Switch 2: BCT: Difference between revisions
Jump to navigation
Jump to search
No edit summary |
|||
| Line 229: | Line 229: | ||
| 0x0 | | 0x0 | ||
| 0x4 | | 0x4 | ||
| | | Mb1BctStartPage | ||
|- | |- | ||
| 0x4 | | 0x4 | ||
| 0x4 | | 0x4 | ||
| | | Mb1BctStartBlock | ||
|- | |- | ||
| 0x8 | | 0x8 | ||
| Line 245: | Line 245: | ||
| 0x10 | | 0x10 | ||
| 0x4 | | 0x4 | ||
| | | PscBlStartPage | ||
|- | |- | ||
| 0x14 | | 0x14 | ||
| 0x4 | | 0x4 | ||
| | | PscBlStartBlock | ||
|- | |- | ||
| 0x18 | | 0x18 | ||
| 0x4 | | 0x4 | ||
| | | PscBlVersion | ||
|- | |- | ||
| 0x1C | | 0x1C | ||
| 0x4 | | 0x4 | ||
| | | PscBlRandom | ||
|- | |- | ||
| 0x20 | | 0x20 | ||
| 0x4 | | 0x4 | ||
| | | Mb1StartPage | ||
|- | |- | ||
| 0x24 | | 0x24 | ||
| 0x4 | | 0x4 | ||
| | | Mb1StartBlock | ||
|- | |- | ||
| 0x28 | | 0x28 | ||
| 0x4 | | 0x4 | ||
| | | Mb1Version | ||
|- | |- | ||
| 0x2C | | 0x2C | ||
| 0x4 | | 0x4 | ||
| | | Mb1Random | ||
|} | |} | ||
Revision as of 05:38, 29 September 2025
BCT (Boot Configuration Table) is a data structure present on Tegra based devices that supplies boot time configuration parameters.
The Switch 2 can use different types of BCTs with the BRBCT (BootROM BCT) being installed into the first bytes of UFS storage's LUN0 and LUN1.
Structure
BRBCT
| Offset | Size | Description |
|---|---|---|
| 0x0 | 0x4 | Magic ("BCTB") |
| 0x4 | 0x40 | BctHash (SHA-512 hash over data from 0x44 to 0x2000) |
| 0x44 | 0x180 | PublicParams |
| 0x1C4 | 0x40 | CryptoHash (SHA-512 hash over data from 0x1200 to 0x2000) |
| 0x204 | 0xB10 | CryptoSignature (XMSS-SHA2_20_256 signature) |
| 0xD14 | 0x400 | CustomerInfo |
| 0x1114 | 0xEC | |
| 0x1200 | 0xE00 | SignedSect |
SignedSect
| Offset | Size | Description |
|---|---|---|
| AAD Section Begin | ||
| 0x0 | 0x10 | Salt1. Random 16 bytes. |
| 0x10 | 0x4 | Magic ("BCTB") |
| 0x14 | 0x14 | KdfLabel |
| 0x28 | 0x4 | Zeroes |
| 0x2C | 0x0C | AesGcmIv |
| AAD Section End | ||
| 0x38 | 0x10 | AesGcmTag |
| 0x48 | 0xC0 (0x30 * 4) | PtInfo[4] |
| 0x108 | 0x1 | VerMajor |
| 0x109 | 0x1 | VerMinor |
| 0x10A | 0x1 | RatchetLevel |
| 0x10B | 0x1 | RevokePk. Bit0: RevokeH0, Bit1: RevokeH1 |
| 0x10C | 0x400 | CustomerInfo |
| 0x50C | 0x284 | |
| 0x790 | 0x10 | Salt2. Random 16 bytes. |
| 0x7A0 | 0x10 | Ecid |
| 0x7B0 | 0x8 | BrBctBinding |
| 0x7B8 | 0x8 | SbkKdfLabel |
| 0x7C0 | 0x8 | UnknownKdfLabel0 |
| 0x7C8 | 0x8 | UnknownKdfLabel1 |
| 0x7D0 | 0x8 | FsiKdfLabel |
| 0x7D8 | 0x4 | NonGpioSelectBootChain |
| 0x7DC | 0x4 | BootLoadersUsed |
| 0x7E0 | 0x4 | SecureDebugControlNoneEcid |
| 0x7E4 | 0x4 | SecureDebugControlEcid |
| 0x7E8 | 0x4 | PreprodDevSign |
| 0x7EC | 0x4 | SecProvisioningKeynumSecure |
| 0x7F0 | 0x4 | BfBlBits |
| 0x7F4 | 0x20 | TzTestKey |
| 0x814 | 0x20 | FskpTestKey |
| 0x834 | 0x20 | PkaTestKey |
| 0x854 | 0x24 | |
| 0x878 | 0x01 | FskpKeyAesType |
| 0x879 | 0x01 | FskpKeyHmacType |
| 0x87A | 0x01 | PkaTestKeyType |
| 0x87B | 0x20 | SecProvisionDerivationString1 |
| 0x89B | 0x20 | SecProvisionDerivationString2 |
| 0x8BB | 0x1 | |
| 0x8BC | 0x4 | SoftSkuOverwrite |
| 0x8C0 | 0x4FC | |
| 0xDBC | 0x44 | Digest |
NvBctPtInfo
| Offset | Size | Description |
|---|---|---|
| 0x0 | 0x4 | Mb1BctStartPage |
| 0x4 | 0x4 | Mb1BctStartBlock |
| 0x8 | 0x4 | Mb1BctVersion |
| 0xC | 0x4 | Mb1BctRandom |
| 0x10 | 0x4 | PscBlStartPage |
| 0x14 | 0x4 | PscBlStartBlock |
| 0x18 | 0x4 | PscBlVersion |
| 0x1C | 0x4 | PscBlRandom |
| 0x20 | 0x4 | Mb1StartPage |
| 0x24 | 0x4 | Mb1StartBlock |
| 0x28 | 0x4 | Mb1Version |
| 0x2C | 0x4 | Mb1Random |
BfBlBits
| Bits | Description |
|---|---|
| 0 | GpioSelectBootChain |
| 1 | Mb1DebugProduction |
| 2 | Sc7RfDebugProduction |
| 3 | PscBlDebugProduction |
| 4 | PscRfDebugProduction |
| 5 | PscFwDebugProduction |
| 6 | BpmpDebugProduction |
| 7 | BpmpIstDebugProduction |
| 8 | MceDebugProduction |
| 9 | IstCcplexDebugProduction |
| 10 | IstFwDebugProduction |
| 11 | RtcRailViolationDetect |
| 12 | CustNvCcplexDfdEn |
| 13 | DebugWithTestKeys |
| 14 | DebugWithTestKeysDuringPscDebug |
| 15 | DisableBootromClockBoost |
| 16 | DisablePscromClkBoost |
| 17 | EnableScpmReset |
| 18 | SkipOemAuthDiagBoot |
| 19 | DiagBoot |
| 20 | BpmpDiagBoot |
| 21 | L0Ist |
| 22 | L1Ist |
| 23-31 |