Xrpc call list
From t-hack.com - Hack X300T / X301T
(Created page with '== XRPC_ID_GETSERIAL (0)== returns the chip serial number. {| border="1" !!! param0 !! param1 !! param2 !! param3 !! param4 |- ! input | 0 || 0 || 0 || 0 || 0 |- ! output | SN[0...') |
|||
| Line 1: | Line 1: | ||
== XRPC_ID_GETSERIAL (0)== | == XRPC_ID_GETSERIAL (0)== | ||
| − | + | Returns the chip serial number. | |
{| border="1" | {| border="1" | ||
!!! param0 !! param1 !! param2 !! param3 !! param4 | !!! param0 !! param1 !! param2 !! param3 !! param4 | ||
| Line 8: | Line 8: | ||
|- | |- | ||
! output | ! output | ||
| − | | | + | | serial number [0..31](LSB) || [32..63] || [64..91] || [92..127](MSB) || 0 |
|} | |} | ||
| + | |||
== XRPC_ID_GETRANDOM (2) == | == XRPC_ID_GETRANDOM (2) == | ||
| − | + | Returns a random number generated by the chip hardware, this xrpc takes about ~10ms | |
{| border="1" | {| border="1" | ||
!!! param0 !! param1 !! param2 !! param3 !! param4 | !!! param0 !! param1 !! param2 !! param3 !! param4 | ||
| Line 23: | Line 24: | ||
|} | |} | ||
| − | == XRPC_ID_GETBONDINGCOMMENT == | + | |
| − | + | == XRPC_ID_GETBONDINGCOMMENT (3)== | |
| + | Returns the chip bonding option string in param0 and param1, "developA" for development chips (ES4/ES5/ES6/ES7) or "productA" for production chips (revA/revB/revC/..) | ||
{| border="1" | {| border="1" | ||
!!! param0 !! param1 !! param2 !! param3 !! param4 | !!! param0 !! param1 !! param2 !! param3 !! param4 | ||
| Line 34: | Line 36: | ||
| Bonding comment [0..31] (LSB) || Bonding comment [32..63] (MSB) || 0 || 0 || 0 | | Bonding comment [0..31] (LSB) || Bonding comment [32..63] (MSB) || 0 || 0 || 0 | ||
|} | |} | ||
| + | |||
| + | |||
| + | == XRPC_ID_SHA1XOS (4)== | ||
| + | Returns the SHA1 hash of the xos currently in serial flash. | ||
| + | |||
| + | For 'M' versions of xos (development versions), the last 3 hex digits of the hash are normally equal to the release version (since xosM7d), this is not true for 'P' (production) versions of xos. | ||
| + | {| border="1" | ||
| + | !!! param0 !! param1 !! param2 !! param3 !! param4 | ||
| + | |- | ||
| + | ! input | ||
| + | | 0 || 0 || 0 || 0 || 0 | ||
| + | |- | ||
| + | ! output | ||
| + | | xos SHA1 hash [0..31] (LSB) || [32..63] || [64..91] || [92..127] || [128..159](MSB) | ||
| + | |} | ||
| + | |||
| + | |||
| + | == XRPC_ID_XLOAD (5) == | ||
| + | Load a secure binary in xload format (payload) | ||
| + | {| border="1" | ||
| + | !!! param0 !! param1 !! param2 !! param3 !! param4 | ||
| + | |- | ||
| + | ! input | ||
| + | | Size || Depends on xload cert type || 0 || 0 || 0 | ||
| + | |- | ||
| + | ! output | ||
| + | | Depends on xload cert type || 0 || 0 || 0 ||0 | ||
| + | |} | ||
| + | |||
| + | * Param0 is the size of the xload payload, '''before''' encryption and formatting, not the size of the xload packet ! | ||
| + | * For zboot/cpu type xloads, param1 is the load address. | ||
| + | * For xtasks and ucode type xloads, and from xos version >= D0, param1 is the dram controller to load the xtask too. | ||
| + | * Otherwise param1 is reserved (should be 0). | ||
| + | |||
| + | |||
| + | == XRPC_ID_XUNLOAD (17) == | ||
| + | Unload an xtask image previously loaded (payload is the corresponding xunload file) | ||
| + | {| border="1" | ||
| + | !!! param0 !! param1 !! param2 !! param3 !! param4 | ||
| + | |- | ||
| + | ! input | ||
| + | | Size of xunload payload|| image number to unload || 0 || 0 || 0 | ||
| + | |- | ||
| + | ! output | ||
| + | | 0 || 0 || 0 || 0 ||0 | ||
| + | |} | ||
| + | |||
| + | |||
| + | == XRPC_ID_REBOOT (19) == | ||
| + | reboot. | ||
| + | {| border="1" | ||
| + | !!! param0 !! param1 !! param2 !! param3 !! param4 | ||
| + | |- | ||
| + | ! input | ||
| + | | 0 || 0 || 0 || 0 || 0 | ||
| + | |- | ||
| + | ! output | ||
| + | | 0 || 0 || 0 || 0 ||0 | ||
| + | |} | ||
| + | |||
| + | |||
| + | == XRPC_ID_XBIND (20) == | ||
| + | Bind the certificate type to a specific certificate (payload is the binding token). After binding the xload operation will only succeed when using the right certificate. | ||
| + | {| border="1" | ||
| + | !!! param0 !! param1 !! param2 !! param3 !! param4 | ||
| + | |- | ||
| + | ! input | ||
| + | | xbind payload size || 0 || 0 || 0 || 0 | ||
| + | |- | ||
| + | ! output | ||
| + | | 0 || 0 || 0 || 0 ||0 | ||
| + | |} | ||
| + | |||
| + | |||
| + | == XRPC_ID_XSTART (21) == | ||
| + | Instantiate an xtask or microcode using the specified image. The image needs to be previously loaded with XLOAD xrpc. The registers a0-a3 are initialized before starting the xtask. | ||
| + | {| border="1" | ||
| + | !!! param0 !! param1 !! param2 !! param3 !! param4 | ||
| + | |- | ||
| + | ! input | ||
| + | | Image ID || xtask initial a0 register / microcode target DSP or RISC. || task initial a1 register / 0 || task initial a2 register / 0 || task initial a3 register / 0 | ||
| + | |- | ||
| + | ! output | ||
| + | | xtask id (aka Thread ID) / 0 || 0 || 0 || 0 ||0 | ||
| + | |} | ||
| + | |||
| + | * If ImageID<100, XSTART will start the xtask loaded in the 'ImageID' xtask image slot. If ImageID>=100, XSTART will start the microcode loaded in the 'ImageID-100' microcode image slot. | ||
| + | * In case of microcode loading, param1 indicates the target DSP/RISC on which the microcode is going to be started: | ||
| + | |||
| + | {| border="1" | ||
| + | |- | ||
| + | |0|| Video Risc 0 | ||
| + | |- | ||
| + | |1|| Video Risc 1 | ||
| + | |- | ||
| + | |2|| Audio DSP 0 | ||
| + | |- | ||
| + | |3|| Audio DSP 1 | ||
| + | |- | ||
| + | |4|| Demux Risc | ||
| + | |} | ||
| + | |||
| + | * In case of microcode loading, param2..param4 are reserved, and output parameters are also all reserved. | ||
| + | |||
| + | |||
| + | == XRPC_ID_XKILL (22) == | ||
| + | Send a signal to an xtask. Use signal number -1 to stop an xtask. | ||
| + | {| border="1" | ||
| + | !!! param0 !! param1 !! param2 !! param3 !! param4 | ||
| + | |- | ||
| + | ! input | ||
| + | | xtask id (aka Thread ID) || Signal number || 0 || 0 || 0 | ||
| + | |- | ||
| + | ! output | ||
| + | | 0 || 0 || 0 || 0 ||0 | ||
| + | |} | ||
| + | |||
| + | * In case of a multi-threaded xtask, xkill will only signal or stop one specific thread. | ||
| + | * There is no way to kill all spawned threads at once. | ||
| + | * Each thread must terminate or be stopped individually. | ||
| + | |||
| + | |||
| + | == XRPC_ID_GETBINDING (24) == | ||
| + | Get current binding. Return the SHA-1 of the current bound certificate for a particular certificate type. XRPC will fail if type is not bound. | ||
| + | {| border="1" | ||
| + | !!! param0 !! param1 !! param2 !! param3 !! param4 | ||
| + | |- | ||
| + | ! input | ||
| + | | cert id || 0 || 0 || 0 || 0 | ||
| + | |- | ||
| + | ! output | ||
| + | | SHA1 hash [0..31] (LSB) ||[32..63] ||[64..91] ||[92..127] ||[128..159] (MSB) | ||
| + | |} | ||
| + | |||
| + | |||
| + | == XRPC_ID_GETOWNER (25) == | ||
| + | Get current owner of a sflash (secure flash) sector. Return the SHA-1 of the certificate of the owner of the sector. XRPC will fail if type sector is not currently owned. | ||
| + | {| border="1" | ||
| + | !!! param0 !! param1 !! param2 !! param3 !! param4 | ||
| + | |- | ||
| + | ! input | ||
| + | | sector number || 0 || 0 || 0 || 0 | ||
| + | |- | ||
| + | ! output | ||
| + | | SHA1 hash [0..31] (LSB) ||[32..63] ||[64..91] ||[92..127] ||[128..159] (MSB) | ||
| + | |} | ||
| + | |||
| + | |||
| + | == XRPC_ID_VERSION (27) == | ||
| + | VERSION returns the XOS version. Available for xos version >= 0xD0. | ||
| + | |||
| + | The version is returned in param0 as follows: | ||
| + | |||
| + | For development xos ('M' versions) : param0 = 'M' << 24 | version | ||
| + | |||
| + | For production xos ('P' versions) : param0 = 'P' << 24 | version | ||
| + | {| border="1" | ||
| + | !!! param0 !! param1 !! param2 !! param3 !! param4 | ||
| + | |- | ||
| + | ! input | ||
| + | | 0 || 0 || 0 || 0 || 0 | ||
| + | |- | ||
| + | ! output | ||
| + | | Version number ||0||0||0||0 | ||
| + | |} | ||
| + | |||
| + | |||
| + | == XRPC_ID_GETPROTECTION (23) == | ||
| + | Get current protection register settings (PBUS settings). | ||
| + | {| border="1" | ||
| + | !!! param0 !! param1 !! param2 !! param3 !! param4 | ||
| + | |- | ||
| + | ! input | ||
| + | | 0 || Gbus address of the protection register. || 0 || 0 || 0 | ||
| + | |- | ||
| + | ! output | ||
| + | | Value of the protection register. ||0||0||0||0 | ||
| + | |} | ||
| + | |||
| + | |||
| + | == XRPC_ID_SETENHANCEDMODE (26) == | ||
| + | Switch XOS to enhanced security mode. | ||
| + | {| border="1" | ||
| + | !!! param0 !! param1 !! param2 !! param3 !! param4 | ||
| + | |- | ||
| + | ! input | ||
| + | | 0 || DRAM0 XPU Zone allocator size || DRAM0 Risc Zone C allocator size || DRAM1 XPU Zone allocator size || DRAM1 Risc Zone C allocator size | ||
| + | |- | ||
| + | ! output | ||
| + | | 0 ||0||0||0||0 | ||
| + | |} | ||
| + | |||
| + | * Switching to enhanced mode causes the following to happen: | ||
| + | ** All running xtasks are killed. | ||
| + | ** All loaded xtasks are unloaded. | ||
| + | ** Irq Handler is killed and unloaded. | ||
| + | ** All running codec microcodes are stopped. | ||
| + | ** All loaded codec microcodes are unloaded. | ||
| + | ** DRAM controller config register is protected from host access and restored to the proper initial value as determined at XOS boot time. | ||
| + | ** XOS allocators are reinitialized using size values passed in param1...param4. | ||
| + | ** Curtains are reinitialized to the default value, according to the allocators size. | ||
| + | * The allocators size must be a power of 2, param0...param4 only contain the power, in the same way as the xos xenv parameters (x.l2xz, x.l2rzc, x.l2xz1, x.l2rzc1). | ||
