GX BootROM notes

Sample bootROM UART log of a successful boot on Amlogic S805Y:

GXL:BL1:9ac50e:bb16dc;FEAT:BDFD71BC:0;POC:3;RCY:0;EMMC:0;READ:0;0.0;0.0;CHK:0;

Status messages

• GXL:BL1:9ac50e:bb16dc: Indicates SoC generation, git commit hash (?)
• FEAT: Dump of SECUREBOOT_FLAG (0xc8100228):
• POC: POC pin
• RCY: If HDMI boot dongle is plugged in, this is 1, else 0

Boot device status

• EMMC/SD/SPI/USB/NAND: Supported boot devices
• CHK: Image/Payload checks
  • 0: Success, no error
  • A7: Wrong magic (!= @AML) or version number
  • C7: Wrong header size or digest offset
  • CF: Payload size or offset too big

EFUSE/OTP

Where many settings are set, e.g. regarding SecureBoot. A copy of it is available at 0xd9013c00 (in AHB SRAM).

The AES key and IV are located at 0xd9013c50 and 0xd9013c70 respectively. On a secureboot-enabled device, they can be dumped easily using amlogic-usbdl.

[Will do more research later]