Bootloader: Difference between revisions

Line 28:

* 0xffffe060(end addr of the above key-area) size 0x230-bytes: This is the initial DTCM image @ 0xFFF00000, see below.

* 0xffffe290(DTCM_image_end) - {boot9 image end}: All-zero.

Layout of the 0x2f80-byte key-area at 0xffffb0e0:

* 0xffffb0e0 size 0x2600-bytes: This is the RSA key-data, see below.

* 0xffffd6e0(end-addr of the above area) size 0x40-bytes: This is the keydata used for crypting the entire OTP with keyslot 0x3f, used by main(). The first 0x20-bytes is for retail, the remaining 0x20-bytes starting at 0xffffd700 is for devunit. Chunk+0(retail=0xffffd6e0 devunit=0xffffd700) is the normalkey, chunk+0x10(retail=0xffffd6f0 devunit=0xffffd710) is the AES-IV.

* ...

* 0xffffd760: size 0x100-bytes: First 0x80-bytes is for retail, the remaining 0x80-bytes at 0xffffd7e0 is for devunit. This 0x80-byte block is copied to 0x07ffcd00 by a Boot9 function, however that code actually does the copy in two 0x40-bytes chunks.

* 0xffffd860(end-addr of the above area) size 0x400-bytes: This is the ptr passed to the aes-keyinit function for retail.

* 0xffffdc60(end-addr of the above area) size 0x400-bytes: This is the ptr passed to the aes-keyinit function for devunit. This is very last chunk of data in the boot9 data-section key-area: end addr for this area is 0xffffe060.

Layout of the 0x2600-byte RSA key-data at 0xffffb0e0:

First 0x1300-bytes is for retail, the remaining 0x1300-bytes starting at 0xffffc3e0 is for devunit.

* ...

== Boot9 DTCM layout ==

@@ Line 28: / Line 28: @@
 * 0xffffe060(end addr of the above key-area) size 0x230-bytes: This is the initial DTCM image @ 0xFFF00000, see below.
 * 0xffffe290(DTCM_image_end) - {boot9 image end}: All-zero.
+Layout of the 0x2f80-byte key-area at 0xffffb0e0:
+* 0xffffb0e0 size 0x2600-bytes: This is the RSA key-data, see below.
+* 0xffffd6e0(end-addr of the above area) size 0x40-bytes: This is the keydata used for crypting the entire OTP with keyslot 0x3f, used by main(). The first 0x20-bytes is for retail, the remaining 0x20-bytes starting at 0xffffd700 is for devunit. Chunk+0(retail=0xffffd6e0 devunit=0xffffd700) is the normalkey, chunk+0x10(retail=0xffffd6f0 devunit=0xffffd710) is the AES-IV.
+* ...
+* 0xffffd760: size 0x100-bytes: First 0x80-bytes is for retail, the remaining 0x80-bytes at 0xffffd7e0 is for devunit. This 0x80-byte block is copied to 0x07ffcd00 by a Boot9 function, however that code actually does the copy in two 0x40-bytes chunks.
+* 0xffffd860(end-addr of the above area) size 0x400-bytes: This is the ptr passed to the aes-keyinit function for retail.
+* 0xffffdc60(end-addr of the above area) size 0x400-bytes: This is the ptr passed to the aes-keyinit function for devunit. This is very last chunk of data in the boot9 data-section key-area: end addr for this area is 0xffffe060.
+Layout of the 0x2600-byte RSA key-data at 0xffffb0e0:
+First 0x1300-bytes is for retail, the remaining 0x1300-bytes starting at 0xffffc3e0 is for devunit.
+* ...
 == Boot9 DTCM layout ==