In memory of Ben “bushing” Byer, who passed away on Monday, February 8th, 2016.

Difference between revisions of "Hardware/SEEPROM"

From WiiUBrew
Jump to navigation Jump to search
(there's a button combo for this but idk if it exists on retail yet)
(There are multiple DRAM vendors, and all systems have 0x5521 no matter the vendor.)
 
(32 intermediate revisions by 6 users not shown)
Line 1: Line 1:
−
== General ==
+
= General =
 
The Latte package contains a [http://www.atmel.com/images/doc0172z.pdf 93C66] (or similar) SPI EEPROM, organized as 256 16-bit words, making it twice the size of the EEPROM found in the Wii's Hollywood package. It is accessed by twiddling some of the Starbuck GPIO lines in the exact same way as it was done on the Wii's Starlet GPIO lines.
 
The Latte package contains a [http://www.atmel.com/images/doc0172z.pdf 93C66] (or similar) SPI EEPROM, organized as 256 16-bit words, making it twice the size of the EEPROM found in the Wii's Hollywood package. It is accessed by twiddling some of the Starbuck GPIO lines in the exact same way as it was done on the Wii's Starlet GPIO lines.
  
−
== SEEPROM Contents ==
+
= Contents =
−
Most of the data here is written once at the factory and never changed, but some fields are updated fairly frequently:
+
Most of the data here is only written once during manufacturing, but some fields are updated fairly frequently. Items listed as reserved are empty and not known to be used.
 
{| style="border: 1px solid #bbb; border-collapse: collapse; background-color: #eef; padding: 0.2em 0.2em 0.2em 0.2em;" border="1" cellpadding="2"
 
{| style="border: 1px solid #bbb; border-collapse: collapse; background-color: #eef; padding: 0.2em 0.2em 0.2em 0.2em;" border="1" cellpadding="2"
 
|- style="background-color: #ddd;"
 
|- style="background-color: #ddd;"
Line 10: Line 10:
 
! Description
 
! Description
 
|-
 
|-
−
| 0x000 (0x00 * 2) || 0x12 bytes || Empty.
+
| 0x000 (0x00 * 2) || 0x12 bytes || Reserved
 
|-
 
|-
−
| 0x012 (0x09 * 2) || 0x08 bytes || SEEPROM PRNG seed.
+
| 0x012 (0x09 * 2) || 0x08 bytes || RNG seed
−
  Incremented every time IOS-CRYPTO starts.  
+
  This seed is incremented every time IOS-CRYPTO starts.  
−
  Used with the OTP's RNG key and the OTP's RNG seed to setup IOSU's PRNG.
+
  It is also combined with the OTP's RNG key and seed to setup the IOS-CRYPTO RNG functions.
 
|-
 
|-
−
| 0x01A (0x0D * 2) || 0x06 bytes || Empty.
+
| 0x01A (0x0D * 2) || 0x06 bytes || Reserved
 
|-
 
|-
−
| 0x020 (0x10 * 2) || 0x04 bytes || PPC PVR (0x70010201).
+
| 0x020 (0x10 * 2) || 0x0C bytes || [[#EspressoPackageInfo|EspressoPackageInfo]]
 
|-
 
|-
−
| 0x024 (0x12 * 2) || 0x06 bytes || ASCII tag.
+
| 0x02C (0x16 * 2) || 0x0C bytes || [[#LattePackageInfo|LattePackageInfo]]
 
|-
 
|-
−
| 0x02A (0x15 * 2) || 0x06 bytes || Unknown.
+
| 0x038 (0x1C * 2) || 0x48 bytes || [[#BoardConfig|BoardConfig]]
 
|-
 
|-
−
| 0x030 (0x18 * 2) || 0x08 bytes || OTP tag.
+
| 0x080 (0x40 * 2) || 0x10 bytes || Drive key
 
|-
 
|-
−
| 0x038 (0x1C * 2) || 0x04 bytes || BC struct's CRC32.
+
| 0x090 (0x48 * 2) || 0x10 bytes || Factory key
 +
This key is cleared by IOS-MCP.
 
|-
 
|-
−
| 0x03C (0x1E * 2) || 0x02 bytes || BC struct's size.
+
| 0x0A0 (0x50 * 2) || 0x10 bytes || SHDD seed
 
|-
 
|-
−
| 0x03E (0x1F * 2) || 0x02 bytes || BC library version.
+
| 0x0B0 (0x58 * 2) || 0x10 bytes || IVS seed
 +
This seed is encrypted with the IVS key from OTP then used to set the /dev/crypto USB key.
 +
The first 0x04 bytes of this key must match the Wii U device ID.
 
|-
 
|-
−
| 0x040 (0x20 * 2) || 0x02 bytes || BC author.
+
| 0x0C0 (0x60 * 2) || 0x02 bytes || DriveConfig
 +
If the flag is 0x0000, the drive key is unencrypted.
 +
If the flag is 0xFFFE, the drive key is empty.
 +
If the flag is 0xFFFF, the drive key is encrypted with the SEEPROM key.
 
|-
 
|-
−
| 0x042 (0x21 * 2) || 0x02 bytes || BC boardType.
+
| 0x0C2 (0x61 * 2) || 0x02 bytes || IvsConfig
 +
If the flag is 0x0010, real IVS should be used.
 
|-
 
|-
−
| 0x044 (0x22 * 2) || 0x02 bytes || BC boardRevision.
+
| 0x0C4 (0x62 * 2) || 0x02 bytes || ShddConfig
 +
If the flag is 0x0000, the SHDD seed is empty.
 +
If the flag is 0xFFFF, the SHDD seed is encrypted with the SHDD key from OTP.
 
|-
 
|-
−
| 0x046 (0x23 * 2) || 0x02 bytes || BC bootSource.
+
| 0x0C6 (0x63 * 2) || 0x6A bytes || Reserved
 
|-
 
|-
−
| 0x048 (0x24 * 2) || 0x02 bytes || BC ddr3Size.
+
| 0x130 (0x98 * 2) || 0x04 bytes ||  
 
|-
 
|-
−
| 0x04A (0x25 * 2) || 0x02 bytes || BC ddr3Speed.
+
| 0x134 (0x9A * 2) || 0x02 bytes ||  
 
|-
 
|-
−
| 0x04C (0x26 * 2) || 0x02 bytes || BC ppcClockMultiplier.
+
| 0x136 (0x9B * 2) || 0x02 bytes ||  
 
|-
 
|-
−
| 0x04E (0x27 * 2) || 0x02 bytes || BC iopClockMultiplier.
+
| 0x138 (0x9C * 2) || 0x08 bytes || Reserved
 
|-
 
|-
−
| 0x050 (0x28 * 2) || 0x02 bytes || BC video1080p.
+
| 0x140 (0xA0 * 2) || 0x40 bytes || [[#SysProd|SysProd]]
 
|-
 
|-
−
| 0x052 (0x29 * 2) || 0x02 bytes || BC ddr3Vendor.
+
| 0x180 (0xC0 * 2) || 0x12 bytes || [[#ProdInfo|ProdInfo]]
 
|-
 
|-
−
| 0x054 (0x2A * 2) || 0x02 bytes || BC movPassiveReset.
+
| 0x192 (0xC9 * 2) || 0x02 bytes || Always 0xAA55
 
|-
 
|-
−
| 0x056 (0x2B * 2) || 0x02 bytes || BC sysPllSpeed.
+
| 0x194 (0xCA * 2) || 0x02 bytes ||  
 
|-
 
|-
−
| 0x058 (0x2C * 2) || 0x02 bytes || BC sataDevice.
+
| 0x196 (0xCB * 2) || 0x02 bytes ||  
 
|-
 
|-
−
| 0x05A (0x2D * 2) || 0x02 bytes || BC consoleType.
+
| 0x198 (0xCC * 2) || 0x02 bytes ||  
 
|-
 
|-
−
| 0x05C (0x2E * 2) || 0x04 bytes || BC devicePresence.
+
| 0x19A (0xCD * 2) || 0x04 bytes ||  
 
|-
 
|-
−
| 0x060 (0x30 * 2) || 0x20 bytes || Reserved for BC ("BoardConfig") library.
+
| 0x19E (0xCF * 2) || 0x04 bytes ||  
 
|-
 
|-
−
| 0x080 (0x40 * 2) || 0x10 bytes || Wii U drive key.
+
| 0x1A2 (0xD1 * 2) || 0x02 bytes || Always 0xBB66
 
|-
 
|-
−
| 0x090 (0x48 * 2) || 0x10 bytes || Wii U factory key (cleared by IOS-MCP).
+
| 0x1A4 (0xD2 * 2) || 0x02 bytes ||  
 
|-
 
|-
−
| 0x0A0 (0x50 * 2) || 0x10 bytes || Wii U devkit key (?).
+
| 0x1A6 (0xD3 * 2) || 0x02 bytes ||  
 
|-
 
|-
−
| 0x0B0 (0x58 * 2) || 0x10 bytes || Wii U 0x12-keyhandle key.
+
| 0x1A8 (0xD4 * 2) || 0x08 bytes ||  
−
This key is encrypted then used to set the /dev/crypto 0x12-keyhandle keydata.
 
−
The first 4 bytes of this key must match the last 4 bytes of a 0x10 seed stored in the OTP.
 
 
|-
 
|-
−
| 0x0C0 (0x60 * 2) || 0x02 bytes || Drive key's status flag.
+
| 0x1B0 (0xD8 * 2) || 0x02 bytes ||  
−
If the flag is 0xFFFF, the drive key is set and encrypted with the Wii U SEEPROM key.
 
−
If the flag is 0x0000, the drive key is set and in plain form.
 
 
|-
 
|-
−
| 0x0C2 (0x61 * 2) || 0x02 bytes || 0x12-keyhandle key's status flag.
+
| 0x1B2 (0xD9 * 2) || 0x02 bytes ||  
 
|-
 
|-
−
| 0x0C4 (0x62 * 2) || 0x02 bytes || Devkit key's status flag.
+
| 0x1B4 (0xDA * 2) || 0x08 bytes ||  
−
If the flag is 0xFFFF, the devkit key is set and encrypted with a key from OTP.
 
−
If the flag is 0x0000, the devkit key is not set.
 
 
|-
 
|-
−
| 0x0C6 (0x63 * 2) || 0x6A bytes || Empty.
+
| 0x1BC (0xDE * 2) || 0x04 bytes || [[#StorageSize|StorageSize]]
 
|-
 
|-
−
| 0x130 (0x98 * 2) || 0x04 bytes || Unknown.
+
| 0x1C0 (0xE0 * 2) || 0x30 bytes || [[#BootParams|BootParams]]
 
|-
 
|-
−
| 0x134 (0x9A * 2) || 0x04 bytes || Unknown.
+
| 0x1F0 (0xF8 * 2) || 0x10 bytes || Reserved
 +
|}
 +
 
 +
== EspressoPackageInfo ==
 +
{| class="wikitable" border="1"
 +
|-
 +
! Offset || Size || Description
 +
|-
 +
| 0x0 || 0x4 || PpcPvr (0x70010201)
 +
|-
 +
| 0x4 || 0x6 || EspressoPackageId
 +
|-
 +
| 0xA || 0x2 ||
 +
|}
 +
 
 +
== LattePackageInfo ==
 +
{| class="wikitable" border="1"
 +
|-
 +
! Offset || Size || Description
 +
|-
 +
| 0x0 || 0x2 || LatteWaferX
 +
|-
 +
| 0x2 || 0x2 || LatteWaferY
 +
|-
 +
| 0x4 || 0x8 || [[Hardware/OTP#LattePackageId|LattePackageId]]
 +
|}
 +
 
 +
== BoardConfig ==
 +
{| class="wikitable" border="1"
 +
|-
 +
! Offset || Size || Description
 +
|-
 +
| 0x0 || 0x4 || crc
 +
|-
 +
| 0x4 || 0x2 || size
 +
|-
 +
| 0x6 || 0x2 || version
 +
|-
 +
| 0x8 || 0x2 || [[#author|author]]
 +
|-
 +
| 0xA || 0x2 || [[#boardType|boardType]]
 +
|-
 +
| 0xC || 0x2 || boardRevision
 +
|-
 +
| 0xE || 0x2 || [[#bootSource|bootSource]]
 +
|-
 +
| 0x10 || 0x2 || [[#ddr3Size|ddr3Size]]
 +
|-
 +
| 0x12 || 0x2 || ddr3Speed
 +
|-
 +
| 0x14 || 0x2 || ppcClockMultiplier
 +
|-
 +
| 0x16 || 0x2 || iopClockMultiplier
 +
|-
 +
| 0x18 || 0x2 || video1080p
 +
|-
 +
| 0x1A || 0x2 || [[#ddr3Vendor|ddr3Vendor]]
 +
|-
 +
| 0x1C || 0x2 || movPassiveReset
 +
|-
 +
| 0x20 || 0x2 || sysPllSpeed
 +
|-
 +
| 0x22 || 0x2 || [[#sataDevice|sataDevice]]
 +
|-
 +
| 0x24 || 0x2 || [[#consoleType|consoleType]]
 +
|-
 +
| 0x26 || 0x4 || devicePresence
 +
|-
 +
| 0x28 || 0x20 || Reserved
 +
|}
 +
 
 +
=== author ===
 +
{| class="wikitable"
 +
|-
 +
! Value
 +
! Description
 +
|-
 +
| 0x404D
 +
| @M (Atmel?)
 +
|}
 +
 
 +
=== boardType ===
 +
{| class="wikitable"
 +
|-
 +
! Value
 +
! Description
 +
|-
 +
| 0x4346
 +
| CF (CAFE: Production/Test)
 +
|-
 +
| 0x4354
 +
| CT (CAT: Development)
 +
|-
 +
| 0x4556
 +
| EV (EV: Evaluation)
 +
|-
 +
| 0x4944
 +
| ID (WUIH_DEV)
 +
|-
 +
| 0x4948
 +
| IH (WUIH)
 +
|}
 +
 
 +
=== bootSource ===
 +
{| class="wikitable"
 +
|-
 +
! Value
 +
! Description
 +
|-
 +
| 0x4E31
 +
| N1 (NAND1)
 +
|-
 +
| 0x5333
 +
| S3 (SDIO3)
 +
|}
 +
 
 +
=== ddr3Size ===
 +
{| class="wikitable"
 +
|-
 +
! Value
 +
! Description
 +
|-
 +
| 0x0800
 +
| 2GB (Production/Test)
 +
|-
 +
| 0x1000
 +
| 4GB (Development)
 +
|}
 +
 
 +
=== ddr3Vendor ===
 +
{| class="wikitable"
 +
|-
 +
! Value
 +
! Description
 +
|-
 +
| 0x5521
 +
| U!
 +
|}
 +
 
 +
=== sataDevice ===
 +
{| class="wikitable"
 +
|-
 +
! Value
 +
! Description
 +
|-
 +
| 0x0001
 +
| Default
 +
|-
 +
| 0x0002
 +
| No device
 +
|-
 +
| 0x0003
 +
| ROM drive (Production)
 +
|-
 +
| 0x0004
 +
| R drive (CAT-R/CAT-I)
 +
|-
 +
| 0x0005
 +
| MION (CAT-DEV)
 +
|-
 +
| 0x0006
 +
| SES (CAT-SES)
 +
|-
 +
| 0x0007
 +
| GEN2-HDD
 +
|-
 +
| 0x0008
 +
| GEN1-HDD
 +
|}
 +
 
 +
=== consoleType ===
 +
{| class="wikitable"
 +
|-
 +
! Value
 +
! Description
 +
|-
 +
| 0x0001
 +
| WUP (Production)
 +
|-
 +
| 0x0002
 +
| CAT-R (Test)
 +
|-
 +
| 0x0003
 +
| CAT-DEV (Development)
 +
|-
 +
| 0x0004
 +
| EV board (Evaluation)
 +
|-
 +
| 0x0005
 +
| Promotion (CAT-I/CAT-SES)
 +
|-
 +
| 0x0006
 +
| OrchestraX
 +
|-
 +
| 0x0007
 +
| WUIH
 +
|-
 +
| 0x0008
 +
| WUIH_DEV
 +
|-
 +
| 0x0009
 +
| CAT_DEV_WUIH
 +
|}
 +
 
 +
== SysProd ==
 +
{| class="wikitable" border="1"
 +
|-
 +
! Offset || Size || Description
 +
|-
 +
| 0x0 || 0x4 || product_area
 +
|-
 +
| 0x4 || 0x2 || eeprom_version
 +
|-
 +
| 0x6 || 0x2 || Reserved
 +
|-
 +
| 0x8 || 0x4 || game_region
 +
|-
 +
| 0xC || 0x4 || Reserved
 +
|-
 +
| 0x10 || 0x4 || ntsc_pal
 +
|-
 +
| 0x14 || 0x3 || 5ghz_country_code
 +
|-
 +
| 0x17 || 0x1 || 5ghz_country_code_revision
 +
|-
 +
| 0x18 || 0x8 || code_id
 +
|-
 +
| 0x20 || 0xC || serial_id
 +
|-
 +
| 0x2C || 0x4 || Reserved
 +
|-
 +
| 0x30 || 0x10 || model_number
 +
|}
 +
 
 +
== ProdInfo ==
 +
This 0x12-byte structure is only present in production/test units. For development units, this structure is left empty.
 +
 
 +
{| class="wikitable" border="1"
 +
|-
 +
! Offset || Size || Description
 +
|-
 +
| 0x0 || 0x4 || LotNumber
 +
|-
 +
| 0x4 || 0x4 || LotNumberEx (only available if [[#BoardConfig|boardRevision]] >= 0x0C)
 +
|-
 +
| 0x8 || 0x2 || ProdYear
 +
|-
 +
| 0xA || 0x2 || ProdMonthDay
 +
|-
 +
| 0xC || 0x2 || ProdHourMinute
 +
|-
 +
| 0xE || 0x4 || ProdInfoCrc (CRC32 over the previous 14 bytes)
 +
|}
 +
 
 +
== StorageSize ==
 +
{| class="wikitable"
 +
|-
 +
! Value
 +
! Description
 
|-
 
|-
−
| 0x138 (0x9C * 2) || 0x08 bytes || Unknown.
+
| 0x1000
 +
| 8GB (MLC)
 
|-
 
|-
−
| 0x140 (0xA0 * 2) || 0x04 bytes || slc:sys_prod.version
+
| 0x4000
 +
| 32GB (MLC)
 
|-
 
|-
−
| 0x144 (0xA2 * 2) || 0x04 bytes || slc:sys_prod.eeprom_version
+
| 0x14000
 +
| 320GB (MION)
 +
|}
 +
 
 +
== BootParams ==
 +
This 0x30-byte structure is AES-128-ECB encrypted with the SEEPROM key.
 +
 
 +
{| class="wikitable" border="1"
 
|-
 
|-
−
| 0x148 (0xA4 * 2) || 0x04 bytes || slc:sys_prod.product_area
+
! Offset || Size || Description
 
|-
 
|-
−
| 0x14C (0xA6 * 2) || 0x04 bytes || slc:sys_prod.game_region
+
| 0x0 || 0x2 || [[#MiscConfig|MiscConfig]]
 
|-
 
|-
−
| 0x150 (0xA8 * 2) || 0x04 bytes || slc:sys_prod.ntsc_pal
+
| 0x2 || 0x2 || [[#BootConfig|BootConfig]]
 
|-
 
|-
−
| 0x154 (0xAA * 2) || 0x02 bytes || slc:sys_prod.5ghz_country_code
+
| 0x4 || 0x4 || NandConfig (value for overwriting the NAND_CONFIG register)
 
|-
 
|-
−
| 0x156 (0xAB * 2) || 0x02 bytes || slc:sys_prod.5ghz_country_code_revision
+
| 0x8 || 0x4 || NandBank (value for overwriting the NAND_BANK register)
 
|-
 
|-
−
| 0x158 (0xAC * 2) || 0x08 bytes || slc:sys_prod.code_id
+
| 0xC || 0x4 || BootParamsCrc0 (CRC32 over the previous 12 bytes)
 
|-
 
|-
−
| 0x160 (0xB0 * 2) || 0x10 bytes || slc:sys_prod.serial_id
+
| 0x10 || 0x2 || Boot1Version0
 
|-
 
|-
−
| 0x170 (0xB8 * 2) || 0x10 bytes || slc:sys_prod.model_number
+
| 0x12 || 0x2 || Boot1Sector0 (default: 0x1000 => 0x40000 pages = NAND bank 1, byte offset 0x0)
 
|-
 
|-
−
| 0x180 (0xC0 * 2) || 0x04 bytes || Unknown.
+
| 0x14 || 0x8 || Reserved
 
|-
 
|-
−
| 0x184 (0xC2 * 2) || 0x0C bytes || Unknown.
+
| 0x1C || 0x4 || BootParamsCrc1 (CRC32 over the previous 12 bytes)
 
|-
 
|-
−
| 0x190 (0xC8 * 2) || 0x10 bytes || Unknown.
+
| 0x20 || 0x2 || Boot1Version1
 
|-
 
|-
−
| 0x1A0 (0xD0 * 2) || 0x08 bytes || Unknown.
+
| 0x22 || 0x2 || Boot1Sector1 (default: 0x1001 => 0x40040 pages = NAND bank 1, byte offset 0x21000)
 
|-
 
|-
−
| 0x1A8 (0xD4 * 2) || 0x08 bytes || ASCII tag.
+
| 0x24 || 0x8 || Reserved
 
|-
 
|-
−
| 0x1B0 (0xD8 * 2) || 0x10 bytes || Unknown.
+
| 0x2C || 0x4 || BootParamsCrc2 (CRC32 over the previous 12 bytes)
 +
|}
 +
 
 +
=== MiscConfig ===
 +
{| class="wikitable" border="1"
 
|-
 
|-
−
| 0x1C0 (0xE0 * 2) || 0x10 bytes || Boot parameters (encrypted with Wii U SEEPROM key).
+
! Bits
−
Structure containing parameters for boot0:
+
! Description
−
  - 0x1C0 to 0x1C2 (0x02 bytes): Control flags (clock config + SMC delay?):
+
|-
−
                                  -> bits 0-9 set the cpu speed in MHz used for various IO delay calculations.
+
| 0-9
−
                                  -> bits 10-14 set an io delay length before asking SMC if an SD boot has been requested.
+
| CPU speed in MHz used for delay calculations
−
                                  -> bit 15, if set, causes 0x3 to be written to LT_IOP2X and waits for interrupt (presumably after clock increased)
+
|-
 +
| 10-14
 +
| Value for delaying before checking if the SD boot combo has been pressed
 +
|-
 +
| 15
 +
| Causes 0x3 to be written to LT_IOP2X which increases the ARM CPU clock multiplier
 +
|}
  
−
  - 0x1C2 to 0x1C4 (0x02 bytes): Control flags (NAND config):
+
=== BootConfig ===
−
                                  -> bit 13 tells boot0 to overwrite NAND_BANK with the supplied value.
+
{| class="wikitable" border="1"
−
                                  -> bit 14 tells boot0 to overwrite NAND_CONFIG with the supplied value.
+
|-
−
  - 0x1C4 to 0x1C8 (0x04 bytes): Value to overwrite NAND_CONFIG (optional).
+
! Bits
−
  - 0x1C8 to 0x1CC (0x04 bytes): Value to overwrite NAND_BANK (optional).
+
! Description
−
  - 0x1CC to 0x1D0 (0x04 bytes): CRC32 of data from 0x1C0 to 0x1CC.
+
|-
 +
| 0-7
 +
| SD card clock divider
 +
|-
 +
| 8-9
 +
| Value for delaying before initializing the SD host controller
 +
|-
 +
| 10
 +
| Enables SD card 4-bit bus through CMD55 (SD_APP_CMD) and CMD6 (SD_APP_SET_BUS_WIDTH)
 +
|-
 +
| 11
 +
| Enables using the supplied value for the SD card clock divider
 
|-
 
|-
−
| 0x1D0 (0xE8 * 2) || 0x10 bytes || Boot parameters (encrypted with Wii U SEEPROM key).
+
| 12
−
Structure containing parameters for boot0:
+
|  
−
  - 0x1D0 to 0x1D2 (0x02 bytes): boot1 version.
 
−
  - 0x1D2 to 0x1D4 (0x02 bytes): boot1 NAND sector.
 
−
  - 0x1D4 to 0x1DC (0x08 bytes): Empty.
 
−
  - 0x1DC to 0x1E0 (0x04 bytes): CRC32 of data from 0x1D0 to 0x1DC.
 
 
|-
 
|-
−
| 0x1E0 (0xF0 * 2) || 0x10 bytes || Boot parameters (encrypted with Wii U SEEPROM key).
+
| 13
−
Structure containing parameters for boot0:
+
| Enables using the supplied value for overwriting NAND_BANK
−
  - 0x1E0 to 0x1E2 (0x02 bytes): boot1 copy version.
 
−
  - 0x1E2 to 0x1E4 (0x02 bytes): boot1 copy NAND sector.
 
−
  - 0x1E4 to 0x1EC (0x08 bytes): Empty.
 
−
  - 0x1EC to 0x1F0 (0x04 bytes): CRC32 of data from 0x1E0 to 0x1EC.
 
 
|-
 
|-
−
| 0x1F0 (0xF8 * 2) || 0x10 bytes || Empty.
+
| 14
 +
| Enables using the supplied value for overwriting NAND_CONFIG
 
|-
 
|-
 +
| 15
 +
| Forces NAND to validate ECC data
 
|}
 
|}
 +
 +
[[Category:Hardware]]

Latest revision as of 02:47, 18 November 2024

General

The Latte package contains a 93C66 (or similar) SPI EEPROM, organized as 256 16-bit words, making it twice the size of the EEPROM found in the Wii's Hollywood package. It is accessed by twiddling some of the Starbuck GPIO lines in the exact same way as it was done on the Wii's Starlet GPIO lines.

Contents

Most of the data here is only written once during manufacturing, but some fields are updated fairly frequently. Items listed as reserved are empty and not known to be used.

Offset (word index * 2) Size Description
0x000 (0x00 * 2) 0x12 bytes Reserved
0x012 (0x09 * 2) 0x08 bytes RNG seed 
This seed is incremented every time IOS-CRYPTO starts. 
It is also combined with the OTP's RNG key and seed to setup the IOS-CRYPTO RNG functions.
0x01A (0x0D * 2) 0x06 bytes Reserved
0x020 (0x10 * 2) 0x0C bytes EspressoPackageInfo
0x02C (0x16 * 2) 0x0C bytes LattePackageInfo
0x038 (0x1C * 2) 0x48 bytes BoardConfig
0x080 (0x40 * 2) 0x10 bytes Drive key
0x090 (0x48 * 2) 0x10 bytes Factory key 
This key is cleared by IOS-MCP.
0x0A0 (0x50 * 2) 0x10 bytes SHDD seed
0x0B0 (0x58 * 2) 0x10 bytes IVS seed 
This seed is encrypted with the IVS key from OTP then used to set the /dev/crypto USB key.
The first 0x04 bytes of this key must match the Wii U device ID.
0x0C0 (0x60 * 2) 0x02 bytes DriveConfig 
If the flag is 0x0000, the drive key is unencrypted.
If the flag is 0xFFFE, the drive key is empty.
If the flag is 0xFFFF, the drive key is encrypted with the SEEPROM key.
0x0C2 (0x61 * 2) 0x02 bytes IvsConfig 
If the flag is 0x0010, real IVS should be used.
0x0C4 (0x62 * 2) 0x02 bytes ShddConfig 
If the flag is 0x0000, the SHDD seed is empty.
If the flag is 0xFFFF, the SHDD seed is encrypted with the SHDD key from OTP.
0x0C6 (0x63 * 2) 0x6A bytes Reserved
0x130 (0x98 * 2) 0x04 bytes
0x134 (0x9A * 2) 0x02 bytes
0x136 (0x9B * 2) 0x02 bytes
0x138 (0x9C * 2) 0x08 bytes Reserved
0x140 (0xA0 * 2) 0x40 bytes SysProd
0x180 (0xC0 * 2) 0x12 bytes ProdInfo
0x192 (0xC9 * 2) 0x02 bytes Always 0xAA55
0x194 (0xCA * 2) 0x02 bytes
0x196 (0xCB * 2) 0x02 bytes
0x198 (0xCC * 2) 0x02 bytes
0x19A (0xCD * 2) 0x04 bytes
0x19E (0xCF * 2) 0x04 bytes
0x1A2 (0xD1 * 2) 0x02 bytes Always 0xBB66
0x1A4 (0xD2 * 2) 0x02 bytes
0x1A6 (0xD3 * 2) 0x02 bytes
0x1A8 (0xD4 * 2) 0x08 bytes
0x1B0 (0xD8 * 2) 0x02 bytes
0x1B2 (0xD9 * 2) 0x02 bytes
0x1B4 (0xDA * 2) 0x08 bytes
0x1BC (0xDE * 2) 0x04 bytes StorageSize
0x1C0 (0xE0 * 2) 0x30 bytes BootParams
0x1F0 (0xF8 * 2) 0x10 bytes Reserved

EspressoPackageInfo

Offset Size Description
0x0 0x4 PpcPvr (0x70010201)
0x4 0x6 EspressoPackageId
0xA 0x2

LattePackageInfo

Offset Size Description
0x0 0x2 LatteWaferX
0x2 0x2 LatteWaferY
0x4 0x8 LattePackageId

BoardConfig

Offset Size Description
0x0 0x4 crc
0x4 0x2 size
0x6 0x2 version
0x8 0x2 author
0xA 0x2 boardType
0xC 0x2 boardRevision
0xE 0x2 bootSource
0x10 0x2 ddr3Size
0x12 0x2 ddr3Speed
0x14 0x2 ppcClockMultiplier
0x16 0x2 iopClockMultiplier
0x18 0x2 video1080p
0x1A 0x2 ddr3Vendor
0x1C 0x2 movPassiveReset
0x20 0x2 sysPllSpeed
0x22 0x2 sataDevice
0x24 0x2 consoleType
0x26 0x4 devicePresence
0x28 0x20 Reserved

author

Value Description
0x404D @M (Atmel?)

boardType

Value Description
0x4346 CF (CAFE: Production/Test)
0x4354 CT (CAT: Development)
0x4556 EV (EV: Evaluation)
0x4944 ID (WUIH_DEV)
0x4948 IH (WUIH)

bootSource

Value Description
0x4E31 N1 (NAND1)
0x5333 S3 (SDIO3)

ddr3Size

Value Description
0x0800 2GB (Production/Test)
0x1000 4GB (Development)

ddr3Vendor

Value Description
0x5521 U!

sataDevice

Value Description
0x0001 Default
0x0002 No device
0x0003 ROM drive (Production)
0x0004 R drive (CAT-R/CAT-I)
0x0005 MION (CAT-DEV)
0x0006 SES (CAT-SES)
0x0007 GEN2-HDD
0x0008 GEN1-HDD

consoleType

Value Description
0x0001 WUP (Production)
0x0002 CAT-R (Test)
0x0003 CAT-DEV (Development)
0x0004 EV board (Evaluation)
0x0005 Promotion (CAT-I/CAT-SES)
0x0006 OrchestraX
0x0007 WUIH
0x0008 WUIH_DEV
0x0009 CAT_DEV_WUIH

SysProd

Offset Size Description
0x0 0x4 product_area
0x4 0x2 eeprom_version
0x6 0x2 Reserved
0x8 0x4 game_region
0xC 0x4 Reserved
0x10 0x4 ntsc_pal
0x14 0x3 5ghz_country_code
0x17 0x1 5ghz_country_code_revision
0x18 0x8 code_id
0x20 0xC serial_id
0x2C 0x4 Reserved
0x30 0x10 model_number

ProdInfo

This 0x12-byte structure is only present in production/test units. For development units, this structure is left empty.

Offset Size Description
0x0 0x4 LotNumber
0x4 0x4 LotNumberEx (only available if boardRevision >= 0x0C)
0x8 0x2 ProdYear
0xA 0x2 ProdMonthDay
0xC 0x2 ProdHourMinute
0xE 0x4 ProdInfoCrc (CRC32 over the previous 14 bytes)

StorageSize

Value Description
0x1000 8GB (MLC)
0x4000 32GB (MLC)
0x14000 320GB (MION)

BootParams

This 0x30-byte structure is AES-128-ECB encrypted with the SEEPROM key.

Offset Size Description
0x0 0x2 MiscConfig
0x2 0x2 BootConfig
0x4 0x4 NandConfig (value for overwriting the NAND_CONFIG register)
0x8 0x4 NandBank (value for overwriting the NAND_BANK register)
0xC 0x4 BootParamsCrc0 (CRC32 over the previous 12 bytes)
0x10 0x2 Boot1Version0
0x12 0x2 Boot1Sector0 (default: 0x1000 => 0x40000 pages = NAND bank 1, byte offset 0x0)
0x14 0x8 Reserved
0x1C 0x4 BootParamsCrc1 (CRC32 over the previous 12 bytes)
0x20 0x2 Boot1Version1
0x22 0x2 Boot1Sector1 (default: 0x1001 => 0x40040 pages = NAND bank 1, byte offset 0x21000)
0x24 0x8 Reserved
0x2C 0x4 BootParamsCrc2 (CRC32 over the previous 12 bytes)

MiscConfig

Bits Description
0-9 CPU speed in MHz used for delay calculations
10-14 Value for delaying before checking if the SD boot combo has been pressed
15 Causes 0x3 to be written to LT_IOP2X which increases the ARM CPU clock multiplier

BootConfig

Bits Description
0-7 SD card clock divider
8-9 Value for delaying before initializing the SD host controller
10 Enables SD card 4-bit bus through CMD55 (SD_APP_CMD) and CMD6 (SD_APP_SET_BUS_WIDTH)
11 Enables using the supplied value for the SD card clock divider
12
13 Enables using the supplied value for overwriting NAND_BANK
14 Enables using the supplied value for overwriting NAND_CONFIG
15 Forces NAND to validate ECC data
Retrieved from "https://wiiubrew.org/w/index.php?title=Hardware/SEEPROM&oldid=4080"