1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
|
"""Bring up minimal display-core: register a display topology via the DTM TA,
then check whether HDCP's topology query (RPC 0x103) starts succeeding.
Evidence this is the right mechanism: DTM and HDCP use the SAME TEE service
(SVC 0xF2, R0=2) and the same 0x1xx command space:
DTM sub_4012A4 -> cmd 0x100 topology ADD
DTM sub_401284 -> cmd 0x101 topology REMOVE
HDCP sub_404358 -> cmd 0x103 QUERY -> writes ctx+16
DTM buffer layout (from sub_401058):
shm+0x00 = command id (2 = TOPOLOGY_UPDATE_V2)
shm+0x08 = return code (output)
shm+0x10 = input struct:
[0] display_handle [1] is_active (!=0 required)
[2] is_miracast [3] controller_id
[4] encoder_type [5] dio_output_type
[6] dio_output_id [7],[8] link info (64-bit)
[9] must be <= 0x17
"""
import ctypes, struct
from tinygrad import Device
from tinygrad.runtime.autogen.am import am
from tinygrad.helpers import lo32, hi32
d=Device["AMD"]; adev=d.iface.dev_impl; psp=adev.psp
SZ=ctypes.sizeof(am.struct_psp_gfx_cmd_resp)
def stat(): return int.from_bytes(bytes(adev.vram.view(psp.cmd_paddr,SZ)[:])[864:868],"little")
def alloc(n):
pa=adev.mm.palloc(n,align=0x1000,zero=True); return pa,adev.paddr2mc(pa)
P='/Users/user/dev/amd-psp-re/psp_out/'
def load(cmd,blob):
ap,amc=alloc(0x40000); cp,cmc=alloc(0x8000)
adev.vram.view(ap,len(blob))[:]=blob; adev.gmc.flush_hdp()
adev.vram.view(psp.cmd_paddr,SZ)[:]=b"\x00"*SZ
c=am.struct_psp_gfx_cmd_resp(cmd_id=cmd); t=c.cmd.cmd_load_ta
t.app_phy_addr_hi,t.app_phy_addr_lo=hi32(amc),lo32(amc); t.app_len=len(blob)
t.cmd_buf_phy_addr_hi,t.cmd_buf_phy_addr_lo=hi32(cmc),lo32(cmc); t.cmd_buf_len=0x8000
r=psp._ring_submit(c); return r.resp.session_id,cp
load(am.GFX_CMD_ID_LOAD_ASD, open(P+'asd_full.bin','rb').read())
dtm_sid, dtm_shm = load(am.GFX_CMD_ID_LOAD_TA, open(P+'dtm_full.bin','rb').read())
hdcp_sid,hdcp_shm= load(am.GFX_CMD_ID_LOAD_TA, open(P+'hdcp_full.bin','rb').read())
print("DTM sid=%#x HDCP sid=%#x\n" % (dtm_sid, hdcp_sid))
def raw_invoke(sid, shm, buf, ta_cmd):
adev.vram.view(shm,0x8000)[:]=bytes(buf); adev.gmc.flush_hdp()
adev.vram.view(psp.cmd_paddr,SZ)[:]=b"\x00"*SZ
ic=am.struct_psp_gfx_cmd_resp(cmd_id=am.GFX_CMD_ID_INVOKE_CMD); iv=ic.cmd.cmd_invoke_cmd
iv.session_id, iv.ta_cmd_id = sid, ta_cmd
try: psp._ring_submit(ic); ps=0
except RuntimeError: ps=stat()
except TimeoutError: return "TIMEOUT", None
return ps, bytes(adev.vram.view(shm,0x2000)[:])
def dtm_topology(handle, active=1, miracast=0, controller=0, enc=0, dio_type=0,
dio_id=0, l0=0, l1=0, f9=0):
b=bytearray(0x8000)
struct.pack_into('<I', b, 0, 2) # TOPOLOGY_UPDATE_V2
struct.pack_into('<10I', b, 0x10, handle, active, miracast, controller,
enc, dio_type, dio_id, l0, l1, f9)
ps,out = raw_invoke(dtm_sid, dtm_shm, b, 2)
return ps, (struct.unpack_from('<I',out,8)[0] if out else None)
def hdcp_cmd(cmd, devid):
b=bytearray(0x8000)
struct.pack_into('<I', b, 0, cmd)
struct.pack_into('<I', b, 0xC, devid)
ps,out = raw_invoke(hdcp_sid, hdcp_shm, b, cmd)
return ps, (struct.unpack_from('<I',out,4)[0] if out else None)
print("BASELINE (no topology registered):")
ps,ret = hdcp_cmd(0x01, 0); print(" HDCP cmd1 devid0 -> ta_ret=%s (4 = query failed)" % ret)
print("\nSTEP 1: register topology for display_handle 0..3 via DTM cmd 2")
for h in range(4):
ps,ret = dtm_topology(h, active=1, controller=h, enc=0, dio_type=0, dio_id=h, f9=0)
print(" DTM handle=%d -> psp=%s dtm_ret=%s %s" % (h, hex(ps), ret,
"OK" if ret==0 else "FAILED"))
print("\nSTEP 2: HDCP cmd 1 after topology registration")
for devid in range(4):
ps,ret = hdcp_cmd(0x01, devid)
flag = " <<< QUERY SUCCEEDED" if ret not in (4,3) else ""
print(" devid=%d -> ta_ret=%s%s" % (devid, ret, flag))
print("\nSTEP 3: HDCP cmd 0x0E after topology registration")
for devid in range(4):
ps,ret = hdcp_cmd(0x0E, devid)
flag = " <<< QUERY SUCCEEDED" if ret not in (17,3) else ""
print(" devid=%d -> ta_ret=%s%s" % (devid, ret, flag))
print("\nsOS alive:", psp.is_sos_alive())
|
