This repository has been archived by the owner on Sep 3, 2022. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathbootcode_re.txt
136 lines (108 loc) · 4.29 KB
/
bootcode_re.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
config forms an array of 32bit ints
uint type (0 signed/1 unsigned/2 string)
char* to name
void* to destination
uint length?
?? 0 if option not set?
FREEZE_VERSION being non-zero, will force ENABLE_SELF_UPDATE=0
if BOOT_ORDER is zero, default to 0xf21
config array at 80017dec
bootloader_update unsigned
boot_load_flags unsigned
bootcode_delay unsigned
gpu_mem unsigned
gpu_mem_1024 unsigned
gpu_mem_512 unsigned
gpu_mem_256 unsigned
require_total_mem unsigned
total_mem unsigned
start_x unsigned
start_debug unsigned
uart_2ndstage unsigned
fixup_file string 13
start_file string 13
sdram_freq unsigned
mfg_test unsigned
config array at 80017fc8
DHCP_OPTION97 unsigned y defaults to "RPi4" as uint32_t
XHCI_DEBUG unsigned y
NETCONSOLE string 64 y
ENABLE_SELF_UPDATE unsigned
BOOT_UART unsigned y
WAKE_ON_GPIO unsigned y
POWER_OFF_ON_HALT unsigned y
NET_BOOT_MAX_RETRIES signed y
SD_BOOT_MAX_RETRIES signed y
USB_DEV_BOOT_MAX_RETRIES signed
USB_DEV_FILE_TIMEOUT signed
USB_MSD_BOOT_MAX_RETRIES signed
USB_MSD_DISCOVER_TIMEOUT signed y
USB_MSD_LUN_TIMEOUT signed y
USB_MSD_EXCLUDE_VID_PID string 40 y
DHCP_TIMEOUT unsigned y
DHCP_REQ_TIMEOUT unsigned y
TFTP_FILE_TIMEOUT unsigned
TFTP_IP string 16 y
PXE_OPTION43 unsigned 40 y
BOOT_ORDER unsigned y
MAX_RESTARTS signed y
TFTP_PREFIX unsigned y
TFTP_PREFIX_STR string 128 y
MAC_ADDRESS string 32
DISABLE_HDMI unsigned y
CLIENT_IP string 16 y
SUBNET string 16 y
GATEWAY string 16 y
FREEZE_VERSION unsigned y
USB_DEV_BOOT_MAX_RETRIES, NET_BOOT_MAX_RETRIES, USB_MSD_BOOT_MAX_RETRIES, SD_BOOT_MAX_RETRIES all behave the same way
when in the relevant mode, it gets copied to a generic max-tries variable
if (USB_DEV_FILE_TIMEOUT < 10000) USB_DEV_FILE_TIMEOUT = 10000;
long short
0 4 start4.elf not found
0 9 require_total_mem not met
2 4 related to bootloader_upgrade
4 4 start4.elf not compatible with board
bootloader_upgrade will default to 1 if unset
bootloader_upgrade is forced 0 if ENABLE_SELF_UPDATE=0
2019-12-03:
has a function to scan the entire SPI and generate an array containing magic/name/start/length
checks .text.bootloader_state
`struct bootloader_state` is 0x164 bytes long
2020-05-15:
has a function to scan the SPI on-demand, searching for a file with a given name
checks .text.bootloader_state
checks .text.firmware_rev
`struct bootloader_state` is 0x1b8 bytes long
.text.bootloader_state
a section in the .elf file, gets populated if it contains BSTA
if (state[0] == 'BSTA') state[1] = 0x40000;
0x40000 is the address of the bootloader state made by start_elf just before entering the elf
upon entry to start.elf:
* 0x20000 has 0x400 bytes of nulls to wipe something
* 0x40000 contains the full `struct bootloader_state`
struct bootloader_state {
char[4] tag;
uint32_t size2;
uint32_t size; // including this header
char[] payload;
}
known tags:
tag size2 size
BSTE 0x164/0x1b8 0xc , no payload
BVER 0x6c 0x6c , revision, type, date, time, unknown, serial, revision-related
BSTS 0x18 0x18 , unknown payload
BSTN 0xc0/0xc4 0xc0/0xc4 , macend, macstart, mymac, serial_string, tftp_ip, prefix_thing
BSTM 0x14 0x0/0x14 , sometimes the last field
BUSB 0x50 0x0 , sometimes the last field
a size of 0 seems to indicate end of list?
on VC4:
0xc010_0000 (1mb into ram) appears to be the temp buffer the ELF is held at during loading
gpio3 is the wake-on-halt pin by default, pairing up to dtoverlay=gpio-shutdown
gpio1 is wake-on-halt for rpi 1 a rev 0/1
from a vc4 bootcode.bin, try this later
PM_SMPS = 0x5a000001;
A2W_SMPS_LDO1 = 0x5a040000;
A2W_SMPS_LDO0 = 0x5a000000;
*REG32(0x7e102190) |= 0x5a000010;
usb-dev-boot-max-retries, 0x80018480
usb-dev file timeout, 0x80018494