Package1: Difference between revisions

The stack pointer is set.

  // Set the stack pointer

  *(u32 *)sp = 0x40008000;

  // Infinite loop

  deadlock();

=== Main ===

The bootloader poisons the exception vectors, cleans up memory (.bss and init_array), sets up hardware devices (including the security engine and fuses), does all the necessary checks, generates keys and finally decrypts and executes the next stage.

  // Poison all exception vectors

  *(u32 *)0x6000F200 = panic();

   

  return;

==== Panic ====

If a panic occurs, all sensitive memory contents are cleared, the security engine and fuse programming are disabled and the boot processor is left in a halted state.

  // Clear all stack contents

  clear_stack();

  while (true)

     *(u32 *)FLOW_CTLR_HALT_COP_EVENTS = (FLOW_MODE_STOP | HALT_COP_EVENT_JTAG);

==== Anti-downgrade ====

After disabling fuse programming, the bootloader configures the EMC and MEM/MC. It additionally disables QSPI resets and programs a special aperture designed for AHB redirected access to IRAM.

  u32 PERIPH_CLK_SOURCE_EMC = 0x6000619C;

  u32 CLK_OUT_ENB_SET_H = 0x60006328;

 

  return mc_iram_reg_ctrl_val;

==== Key generation ====

Depending on [[Fuses#FUSE_RESERVED_ODM4|FUSE_RESERVED_ODM4]] and [[Fuses#FUSE_SPARE_BIT_5|FUSE_SPARE_BIT_5]] different static seeds are selected for key generation.

  // Initialize keyslots 0x0C and 0x0D as readable

  init_keyslot(0x0C, 0x15);

   

  return;

===== generate_retail_keys =====

See the pseudocode bellow for the detailed process.

  u32 in_addr = 0;

  u32 in_size = 0;

   

  return;

===== generate_debug_keys =====

See the pseudocode bellow for the detailed process.

  u32 in_addr = 0;

  u32 in_size = 0;

   

  return;

== PK11 Blob ==

The encrypted blob is prepended with it's CTR and total image size. After checking the image's size against an hardcoded value (can change on firmware updates), the image is AES-CTR decrypted and the keyslot used for decryption is immediately cleared.

  // Maximum encrypted blob's size on firmware version 1.0.0

  u32 max_pk11_enc_blob_size = 0x29000;

 

  return nx_boot_addr;

=== Header ===