Changes

1,666 bytes added ,  16:41, 4 September 2018
Line 1,244: Line 1,244:     
= IRAM =
 
= IRAM =
== [[BIT|BIT]] ==
+
== BIT ==
When copied to IRAM at address 0x40000000, the BCT has an additional header called Boot Info Table as follows.
+
During boot, the BootROM saves the BCT in IRAM at address 0x40000100. The preceding 0x100 bytes (IRAM memory range from 0x40000000 to 0x40000100) contain a structure called BIT (Boot Info Table) which encapsulates the BCT in IRAM and is initialized by the BootROM as follows:
    
{| class="wikitable" border="1"
 
{| class="wikitable" border="1"
Line 1,256: Line 1,256:  
|  0x00
 
|  0x00
 
|  0x04
 
|  0x04
unk_version0
+
br_version
|
+
Set to 0x00210001 (BOOTDATA_VERSION_T210).
  0x00210001
   
|-
 
|-
 
|  0x04
 
|  0x04
 
|  0x04
 
|  0x04
unk_version1
+
bd_version
|
+
Set to 0x00210001 (BOOTDATA_VERSION_T210).
  0x00210001
   
|-
 
|-
 
|  0x08
 
|  0x08
 
|  0x04
 
|  0x04
unk_version2
+
rcm_version
|
+
Set to 0x00210001 (BOOTDATA_VERSION_T210).
  0x00210001
   
|-
 
|-
 
|  0x0C
 
|  0x0C
Line 1,281: Line 1,278:  
  BOOT_TYPE_EXIT_RCM = 4
 
  BOOT_TYPE_EXIT_RCM = 4
 
|-
 
|-
  0x4C: bct_data_addr (address of the actual BCT)
+
|  0x10
 +
|  0x04
 +
|  unk0
 +
|  Set to 0x05 on coldboot.
 +
|-
 +
|  0x14
 +
|  0x04
 +
|  boot_device_type
 +
|
 +
|-
 +
|  0x18
 +
|  0x04
 +
|  boot_start_time
 +
|  Value from TIMERUS_CNTR_1US when the BootROM enters its main function.
 +
|-
 +
|  0x1C
 +
|  0x04
 +
|  unk1
 +
 +
|-
 +
|  0x20
 +
|  0x04
 +
|  boot_read_bct_time
 +
|  Time spent reading the BCT.
 +
|-
 +
|  0x24
 +
|  0x04
 +
|  boot_parse_bootloader_time
 +
|  Time spent parsing the bootloader info from the BCT.
 +
|-
 +
|  0x28
 +
|  0x04
 +
|  osc_freq
 +
|  Value from CLK_RST_CONTROLLER_OSC_CTRL.
 +
|-
 +
|  0x2C
 +
|  0x01
 +
|  is_boot_device_loaded
 +
|  Set to 1 after the boot device is initialized.
 +
|-
 +
|  0x2D
 +
|  0x01
 +
|  is_sdram_configured
 +
|  Set to 1 after the SDRAM parameters are parsed.
 +
|-
 +
|  0x2E
 +
|  0x01
 +
|  is_forced_rcm_pmc
 +
|  Set to 1 if bit 2 was set in APBDEV_PMC_SCRATCH0.
 +
|-
 +
|  0x2F
 +
|  0x01
 +
|  is_enable_fail_back_pmc
 +
|  Set to 1 if bit 4 was set in APBDEV_PMC_SCRATCH0.
 +
|-
 +
|  0x30
 +
|  0x02
 +
|  is_bootloader_version_mismatch
 +
|  Set to 1 if the bootloaders have different versions in the BCT.
 +
|-
 +
|  0x32
 +
|  0x02
 +
|  is_bct_valid
 +
|  Set to 1 if the BCT was parsed successfully.
 +
|-
 +
|  0x34
 +
|  0x04
 +
|  unk2
 +
 +
|-
 +
|  0x38
 +
|  0x04
 +
|  unk3
 +
 +
|-
 +
|  0x3C
 +
|  0x04
 +
|  active_bootloader_idx
 +
|  Value from 0 to 3 that represents which bootloader is active.
 +
|-
 +
|  0x40
 +
|  0x04
 +
|  bct_start_block
 +
|  Block number where the BCT was found.
 +
|-
 +
|  0x44
 +
|  0x04
 +
|  bct_start_page
 +
|  Page number where the BCT was found.
 +
|-
 +
|  0x48
 +
|  0x04
 +
|  bct_size
 +
|  Size of the BCT in IRAM (0x2800).
 +
|-
 +
| 0x4C
 +
|  0x04
 +
|  bct_ptr
 +
|  Pointer to the BCT in IRAM (0x40000100).
 
|-
 
|-
 
|  0x50
 
|  0x50
Line 1,295: Line 1,390:  
  |  0x00
 
  |  0x00
 
  |  0x04
 
  |  0x04
  |  is_active
+
  |  bootloader_idx
 
  |-
 
  |-
 
  |  0x04
 
  |  0x04
 
  |  0x04
 
  |  0x04
  |  start_block
+
  |  bootloader_start_block
 
  |-
 
  |-
 
  |  0x08
 
  |  0x08
 
  |  0x04
 
  |  0x04
  |  start_page
+
  |  bootloader_start_page
 
  |-
 
  |-
 
  |  0x0C
 
  |  0x0C
 
  |  0x04
 
  |  0x04
  |  length
+
  |  bootloader_length
 
  |-
 
  |-
 
  |  0x10
 
  |  0x10
 
  |  0x04
 
  |  0x04
  |  signed_start
+
  |  bootloader_signed_start
 
  |-
 
  |-
 
  |  0x14
 
  |  0x14
 
  |  0x04
 
  |  0x04
  |  signature
+
  |  bootloader_signature
|-
   
  |}
 
  |}
 
|-
 
|-
 
|  0xB0
 
|  0xB0
 
|  0x40
 
|  0x40
|   
+
boot_device_info
|
+
| Structure to hold boot device parameters.
 
|-
 
|-
 
|  0xF0
 
|  0xF0
 
|  0x04
 
|  0x04
|   
+
bct_end_ptr
|
+
| Pointer to the end of the BCT in IRAM (0x40002900).
  bct_end_addr
   
|-
 
|-
 
|  0xF4
 
|  0xF4
 
|  0x0C
 
|  0x0C
|   
+
padding
|
+
| Must be empty.
|-
   
|}
 
|}
  −
bct_data_addr should pint to a bct that contains the keyblob.
  −
  −
It's used in key generation in PK1.
  −
  −
PK11 checks boot_type to be cold, if it's not it panics.
  −
  −
bootloader_headers[0] or bootloader_headers[1] should be set to active. It is also checked by PK11.
      
= Notes =
 
= Notes =