BSP
Jump to navigation
Jump to search
BSP area contents[edit | edit source]
BSP area is located in first partition of NOR flash. Two copies of BSP area are stored (at 0x250000 and 0x260000 positions).
BSP is 84-byte structure containing signature (A5 5A 5A A5, used for structure validation), 76 bytes of data and 4 bytes of CRC32 field.
CRC32 field can be calculated using following PHP code:
$file = file_get_contents("bsp_block_wo_crc"); // must be 80 bytes length $file_original_with_crc32 = $file . pack("V", crc32($file)); file_put_contents("bsp_block_with_crc_original_from_php", $file_original_with_crc32); // 84 bytes
BSP fields[edit | edit source]
struct bsp_data_info { ulong ulSignature; // 0 ulong ulbootmode; // 4 ulong ullaunchmode; // 8 ulong ultestsubmode; // 12 ulong ulbootimageflag; // 16 ulong ulrecoveryimageflag; // 20 ulong uldebugswitch; // 24 ulong ulusbotgswitch; // 28 ulong ulmemchkflag; // 32 ulong ulwarpboot; // 36 ulong ulsubbootmode; // 40 ulong ulupdateflag; // 44 ulong ulupdatesubflag; // 48 char passwd[MMC_SET_PASSWD_MAX_LEN]; // 52 ulong uluiupdateflag; // 68 ulong ulreserved1; // 72 ulong ulreserved2; // 74 ulong ulcrc32; // 80 };
All fields are unsigned 32-bit integers (4 bytes, except password) and stored in Little-endian form. So value 0x12345678 is stored as 0x78 0x56 0x34 0x12 (order of bytes is reversed)
Real-world BSP structure example[edit | edit source]
A5 5A 5A A5 // ulSignature; // 0 // 00 00 00 00 // ulbootmode; // 4 // normal boot 00 00 00 00 // ullaunchmode; // 8 // APL 00 00 00 00 // ultestsubmode; // 12 // TestMode.apk 00 00 00 00 // ulbootimageflag; // 16 // side a 00 00 00 00 // ulrecoveryimageflag; // 20 // side a 00 00 00 00 // uldebugswitch; // 24 // debugging disabled 00 00 00 00 // ulusbotgswitch; // 28 // usb otg disabled 00 00 00 00 // ulmemchkflag; // 32 // do not check memory at startup 00 00 00 00 // ulwarpboot; // 36 // warp boot side A 02 00 00 00 // ulsubbootmode; // 40 // enable warp boot 00 00 00 00 // ulupdateflag; // 44 // recovery-update 02 00 00 00 // ulupdatesubflag; // 48 // USB2 4C 4B 50 46 65 44 34 42 63 56 7A 45 53 52 32 59 // password: LKPFeD4BcVzESR2Y 00 00 00 00 // uluiupdateflag; // 68 // non-updating FF FF FF FF // ulreserved1; // 72 FF FF FF FF // ulreserved2; // 74 96 8D 6E 12 // ulcrc32; // 80 crc32 of all previous data including signature
Editing BSP area[edit | edit source]
BSP can be edited by using bootloader's DebugConsole. You can use bsp get
command to get current BSP contents and bsp set
to change contents.
Example output of bsp get
command:
Magic Number :0xa55a5aa5(a55a5aa5:Valid, other:Invalid) Boot Mode :0x00000000(0:Normal, 1:Recovery, 2:EasyRecovery, 3:Re-EasyRecovery, default:Normal) Launch Mode :0x00000000(0:APL, 1:TestMode.apk, 2:Slave TestMode, 3:Boot Error, default:APL) TestMode Sub-Mode :0x00000000(0:TextMode_A.key, 1:Serv Mode, 2:Tech Mode, default:Tech Mode) Bootimage Side :0x00000000(0:Side A, 1:Side B, default:Side A) Recoveryimage Side :0x00000000(0:Side A, 1:Side B, default:Side A) Debug Switch :0x00000001(0:OFF, 1:ON, default:OFF) Usb OTG Switch :0x00000000(0:Host, 1:Device, default:Host) Memchk flag :0x00000000(0:No, 1:Yes, default:No) Warp boot :0x00000000(0:Side A, 1:Side B, default:Side A) Boot Sub-Mode :0x00000000(0:Normal, 1:Catch snapshot, 2:Warp, default:Normal) Update flag :0x0000000c(0:Recovery-Update, 1:uboot update, 2:boot.img update, 3:recovery.img update, 4:system.img update, 5:opening data update, 6:UI update, 7:All image update, 8:TESTMODE_N.KEY, 9:easyrecovery copy, a:easyrecovery copy&verify, b:password key copy&verify, c:easyrecovery mode change, default:Recovery-Update) Update sub-flag :0x00000001(0:SD Card, 1:USB1, 2:USB2 default:SD Card) UI Update flag :0x00000000(0:non-updating, 1:updating, default:non-updating) Reserved1 flag :0xffffffff(default:0xFFFFFFFF) Reserved2 flag :0xffffffff(default:0xFFFFFFFF)