usbliter8 on A14

A14 AP ROM Versions

1. A0(Early): iBoot-5281.0.0.100.22
2. B0(Middle): iBoot-5281.0.0.100.34
3. B1(PROD): iBoot-5281.0.0.100.45

M1 AP ROM Versions

1. A0(Early): iBoot-5540.0.0.200.13
2. B1(PROD): iBoot-5540.0.0.400.2

Reverse DART Configuration

A14-A0(Early): iBoot-5281.0.0.100.22

1. DMA OUT Address: synopsys_otg_init, 0x10000F8B0

   __int64 __fastcall synopsys_otg_init()
   {
     // ...
     ep0_setup_buffer = g_usb_otg.ep0_setup_buffer;
     if ( g_usb_otg.ep0_setup_buffer == 0 )
     {
    ep0_setup_buffer = heap_memalign(0x40u, misc); // Addr: 0x10000F94C
    g_usb_otg.ep0_setup_buffer = ep0_setup_buffer;
     }
     // ...
     return 0;
   }
   

2. Config DMA OUT: synopsys_otg_start_endpoint_out, 0x1000110A8

   __int64 __fastcall synopsys_otg_start_endpoint_out(int ep_address)
   {
    // ...
    doep_regs->out_ep[offsetof(dwc2_otg_regs, gotgctl)].doepdma = dma_handle;// Addr: 0x100011160
    // ...
   }
   

3. dart_config_id6

   ROM:10002DFD0 dart_config_id6 DCQ dart_hw_config_id6  ; config
   ROM:10002DFD8                 DCQ g_null_str          ; 
   ROM:10002DFE0                 DCQ 0                   ; trusted_regions
   ROM:10002DFE8                 DCB 0, 0, 0, 0, 0, 0, 0, 0; reserved_18
   ROM:10002DFF0                 DCB DART_ID_USB         ; id: 6
   ROM:10002DFF1                 DCB 0                   ; tcr_index
   ROM:10002DFF2                 DCB 1                   ; config_bypass
   ROM:10002DFF3                 DCB 0                   ; flags
   ROM:10002DFF4                 DCD 0                   ; pad_24
   

DART config is not correct, so this version is affected by usbliter8.

A14-B0(Middle): iBoot-5281.0.0.100.34

1. DMA OUT Address: synopsys_otg_init, 0x10000F220

   void __fastcall __noreturn synopsys_otg_init()
   {
    // ...
    ep0_setup_buffer = g_usb_otg.ep0_setup_buffer;
    if ( g_usb_otg.ep0_setup_buffer == 0 )
    {
        ep0_setup_buffer = heap_memalign(0x40u, misc); // Addr: 0x10000F2C0
        g_usb_otg.ep0_setup_buffer = ep0_setup_buffer;
    }
    // ...
   }
   

2. Config DMA OUT: synopsys_otg_start_endpoint_out, 0x100010230

   __int64 __fastcall synopsys_otg_start_ep0_out(/* ... */)
   {
    // ...
    if ( (USB_OTG_MMIO.out_ep[0].doepctl & 0x80000000) != 0 )
    {
        // ...
    }
    else
    {
        USB_OTG_MMIO.out_ep[0].doeptsiz = 0x20080040;
        result = platform_cache_operation(3, g_usb_otg.ep0_setup_buffer, 0x40);
        USB_OTG_MMIO.out_ep[0].doepdma = g_usb_otg.ep0_setup_buffer; // Addr: 0x100010284
        // ...
   }
   

3. dart_config_id6

   ROM:10002CBF0 dart_config_id6 DCQ dart_hw_config_id6  ; config
   ROM:10002CBF8                 DCQ byte_1000257C0      ; intr_cfg
   ROM:10002CC00                 DCQ 0                   ; trusted_regions
   ROM:10002CC08                 DCB 0, 0, 0, 0, 0, 0, 0, 0; reserved_18
   ROM:10002CC10                 DCB 6                   ; id
   ROM:10002CC11                 DCB 0                   ; tcr_index
   ROM:10002CC12                 DCB 1                   ; config_bypass
   ROM:10002CC13                 DCB 0                   ; flags
   ROM:10002CC14                 DCD 0                   ; pad_24
   

DART config is not correct, so this version is affected by usbliter8.

A14-B1(PROD): iBoot-5281.0.0.100.45

1. DMA OUT Address: synopsys_otg_init, 0x10000F560

   void __fastcall synopsys_otg_init()
   {
    // ...
    // 0x10000F580, Config USB DART, ID: 6
    dart_hw_bringup_id6();
    page_size = usb_dart_get_page_size();
    // ...
    // 0x10000F5AC, Set DMA OUT Address, Addr: 0x4000, it't not a physical address, but IOVA.
    g_usb_otg.ep0_setup_buffer = page_size;
    // ...
    sub_100015370(qword_1FC010000, 0x4000u);
    sub_100015370(qword_1FC014000, 0x4000u);
    g_usb_otg.setup_packet = 0;
    if ( (g_usb_otg.field_0 & 0x100) == 0 )
    {
        // 0x10000F644, Map DMA OUT, Addr: 0x4000, Page Count: 1
        usb_dart_map_pages(qword_1FC010000, page_size, 1, 0);
        // 0x10000F65C, Map DMA IN, Addr: 0xC000, Page Count: 1
        usb_dart_map_pages(qword_1FC014000, (3 * LODWORD(g_usb_otg.ep0_setup_buffer)), 1, 0);
        BYTE1(g_usb_otg.field_0) = 1;
    }
    // ...
   }
   

2. Config DMA OUT: synopsys_otg_start_endpoint_out, 0x100010E5C

   __int64 __fastcall synopsys_otg_start_ep0_out(/* ... */)
   {
    // ...
    if ( (USB_OTG_MMIO.out_ep[0].doepctl & 0x80000000) != 0 )
    {
        // ...
    }
    else
    {
        USB_OTG_MMIO.out_ep[0].doeptsiz = 0x20080040;
        result = platform_cache_operation(3, qword_1FC010000, 0x40, a4, a5, a6, a7);
        // 0x100010654, Set DMA OUT，IOVA：0x4000
        USB_OTG_MMIO.out_ep[0].doepdma = g_usb_otg.ep0_setup_buffer;
        // ...
    }
    USB_OTG_MMIO.out_ep[0].doepctl |= v8;
    return result;
   }
   

3. dart_config_id6

   ROM:10002D030 dart_config_id6 DCQ dart_hw_config_id6  ; config
   ROM:10002D038                 DCQ byte_100025C00      ; intr_cfg
   ROM:10002D040                 DCQ qword_1000272D4     ; trusted_regions
   ROM:10002D048                 DCB 0, 0, 0, 0, 0, 0, 0, 0; reserved_18
   ROM:10002D050                 DCB 6                   ; id
   ROM:10002D051                 DCB 0                   ; tcr_index
   ROM:10002D052                 DCB 0                   ; config_bypass
   ROM:10002D053                 DCB 8                   ; flags
   ROM:10002D054                 DCD 0                   ; pad_24
   

It can be seen that the USB OUT DMA uses the IOVA mapped through the DART, rather than the actual physical address.</br> So this version is not affected by usbliter8.

M1-A0(Early): iBoot-5540.0.0.200.13

1. DMA OUT Address: synopsys_otg_init, 0x10000FB28

   __int64 __fastcall synopsys_otg_init(__int64 a1)
   {
    // ...
    ep0_setup_buffer = g_usb_otg.ep0_setup_buffer;
    if ( g_usb_otg.ep0_setup_buffer == 0 )
    {
        ep0_setup_buffer = heap_memalign(0x40u);
        g_usb_otg.ep0_setup_buffer = ep0_setup_buffer; // Addr: 0x10000FBC4
    }
    // ...
   }
   

2. Config DMA OUT: synopsys_otg_start_endpoint_out, 0x1000113A0

   ROM:100011458                 STR             W19, [X8,#0xB14]
   

   DART config is not correct, so this version is affected by usbliter8.

M1-B1(PROD): iBoot-5540.0.0.400.2

1. DMA OUT Address: synopsys_otg_init, 0x10000FEA8

   void __noreturn synopsys_otg_init()
   {
    // ...
    dart_hw_bringup_id6();
    page_size = usb_dart_get_page_size();
    v1 = 0;
    v2 = 0;
    MEMORY[0x1FC021978] = page_size; // 0x1FC021978 = page_size = 0x4000
    // ...
    sub_100016050(0x1FC010000uLL, 0x4000);
    sub_100016050(0x1FC014000uLL, 0x4000);
    MEMORY[0x1FC021980] = 0;
    if ( (MEMORY[0x1FC021959] & 1) == 0 )
    {
        // 0x10000FF8C, Map DMA OUT, Addr: 0x4000, Page Count: 1
        usb_dart_map_pages(0x1FC010000LL, page_size, 1, 0);
        // 0x10000FFAC, Map DMA IN, Addr: 0xC000, Page Count: 1
        usb_dart_map_pages(0x1FC014000LL, (3 * MEMORY[0x1FC021978]), 1, 0);
        MEMORY[0x1FC021959] = 1;
    }
   }
   

2. Config DMA OUT: synopsys_otg_start_endpoint_out, 0x100010F94

   void __fastcall synopsys_otg_start_ep0_out(/* ... */)
   {
    // ...
    if ( (MEMORY[0x382100B00] & 0x80000000) != 0 )
    {
        // ...
    }
    else
    {
        MEMORY[0x382100B10] = 0x20080040;
        platform_cache_operation(3, 0x1FC010000LL, 0x40);
        // Addr: 0x100010FF8
        MEMORY[0x382100B14] = MEMORY[0x1FC021978]; // MEMORY[0x1FC021978] = page_size = 0x4000
        if ( v7 != 0 )
            v8 = 0x84000000;
        else
            v8 = 0x80000000;
    }
    MEMORY[0x382100B00] |= v8;
   }
   

   This version is not affected by usbliter8.

Conclusion

AP ROM	iBoot Version	Affected by usbliter8
A14-A0(Early)	iBoot-5281.0.0.100.22	Yes
A14-B0(Middle)	iBoot-5281.0.0.100.34	Yes
A14-B1(PROD)	iBoot-5281.0.0.100.45	No
M1-A0(Early)	iBoot-5540.0.0.200.13	Yes
M1-B1(PROD)	iBoot-5540.0.0.400.2	No

References

1. https://ps.tc/pages/blog-usbliter8.html
2. https://securerom.fun/