Nintendo Switch Brew

Changes

Memory layout (view source)

Revision as of 16:33, 11 June 2020

7,883 bytes added ,  16:33, 11 June 2020
→‎Mariko
Line 1,047: Line 1,047:  
| 0x40000000000300
 
| 0x40000000000300
 
| TZRAM (L3 Page Table)
 
| TZRAM (L3 Page Table)
−
|-
   
|}
 
|}
   Line 1,282: Line 1,281:  
| 0x40000000000300
 
| 0x40000000000300
 
| TZRAM (L3 Page Table)
 
| TZRAM (L3 Page Table)
−
|-
   
|}
 
|}
   Line 1,289: Line 1,287:  
During boot, the BootROM saves the BCT in IRAM at address 0x40000100. The preceding 0x100 bytes (IRAM memory range from 0x40000000 to 0x40000100) contain a structure called BIT (Boot Info Table) which encapsulates the BCT in IRAM and is initialized by the BootROM as follows:
 
During boot, the BootROM saves the BCT in IRAM at address 0x40000100. The preceding 0x100 bytes (IRAM memory range from 0x40000000 to 0x40000100) contain a structure called BIT (Boot Info Table) which encapsulates the BCT in IRAM and is initialized by the BootROM as follows:
    +
=== Erista ===
 
{| class="wikitable" border="1"
 
{| class="wikitable" border="1"
 
|-
 
|-
Line 1,332: Line 1,331:  
|-
 
|-
 
|  0x18
 
|  0x18
−
|  0x04
+
|  0x04*0x04
−
|  BootTimeLogInit
+
|  BootTimeLog
−
|  Value from TIMERUS_CNTR_1US when the BootROM enters its main function.
+
|   
−
|-
+
{| class="wikitable" border="1"
−
|  0x1C
+
|-
−
|  0x04
+
!  Offset
−
|  BootTimeLogExit
+
! Size
−
|  This is the value that gets written into SB_CSR before nvboot. (0x10)
+
!  Field
−
|-
+
|-
−
|  0x20
+
|  0x00
−
|  0x04
+
|  0x04
−
|  BootReadBctTickCnt
+
|  BootTimeLogInit
−
| Time spent reading the BCT.
+
|-
−
|-
+
|  0x04
−
|  0x24
+
|  0x04
−
|  0x04
+
|  BootTimeLogExit
−
|  BootReadBLTickCnt
+
|-
−
| Time spent parsing the bootloader info from the BCT.
+
|  0x08
 +
|  0x04
 +
|  BootReadBctTickCnt
 +
  |-
 +
|  0x0C
 +
|  0x04
 +
|  BootReadBLTickCnt
 +
|}
 
|-
 
|-
 
|  0x28
 
|  0x28
Line 1,426: Line 1,432:  
|-
 
|-
 
|  0x50
 
|  0x50
−
|  0x18*4
+
|  0x18*0x04
 
|  BlState
 
|  BlState
 
|  Contains the state of attempts to load each bootloader.
 
|  Contains the state of attempts to load each bootloader.
Line 1,542: Line 1,548:  
  |  0x01
 
  |  0x01
 
  |  BootFromBootPartition
 
  |  BootFromBootPartition
 +
|-
 +
|  0x26
 +
|  0x01
 +
|  BootModeReadSuccessful
 
  |-
 
  |-
 
  |  0x27
 
  |  0x27
Line 1,560: Line 1,570:  
|  0xF4
 
|  0xF4
 
|  0x0C
 
|  0x0C
−
|  Padding
+
|  Reserved
 
|  Must be empty.
 
|  Must be empty.
 +
|}
 +
 +
=== Mariko ===
 +
{| class="wikitable" border="1"
 +
|-
 +
!  Offset
 +
!  Size
 +
!  Field
 +
!  Description
 +
|-
 +
|  0x00
 +
|  0x04
 +
|  BootRomVersion
 +
|  Set to 0x00210001 (BOOTDATA_VERSION_T210).
 +
|-
 +
|  0x04
 +
|  0x04
 +
|  DataVersion
 +
|  Set to 0x00210001 (BOOTDATA_VERSION_T210).
 +
|-
 +
|  0x08
 +
|  0x04
 +
|  RcmVersion
 +
|  Set to 0x00210001 (BOOTDATA_VERSION_T210).
 +
|-
 +
|  0x0C
 +
|  0x04
 +
|  BootType
 +
|
 +
None = 0
 +
Cold = 1
 +
Recovery = 2
 +
Uart = 3
 +
ExitRcm = 4
 +
|-
 +
|  0x10
 +
|  0x04
 +
|  PrimaryDevice
 +
|  Set to 0x05 (IROM) on coldboot.
 +
|-
 +
|  0x14
 +
|  0x04
 +
|  SecondaryDevice
 +
|  Set to 0x04 (SDMMC) on coldboot.
 +
|-
 +
|  0x18
 +
|  0x04
 +
|  AuthenticationScheme
 +
| 
 +
|-
 +
|  0x1C
 +
|  0x01
 +
|  EncryptionEnabled
 +
| 
 +
|-
 +
|  0x1D
 +
|  0x03
 +
|  Reserved
 +
| 
 +
|-
 +
|  0x20
 +
|  0x04
 +
|  BootROMtracker
 +
| 
 +
|-
 +
|  0x24
 +
|  0x05*0x04
 +
|  BootTimeLog
 +
| 
 +
{| class="wikitable" border="1"
 +
|-
 +
!  Offset
 +
!  Size
 +
!  Field
 +
|-
 +
|  0x00
 +
|  0x04
 +
|  BootTimeLogInit
 +
|-
 +
|  0x04
 +
|  0x04
 +
|  BootTimeLogExit
 +
|-
 +
|  0x08
 +
|  0x04
 +
|  BootSetupTickCnt
 +
|-
 +
|  0x0C
 +
|  0x04
 +
|  BootReadBctTickCnt
 +
|-
 +
|  0x10
 +
|  0x04
 +
|  BootReadBLTickCnt
 +
|}
 +
|-
 +
|  0x38
 +
|  0x10*0x28
 +
|  BootFlowLog
 +
| 
 +
{| class="wikitable" border="1"
 +
|-
 +
!  Offset
 +
!  Size
 +
!  Field
 +
|-
 +
|  0x00
 +
|  0x04
 +
|  BootFlowLogInit
 +
|-
 +
|  0x04
 +
|  0x04
 +
|  BootFlowLogExit
 +
|-
 +
|  0x08
 +
|  0x04
 +
|  BootFlowFuncId
 +
|-
 +
|  0x0C
 +
|  0x04
 +
|  BootFlowFuncStatus
 +
|}
 +
|-
 +
|  0x2B8
 +
|  0x04
 +
|  OscFrequency
 +
|  Value from CLK_RST_CONTROLLER_OSC_CTRL.
 +
|-
 +
|  0x2BC
 +
|  0x01
 +
|  DevInitialized
 +
|  Set to 1 after the boot device is initialized.
 +
|-
 +
|  0x2BD
 +
|  0x01
 +
|  SdramInitialized
 +
|  Set to 1 after the SDRAM parameters are parsed.
 +
|-
 +
|  0x2BE
 +
|  0x01
 +
|  ClearedForceRecovery
 +
|  Set to 1 if bit 2 was set in APBDEV_PMC_SCRATCH0.
 +
|-
 +
|  0x2BF
 +
|  0x01
 +
|  ClearedFailBack
 +
|  Set to 1 if bit 4 was set in APBDEV_PMC_SCRATCH0.
 +
|-
 +
|  0x2C0
 +
|  0x01
 +
|  InvokedFailBack
 +
|  Set to 1 if the bootloaders have different versions in the BCT.
 +
|-
 +
|  0x2C1
 +
|  0x01
 +
|  IRomPatchStatus
 +
| 
 +
|-
 +
|  0x2C2
 +
|  0x01
 +
|  BctSizeValid
 +
| 
 +
|-
 +
|  0x2C3
 +
|  0x09
 +
|  BctSizeStatus
 +
| 
 +
|-
 +
|  0x2CC
 +
|  0x04
 +
|  BctSizeLastJournalRead
 +
| 
 +
|-
 +
|  0x2D0
 +
|  0x04
 +
|  BctSizeBlock
 +
| 
 +
|-
 +
|  0x2D4
 +
|  0x04
 +
|  BctSizePage
 +
| 
 +
|-
 +
|  0x2D8
 +
|  0x01
 +
|  BctValid
 +
|  Set to 1 if the BCT was parsed successfully.
 +
|-
 +
|  0x2D9
 +
|  0x09
 +
|  BctStatus
 +
|  Each bit contains the status for BCT reads in a given block.
 +
|-
 +
|  0x2E2
 +
|  0x02
 +
|  Reserved
 +
| 
 +
|-
 +
|  0x2E4
 +
|  0x04
 +
|  BctLastJournalRead
 +
|  Contains the status of the last journal block read.
 +
None = 0
 +
Success = 1
 +
ValidationFailure = 2
 +
DeviceReadError = 3
 +
|-
 +
|  0x2E8
 +
|  0x04
 +
|  BctBlock
 +
|  Block number where the BCT was found.
 +
|-
 +
|  0x2EC
 +
|  0x04
 +
|  BctPage
 +
|  Page number where the BCT was found.
 +
|-
 +
|  0x2F0
 +
|  0x04
 +
|  BctSize
 +
|  Size of the BCT in IRAM.
 +
|-
 +
|  0x2F4
 +
|  0x04
 +
|  BctPtr
 +
|  Pointer to the BCT in IRAM.
 +
|-
 +
|  0x2F8
 +
|  0x18*0x04
 +
|  BlState
 +
|  Contains the state of attempts to load each bootloader.
 +
{| class="wikitable" border="1"
 +
|-
 +
!  Offset
 +
!  Size
 +
!  Field
 +
|-
 +
|  0x00
 +
|  0x04
 +
|  Status
 +
|-
 +
|  0x04
 +
|  0x04
 +
|  FirstEccBlock
 +
|-
 +
|  0x08
 +
|  0x04
 +
|  FirstEccPage
 +
|-
 +
|  0x0C
 +
|  0x04
 +
|  FirstCorrectedEccBlock
 +
|-
 +
|  0x10
 +
|  0x04
 +
|  FirstCorrectedEccPage
 +
|-
 +
|  0x14
 +
|  0x01
 +
|  HadEccError
 +
|-
 +
|  0x15
 +
|  0x01
 +
|  HadCrcError
 +
|-
 +
|  0x16
 +
|  0x01
 +
|  HadCorrectedEccError
 +
|-
 +
|  0x17
 +
|  0x01
 +
|  UsedForEccRecovery
 +
|}
 +
|-
 +
|  0x358
 +
|  0x100
 +
|  SecondaryDevStatus
 +
|  Structure to hold secondary boot device status.
 +
|-
 +
|  0x458
 +
|  0x03
 +
|  Reserved
 +
| 
 +
|-
 +
|  0x45B
 +
|  0x04
 +
|  UsbChargingStatus
 +
| 
 +
|-
 +
|  0x45F
 +
|  0x01
 +
|  PmuBootSelReadError
 +
| 
 +
|-
 +
|  0x460
 +
|  0x04
 +
|  SafeStartAddr
 +
|  Pointer to the end of the BCT in IRAM.
 
|}
 
|}
   Line 1,632: Line 1,940:  
MC_SECURITY_CARVEOUT1/2/3/4/5_CFG0
 
MC_SECURITY_CARVEOUT1/2/3/4/5_CFG0
 
</pre>
 
</pre>
 +
 +
The client access registers (CLIENT_ACCESS0/1/2/3/4) are used to whitelist accesses from MC clients as follows:
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  ClientAccess0
 +
!  ClientAccess1
 +
!  ClientAccess2
 +
!  ClientAccess3
 +
!  ClientAccess4
 +
|-
 +
| 0
 +
| CSR_PTCR
 +
| Reserved
 +
| CSW_VDEMBEW
 +
| CSR_SDMMCRA
 +
| CSR_SESRD
 +
|-
 +
| 1
 +
| CSR_DISPLAY0A
 +
| Reserved
 +
| CSW_VDETPMW
 +
| CSR_SDMMCRAA
 +
| CSW_SESWR
 +
|-
 +
| 2
 +
| CSR_DISPLAY0AB
 +
| CSR_VDEBSEVR
 +
| Reserved
 +
| CSR_SDMMCR
 +
| CSR_AXIAPR
 +
|-
 +
| 3
 +
| CSR_DISPLAY0B
 +
| CSR_VDEMBER
 +
| Reserved
 +
| CSR_SDMMCRAB
 +
| CSW_AXIAPW
 +
|-
 +
| 4
 +
| CSR_DISPLAY0BB
 +
| CSR_VDEMCER
 +
| CSR_ISPRA
 +
| CSW_SDMMCWA
 +
| CSR_ETRR
 +
|-
 +
| 5
 +
| CSR_DISPLAY0C
 +
| CSR_VDETPER
 +
| Reserved
 +
| CSW_SDMMCWAA
 +
| CSW_ETRW
 +
|-
 +
| 6
 +
| CSR_DISPLAY0CB
 +
| CSR_MPCORELPR
 +
| CSW_ISPWA
 +
| CSW_SDMMCW
 +
| CSR_TSECSRDB
 +
|-
 +
| 7
 +
| Reserved
 +
| CSR_MPCORER
 +
| CSW_ISPWB
 +
| CSW_SDMMCWAB
 +
| CSW_TSECSWRB
 +
|-
 +
| 8
 +
| Reserved
 +
| Reserved
 +
| Reserved
 +
| Reserved
 +
| CSR_GPUSRD2
 +
|-
 +
| 9
 +
| Reserved
 +
| Reserved
 +
| Reserved
 +
| Reserved
 +
| CSW_GPUSWR2
 +
|-
 +
| 10
 +
| Reserved
 +
| Reserved
 +
| CSR_XUSB_HOSTR
 +
| Reserved
 +
| Reserved
 +
|-
 +
| 11
 +
| Reserved
 +
| CSW_NVENCSWR
 +
| CSW_XUSB_HOSTW
 +
| Reserved
 +
| Reserved
 +
|-
 +
| 12
 +
| Reserved
 +
| Reserved
 +
| CSR_XUSB_DEVR
 +
| CSR_VICSRD
 +
| Reserved
 +
|-
 +
| 13
 +
| Reserved
 +
| Reserved
 +
| CSW_XUSB_DEVW
 +
| CSW_VICSWR
 +
| Reserved
 +
|-
 +
| 14
 +
| CSR_AFIR
 +
| Reserved
 +
| CSR_ISPRAB (Erista) or CSR_SE2SRD (Mariko)
 +
| Reserved
 +
| Reserved
 +
|-
 +
| 15
 +
| CSR_AVPCARM7R
 +
| Reserved
 +
| Reserved
 +
| Reserved
 +
| Reserved
 +
|-
 +
| 16
 +
| CSR_DISPLAYHC
 +
| Reserved
 +
| CSW_ISPWAB (Erista) or CSW_SE2SWR (Mariko)
 +
| Reserved
 +
| Reserved
 +
|-
 +
| 17
 +
| CSR_DISPLAYHCB
 +
| CSW_AFIW
 +
| CSW_ISPWBB (Erista) or Reserved (Mariko)
 +
| Reserved
 +
| Reserved
 +
|-
 +
| 18
 +
| Reserved
 +
| CSW_AVPCARM7W
 +
| Reserved
 +
| CSW_VIW
 +
| Reserved
 +
|-
 +
| 19
 +
| Reserved
 +
| Reserved
 +
| Reserved
 +
| CSR_DISPLAYD
 +
| Reserved
 +
|-
 +
| 20
 +
| Reserved
 +
| Reserved
 +
| CSR_TSECSRD
 +
| Reserved
 +
| Reserved
 +
|-
 +
| 21
 +
| CSR_HDAR
 +
| CSW_HDAW
 +
| CSW_TSECSWR
 +
| Reserved
 +
| Reserved
 +
|-
 +
| 22
 +
| CSR_HOST1XDMAR
 +
| CSW_HOST1XW
 +
| CSR_A9AVPSCR
 +
| Reserved
 +
| Reserved
 +
|-
 +
| 23
 +
| CSR_HOST1XR
 +
| Reserved
 +
| CSW_A9AVPSCW
 +
| Reserved
 +
| Reserved
 +
|-
 +
| 24
 +
| Reserved
 +
| CSW_MPCORELPW
 +
| CSR_GPUSRD
 +
| CSR_NVDECSRD
 +
| Reserved
 +
|-
 +
| 25
 +
| Reserved
 +
| CSW_MPCOREW
 +
| CSW_GPUSWR
 +
| CSW_NVDECSWR
 +
| Reserved
 +
|-
 +
| 26
 +
| Reserved
 +
| Reserved
 +
| CSR_DISPLAYT
 +
| CSR_APER
 +
| Reserved
 +
|-
 +
| 27
 +
| Reserved
 +
| CSW_PPCSAHBDMAW
 +
| Reserved
 +
| CSW_APEW
 +
| Reserved
 +
|-
 +
| 28
 +
| CSR_NVENCSRD
 +
| CSW_PPCSAHBSLVW
 +
| Reserved
 +
| Reserved
 +
| Reserved
 +
|-
 +
| 29
 +
| CSR_PPCSAHBDMAR
 +
| CSW_SATAW
 +
| Reserved
 +
| Reserved
 +
| Reserved
 +
|-
 +
| 30
 +
| CSR_PPCSAHBSLVR
 +
| CSW_VDEBSEVW
 +
| Reserved
 +
| CSR_NVJPGSRD
 +
| Reserved
 +
|-
 +
| 31
 +
| CSR_SATAR
 +
| CSW_VDEDBGW
 +
| Reserved
 +
| CSW_NVJPGSWR
 +
| Reserved
 +
|}
 +
 +
The configuration register (CFG0) is used to control the carveout's properties as follows:
 +
{| class="wikitable" border="1"
 +
!  Bits
 +
!  Description
 +
|-
 +
| 0
 +
| PROTECT_MODE
 +
0: LOCKBIT_SECURE (registers cannot be modified after lock down)
 +
1: TZ_SECURE (registers can be modified by TZ after lock down)
 +
|-
 +
| 1
 +
| LOCK_MODE
 +
0: UNLOCKED (registers can be modified at any time)
 +
1: LOCKED (registers cannot be modified until reset)
 +
|-
 +
| 2
 +
| ADDRESS_TYPE
 +
0: ANY_ADDRESS
 +
1: UNTRANSLATED_ONLY
 +
|-
 +
| 3-6
 +
| READ_ACCESS_LEVEL
 +
Bit 0: Access level 0 (default for all clients)
 +
Bit 1: Access level 1 (unknown)
 +
Bit 2: Access level 2 (Falcon clients in LS mode)
 +
Bit 3: Access level 3 (Falcon clients in HS mode)
 +
|-
 +
| 7-10
 +
| WRITE_ACCESS_LEVEL
 +
Bit 0: Access level 0 (default for all clients)
 +
Bit 1: Access level 1 (unknown)
 +
Bit 2: Access level 2 (Falcon clients in LS mode)
 +
Bit 3: Access level 3 (Falcon clients in HS mode)
 +
|-
 +
| 11-13
 +
| APERTURE_ID
 +
|-
 +
| 14-17
 +
| DISABLE_READ_CHECK_ACCESS_LEVEL
 +
Bit 0: Disable read access level 0 check
 +
Bit 1: Disable read access level 1 check
 +
Bit 2: Disable read access level 2 check
 +
Bit 3: Disable read access level 3 check
 +
|-
 +
| 18-21
 +
| DISABLE_WRITE_CHECK_ACCESS_LEVEL
 +
Bit 0: Disable write access level 0 check
 +
Bit 1: Disable write access level 1 check
 +
Bit 2: Disable write access level 2 check
 +
Bit 3: Disable write access level 3 check
 +
|-
 +
| 22
 +
| SEND_CFG_TO_GPU
 +
0: DISABLED
 +
1: ENABLED
 +
|-
 +
| 23
 +
| TZ_GLOBAL_WR_EN
 +
0: DISABLED
 +
1: BYPASS_CHECK
 +
|-
 +
| 24
 +
| TZ_GLOBAL_RD_EN
 +
0: DISABLED
 +
1: BYPASS_CHECK
 +
|-
 +
| 25
 +
| ALLOW_APERTURE_ID_MISMATCH
 +
0: DISABLED
 +
1: ENABLED
 +
|-
 +
| 26
 +
| FORCE_APERTURE_ID_MATCH
 +
0: DISABLED
 +
1: ENABLED
 +
|-
 +
| 27
 +
| IS_WPR
 +
0: DISABLED
 +
1: ENABLED
 +
|}
    
=== GSC1 ===
 
=== GSC1 ===
Line 1,720: Line 2,344:     
=== GSC5 ===
 
=== GSC5 ===
−
This carveout is, by default, for TSECB. In the Switch's case, this carveout is reserved for the Kernel.
+
This carveout is, by default, for TSECB. In the Switch's case, this carveout is used by the Kernel.
    
It is initially configured as follows:
 
It is initially configured as follows:
Line 1,740: Line 2,364:  
</pre>
 
</pre>
   −
It can be further configured using [[SMC#ConfigureCarveout|smcConfigureCarveout]], but it's currently unused.
+
Then further configured using [[SMC#ConfigureCarveout|smcConfigureCarveout]].
Retrieved from "https://switchbrew.org/wiki/Special:MobileDiff/7526...9660"