BCT (Boot Configuration Table) is a data structure present on Tegra based devices that supplies boot time configuration parameters.
The Switch 2 can use different types of BCTs with the BRBCT (BootROM BCT) being installed into the first bytes of UFS storage's LUN0 and LUN1.
Structure
BRBCT
| Offset
|
Size
|
Description
|
| 0x0
|
0x4
|
Magic ("BCTB")
|
| 0x4
|
0x40
|
BctHash (SHA-512 hash over data from 0x44 to 0x2000)
|
| 0x44
|
0x180
|
PublicParams
|
| 0x1C4
|
0x40
|
CryptoHash (SHA-512 hash over data from 0x1200 to 0x2000)
|
| 0x204
|
0xB10
|
CryptoSignature (XMSS-SHA2_20_256 signature)
|
| 0xD14
|
0x400
|
CustomerInfo
|
| 0x1114
|
0xEC
|
|
| 0x1200
|
0xE00
|
SignedSect
|
SignedSect
| Offset
|
Size
|
Description
|
| 0x0
|
0x10
|
|
| 0x10
|
0x4
|
Magic ("BCTB")
|
| 0x14
|
0x14
|
|
| 0x28
|
0x4
|
|
| 0x2C
|
0x1C
|
|
| 0x48
|
0xC0 (0x30 * 4)
|
BlInfo
|
| 0x108
|
0x1
|
VerMajor
|
| 0x109
|
0x1
|
VerMinor
|
| 0x10A
|
0x1
|
RatchetLevel
|
| 0x10B
|
0x1
|
RevokePk
|
| 0x10C
|
0x400
|
CustomerInfo
|
| 0x50C
|
0x284
|
|
| 0x790
|
0x10
|
|
| 0x7A0
|
0x10
|
Ecid
|
| 0x7B0
|
0x28
|
|
| 0x7D8
|
0x4
|
NonGpioSelectBootChain
|
| 0x7DC
|
0x4
|
BootLoadersUsed
|
| 0x7E0
|
0x4
|
SecureDebugControlNoneEcid
|
| 0x7E4
|
0x4
|
SecureDebugControlEcid
|
| 0x7E8
|
0x4
|
PreprodDevSign
|
| 0x7EC
|
0x4
|
SecProvisioningKeynumSecure
|
| 0x7F0
|
0x4
|
BfBlBits
|
| 0x7F4
|
0x87
|
|
| 0x87B
|
0x20
|
SecProvisionDerivationString1
|
| 0x89B
|
0x20
|
SecProvisionDerivationString2
|
| 0x8BB
|
0x1
|
|
| 0x8BC
|
0x4
|
SoftSkuOverwrite
|
| 0x8C0
|
0x4FC
|
|
| 0xDBC
|
0x44
|
Digest
|
BlInfo
| Offset
|
Size
|
Description
|
| 0x0
|
0x4
|
StartBlock0
|
| 0x4
|
0x4
|
StartPage0
|
| 0x8
|
0x4
|
Version0
|
| 0xC
|
0x4
|
Random0
|
| 0x10
|
0x4
|
StartBlock1
|
| 0x14
|
0x4
|
StartPage1
|
| 0x18
|
0x4
|
Version1
|
| 0x1C
|
0x4
|
Random1
|
| 0x20
|
0x4
|
StartBlock2
|
| 0x24
|
0x4
|
StartPage2
|
| 0x28
|
0x4
|
Version2
|
| 0x2C
|
0x4
|
Random2
|
BfBlBits
| Bits
|
Description
|
| 0
|
GpioSelectBootChain
|
| 1
|
Mb1DebugProduction
|
| 2
|
Sc7RfDebugProduction
|
| 3
|
PscBlDebugProduction
|
| 4
|
PscRfDebugProduction
|
| 5
|
PscFwDebugProduction
|
| 6
|
BpmpDebugProduction
|
| 7
|
BpmpIstDebugProduction
|
| 8
|
MceDebugProduction
|
| 9
|
IstCcplexDebugProduction
|
| 10
|
IstFwDebugProduction
|
| 11
|
RtcRailViolationDetect
|
| 12
|
CustNvCcplexDfdEn
|
| 13
|
DebugWithTestKeys
|
| 14
|
DebugWithTestKeysDuringPscDebug
|
| 15
|
DisableBootromClockBoost
|
| 16
|
DisablePscromClkBoost
|
| 17
|
EnableScpmReset
|
| 18
|
SkipOemAuthDiagBoot
|
| 19
|
DiagBoot
|
| 20
|
BpmpDiagBoot
|
| 21
|
L0Ist
|
| 22
|
L1Ist
|
| 23-31
|
|