301
edits
Changes
Fixed
Line 1:
Line 1:
−Being 2x bigger than the Wii version, Wii U's boot0 contains a number of features that include the ability of loading a recovery second-stage image from a SD card.+
+
+
+
+
+
−
−
−
−
−
−
Line 384:
Line 394:
−
−
Line 465:
Line 475:
−
−
−
sd_clk = 0x01;+ sd_clk = seeprom_sd_flag1 & 0xFF;+
− // used to turn high speed on+ sd_switch_func = seeprom_sd_flag2;
Line 817:
Line 826:
Analogous to the old Wii, the Wii U also has a first-stage bootloader dubbed boot0, which is placed inside 16K of Mask ROM in the Latte's ARM core Starbuck.
+{{lowercase title}}
−Analogous to the old Wii, the Wii U also has a first-stage bootloader dubbed '''boot0''', which is placed inside 16K of Mask ROM in the Latte's ARM core [[Starbuck]]. Wii U's boot0 resembles the Wii's [https://wiibrew.org/wiki/boot1 boot1], and contains a number of features that include the ability of loading a recovery second-stage image from a SD card.
+boot0 loads boot1 as an [[ancast image]], and does the typical decryption to load it. However, Starbuck ancast images have a slightly different format.
What follows are general descriptions and pseudo-code that illustrates the several sub-stages of the Wii U's boot0.
What follows are general descriptions and pseudo-code that illustrates the several sub-stages of the Wii U's boot0.
−==Initialization==
+== Dumping ==
+<i>See also: [https://fail0verflow.com/media/30c3-slides/#/23/1 30c3 fail0verflow presentation]</i>
+The Wii had a register that is set to prevent boot0 from being read after boot. However, Nintendo forgot to make that register impossible to reset without rebooting, so fail0verflow just reset that register to dump their boot0. Nintendo did not fix this in the vWii, so boot0 could still be dumped.
+boot0 can be dumped by running the latest development build of [https://wiibrew.org/wiki/Xyzzy xyzzy] in [[WiiMode]].
+== Initialization ==
boot0 runs from address 0xFFFF0000 where the ARM exception vectors are located. At this point, all exception vectors point to themselves (deadlock) except for the reset vector.
boot0 runs from address 0xFFFF0000 where the ARM exception vectors are located. At this point, all exception vectors point to themselves (deadlock) except for the reset vector.
Following the execution into the reset vector, the following takes place:
Following the execution into the reset vector, the following takes place:
Line 25:
Line 35:
This behavior could also be observed, to some extent, in the old Wii's bootloader.
This behavior could also be observed, to some extent, in the old Wii's bootloader.
−==Setup==
+== Setup ==
Right after boot0 copies itself over to SRAM, it does the following:
Right after boot0 copies itself over to SRAM, it does the following:
// Invalidate ICache
// Invalidate ICache
Line 56:
Line 66:
Essentially, sets up it's own stack and jumps to boot0's main function.
Essentially, sets up it's own stack and jumps to boot0's main function.
−==Main==
+== Main ==
This is the bulk of the first-stage bootloader. During the main function's execution, boot0 will send different signals to debug ports via GPIO.
This is the bulk of the first-stage bootloader. During the main function's execution, boot0 will send different signals to debug ports via GPIO.
These signals can be used to represent error codes or mark different execution sub-stages.
These signals can be used to represent error codes or mark different execution sub-stages.
===Start===
===Start===
−boot0 reads and saves the value from register LT_TIMER.
+boot0 reads and saves the value from register HW_TIMER.
// Get timer value
// Get timer value
− u32 time_now = *(u32 *)LT_TIMER;
+ u32 time_now = *(u32 *)HW_TIMER;
// Set start time
// Set start time
Line 69:
Line 79:
===Stage 0x00===
===Stage 0x00===
−boot0 sets a flag in LT_BOOT0 and configures debug ports' GPIOs.
+boot0 sets a flag in HW_SPARE1 and configures debug ports' GPIOs.
// Send debug mark
// Send debug mark
SendGPIODebugOut(0x00);
SendGPIODebugOut(0x00);
u32 boot0_val = *(u32 *)LT_BOOT0;
+ u32 spare1_val = *(u32 *)HW_SPARE1;
// Set something in LT_BOOT0
+ // Set something in HW_SPARE1
− *(u32 *)LT_BOOT0 = boot0_val | 0xC0;
+ *(u32 *)HW_SPARE1 = spare1_val | 0xC0;
// Enable GPIO for debug ports
// Enable GPIO for debug ports
− u32 gpio_enable_val = *(u32 *)LT_GPIO_ENABLE;
+ u32 gpio_enable_val = *(u32 *)HW_GPIO_ENABLE;
− *(u32 *)LT_GPIO_ENABLE = gpio_enable_val | 0x00FF0000;
+ *(u32 *)HW_GPIO_ENABLE = gpio_enable_val | 0x00FF0000;
// Set direction to output
// Set direction to output
− u32 gpio_dir_val = *(u32 *)LT_GPIO_DIR;
+ u32 gpio_dir_val = *(u32 *)HW_GPIO_DIR;
− *(u32 *)LT_GPIO_DIR = gpio_dir_val | 0x00FF0000;
+ *(u32 *)HW_GPIO_DIR = gpio_dir_val | 0x00FF0000;
−===Stage 0x01===
+=== Stage 0x01 ===
boot0 sets something for memory swap.
boot0 sets something for memory swap.
// Send debug mark
// Send debug mark
Line 92:
Line 102:
// Set memory swap
// Set memory swap
− *(u32 *)LT_MEMIRR = 0x07;
+ *(u32 *)HW_SRNPROT = 0x07;
−===Stage 0x02===
+=== Stage 0x02 ===
boot0 initializes the AES engine.
boot0 initializes the AES engine.
// Send debug mark
// Send debug mark
Line 111:
Line 121:
*(u32 *)AES_DEST = 0;
*(u32 *)AES_DEST = 0;
−===Stage 0x03===
+=== Stage 0x03 ===
boot0 initializes the SHA-1 engine.
boot0 initializes the SHA-1 engine.
// Send debug mark
// Send debug mark
Line 124:
Line 134:
*(u32 *)SHA_SRC = 0;
*(u32 *)SHA_SRC = 0;
−===Stage 0x04===
+=== Stage 0x04 ===
−boot0 sets something in LT_COMPAT_AHB and enables OTP reading.
+boot0 sets something in LT_AHBCMPT and enables OTP reading.
// Send debug mark
// Send debug mark
SendGPIODebugOut(0x04);
SendGPIODebugOut(0x04);
// Set something in AHB compat
// Set something in AHB compat
− u32 ahb_val = *(u32 *)LT_COMPAT_AHB;
+ u32 ahb_val = *(u32 *)LT_AHBCMPT;
− *(u32 *)LT_COMPAT_AHB = (ahb_val & 0xFFFFF3FF) | 0xC00;
+ *(u32 *)LT_AHBCMPT = (ahb_val & 0xFFFFF3FF) | 0xC00;
// Enable OTP reading
// Enable OTP reading
SetOTPReadCommand();
SetOTPReadCommand();
−===Stages 0x05, 0x06 and 0x07===
+=== Stages 0x05, 0x06 and 0x07 ===
boot0 asserts some resets and enables EXI.
boot0 asserts some resets and enables EXI.
These three stages are all merged together and the only signal sent to the debug ports is effectively 0x05.
These three stages are all merged together and the only signal sent to the debug ports is effectively 0x05.
Line 143:
Line 153:
// Assert RSTB_IOPI
// Assert RSTB_IOPI
− u32 resets = *(u32 *)LT_RESETS;
+ u32 resets = *(u32 *)HW_RSTB;
− *(u32 *)LT_RESETS = resets | 0x80000;
+ *(u32 *)HW_RSTB = resets | 0x80000;
// Assert RSTB_IOMEM
// Assert RSTB_IOMEM
− u32 resets = *(u32 *)LT_RESETS;
+ u32 resets = *(u32 *)HW_RSTB;
− *(u32 *)LT_RESETS = resets | 0x40000;
+ *(u32 *)HW_RSTB = resets | 0x40000;
// Enable EXI
// Enable EXI
− u32 exi_ctrl = *(u32 *)LT_EXICTRL;
+ u32 aip_prot = *(u32 *)HW_AIP_PROT;
− *(u32 *)LT_EXICTRL = exi_ctrl | 0x01;
+ *(u32 *)HW_AIP_PROT = aip_prot | 0x01;
−===Stage 0x08===
+=== Stage 0x08 ===
During this stage boot0 reads all it needs from the OTP.
During this stage boot0 reads all it needs from the OTP.
// Send debug mark
// Send debug mark
Line 181:
Line 191:
// Setup devices' strength
// Setup devices' strength
u32 iostrength_flags = *(u32 *)0x0D41375C;
u32 iostrength_flags = *(u32 *)0x0D41375C;
− u32 iostrength_ctrl0_val = *(u32 *)LT_IOSTRENGTH_CTRL0;
+ u32 iostrength_ctrl0_val = *(u32 *)HW_IOSTRCTRL0;
− u32 iostrength_ctrl1_val = *(u32 *)LT_IOSTRENGTH_CTRL1;
+ u32 iostrength_ctrl1_val = *(u32 *)HW_IOSTRCTRL1;
if (((iostrength_flags >> 0x0F) & 0x01) != 0)
if (((iostrength_flags >> 0x0F) & 0x01) != 0)
Line 190:
Line 200:
}
}
*(u32 *)LT_IOSTRENGTH_CTRL0 = iostrength_ctrl0_val;
+ *(u32 *)HW_IOSTRCTRL0 = iostrength_ctrl0_val;
if (((iostrength_flags >> 0x0F) & 0x01) != 0)
if (((iostrength_flags >> 0x0F) & 0x01) != 0)
Line 216:
Line 226:
}
}
*(u32 *)LT_IOSTRENGTH_CTRL1 = iostrength_ctrl1_val;
+ *(u32 *)HW_IOSTRCTRL1 = iostrength_ctrl1_val;
−===Stage 0x0A===
+=== Stage 0x0A ===
boot0 sets the SEEPROM's pulse length and configures the SEEPROM GPIOs.
boot0 sets the SEEPROM's pulse length and configures the SEEPROM GPIOs.
// Send debug mark
// Send debug mark
Line 235:
Line 245:
Set_SEEPROM_GPIO();
Set_SEEPROM_GPIO();
−===Stage 0x0B===
+=== Stage 0x0B ===
boot0 analyses the OTP security level flag and decides which keys to use.
boot0 analyses the OTP security level flag and decides which keys to use.
// Send debug mark
// Send debug mark
Line 264:
Line 274:
}
}
−===Stage 0x0C===
+=== Stage 0x0C ===
boot0 generates a CRC32 table in it's stack.
boot0 generates a CRC32 table in it's stack.
// Send debug mark
// Send debug mark
Line 273:
Line 283:
CRC32_Gen();
CRC32_Gen();
−===Stage 0x0D===
+=== Stage 0x0D ===
boot0 uses the SEEPROM key to decrypt SEEPROM data related to the boot process.
boot0 uses the SEEPROM key to decrypt SEEPROM data related to the boot process.
// Send debug mark
// Send debug mark
Line 290:
Line 300:
SEEPROM_Read(0x1E, 0x0D4137AC, 0x01);
SEEPROM_Read(0x1E, 0x0D4137AC, 0x01);
−===Stage 0x0E===
+=== Stage 0x0E ===
boot0 validates the data decrypted from the SEEPROM at offset 0x1C0 in the previous stage using CRC32.
boot0 validates the data decrypted from the SEEPROM at offset 0x1C0 in the previous stage using CRC32.
This data is used to set miscellaneous settings during boot0's execution.
This data is used to set miscellaneous settings during boot0's execution.
Line 332:
Line 342:
}
}
−===Stage 0x0F===
+=== Stage 0x0F ===
boot0 validates the data decrypted from the SEEPROM at offsets 0x1D0 and 0x1E0 in the previous stage using CRC32.
boot0 validates the data decrypted from the SEEPROM at offsets 0x1D0 and 0x1E0 in the previous stage using CRC32.
This data is used to determine boot1's version and sector inside the NAND.
This data is used to determine boot1's version and sector inside the NAND.
Line 369:
Line 379:
}
}
−===Stages 0x10, 0x11 and 0x12===
+=== Stages 0x10, 0x11 and 0x12 ===
boot0 configures the Starbuck's clock multiplier.
boot0 configures the Starbuck's clock multiplier.
These stages are optional and only execute if the 2-byte flag read from the SEEPROM at offset 0x1C0 translates to a negative value. The three stages are merged together and the only signal sent to the debug ports is effectively 0x10.
These stages are optional and only execute if the 2-byte flag read from the SEEPROM at offset 0x1C0 translates to a negative value. The three stages are merged together and the only signal sent to the debug ports is effectively 0x10.
Line 375:
Line 385:
SendGPIODebugOut(0x10);
SendGPIODebugOut(0x10);
// Allow IRQ 12 (AHBLT)
+ // Allow IRQ 12 (LT)
− *(u32 *)LT_INTMR_AHBLT_ARM = 0x1000;
+ *(u32 *)LT_ARMIRQMASKLT = 0x1000;
// Turn IOP2X on?
+ // Set the ARM multiplier
*(u32 *)LT_IOP2X = 0x03;
*(u32 *)LT_IOP2X = 0x03;
sub_D4132E8();
sub_D4132E8();
// Disable IRQ 12 (AHBLT)
+ // Disable IRQ 12 (LT)
− *(u32 *)LT_INTMR_AHBLT_ARM = 0;
+ *(u32 *)LT_ARMIRQMASKLT = 0;
−===Stage 0x13===
+=== Stage 0x13 ===
boot0 analyses the remaining data read from SEEPROM at offset 0x1C0 and uses it to configure the NAND_CONFIG and NAND_BANK registers. It then initializes the NAND engine.
boot0 analyses the remaining data read from SEEPROM at offset 0x1C0 and uses it to configure the NAND_CONFIG and NAND_BANK registers. It then initializes the NAND engine.
// Send debug mark
// Send debug mark
Line 406:
Line 416:
u32 result = sub_D411564(boot1_isSLC);
u32 result = sub_D411564(boot1_isSLC);
−===Stage 0x14===
+=== Stage 0x14 ===
boot0 checks if it's start time is valid (must be 0, otherwise boot0 throws an error) and saves the current time (in order to track how long boot1's reading took).
boot0 checks if it's start time is valid (must be 0, otherwise boot0 throws an error) and saves the current time (in order to track how long boot1's reading took).
This stage only executes if NAND engine's initialization was successful.
This stage only executes if NAND engine's initialization was successful.
Line 419:
Line 429:
u32 boot1_read_time = *(u32 *)LT_TIMER;
u32 boot1_read_time = *(u32 *)LT_TIMER;
−===Stages 0x15, 0x16 and 0x17===
+=== Stages 0x15, 0x16 and 0x17 ===
boot0 flushes AHB memory, reads boot1's ancast header from NAND and checks the boot1's image size by looking into the respective field inside the header. If the size is valid (must not exceed 0xF800, so it doesn't overflow boot1's memory region), boot0 then proceeds to read the full boot1's image from NAND into address 0x0D400000:
boot0 flushes AHB memory, reads boot1's ancast header from NAND and checks the boot1's image size by looking into the respective field inside the header. If the size is valid (must not exceed 0xF800, so it doesn't overflow boot1's memory region), boot0 then proceeds to read the full boot1's image from NAND into address 0x0D400000:
Finally, boot0 calculates how long this operation took and stores this value for the IOS-MCP to read later on.
Finally, boot0 calculates how long this operation took and stores this value for the IOS-MCP to read later on.
Line 429:
Line 439:
ahbMemFlush(0);
ahbMemFlush(0);
// Bit 15 in seeprom_1C_02 tells to ignore NAND errors
+ // Bit 15 in seeprom_1C_02 forces NAND to check ECC data
bool ignore_errors = ((seeprom_1C_02 >> 0x0F) & 0x01) ? true : false;
bool ignore_errors = ((seeprom_1C_02 >> 0x0F) & 0x01) ? true : false;
// Calculate how long it took to
// Calculate how long it took to
// read boot1 (MCP later reads this)
// read boot1 (MCP later reads this)
− u32 time_now = *(u32 *)LT_TIMER;
+ u32 time_now = *(u32 *)HW_TIMER;
*(u32 *)0x0D417FE4 = time_now - boot1_read_time;
*(u32 *)0x0D417FE4 = time_now - boot1_read_time;
−===Stage 0x18===
+=== Stage 0x18 ===
boot0 checks if boot1 is encrypted or not (boot1 is not encrypted in factory mode).
boot0 checks if boot1 is encrypted or not (boot1 is not encrypted in factory mode).
This stage only executes if NAND engine's initialization was successful.
This stage only executes if NAND engine's initialization was successful.
Line 478:
Line 488:
goto skip_boot1_decrypt;
goto skip_boot1_decrypt;
−===Stage 0x19===
+=== Stage 0x19 ===
boot0 verifies boot1's hash (SHA-1) and signature (RSA).
boot0 verifies boot1's hash (SHA-1) and signature (RSA).
This stage only executes if NAND engine's initialization was successful and if factory mode is not enabled.
This stage only executes if NAND engine's initialization was successful and if factory mode is not enabled.
Line 491:
Line 501:
throw_error();
throw_error();
−===Stage 0x1A===
+=== Stage 0x1A ===
boot0 decrypts boot1 (using the AES engine) in place.
boot0 decrypts boot1 (using the AES engine) in place.
−This stage only executes if NAND engine's initialization was successful.
+This stage only executes if NAND engine's initialization was successful and factory mode is not enabled.
// Send debug mark
// Send debug mark
SendGPIODebugOut(0x1A);
SendGPIODebugOut(0x1A);
Line 500:
Line 510:
AES_Decrypt(boot1_key, 0x0D400000, image_blocks);
AES_Decrypt(boot1_key, 0x0D400000, image_blocks);
−===Stage 0x1B===
+=== Stage 0x1B ===
boot0 reads a flag from SEEPROM to determine how long it should wait before attempting to initialize the SD card host.
boot0 reads a flag from SEEPROM to determine how long it should wait before attempting to initialize the SD card host.
// Send debug mark
// Send debug mark
Line 508:
Line 518:
if ((seeprom_1C_00 & 0x7C00) != 0)
if ((seeprom_1C_00 & 0x7C00) != 0)
{
{
− u32 time_now = *(u32 *)LT_TIMER;
+ u32 time_now = *(u32 *)HW_TIMER;
// Delay in multiples of 10000 ms
// Delay in multiples of 10000 ms
Line 518:
Line 528:
while (time_now < delay)
while (time_now < delay)
{
{
− time_now = *(u32 *)LT_TIMER;
+ time_now = *(u32 *)HW_TIMER;
delay = sub_D412060(seeprom_delay);
delay = sub_D412060(seeprom_delay);
}
}
}
}
−===Stage 0x1C===
+=== Stage 0x1C ===
boot0 initializes EXI.
boot0 initializes EXI.
// Send debug mark
// Send debug mark
Line 529:
Line 539:
// Assert RSTB_IOEXI
// Assert RSTB_IOEXI
− u32 resets = *(u32 *)LT_RESETS;
+ u32 resets = *(u32 *)HW_RSTB;
− *(u32 *)LT_RESETS = resets | 0x10000;
+ *(u32 *)HW_RSTB = resets | 0x10000;
// Setup EXI
// Setup EXI
sub_D410BB8();
sub_D410BB8();
−===Stage 0x1D===
+=== Stage 0x1D ===
−boot0 uses EXI to capture events coming from surface mounted components (SMC). If a special button combo is being held (additional hardware may be required, like in the case of kiosk units), boot0 will attempt to load a recovery signed boot1 image from a SD card.
+boot0 uses EXI to read events from the [[Hardware/RTC|RTC]]. If UNSTBL_PWR is set in RTC_CONTROL0, boot0 will attempt to load a recovery signed boot1 image from a SD card.
// Send debug mark
// Send debug mark
SendGPIODebugOut(0x1D);
SendGPIODebugOut(0x1D);
Line 548:
Line 558:
u32 exi0_reply = *(u32 *)exi0_out_buf;
u32 exi0_reply = *(u32 *)exi0_out_buf;
// SD card button combo was pressed
+ // UNSTBL_PWR bit is set in RTC_CONTROL0
if ((exi0_reply << 0x14) < 0)
if ((exi0_reply << 0x14) < 0)
load_sd = true;
load_sd = true;
}
}
// No SD card combo, we're done
+ // Nothing to do, skip the next stages
if (!load_sd)
if (!load_sd)
goto exit;
goto exit;
−===Stage 0x1E===
+=== Stage 0x1E ===
boot0 starts by configuring the SDC0S0Power GPIO. It then initializes and configures the SD host controller, flushes AHB memory and loads the recovery image's ancast header from the SD card. It checks the recovery image's size by looking at the size field in it's header (must not exceed 0xF800, so it doesn't overflow boot1's memory region) and then reads in the full image into memory address 0x0D400000 (replacing what was read from the NAND).
boot0 starts by configuring the SDC0S0Power GPIO. It then initializes and configures the SD host controller, flushes AHB memory and loads the recovery image's ancast header from the SD card. It checks the recovery image's size by looking at the size field in it's header (must not exceed 0xF800, so it doesn't overflow boot1's memory region) and then reads in the full image into memory address 0x0D400000 (replacing what was read from the NAND).
This stage only executes if EXI told boot0 to load an image from the SD card.
This stage only executes if EXI told boot0 to load an image from the SD card.
Line 564:
Line 574:
// Disable SDC0S0Power interrupts
// Disable SDC0S0Power interrupts
− u32 gpio_intmask_val = *(u32 *)LT_GPIO_INTMASK;
+ u32 gpio_intmask_val = *(u32 *)HW_GPIO_INTMASK;
− *(u32 *)LT_GPIO_INTMASK = gpio_intmask_val & 0xBFFFFFFF;
+ *(u32 *)HW_GPIO_INTMASK = gpio_intmask_val & 0xBFFFFFFF;
// Set SDC0S0Power GPIO direction to output
// Set SDC0S0Power GPIO direction to output
− u32 gpio_dir_val = *(u32 *)LT_GPIO_DIR;
+ u32 gpio_dir_val = *(u32 *)HW_GPIO_DIR;
− *(u32 *)LT_GPIO_DIR = gpio_dir_val | 0x40000000;
+ *(u32 *)HW_GPIO_DIR = gpio_dir_val | 0x40000000;
// Enable SDC0S0Power GPIO
// Enable SDC0S0Power GPIO
− u32 gpio_enable_val = *(u32 *)LT_GPIO_ENABLE;
+ u32 gpio_enable_val = *(u32 *)HW_GPIO_ENABLE;
− *(u32 *)LT_GPIO_ENABLE = gpio_enable_val | 0x40000000;
+ *(u32 *)HW_GPIO_ENABLE = gpio_enable_val | 0x40000000;
// Clear SDC0S0Power GPIO output
// Clear SDC0S0Power GPIO output
− u32 gpio_out_val = *(u32 *)LT_GPIO_OUT;
+ u32 gpio_out_val = *(u32 *)HW_GPIO_OUT;
− *(u32 *)LT_GPIO_OUT = gpio_out_val & 0xBFFFFFFF;
+ *(u32 *)HW_GPIO_OUT = gpio_out_val & 0xBFFFFFFF;
// Delay execution arbitrarily again
// Delay execution arbitrarily again
− u32 time_now = *(u32 *)LT_TIMER;
+ u32 time_now = *(u32 *)HW_TIMER;
// Delay in multiples of 20000 ms
// Delay in multiples of 20000 ms
Line 590:
Line 600:
while (time_now < delay)
while (time_now < delay)
{
{
− time_now = *(u32 *)LT_TIMER;
+ time_now = *(u32 *)HW_TIMER;
delay = sub_D412060(seeprom_delay);
delay = sub_D412060(seeprom_delay);
}
}
Line 606:
Line 616:
u32 sd_handle = *(u32 *)sd_handle_buf;
u32 sd_handle = *(u32 *)sd_handle_buf;
// It's possible to specify the clock and switch_func
+ // It's possible to specify the clock divider and 4-bit bus
− // values for the SD card from flags in the SEEPROM
+ // option values for the SD card from flags in the SEEPROM
− u32 sd_clk = 0;
+ u32 sd_clk_div = 0;
− u32 sd_switch_func = 0;
+ u32 sd_use_4bit_bus = 0;
u8 seeprom_sd_flag1 = (u8)(seeprom_1C_02 << 0x14);
u8 seeprom_sd_flag1 = (u8)(seeprom_1C_02 << 0x14);
Line 616:
Line 626:
// Set the SD card's clock value
// Set the SD card's clock value
if (seeprom_sd_flag1 > 0)
if (seeprom_sd_flag1 > 0)
− sd_clk_div = 0x01;
else
else
− sd_clk_div = seeprom_1C_02 & 0xFF;
// Set the SD card's switch_func value
+ // Set the SD card's 4-bit bus option value
− // This is passed to SD card CMD6 and can be
+ // This is passed to SD card CMD55+CMD6
− sd_use_4bit_bus = seeprom_sd_flag2;
− // Setup the SD card
// Setup the SD card
− result = sub_D41139C(host_id, reg_offset, sd_handle, sd_clk, sd_switch_func);
+ result = sub_D41139C(host_id, reg_offset, sd_handle, sd_clk_div, sd_use_4bit_bus);
// Failed to setup the SD card
// Failed to setup the SD card
Line 666:
Line 675:
throw_error();
throw_error();
−===Stage 0x1F===
+=== Stage 0x1F ===
boot0 checks if the recovery image is encrypted or not (it is not encrypted in factory mode).
boot0 checks if the recovery image is encrypted or not (it is not encrypted in factory mode).
This stage only executes if EXI told boot0 to load an image from the SD card.
This stage only executes if EXI told boot0 to load an image from the SD card.
Line 676:
Line 685:
goto skip_boot1_decrypt;
goto skip_boot1_decrypt;
−===Stage 0x20===
+=== Stage 0x20 ===
boot0 verifies the recovery image's hash (SHA-1) and signature (RSA).
boot0 verifies the recovery image's hash (SHA-1) and signature (RSA).
This stage only executes if EXI told boot0 to load an image from the SD card.
This stage only executes if EXI told boot0 to load an image from the SD card.
Line 689:
Line 698:
throw_error();
throw_error();
−===Stage 0x21===
+=== Stage 0x21 ===
boot0 decrypts the recovery image (using the AES engine) in place.
boot0 decrypts the recovery image (using the AES engine) in place.
This stage only executes if EXI told boot0 to load an image from the SD card.
This stage only executes if EXI told boot0 to load an image from the SD card.
Line 698:
Line 707:
AES_Decrypt(boot1_key, 0x0D400000, image_blocks);
AES_Decrypt(boot1_key, 0x0D400000, image_blocks);
−===Stages 0x22, 0x23 and 0x24===
+=== Stages 0x22, 0x23 and 0x24 ===
These stages do not exist, but code leftovers indicate they could have been related to loading a recovery image via the 802.11 Wireless host.
These stages do not exist, but code leftovers indicate they could have been related to loading a recovery image via the 802.11 Wireless host.
−===Stage 0x25===
+=== Stage 0x25 ===
boot0 clears boot1 and SEEPROM keys from memory, calculates and stores how long it took to run and returns.
boot0 clears boot1 and SEEPROM keys from memory, calculates and stores how long it took to run and returns.
// Send debug mark
// Send debug mark
Line 720:
Line 729:
return;
return;
−==Loading boot1==
+== Loading boot1 ==
After boot0's main function returns, execution falls into the pointer that was set in the LR register.
After boot0's main function returns, execution falls into the pointer that was set in the LR register.
// Jump to boot1
// Jump to boot1
Line 741:
Line 750:
Since boot0 finishes by setting r0 to 0x0D400200, returning from boot0 is equivalent to call sub_D4100F8(0x0D400200).
Since boot0 finishes by setting r0 to 0x0D400200, returning from boot0 is equivalent to call sub_D4100F8(0x0D400200).
−==Error codes==
+== Error codes ==
In addition to sending debug markers during execution, boot0 also sends error codes through debug ports using GPIO.
In addition to sending debug markers during execution, boot0 also sends error codes through debug ports using GPIO.
// Send the error code
// Send the error code
Line 769:
Line 778:
// Output error code
// Output error code
− u32 gpio_out_val = *(u32 *)LT_GPIO_OUT;
+ u32 gpio_out_val = *(u32 *)HW_GPIO_OUT;
SendGPIODebugOut((gpio_out_val << 0x08) >> 0x18);
SendGPIODebugOut((gpio_out_val << 0x08) >> 0x18);
| Ancast image size overflow (from SD card)
| Ancast image size overflow (from SD card)
|-
|-
−| 0xD7
+| 0xD9
| Failed to read boot1 image from SD card
| Failed to read boot1 image from SD card
|-
|-
| 0xDA
| 0xDA
| Failed to initialize NAND engine
| Failed to initialize NAND engine
+|-
+| 0xE1
+| Failed to verify boot1 RSA-2048 signature
+|-
+| 0xE2
+| boot1 ancast header u16 (0x1A0) was not 0
+|-
+| 0xE3
+| boot1 ancast header u8s (0x1A2, 0x1A3) were not 0
+|-
+| 0xE4
+| boot1 ancast header padding (0x1C8) was not 0
+|-
+| 0xE5
+| Incorrect console type for boot1 image
+|-
+| 0xE6
+| boot1 ancast header version does not match SEEPROM (anti-rollback, NAND)
+|-
+| 0xE7
+| Incorrect device for boot1 image (SDcard vs NAND)
+|-
+| 0xE8
+| boot1 ancast body size is not page-aligned, or is too small (<0x1000 bytes)
+|-
+| 0xE9
+| boot1 ancast body hash does not match header
|}
|}