Boot - Revision history

Qyriad: Made links slightly more helpful

2018-05-02T14:42:28Z

Made links slightly more helpful

← Older revision		Revision as of 18:42, 2 May 2018
Line 34:		Line 34:

	== Done ==		== Done ==
	When done it calls the [[Process_Manager_services\|pm:shell]] NotifyBootCompleted (which launches [[boot2]]), and exits itself.		When done it calls the [[Process_Manager_services#pm:shell\|pm:shell]] [[Process_Manager_services#NotifyBootFinished\|NotifyBootCompleted]] (which launches [[boot2]]), and exits itself.

	= Changelog =		= Changelog =

Hexkyz at 18:13, 24 August 2017

2017-08-24T16:13:05Z

← Older revision		Revision as of 20:13, 24 August 2017
Line 1:		Line 1:
	boot is a built-in sysmodule.		boot is a built-in sysmodule.

	~~[2.0.0+] all panic strings were removed/censored.~~

	~~[2.1.0+] code was updated with changes to the ncm interface.~~

	= Boot =		= Boot =
	First up it initializes gpios and sets the gpio voltage to 1.8v.		First, it initializes gpios and sets the gpio voltage to 1.8v.

	~~[2.0.0+] Code to initialize gpio differently for Copper/Icosa (based on spl HardwareType flag) was removed.~~

	~~[2.0.0+] the "WecDriver" now uses svcReadWriteRegister instead of svcQueryIoMapping to write to 0x7000E400 io (PMC)~~.

	Then it checks battery charge and SoC temperature using i2c. If either is bad, it shows one of two different bitmaps from .data in the framebuffer.		Then it checks battery charge and SoC temperature using i2c. If either is bad, it shows one of two different bitmaps from .data in the framebuffer.
Line 16:		Line 8:
	Because most sysmodules have not yet booted, this all uses raw IO pokes when it comes to gpio and i2c interfacing.		Because most sysmodules have not yet booted, this all uses raw IO pokes when it comes to gpio and i2c interfacing.

	Otherwise, it continues by reading the ~~first two bytes of~~ the BCT at ~~+0xC000 of~~ NAND partition 0.		Otherwise, it continues by reading the bad_block_table.num_entries field from the [[BCT\|BCT]] located at offset 0x00C000 in the NAND [[Flash_Filesystem#Boot_Partitions\|boot partition 0]] (safe mode backup).

	If byte0 is non-zero, it does a repair with type=4. If byte1 is non-zero, it does a repair with type=5.		If bad_block_table.num_entries byte0 is non-zero, it does a repair with type=4. If byte1 is non-zero, it does a repair with type=5.
			The number of entires in the bad block table should always be 0x200 by default (represents partition_size). Values from 0x200 to 0x20F represent bad blocks in the NAND [[Flash_Filesystem#Boot_Partitions\|boot partition 0]] while values from 0x210 to 0x21F represent bad blocks in NAND [[Flash_Filesystem#Boot_Partitions\|boot partition 1]].

	== Repair ==		== Repair ==
	It uses ~~ncm~~ IContentMetaDatabase Iterate with supplied type value~~. The purpose of this ncm usage is~~ to look up the "bip" title-id (0100000000000819 or 010000000000081A) ~~for said type.~~		It uses the NCM [[NCM_services#IContentMetaDatabase\|IContentMetaDatabase]] Iterate command with the supplied type value in order to look up the firmware package ("bip") title-id (0100000000000819 or 010000000000081A).

	It mounts the found bip title-id at "bip", reads the "bip:/nx/bct" file in that filesystem. Then it reads the console-unique keyblobs from NAND, and injects the keyblob based on the u32-index at BCT+0x2330 into the BCT buffer+0x450.

	It ~~calculates a sha256 of this~~ "~~constructed~~" bct ~~buffer~~.		It then mounts the firmware package at "bip" and reads the [[BCT\|BCT]] from the "bip:/nx/bct" file in that filesystem.
			Afterwards, the console's [[Flash_Filesystem#Keyblob\|keyblob]] is read from the NAND keyblob array using [[BCT#bootloader0_info\|bootloader0_info.version]] as index and the selected keyblob is then injected into the BCT's [[BCT#customer_data\|customer_data]] region.

	~~Then it~~ hashes ~~two bcts from~~ actual in ~~partition 0~~ (~~type4: NAND+~~0x0000 and NAND~~+0x8000~~, ~~type5: NAND+~~0x4000 and NAND~~+0xC000~~). If either hash doesn't match the calculated one, it returns error 0xC9E.		A SHA-256 hash is then calculated over this new BCT and compared against calculated hashes of the actual BCTs stored in NAND.
			For a type4 repair process, the comparison is performed with "normal" and "normal backup" BCTs (offsets 0x0000 and 0x8000 in NAND).
			For a type5 repair process, the comparison is performed with "safe mode" and "safe mode backup" BCTs (offsets 0x4000 and 0xC000 in NAND).
			If either hash doesn't match the calculated one, it returns error 0xC9E.

	~~Then it reads and hashes entire~~ "bip:/nx/package1" ~~using sha256~~. ~~It checks if this matches a~~ hash of the ~~two real pkg1~~ stored in (~~type4: partition0 NAND+~~0x100000 and ~~NAND+~~0x140000~~, type5: partition1~~ NAND+0 and NAND~~+0x40000~~). ~~Same~~ error ~~is returned on hash mismatch~~.		The same process is repeated for the [[Package1\|package1]] file in "bip:/nx/package1". This file's SHA-256 hash is compared against calculated hashes over the package1 copy stored in NAND.
			For a type4 repair process, the comparison is performed with "normal" and "normal backup" package1 (offsets 0x100000 and 0x140000 in NAND boot partition 0).
			For a type5 repair process, the comparison is performed with "safe mode" and "safe mode backup" package1 (offsets 0x00000 and 0x40000 in NAND boot partition 1).
			If either hash doesn't match the calculated one, it returns error 0xC9E.

	~~After that it also checks~~ the ~~hash of~~ "nx/package2" ~~against two pkg2s stored~~ in ~~NAND, also error 0xC9E if hash doesn't match~~.		Finally, the process is repeated once more for the "bip:/nx/package2". Error 0xC9E is returned in case of mismatch.

	If this function returns 0xC9E, it calls a function to repair the NAND.		If this function returns 0xC9E, it calls a function to repair the NAND.

	== Done ==		== Done ==
			When done it calls the [[Process_Manager_services\|pm:shell]] NotifyBootCompleted (which launches [[boot2]]), and exits itself.

			= Changelog =
			== 2.0.0 ==
			* All panic strings were removed/censored.
			* Code to initialize gpio differently for Copper/Icosa (based on spl HardwareType flag) was removed.
			* The "WecDriver" now uses svcReadWriteRegister instead of svcQueryIoMapping to write to 0x7000E400 MMIO (PMC).

	~~When done it calls~~ the ~~[[Process_Manager_services\|pm:shell]] NotifyBootCompleted (which launches [[boot2]]), and exits itself~~.		== 2.1.0 ==
			* Code was updated with changes to the NCM interface.

Qlutoo at 01:08, 7 August 2017

2017-08-06T23:08:37Z

← Older revision		Revision as of 03:08, 7 August 2017
Line 37:		Line 37:
	== Done ==		== Done ==

	When done it calls the [[Process_Manager_services\|pm:shell]] NotifyBootCompleted, and exits itself.		When done it calls the [[Process_Manager_services\|pm:shell]] NotifyBootCompleted (which launches [[boot2]]), and exits itself.

Qlutoo at 00:02, 7 August 2017

2017-08-06T22:02:48Z

← Older revision		Revision as of 02:02, 7 August 2017
Line 2:		Line 2:

	[2.0.0+] all panic strings were removed/censored.		[2.0.0+] all panic strings were removed/censored.

			[2.1.0+] code was updated with changes to the ncm interface.

	= Boot =		= Boot =

Qlutoo: /* Boot */

2017-08-06T21:41:38Z

Boot

← Older revision		Revision as of 01:41, 7 August 2017
Line 1:		Line 1:
	boot is a built-in sysmodule.		boot is a built-in sysmodule.

			[2.0.0+] all panic strings were removed/censored.

	= Boot =		= Boot =
	First up it initializes gpios and sets the gpio voltage to 1.8v.		First up it initializes gpios and sets the gpio voltage to 1.8v.

			[2.0.0+] Code to initialize gpio differently for Copper/Icosa (based on spl HardwareType flag) was removed.

			[2.0.0+] the "WecDriver" now uses svcReadWriteRegister instead of svcQueryIoMapping to write to 0x7000E400 io (PMC).

	Then it checks battery charge and SoC temperature using i2c. If either is bad, it shows one of two different bitmaps from .data in the framebuffer.		Then it checks battery charge and SoC temperature using i2c. If either is bad, it shows one of two different bitmaps from .data in the framebuffer.

Qlutoo at 22:44, 18 July 2017

2017-07-18T20:44:32Z

← Older revision		Revision as of 00:44, 19 July 2017
Line 1:		Line 1:
	boot is a built-in sysmodule.		boot is a built-in sysmodule.

			= Boot =
	First up it initializes gpios and sets the gpio voltage to 1.8v.		First up it initializes gpios and sets the gpio voltage to 1.8v.

Line 11:		Line 12:
	If byte0 is non-zero, it does a repair with type=4. If byte1 is non-zero, it does a repair with type=5.		If byte0 is non-zero, it does a repair with type=4. If byte1 is non-zero, it does a repair with type=5.

			== Repair ==
	It uses ncm IContentMetaDatabase Iterate with supplied type value. The purpose of this ncm usage is to look up the "bip" title-id (0100000000000819 or 010000000000081A) for said type.		It uses ncm IContentMetaDatabase Iterate with supplied type value. The purpose of this ncm usage is to look up the "bip" title-id (0100000000000819 or 010000000000081A) for said type.

Line 25:		Line 27:
	If this function returns 0xC9E, it calls a function to repair the NAND.		If this function returns 0xC9E, it calls a function to repair the NAND.

	When done it calls the [[Process_Manager_services\|PM]] NotifyBootCompleted.		== Done ==

			When done it calls the [[Process_Manager_services\|pm:shell]] NotifyBootCompleted, and exits itself.

Qlutoo at 22:30, 18 July 2017

2017-07-18T20:30:06Z

← Older revision		Revision as of 00:30, 19 July 2017
Line 25:		Line 25:
	If this function returns 0xC9E, it calls a function to repair the NAND.		If this function returns 0xC9E, it calls a function to repair the NAND.

	When done it calls the PM NotifyBootCompleted.		When done it calls the [[Process_Manager_services\|PM]] NotifyBootCompleted.

Qlutoo: Created page with "boot is a built-in sysmodule. First up it initializes gpios and sets the gpio voltage to 1.8v. Then it checks battery charge and SoC temperature using i2c. If either is bad,..."

2017-07-18T20:17:25Z

Created page with "boot is a built-in sysmodule. First up it initializes gpios and sets the gpio voltage to 1.8v. Then it checks battery charge and SoC temperature using i2c. If either is bad,..."

New page

boot is a built-in sysmodule.

First up it initializes gpios and sets the gpio voltage to 1.8v.

Then it checks battery charge and SoC temperature using i2c. If either is bad, it shows one of two different bitmaps from .data in the framebuffer.

Because most sysmodules have not yet booted, this all uses raw IO pokes when it comes to gpio and i2c interfacing.

Otherwise, it continues by reading the first two bytes of the BCT at +0xC000 of NAND partition 0.

If byte0 is non-zero, it does a repair with type=4. If byte1 is non-zero, it does a repair with type=5.

It uses ncm IContentMetaDatabase Iterate with supplied type value. The purpose of this ncm usage is to look up the "bip" title-id (0100000000000819 or 010000000000081A) for said type.

It mounts the found bip title-id at "bip", reads the "bip:/nx/bct" file in that filesystem. Then it reads the console-unique keyblobs from NAND, and injects the keyblob based on the u32-index at BCT+0x2330 into the BCT buffer+0x450.

It calculates a sha256 of this "constructed" bct buffer.

Then it hashes two bcts from actual in partition 0 (type4: NAND+0x0000 and NAND+0x8000, type5: NAND+0x4000 and NAND+0xC000). If either hash doesn't match the calculated one, it returns error 0xC9E.

Then it reads and hashes entire "bip:/nx/package1" using sha256. It checks if this matches a hash of the two real pkg1 stored in (type4: partition0 NAND+0x100000 and NAND+0x140000, type5: partition1 NAND+0 and NAND+0x40000). Same error is returned on hash mismatch.

After that it also checks the hash of "nx/package2" against two pkg2s stored in NAND, also error 0xC9E if hash doesn't match.

If this function returns 0xC9E, it calls a function to repair the NAND.

When done it calls the PM NotifyBootCompleted.