random Number || 0 || 0 || 0 || 0
 
|}
 
|}
 +
  
 
== XRPC_ID_GETBONDINGCOMMENT (3)==
 
== XRPC_ID_GETBONDINGCOMMENT (3)==
Line 34: Line 36:
 
| Bonding comment [0..31] (LSB)  || Bonding comment [32..63] (MSB)  || 0 || 0 || 0
 
| Bonding comment [0..31] (LSB)  || Bonding comment [32..63] (MSB)  || 0 || 0 || 0
 
|}
 
|}
 +
  
 
== XRPC_ID_SHA1XOS (4)==
 
== XRPC_ID_SHA1XOS (4)==
Line 48: Line 51:
 
| xos SHA1 hash [0..31] (LSB) || [32..63] || [64..91] || [92..127] || [128..159](MSB)
 
| xos SHA1 hash [0..31] (LSB) || [32..63] || [64..91] || [92..127] || [128..159](MSB)
 
|}
 
|}
 +
  
 
== XRPC_ID_XLOAD (5) ==
 
== XRPC_ID_XLOAD (5) ==
Line 65: Line 69:
 
* For xtasks and ucode type xloads, and from xos version >= D0, param1 is the dram controller to load the xtask too.
 
* For xtasks and ucode type xloads, and from xos version >= D0, param1 is the dram controller to load the xtask too.
 
* Otherwise param1 is reserved (should be 0).
 
* Otherwise param1 is reserved (should be 0).
 +
  
 
== XRPC_ID_XUNLOAD (17) ==
 
== XRPC_ID_XUNLOAD (17) ==
Line 77: Line 82:
 
| 0 || 0 || 0 || 0 ||0
 
| 0 || 0 || 0 || 0 ||0
 
|}
 
|}
 +
 +
 +
== XRPC_ID_REBOOT (19) ==
 +
reboot.
 +
{| border="1"
 +
!!! param0  !! param1 !! param2 !! param3 !! param4
 +
|-
 +
! input
 +
| 0 || 0 || 0 || 0 || 0
 +
|-
 +
! output
 +
| 0 || 0 || 0 || 0 ||0
 +
|}
 +
 +
 +
== XRPC_ID_XBIND (20) ==
 +
Bind the certificate type to a specific certificate (payload is the binding token). After binding the xload operation will only succeed when using the right certificate.
 +
{| border="1"
 +
!!! param0  !! param1 !! param2 !! param3 !! param4
 +
|-
 +
! input
 +
| xbind payload size || 0 || 0 || 0 || 0
 +
|-
 +
! output
 +
| 0 || 0 || 0 || 0 ||0
 +
|}
 +
 +
 +
== XRPC_ID_XSTART (21) ==
 +
Instantiate an xtask or microcode using the specified image. The image needs to be previously loaded with XLOAD xrpc. The registers a0-a3 are initialized before starting the xtask.
 +
{| border="1"
 +
!!! param0  !! param1 !! param2 !! param3 !! param4
 +
|-
 +
! input
 +
| Image ID || xtask initial a0 register / microcode target DSP or RISC. || task initial a1 register / 0 || task initial a2 register / 0 || task initial a3 register / 0
 +
|-
 +
! output
 +
| xtask id (aka Thread ID) / 0 || 0 || 0 || 0 ||0
 +
|}
 +
 +
* If ImageID<100, XSTART will start the xtask loaded in the 'ImageID' xtask image slot. If ImageID>=100, XSTART will start the microcode loaded in the 'ImageID-100' microcode image slot.
 +
* In case of microcode loading, param1 indicates the target DSP/RISC on which the microcode is going to be started:
 +
 +
{| border="1"
 +
|-
 +
|0|| Video Risc 0
 +
|-
 +
|1|| Video Risc 1
 +
|-
 +
|2|| Audio DSP 0
 +
|-
 +
|3|| Audio DSP 1
 +
|-
 +
|4|| Demux Risc
 +
|}
 +
 +
* In case of microcode loading, param2..param4 are reserved, and output parameters are also all reserved.
 +
 +
 +
== XRPC_ID_XKILL (22) ==
 +
Send a signal to an xtask. Use signal number -1 to stop an xtask.
 +
{| border="1"
 +
!!! param0  !! param1 !! param2 !! param3 !! param4
 +
|-
 +
! input
 +
| xtask id (aka Thread ID) || Signal number || 0 || 0 || 0
 +
|-
 +
! output
 +
| 0 || 0 || 0 || 0 ||0
 +
|}
 +
 +
* In case of a multi-threaded xtask, xkill will only signal or stop one specific thread.
 +
* There is no way to kill all spawned threads at once.
 +
* Each thread must terminate or be stopped individually.
 +
 +
 +
== XRPC_ID_GETBINDING (24) ==
 +
Get current binding. Return the SHA-1 of the current bound certificate for a particular certificate type. XRPC will fail if type is not bound.
 +
{| border="1"
 +
!!! param0  !! param1 !! param2 !! param3 !! param4
 +
|-
 +
! input
 +
| cert id || 0 || 0 || 0 || 0
 +
|-
 +
! output
 +
| SHA1 hash [0..31] (LSB) ||[32..63] ||[64..91] ||[92..127]  ||[128..159] (MSB)
 +
|}
 +
 +
 +
== XRPC_ID_GETOWNER (25) ==
 +
Get current owner of a sflash (secure flash) sector. Return the SHA-1 of the certificate of the owner of the sector. XRPC will fail if type sector is not currently owned.
 +
{| border="1"
 +
!!! param0  !! param1 !! param2 !! param3 !! param4
 +
|-
 +
! input
 +
| sector number || 0 || 0 || 0 || 0
 +
|-
 +
! output
 +
| SHA1 hash [0..31] (LSB) ||[32..63] ||[64..91] ||[92..127]  ||[128..159] (MSB)
 +
|}
 +
 +
 +
== XRPC_ID_VERSION (27) ==
 +
VERSION returns the XOS version. Available for xos version >= 0xD0.
 +
 +
The version is returned in param0 as follows:
 +
 +
For development xos ('M' versions) : param0 = 'M' << 24 | version
 +
 +
For production xos ('P' versions) : param0 = 'P' << 24 | version
 +
{| border="1"
 +
!!! param0  !! param1 !! param2 !! param3 !! param4
 +
|-
 +
! input
 +
| 0 || 0 || 0 || 0 || 0
 +
|-
 +
! output
 +
| Version number ||0||0||0||0
 +
|}
 +
 +
 +
== XRPC_ID_GETPROTECTION (23) ==
 +
Get current protection register settings (PBUS settings).
 +
{| border="1"
 +
!!! param0  !! param1 !! param2 !! param3 !! param4
 +
|-
 +
! input
 +
| 0 || Gbus address of the protection register.  || 0 || 0 || 0
 +
|-
 +
! output
 +
| Value of the protection register. ||0||0||0||0
 +
|}
 +
 +
 +
== XRPC_ID_SETENHANCEDMODE (26) ==
 +
Switch XOS to enhanced security mode.
 +
{| border="1"
 +
!!! param0  !! param1 !! param2 !! param3 !! param4
 +
|-
 +
! input
 +
| 0 || DRAM0 XPU Zone allocator size || DRAM0 Risc Zone C allocator size || DRAM1 XPU Zone allocator size || DRAM1 Risc Zone C allocator size
 +
|-
 +
! output
 +
| 0 ||0||0||0||0
 +
|}
 +
 +
*  Switching to enhanced mode causes the following to happen:
 +
** All running xtasks are killed.
 +
** All loaded xtasks are unloaded.
 +
** Irq Handler is killed and unloaded.
 +
** All running codec microcodes are stopped.
 +
** All loaded codec microcodes are unloaded.
 +
** DRAM controller config register is protected from host access and restored to the proper initial value as determined at XOS boot time.
 +
** XOS allocators are reinitialized using size values passed in param1...param4.
 +
** Curtains are reinitialized to the default value, according to the allocators size.
 +
* The allocators size must be a power of 2, param0...param4 only contain the power, in the same way as the xos xenv parameters (x.l2xz, x.l2rzc, x.l2xz1, x.l2rzc1).

Latest revision as of 19:34, 15 June 2009

Contents

[edit] XRPC_ID_GETSERIAL (0)

Returns the chip serial number.

param0 param1 param2 param3 param4
input 0 0 0 0 0
output serial number [0..31](LSB) [32..63] [64..91] [92..127](MSB) 0


[edit] XRPC_ID_GETRANDOM (2)

Returns a random number generated by the chip hardware, this xrpc takes about ~10ms

param0 param1 param2 param3 param4
input 0 0 0 0 0
output Random Number 0 0 0 0


[edit] XRPC_ID_GETBONDINGCOMMENT (3)

Returns the chip bonding option string in param0 and param1, "developA" for development chips (ES4/ES5/ES6/ES7) or "productA" for production chips (revA/revB/revC/..)

param0 param1 param2 param3 param4
input 0 0 0 0 0
output Bonding comment [0..31] (LSB) Bonding comment [32..63] (MSB) 0 0 0


[edit] XRPC_ID_SHA1XOS (4)

Returns the SHA1 hash of the xos currently in serial flash.

For 'M' versions of xos (development versions), the last 3 hex digits of the hash are normally equal to the release version (since xosM7d), this is not true for 'P' (production) versions of xos.

param0 param1 param2 param3 param4
input 0 0 0 0 0
output xos SHA1 hash [0..31] (LSB) [32..63] [64..91] [92..127] [128..159](MSB)


[edit] XRPC_ID_XLOAD (5)

Load a secure binary in xload format (payload)

param0 param1 param2 param3 param4
input Size Depends on xload cert type 0 0 0
output Depends on xload cert type 0 0 0 0
  • Param0 is the size of the xload payload, before encryption and formatting, not the size of the xload packet !
  • For zboot/cpu type xloads, param1 is the load address.
  • For xtasks and ucode type xloads, and from xos version >= D0, param1 is the dram controller to load the xtask too.
  • Otherwise param1 is reserved (should be 0).


[edit] XRPC_ID_XUNLOAD (17)

Unload an xtask image previously loaded (payload is the corresponding xunload file)

param0 param1 param2 param3 param4
input Size of xunload payload image number to unload 0 0 0
output 0 0 0 0 0


[edit] XRPC_ID_REBOOT (19)

reboot.

param0 param1 param2 param3 param4
input 0 0 0 0 0
output 0 0 0 0 0


[edit] XRPC_ID_XBIND (20)

Bind the certificate type to a specific certificate (payload is the binding token). After binding the xload operation will only succeed when using the right certificate.

param0 param1 param2 param3 param4
input xbind payload size 0 0 0 0
output 0 0 0 0 0


[edit] XRPC_ID_XSTART (21)

Instantiate an xtask or microcode using the specified image. The image needs to be previously loaded with XLOAD xrpc. The registers a0-a3 are initialized before starting the xtask.

param0 param1 param2 param3 param4
input Image ID xtask initial a0 register / microcode target DSP or RISC. task initial a1 register / 0 task initial a2 register / 0 task initial a3 register / 0
output xtask id (aka Thread ID) / 0 0 0 0 0
  • If ImageID<100, XSTART will start the xtask loaded in the 'ImageID' xtask image slot. If ImageID>=100, XSTART will start the microcode loaded in the 'ImageID-100' microcode image slot.
  • In case of microcode loading, param1 indicates the target DSP/RISC on which the microcode is going to be started:
0 Video Risc 0
1 Video Risc 1
2 Audio DSP 0
3 Audio DSP 1
4 Demux Risc
  • In case of microcode loading, param2..param4 are reserved, and output parameters are also all reserved.


[edit] XRPC_ID_XKILL (22)

Send a signal to an xtask. Use signal number -1 to stop an xtask.

param0 param1 param2 param3 param4
input xtask id (aka Thread ID) Signal number 0 0 0
output 0 0 0 0 0
  • In case of a multi-threaded xtask, xkill will only signal or stop one specific thread.
  • There is no way to kill all spawned threads at once.
  • Each thread must terminate or be stopped individually.


[edit] XRPC_ID_GETBINDING (24)

Get current binding. Return the SHA-1 of the current bound certificate for a particular certificate type. XRPC will fail if type is not bound.

param0 param1 param2 param3 param4
input cert id 0 0 0 0
output SHA1 hash [0..31] (LSB) [32..63] [64..91] [92..127] [128..159] (MSB)


[edit] XRPC_ID_GETOWNER (25)

Get current owner of a sflash (secure flash) sector. Return the SHA-1 of the certificate of the owner of the sector. XRPC will fail if type sector is not currently owned.

param0 param1 param2 param3 param4
input sector number 0 0 0 0
output SHA1 hash [0..31] (LSB) [32..63] [64..91] [92..127] [128..159] (MSB)


[edit] XRPC_ID_VERSION (27)

VERSION returns the XOS version. Available for xos version >= 0xD0.

The version is returned in param0 as follows:

For development xos ('M' versions) : param0 = 'M' << 24 | version

For production xos ('P' versions) : param0 = 'P' << 24 | version

param0 param1 param2 param3 param4
input 0 0 0 0 0
output Version number 0 0 0 0


[edit] XRPC_ID_GETPROTECTION (23)

Get current protection register settings (PBUS settings).

param0 param1 param2 param3 param4
input 0 Gbus address of the protection register. 0 0 0
output Value of the protection register. 0 0 0 0


[edit] XRPC_ID_SETENHANCEDMODE (26)

Switch XOS to enhanced security mode.

param0 param1 param2 param3 param4
input 0 DRAM0 XPU Zone allocator size DRAM0 Risc Zone C allocator size DRAM1 XPU Zone allocator size DRAM1 Risc Zone C allocator size
output 0 0 0 0 0
  • Switching to enhanced mode causes the following to happen:
    • All running xtasks are killed.
    • All loaded xtasks are unloaded.
    • Irq Handler is killed and unloaded.
    • All running codec microcodes are stopped.
    • All loaded codec microcodes are unloaded.
    • DRAM controller config register is protected from host access and restored to the proper initial value as determined at XOS boot time.
    • XOS allocators are reinitialized using size values passed in param1...param4.
    • Curtains are reinitialized to the default value, according to the allocators size.
  • The allocators size must be a power of 2, param0...param4 only contain the power, in the same way as the xos xenv parameters (x.l2xz, x.l2rzc, x.l2xz1, x.l2rzc1).
Personal tools