Nintendo Switch Brew

Lotus3: Difference between revisions

← Older editNewer edit →
Tatsuko (talk | contribs)
2 edits
m Lotus3 bootrom info
No edit summary
(9 intermediate revisions by the same user not shown)
Line 1: Line 1:
The Gamecard ASIC (known internally as the LOTUS3) is a separate chip on the motherboard responsible for communicating with the [[Gamecard]].
Lotus3 is the Gamecard ASIC, which is a separate chip on the motherboard responsible for communicating with the [[Gamecard]].


It is the Tegra's SDMMC2 device on the Switch and [[Filesystem_services|FS]] communicates with it using a custom protocol based on vendor specific MMC commands.
It is the Tegra's SDMMC2 device on the Switch and [[Filesystem_services|FS]] communicates with it using a custom protocol based on vendor specific MMC commands.
= Bootrom =
SHA256(lotus3_brom[0..0xFFF]) = b7d4cfb22c25c80cca6c55473b4f7730e675143321ba38f11727c99f787a8acf


= Protocol =
= Protocol =
Line 28: Line 25:


== WriteOperation ==
== WriteOperation ==
Submits a Gamecard ASIC [[#ASIC commands|operation]] using a 0x40 byte sized buffer as follows.
Submits a Gamecard ASIC [[#ASIC commands|operation]] using a 0x40 byte sized [[#OperationBuffer|OperationBuffer]].


=== OperationBuffer ===
=== OperationBuffer ===
Line 161: Line 158:


== WriteRegister ==
== WriteRegister ==
Signals the Gamecard ASIC to write an internal register. The register value is passed in the first word of a 0x200 byte sized buffer while the register index is passed in the actual [[#OperationBuffer]] as follows.
Signals the Gamecard ASIC to write an internal register. The register value is passed in the first word of a 0x200 byte sized buffer while the register index is passed in the actual [[#OperationBuffer]] as follows:


{| class="wikitable" border="1"
{| class="wikitable" border="1"
Line 191: Line 188:


== ReadRegister ==
== ReadRegister ==
Signals the Gamecard ASIC to send a 0x30 byte sized buffer containing the values of all ASIC registers as follows.
Signals the Gamecard ASIC to send a 0x30 byte sized buffer containing the values of all ASIC registers as follows:


{| class="wikitable" border="1"
{| class="wikitable" border="1"
Line 252: Line 249:


== GetCardHeader ==
== GetCardHeader ==
Signals the Gamecard ASIC to send a 0x108 byte sized buffer containing the current Gamecard's header data as follows.
Signals the Gamecard ASIC to send a 0x200 byte sized buffer containing the current Gamecard's header data as follows:


{| class="wikitable" border="1"
{| class="wikitable" border="1"
Line 262: Line 259:
| 0x0
| 0x0
| 0x4
| 0x4
| [[Gamecard_Format#Gamecard_Info|CUP Version]]
| CupVersion
|-
|-
| 0x4
| 0x4
| 0x4
| 0x4
| [[#ReadId1Normal.2C_ReadId1Secure.2C_ReadId1Writer|Gamecard ID1]]
| [[Filesystem_services#CardId1|CardId1]]
|-
|-
| 0x8
| 0x8
| 0x100
| 0x100
| [[Gamecard_Format#Gamecard_Header|Gamecard Header]] (without the signature)
| [[XCI#CardHeader|CardHeader]] (without the signature)
|-
| 0x108
| 0xD8
| Reserved
|-
| 0x1E0
| 0x20
| [11.0.0+] SHA-256 hash of the data from 0 to 0x1E0 ([1.0.0-10.2.0] Reserved)  
|}
|}


== ChangeGcModeToSecure ==
== ChangeGcModeToSecure ==
Signals the Gamecard ASIC to send a 0x800 byte sized buffer containing the current Gamecard's key area sectors as follows.
Signals the Gamecard ASIC to send a 0x800 byte sized buffer containing the current Gamecard's key area sectors as follows:


{| class="wikitable" border="1"
{| class="wikitable" border="1"
|-
|-
! Sector
! Offset
! Size
! Size
! Description
! Description
|-
|-
| 0
| 0x0
| 0x4
| SecurityLevel
|-
| 0x4
| 0x4
| Lotus3Status
|-
| 0x8
| 0x4
| [[Filesystem_services#CardId1|CardId1]]
|-
| 0xC
| 0x4
| [[Filesystem_services#CardId2|CardId2]]
|-
| 0x10
| 0x40
| CardUid
|-
| 0x50
| 0x1B0
| Reserved
|-
| 0x200
| 0x200
| 0x200
| Gamecard specific data
| [[XCI#CertArea|CertArea]]
|-
|-
| 1
| 0x400
| 0x200
| 0x200
| [[Gamecard_Format#Gamecard_Certificate|Gamecard Certificate]]
| Reserved
|-
|-
| 2
| 0x600
| 0x200
| 0x200
| Empty sector (all 0xFF)
| [[XCI#InitialData|InitialData]]
|}
 
[11.0.0+] This now signals the Gamecard ASIC to send a 0x600 byte sized buffer containing the current Gamecard's key area sectors as follows:
 
{| class="wikitable" border="1"
|-
|-
| 3
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| SecurityLevel
|-
| 0x4
| 0x4
| Lotus3Status
|-
| 0x8
| 0x4
| [[Filesystem_services#CardId1|CardId1]]
|-
| 0xC
| 0x4
| [[Filesystem_services#CardId2|CardId2]]
|-
| 0x10
| 0x40
| CardUid
|-
| 0x50
| 0x1B0
| Reserved
|-
| 0x200
| 0x200
| [[XCI#CertArea|CertArea]]
|-
| 0x400
| 0x200
| 0x200
| [[Gamecard_Format#Initial_Data|Gamecard Initial Data]]
| [[XCI#InitialData|InitialData]]
|}
|}


== SendCardCommand ==
== SendCardCommand ==
Signals the Gamecard ASIC to relay a specific [[#Gamecard commands|command]] to the Gamecard. The command is sent to the Gamecard using the [[#OperationBuffer]] as follows.
Signals the Gamecard ASIC to relay a specific [[#Gamecard commands|command]] to the Gamecard. The command is sent to the Gamecard using the [[#OperationBuffer]] as follows:


{| class="wikitable" border="1"
{| class="wikitable" border="1"
Line 345: Line 411:


== ExchangeRandomValuesInSecureMode ==
== ExchangeRandomValuesInSecureMode ==
Signals the Gamecard ASIC to exchange random authentication values with the current Gamecard. The Gamecard response values are returned in a 0x20 sized buffer while the host values are passed in the actual [[#OperationBuffer]] as follows.
Signals the Gamecard ASIC to exchange random authentication values with the current Gamecard. The Gamecard response values are returned in a 0x20 sized buffer while the host values are passed in the actual [[#OperationBuffer]] as follows:


{| class="wikitable" border="1"
{| class="wikitable" border="1"
Line 370: Line 436:


== ChallengeCardExistence ==
== ChallengeCardExistence ==
Signals the Gamecard ASIC to exchange random values with the current Gamecard. The Gamecard response values are returned in a 0x58 sized buffer while the host values are passed in the actual [[#OperationBuffer]] as follows.
Signals the Gamecard ASIC to exchange random values with the current Gamecard. The Gamecard response values are returned in a 0x58 sized buffer while the host values are passed in the actual [[#OperationBuffer]] as follows:


{| class="wikitable" border="1"
{| class="wikitable" border="1"
Line 471: Line 537:
Returns the Gamecard ID1 under one of the valid [[#Gamecard modes|Gamecard modes]].
Returns the Gamecard ID1 under one of the valid [[#Gamecard modes|Gamecard modes]].


The [[#OperationBuffer]] is as follows.
The [[#OperationBuffer]] is as follows:


{| class="wikitable" border="1"
{| class="wikitable" border="1"
Line 527: Line 593:
Returns the Gamecard ID2 under one of the valid [[#Gamecard modes|Gamecard modes]].
Returns the Gamecard ID2 under one of the valid [[#Gamecard modes|Gamecard modes]].


The [[#OperationBuffer]] is as follows.
The [[#OperationBuffer]] is as follows:


{| class="wikitable" border="1"
{| class="wikitable" border="1"
Line 583: Line 649:
Returns the Gamecard ID3 under one of the valid [[#Gamecard modes|Gamecard modes]].
Returns the Gamecard ID3 under one of the valid [[#Gamecard modes|Gamecard modes]].


The [[#OperationBuffer]] is as follows.
The [[#OperationBuffer]] is as follows:


{| class="wikitable" border="1"
{| class="wikitable" border="1"
Line 639: Line 705:
Reads pages from the Gamecard, calculates their CRC and returns it. This command is only available in [[#Gamecard modes|Write]] mode.
Reads pages from the Gamecard, calculates their CRC and returns it. This command is only available in [[#Gamecard modes|Write]] mode.


The [[#OperationBuffer]] is as follows.
The [[#OperationBuffer]] is as follows:


{| class="wikitable" border="1"
{| class="wikitable" border="1"
Line 691: Line 757:
Writes Gamecard pages. This command is only available in [[#Gamecard modes|Write]] and [[#Gamecard modes|Secure]] modes.
Writes Gamecard pages. This command is only available in [[#Gamecard modes|Write]] and [[#Gamecard modes|Secure]] modes.


The [[#OperationBuffer]] is as follows.
The [[#OperationBuffer]] is as follows:


{| class="wikitable" border="1"
{| class="wikitable" border="1"
Line 743: Line 809:
Reads Gamecard pages. This command is only available in [[#Gamecard modes|Normal]] and [[#Gamecard modes|Secure]] modes.
Reads Gamecard pages. This command is only available in [[#Gamecard modes|Normal]] and [[#Gamecard modes|Secure]] modes.


The [[#OperationBuffer]] is as follows.
The [[#OperationBuffer]] is as follows:


{| class="wikitable" border="1"
{| class="wikitable" border="1"
Line 795: Line 861:
Fully erases a Gamecard's contents. This command is only available in [[#Gamecard modes|Write]] mode.
Fully erases a Gamecard's contents. This command is only available in [[#Gamecard modes|Write]] mode.


The [[#OperationBuffer]] is as follows.
The [[#OperationBuffer]] is as follows:


{| class="wikitable" border="1"
{| class="wikitable" border="1"
Line 851: Line 917:
Reads a development Gamecard's parameters. This command is only available in [[#Gamecard modes|Write]] mode.
Reads a development Gamecard's parameters. This command is only available in [[#Gamecard modes|Write]] mode.


The [[#OperationBuffer]] is as follows.
The [[#OperationBuffer]] is as follows:


{| class="wikitable" border="1"
{| class="wikitable" border="1"
Line 907: Line 973:
Writes a development Gamecard's parameters. This command is only available in [[#Gamecard modes|Write]] mode.
Writes a development Gamecard's parameters. This command is only available in [[#Gamecard modes|Write]] mode.


The [[#OperationBuffer]] is as follows.
The [[#OperationBuffer]] is as follows:


{| class="wikitable" border="1"
{| class="wikitable" border="1"
Line 963: Line 1,029:
Sets the Gamecard's internal key data. This command is only available in [[#Gamecard modes|Secure]] mode.
Sets the Gamecard's internal key data. This command is only available in [[#Gamecard modes|Secure]] mode.


The [[#OperationBuffer]] is as follows.
The [[#OperationBuffer]] is as follows:


{| class="wikitable" border="1"
{| class="wikitable" border="1"
Line 1,019: Line 1,085:
Resets the Gamecard's internal status. This command is only available in [[#Gamecard modes|Secure]] mode.
Resets the Gamecard's internal status. This command is only available in [[#Gamecard modes|Secure]] mode.


The [[#OperationBuffer]] is as follows.
The [[#OperationBuffer]] is as follows:


{| class="wikitable" border="1"
{| class="wikitable" border="1"
Line 1,075: Line 1,141:
Used by [[Filesystem_services#OpenGameCardStorage|OpenGameCardStorage]]. This command is only available in [[#Gamecard modes|Normal]] mode.
Used by [[Filesystem_services#OpenGameCardStorage|OpenGameCardStorage]]. This command is only available in [[#Gamecard modes|Normal]] mode.


The [[#OperationBuffer]] is as follows.
The [[#OperationBuffer]] is as follows:


{| class="wikitable" border="1"
{| class="wikitable" border="1"
Line 1,156: Line 1,222:


= User firmware =
= User firmware =
[[Filesystem_services|FS]] provides the appropriate Gamecard ASIC's user firmware (Lotus ASIC Firmware or LAFW) which is encrypted, signed and follows the format below.
[[Filesystem_services|FS]] provides the appropriate Gamecard ASIC's user firmware (Lotus ASIC Firmware or LAFW) which is encrypted, signed and follows the format below:


{| class="wikitable" border="1"
{| class="wikitable" border="1"
Line 1,186: Line 1,252:
| 0x110
| 0x110
| 0x4
| 0x4
| Version (0, 0x1, [4.0.0+] 0x3, [9.0.0+] 0x7, [11.0.0+] 0xF)
| Version (0, 0x1, [4.0.0+] 0x3, [9.0.0+] 0x7, [11.0.0+] 0xF, [12.0.0+] 0x1F)
|-
|-
| 0x114
| 0x114
Line 1,230: Line 1,296:


[11.0.0+] This firmware blob was updated.
[11.0.0+] This firmware blob was updated.
[12.0.0+] This firmware blob was updated.
[14.0.0+] This firmware blob was updated.


=== WriterFw ===
=== WriterFw ===
Line 1,240: Line 1,310:


Found inside [[Filesystem_services|FS]].
Found inside [[Filesystem_services|FS]].
[9.0.0+] This firmware blob was updated.
[11.0.0+] This firmware blob was updated.
[14.0.0+] This firmware blob was updated.


=== RmaFw ===
=== RmaFw ===
Retrieved from "https://switchbrew.org/wiki/Lotus3"