Line 1,047: |
Line 1,047: |
| | 0x40000000000300 | | | 0x40000000000300 |
| | TZRAM (L3 Page Table) | | | TZRAM (L3 Page Table) |
− | |-
| |
| |} | | |} |
| | | |
Line 1,282: |
Line 1,281: |
| | 0x40000000000300 | | | 0x40000000000300 |
| | TZRAM (L3 Page Table) | | | TZRAM (L3 Page Table) |
− | |-
| |
| |} | | |} |
| | | |
Line 1,289: |
Line 1,287: |
| During boot, the BootROM saves the BCT in IRAM at address 0x40000100. The preceding 0x100 bytes (IRAM memory range from 0x40000000 to 0x40000100) contain a structure called BIT (Boot Info Table) which encapsulates the BCT in IRAM and is initialized by the BootROM as follows: | | During boot, the BootROM saves the BCT in IRAM at address 0x40000100. The preceding 0x100 bytes (IRAM memory range from 0x40000000 to 0x40000100) contain a structure called BIT (Boot Info Table) which encapsulates the BCT in IRAM and is initialized by the BootROM as follows: |
| | | |
| + | === Erista === |
| {| class="wikitable" border="1" | | {| class="wikitable" border="1" |
| |- | | |- |
Line 1,332: |
Line 1,331: |
| |- | | |- |
| | 0x18 | | | 0x18 |
− | | 0x04 | + | | 0x04*0x04 |
− | | BootTimeLogInit | + | | BootTimeLog |
− | | Value from TIMERUS_CNTR_1US when the BootROM enters its main function. | + | | |
− | |- | + | {| class="wikitable" border="1" |
− | | 0x1C | + | |- |
− | | 0x04 | + | ! Offset |
− | | BootTimeLogExit | + | ! Size |
− | | This is the value that gets written into SB_CSR before nvboot. (0x10) | + | ! Field |
− | |- | + | |- |
− | | 0x20 | + | | 0x00 |
− | | 0x04 | + | | 0x04 |
− | | BootReadBctTickCnt | + | | BootTimeLogInit |
− | | Time spent reading the BCT.
| + | |- |
− | |- | + | | 0x04 |
− | | 0x24 | + | | 0x04 |
− | | 0x04 | + | | BootTimeLogExit |
− | | BootReadBLTickCnt | + | |- |
− | | Time spent parsing the bootloader info from the BCT. | + | | 0x08 |
| + | | 0x04 |
| + | | BootReadBctTickCnt |
| + | |- |
| + | | 0x0C |
| + | | 0x04 |
| + | | BootReadBLTickCnt |
| + | |} |
| |- | | |- |
| | 0x28 | | | 0x28 |
Line 1,426: |
Line 1,432: |
| |- | | |- |
| | 0x50 | | | 0x50 |
− | | 0x18*4 | + | | 0x18*0x04 |
| | BlState | | | BlState |
| | Contains the state of attempts to load each bootloader. | | | Contains the state of attempts to load each bootloader. |
Line 1,542: |
Line 1,548: |
| | 0x01 | | | 0x01 |
| | BootFromBootPartition | | | BootFromBootPartition |
| + | |- |
| + | | 0x26 |
| + | | 0x01 |
| + | | BootModeReadSuccessful |
| |- | | |- |
| | 0x27 | | | 0x27 |
Line 1,560: |
Line 1,570: |
| | 0xF4 | | | 0xF4 |
| | 0x0C | | | 0x0C |
− | | Padding | + | | Reserved |
| | Must be empty. | | | Must be empty. |
| + | |} |
| + | |
| + | === Mariko === |
| + | {| class="wikitable" border="1" |
| + | |- |
| + | ! Offset |
| + | ! Size |
| + | ! Field |
| + | ! Description |
| + | |- |
| + | | 0x00 |
| + | | 0x04 |
| + | | BootRomVersion |
| + | | Set to 0x00210001 (BOOTDATA_VERSION_T210). |
| + | |- |
| + | | 0x04 |
| + | | 0x04 |
| + | | DataVersion |
| + | | Set to 0x00210001 (BOOTDATA_VERSION_T210). |
| + | |- |
| + | | 0x08 |
| + | | 0x04 |
| + | | RcmVersion |
| + | | Set to 0x00210001 (BOOTDATA_VERSION_T210). |
| + | |- |
| + | | 0x0C |
| + | | 0x04 |
| + | | BootType |
| + | | |
| + | None = 0 |
| + | Cold = 1 |
| + | Recovery = 2 |
| + | Uart = 3 |
| + | ExitRcm = 4 |
| + | |- |
| + | | 0x10 |
| + | | 0x04 |
| + | | PrimaryDevice |
| + | | Set to 0x05 (IROM) on coldboot. |
| + | |- |
| + | | 0x14 |
| + | | 0x04 |
| + | | SecondaryDevice |
| + | | Set to 0x04 (SDMMC) on coldboot. |
| + | |- |
| + | | 0x18 |
| + | | 0x04 |
| + | | AuthenticationScheme |
| + | | |
| + | |- |
| + | | 0x1C |
| + | | 0x01 |
| + | | EncryptionEnabled |
| + | | |
| + | |- |
| + | | 0x1D |
| + | | 0x03 |
| + | | Reserved |
| + | | |
| + | |- |
| + | | 0x20 |
| + | | 0x04 |
| + | | BootROMtracker |
| + | | |
| + | |- |
| + | | 0x24 |
| + | | 0x05*0x04 |
| + | | BootTimeLog |
| + | | |
| + | {| class="wikitable" border="1" |
| + | |- |
| + | ! Offset |
| + | ! Size |
| + | ! Field |
| + | |- |
| + | | 0x00 |
| + | | 0x04 |
| + | | BootTimeLogInit |
| + | |- |
| + | | 0x04 |
| + | | 0x04 |
| + | | BootTimeLogExit |
| + | |- |
| + | | 0x08 |
| + | | 0x04 |
| + | | BootSetupTickCnt |
| + | |- |
| + | | 0x0C |
| + | | 0x04 |
| + | | BootReadBctTickCnt |
| + | |- |
| + | | 0x10 |
| + | | 0x04 |
| + | | BootReadBLTickCnt |
| + | |} |
| + | |- |
| + | | 0x38 |
| + | | 0x10*0x28 |
| + | | BootFlowLog |
| + | | |
| + | {| class="wikitable" border="1" |
| + | |- |
| + | ! Offset |
| + | ! Size |
| + | ! Field |
| + | |- |
| + | | 0x00 |
| + | | 0x04 |
| + | | BootFlowLogInit |
| + | |- |
| + | | 0x04 |
| + | | 0x04 |
| + | | BootFlowLogExit |
| + | |- |
| + | | 0x08 |
| + | | 0x04 |
| + | | BootFlowFuncId |
| + | |- |
| + | | 0x0C |
| + | | 0x04 |
| + | | BootFlowFuncStatus |
| + | |} |
| + | |- |
| + | | 0x2B8 |
| + | | 0x04 |
| + | | OscFrequency |
| + | | Value from CLK_RST_CONTROLLER_OSC_CTRL. |
| + | |- |
| + | | 0x2BC |
| + | | 0x01 |
| + | | DevInitialized |
| + | | Set to 1 after the boot device is initialized. |
| + | |- |
| + | | 0x2BD |
| + | | 0x01 |
| + | | SdramInitialized |
| + | | Set to 1 after the SDRAM parameters are parsed. |
| + | |- |
| + | | 0x2BE |
| + | | 0x01 |
| + | | ClearedForceRecovery |
| + | | Set to 1 if bit 2 was set in APBDEV_PMC_SCRATCH0. |
| + | |- |
| + | | 0x2BF |
| + | | 0x01 |
| + | | ClearedFailBack |
| + | | Set to 1 if bit 4 was set in APBDEV_PMC_SCRATCH0. |
| + | |- |
| + | | 0x2C0 |
| + | | 0x01 |
| + | | InvokedFailBack |
| + | | Set to 1 if the bootloaders have different versions in the BCT. |
| + | |- |
| + | | 0x2C1 |
| + | | 0x01 |
| + | | IRomPatchStatus |
| + | | |
| + | |- |
| + | | 0x2C2 |
| + | | 0x01 |
| + | | BctSizeValid |
| + | | |
| + | |- |
| + | | 0x2C3 |
| + | | 0x09 |
| + | | BctSizeStatus |
| + | | |
| + | |- |
| + | | 0x2CC |
| + | | 0x04 |
| + | | BctSizeLastJournalRead |
| + | | |
| + | |- |
| + | | 0x2D0 |
| + | | 0x04 |
| + | | BctSizeBlock |
| + | | |
| + | |- |
| + | | 0x2D4 |
| + | | 0x04 |
| + | | BctSizePage |
| + | | |
| + | |- |
| + | | 0x2D8 |
| + | | 0x01 |
| + | | BctValid |
| + | | Set to 1 if the BCT was parsed successfully. |
| + | |- |
| + | | 0x2D9 |
| + | | 0x09 |
| + | | BctStatus |
| + | | Each bit contains the status for BCT reads in a given block. |
| + | |- |
| + | | 0x2E2 |
| + | | 0x02 |
| + | | Reserved |
| + | | |
| + | |- |
| + | | 0x2E4 |
| + | | 0x04 |
| + | | BctLastJournalRead |
| + | | Contains the status of the last journal block read. |
| + | None = 0 |
| + | Success = 1 |
| + | ValidationFailure = 2 |
| + | DeviceReadError = 3 |
| + | |- |
| + | | 0x2E8 |
| + | | 0x04 |
| + | | BctBlock |
| + | | Block number where the BCT was found. |
| + | |- |
| + | | 0x2EC |
| + | | 0x04 |
| + | | BctPage |
| + | | Page number where the BCT was found. |
| + | |- |
| + | | 0x2F0 |
| + | | 0x04 |
| + | | BctSize |
| + | | Size of the BCT in IRAM. |
| + | |- |
| + | | 0x2F4 |
| + | | 0x04 |
| + | | BctPtr |
| + | | Pointer to the BCT in IRAM. |
| + | |- |
| + | | 0x2F8 |
| + | | 0x18*0x04 |
| + | | BlState |
| + | | Contains the state of attempts to load each bootloader. |
| + | {| class="wikitable" border="1" |
| + | |- |
| + | ! Offset |
| + | ! Size |
| + | ! Field |
| + | |- |
| + | | 0x00 |
| + | | 0x04 |
| + | | Status |
| + | |- |
| + | | 0x04 |
| + | | 0x04 |
| + | | FirstEccBlock |
| + | |- |
| + | | 0x08 |
| + | | 0x04 |
| + | | FirstEccPage |
| + | |- |
| + | | 0x0C |
| + | | 0x04 |
| + | | FirstCorrectedEccBlock |
| + | |- |
| + | | 0x10 |
| + | | 0x04 |
| + | | FirstCorrectedEccPage |
| + | |- |
| + | | 0x14 |
| + | | 0x01 |
| + | | HadEccError |
| + | |- |
| + | | 0x15 |
| + | | 0x01 |
| + | | HadCrcError |
| + | |- |
| + | | 0x16 |
| + | | 0x01 |
| + | | HadCorrectedEccError |
| + | |- |
| + | | 0x17 |
| + | | 0x01 |
| + | | UsedForEccRecovery |
| + | |} |
| + | |- |
| + | | 0x358 |
| + | | 0x100 |
| + | | SecondaryDevStatus |
| + | | Structure to hold secondary boot device status. |
| + | |- |
| + | | 0x458 |
| + | | 0x03 |
| + | | Reserved |
| + | | |
| + | |- |
| + | | 0x45B |
| + | | 0x04 |
| + | | UsbChargingStatus |
| + | | |
| + | |- |
| + | | 0x45F |
| + | | 0x01 |
| + | | PmuBootSelReadError |
| + | | |
| + | |- |
| + | | 0x460 |
| + | | 0x04 |
| + | | SafeStartAddr |
| + | | Pointer to the end of the BCT in IRAM. |
| |} | | |} |
| | | |
Line 1,632: |
Line 1,940: |
| MC_SECURITY_CARVEOUT1/2/3/4/5_CFG0 | | MC_SECURITY_CARVEOUT1/2/3/4/5_CFG0 |
| </pre> | | </pre> |
| + | |
| + | The client access registers (CLIENT_ACCESS0/1/2/3/4) are used to whitelist accesses from MC clients as follows: |
| + | {| class="wikitable" border="1" |
| + | ! Bits |
| + | ! ClientAccess0 |
| + | ! ClientAccess1 |
| + | ! ClientAccess2 |
| + | ! ClientAccess3 |
| + | ! ClientAccess4 |
| + | |- |
| + | | 0 |
| + | | CSR_PTCR |
| + | | Reserved |
| + | | CSW_VDEMBEW |
| + | | CSR_SDMMCRA |
| + | | CSR_SESRD |
| + | |- |
| + | | 1 |
| + | | CSR_DISPLAY0A |
| + | | Reserved |
| + | | CSW_VDETPMW |
| + | | CSR_SDMMCRAA |
| + | | CSW_SESWR |
| + | |- |
| + | | 2 |
| + | | CSR_DISPLAY0AB |
| + | | CSR_VDEBSEVR |
| + | | Reserved |
| + | | CSR_SDMMCR |
| + | | CSR_AXIAPR |
| + | |- |
| + | | 3 |
| + | | CSR_DISPLAY0B |
| + | | CSR_VDEMBER |
| + | | Reserved |
| + | | CSR_SDMMCRAB |
| + | | CSW_AXIAPW |
| + | |- |
| + | | 4 |
| + | | CSR_DISPLAY0BB |
| + | | CSR_VDEMCER |
| + | | CSR_ISPRA |
| + | | CSW_SDMMCWA |
| + | | CSR_ETRR |
| + | |- |
| + | | 5 |
| + | | CSR_DISPLAY0C |
| + | | CSR_VDETPER |
| + | | Reserved |
| + | | CSW_SDMMCWAA |
| + | | CSW_ETRW |
| + | |- |
| + | | 6 |
| + | | CSR_DISPLAY0CB |
| + | | CSR_MPCORELPR |
| + | | CSW_ISPWA |
| + | | CSW_SDMMCW |
| + | | CSR_TSECSRDB |
| + | |- |
| + | | 7 |
| + | | Reserved |
| + | | CSR_MPCORER |
| + | | CSW_ISPWB |
| + | | CSW_SDMMCWAB |
| + | | CSW_TSECSWRB |
| + | |- |
| + | | 8 |
| + | | Reserved |
| + | | Reserved |
| + | | Reserved |
| + | | Reserved |
| + | | CSR_GPUSRD2 |
| + | |- |
| + | | 9 |
| + | | Reserved |
| + | | Reserved |
| + | | Reserved |
| + | | Reserved |
| + | | CSW_GPUSWR2 |
| + | |- |
| + | | 10 |
| + | | Reserved |
| + | | Reserved |
| + | | CSR_XUSB_HOSTR |
| + | | Reserved |
| + | | Reserved |
| + | |- |
| + | | 11 |
| + | | Reserved |
| + | | CSW_NVENCSWR |
| + | | CSW_XUSB_HOSTW |
| + | | Reserved |
| + | | Reserved |
| + | |- |
| + | | 12 |
| + | | Reserved |
| + | | Reserved |
| + | | CSR_XUSB_DEVR |
| + | | CSR_VICSRD |
| + | | Reserved |
| + | |- |
| + | | 13 |
| + | | Reserved |
| + | | Reserved |
| + | | CSW_XUSB_DEVW |
| + | | CSW_VICSWR |
| + | | Reserved |
| + | |- |
| + | | 14 |
| + | | CSR_AFIR |
| + | | Reserved |
| + | | CSR_ISPRAB (Erista) or CSR_SE2SRD (Mariko) |
| + | | Reserved |
| + | | Reserved |
| + | |- |
| + | | 15 |
| + | | CSR_AVPCARM7R |
| + | | Reserved |
| + | | Reserved |
| + | | Reserved |
| + | | Reserved |
| + | |- |
| + | | 16 |
| + | | CSR_DISPLAYHC |
| + | | Reserved |
| + | | CSW_ISPWAB (Erista) or CSW_SE2SWR (Mariko) |
| + | | Reserved |
| + | | Reserved |
| + | |- |
| + | | 17 |
| + | | CSR_DISPLAYHCB |
| + | | CSW_AFIW |
| + | | CSW_ISPWBB (Erista) or Reserved (Mariko) |
| + | | Reserved |
| + | | Reserved |
| + | |- |
| + | | 18 |
| + | | Reserved |
| + | | CSW_AVPCARM7W |
| + | | Reserved |
| + | | CSW_VIW |
| + | | Reserved |
| + | |- |
| + | | 19 |
| + | | Reserved |
| + | | Reserved |
| + | | Reserved |
| + | | CSR_DISPLAYD |
| + | | Reserved |
| + | |- |
| + | | 20 |
| + | | Reserved |
| + | | Reserved |
| + | | CSR_TSECSRD |
| + | | Reserved |
| + | | Reserved |
| + | |- |
| + | | 21 |
| + | | CSR_HDAR |
| + | | CSW_HDAW |
| + | | CSW_TSECSWR |
| + | | Reserved |
| + | | Reserved |
| + | |- |
| + | | 22 |
| + | | CSR_HOST1XDMAR |
| + | | CSW_HOST1XW |
| + | | CSR_A9AVPSCR |
| + | | Reserved |
| + | | Reserved |
| + | |- |
| + | | 23 |
| + | | CSR_HOST1XR |
| + | | Reserved |
| + | | CSW_A9AVPSCW |
| + | | Reserved |
| + | | Reserved |
| + | |- |
| + | | 24 |
| + | | Reserved |
| + | | CSW_MPCORELPW |
| + | | CSR_GPUSRD |
| + | | CSR_NVDECSRD |
| + | | Reserved |
| + | |- |
| + | | 25 |
| + | | Reserved |
| + | | CSW_MPCOREW |
| + | | CSW_GPUSWR |
| + | | CSW_NVDECSWR |
| + | | Reserved |
| + | |- |
| + | | 26 |
| + | | Reserved |
| + | | Reserved |
| + | | CSR_DISPLAYT |
| + | | CSR_APER |
| + | | Reserved |
| + | |- |
| + | | 27 |
| + | | Reserved |
| + | | CSW_PPCSAHBDMAW |
| + | | Reserved |
| + | | CSW_APEW |
| + | | Reserved |
| + | |- |
| + | | 28 |
| + | | CSR_NVENCSRD |
| + | | CSW_PPCSAHBSLVW |
| + | | Reserved |
| + | | Reserved |
| + | | Reserved |
| + | |- |
| + | | 29 |
| + | | CSR_PPCSAHBDMAR |
| + | | CSW_SATAW |
| + | | Reserved |
| + | | Reserved |
| + | | Reserved |
| + | |- |
| + | | 30 |
| + | | CSR_PPCSAHBSLVR |
| + | | CSW_VDEBSEVW |
| + | | Reserved |
| + | | CSR_NVJPGSRD |
| + | | Reserved |
| + | |- |
| + | | 31 |
| + | | CSR_SATAR |
| + | | CSW_VDEDBGW |
| + | | Reserved |
| + | | CSW_NVJPGSWR |
| + | | Reserved |
| + | |} |
| + | |
| + | The configuration register (CFG0) is used to control the carveout's properties as follows: |
| + | {| class="wikitable" border="1" |
| + | ! Bits |
| + | ! Description |
| + | |- |
| + | | 0 |
| + | | PROTECT_MODE |
| + | 0: LOCKBIT_SECURE (registers cannot be modified after lock down) |
| + | 1: TZ_SECURE (registers can be modified by TZ after lock down) |
| + | |- |
| + | | 1 |
| + | | LOCK_MODE |
| + | 0: UNLOCKED (registers can be modified at any time) |
| + | 1: LOCKED (registers cannot be modified until reset) |
| + | |- |
| + | | 2 |
| + | | ADDRESS_TYPE |
| + | 0: ANY_ADDRESS |
| + | 1: UNTRANSLATED_ONLY |
| + | |- |
| + | | 3-6 |
| + | | READ_ACCESS_LEVEL |
| + | Bit 0: Access level 0 (default for all clients) |
| + | Bit 1: Access level 1 (unknown) |
| + | Bit 2: Access level 2 (Falcon clients in LS mode) |
| + | Bit 3: Access level 3 (Falcon clients in HS mode) |
| + | |- |
| + | | 7-10 |
| + | | WRITE_ACCESS_LEVEL |
| + | Bit 0: Access level 0 (default for all clients) |
| + | Bit 1: Access level 1 (unknown) |
| + | Bit 2: Access level 2 (Falcon clients in LS mode) |
| + | Bit 3: Access level 3 (Falcon clients in HS mode) |
| + | |- |
| + | | 11-13 |
| + | | APERTURE_ID |
| + | |- |
| + | | 14-17 |
| + | | DISABLE_READ_CHECK_ACCESS_LEVEL |
| + | Bit 0: Disable read access level 0 check |
| + | Bit 1: Disable read access level 1 check |
| + | Bit 2: Disable read access level 2 check |
| + | Bit 3: Disable read access level 3 check |
| + | |- |
| + | | 18-21 |
| + | | DISABLE_WRITE_CHECK_ACCESS_LEVEL |
| + | Bit 0: Disable write access level 0 check |
| + | Bit 1: Disable write access level 1 check |
| + | Bit 2: Disable write access level 2 check |
| + | Bit 3: Disable write access level 3 check |
| + | |- |
| + | | 22 |
| + | | SEND_CFG_TO_GPU |
| + | 0: DISABLED |
| + | 1: ENABLED |
| + | |- |
| + | | 23 |
| + | | TZ_GLOBAL_WR_EN |
| + | 0: DISABLED |
| + | 1: BYPASS_CHECK |
| + | |- |
| + | | 24 |
| + | | TZ_GLOBAL_RD_EN |
| + | 0: DISABLED |
| + | 1: BYPASS_CHECK |
| + | |- |
| + | | 25 |
| + | | ALLOW_APERTURE_ID_MISMATCH |
| + | 0: DISABLED |
| + | 1: ENABLED |
| + | |- |
| + | | 26 |
| + | | FORCE_APERTURE_ID_MATCH |
| + | 0: DISABLED |
| + | 1: ENABLED |
| + | |- |
| + | | 27 |
| + | | IS_WPR |
| + | 0: DISABLED |
| + | 1: ENABLED |
| + | |} |
| | | |
| === GSC1 === | | === GSC1 === |
Line 1,720: |
Line 2,344: |
| | | |
| === GSC5 === | | === GSC5 === |
− | This carveout is, by default, for TSECB. In the Switch's case, this carveout is reserved for the Kernel. | + | This carveout is, by default, for TSECB. In the Switch's case, this carveout is used by the Kernel. |
| | | |
| It is initially configured as follows: | | It is initially configured as follows: |
Line 1,740: |
Line 2,364: |
| </pre> | | </pre> |
| | | |
− | It can be further configured using [[SMC#ConfigureCarveout|smcConfigureCarveout]].
| + | Then further configured using [[SMC#ConfigureCarveout|smcConfigureCarveout]]. |