WiiUBrew

Changes

Hardware/eFuse (view source)

Revision as of 03:37, 11 February 2024

365 bytes removed ,  03:37, 11 February 2024
no edit summary
Line 1: Line 1:  +
= General =
 +
Both the [[#Hardware/Latte|Latte]] and the [[#Hardware/Espresso|Espresso]] hardware use eFuses for holding an assortment of read-only data, including the console's encryption/decryption keys.
 +
 +
= Latte =
 
{{Infobox MMIO
 
{{Infobox MMIO
 
| partof = [[Hardware/Latte Registers|Latte Registers]]
 
| partof = [[Hardware/Latte Registers|Latte Registers]]
Line 7: Line 11:  
}}
 
}}
   −
= General =
+
== Register List ==
−
The '''O'''ne '''T'''ime '''P'''rogrammable memory is programmed sometime during the factory process and can never be changed afterwards. The Wii U's OTP is much larger than the Wii's (1KB split across 8 banks of 128 bytes each) and contains an assortment of read-only data, including the console's encryption/decryption keys.
+
{{reglist|eFuse}}
−
 
+
{{rla|0x0d8001ec|32|HW_EFUSEADDR|eFuse address}}
−
= Register List =
+
{{rla|0x0d8001f0|32|HW_EFUSEDATA|eFuse data}}
−
{{reglist|OTP}}
+
{{rla|0x0d800510|32|LT_EFUSEPROT|eFuse access control}}
−
{{rla|0x0d8001ec|32|HW_EFUSEADDR|OTP command}}
  −
{{rla|0x0d8001f0|32|HW_EFUSEDATA|OTP data}}
   
|}
 
|}
   −
= General Registers =
+
== Register Details ==
 
{{reg32 | HW_EFUSEADDR | addr = 0x0d8001ec | hifields = 2 | lofields = 4 |
 
{{reg32 | HW_EFUSEADDR | addr = 0x0d8001ec | hifields = 2 | lofields = 4 |
 
|1|15|
 
|1|15|
Line 30: Line 32:  
|ADDR|Word address to read, 0x00 to 0x1F (32 4byte words).
 
|ADDR|Word address to read, 0x00 to 0x1F (32 4byte words).
 
}}
 
}}
−
This register contains the command sent to the OTP. It is unknown whether is register is also used during the factory process to program the OTP.
+
This register contains the address sent to the eFuse driver.
−
----
+
 
 +
 
 
{{regsimple|HW_EFUSEDATA|addr=0x0d8001f0|bits=32|access=R}}
 
{{regsimple|HW_EFUSEDATA|addr=0x0d8001f0|bits=32|access=R}}
−
This register contains the output data for the last issued OTP read command. The execution of a read operation via the HW_EFUSEADDR register immediately changes this register without any delay.
+
This register contains the output data for the last issued eFuse read command. The execution of a read operation via the HW_EFUSEADDR register immediately changes this register without any delay.
   −
= IOSU =
  −
The Wii U's IOSU interacts with the OTP by setting it's respective Latte registers. In addition to this, the IOS-CRYPTO process is also able to access the OTP indirectly through syscall 0x22, which takes the OTP word index, a buffer to store the result and the requested size as parameters. The IOS-KERNEL then converts the word index:
  −
int read_otp_internal(int index, void* out_buf, u32 size)
  −
{
  −
  int i_res = disable_interrupts();
  −
 
  −
  if (size != 0)
  −
  {
  −
    int step = 0;
  −
   
  −
    while (step < size)
  −
    {
  −
      int word_addr = index + (step >> 2);
  −
      int word_offset = word_addr & 0x1F;      // Each OTP bank has 0x20 * 4 = 0x80 bytes. Valid word indexes go from 0x00 to 0x1F.
  −
      word_addr = word_addr << 3;
  −
      word_offset = word_offset | 0x80000000;  // Set OTP read flag.
  −
      word_addr = word_addr & 0x700;          // OTP bank goes from 0x000 to 0x700.
  −
      word_addr = word_addr | word_offset;
  −
     
  −
      *(u32*)0x0D8001EC = word_addr;                    // Write to HW_EFUSEADDR
  −
        u32 temp = *(u32*)0x0D8001EC;                    // Read from HW_EFUSEADDR
  −
     
  −
      *(u32*)(out_buf + step) = *(u32*)0x0D8001F0;      // Copy from HW_EFUSEDATA
  −
     
  −
      step += 4;
  −
    }
  −
  }
  −
 
  −
  enable_interrupts(i_res);
  −
  return 0;
  −
}
     −
syscall_0x22(index, out_buf, size)
+
{{reg32 | LT_EFUSEPROT | addr = 0x0d800510 | hifields = 1 | lofields = 1 |
−
{
+
|16          |
−
  // Do some permission checks.
+
|R/W          |
−
  ...
+
|            ||
−
 
+
|16          |
−
  // Internal IOS-KERNEL function.
+
|R/W          |
−
  read_otp_internal(index, out_buf, size);
+
|            |
−
}
+
}}
 +
This register is a bitmask for locking out chunks of eFuses. Each bit clears out 0x20 bytes starting from the bottom (bank 7 is 0xF0000000) to the top (bank 0 is 0x0000000F).
   −
= Contents =
+
== Contents ==
 
All data here is written during manufacturing. Items listed as reserved are not known to be used and are either empty or random.
 
All data here is written during manufacturing. Items listed as reserved are not known to be used and are either empty or random.
 
{| style="border: 1px solid #bbb; border-collapse: collapse; background-color: #eef; padding: 0.2em 0.2em 0.2em 0.2em;" border="1" cellpadding="2"
 
{| style="border: 1px solid #bbb; border-collapse: collapse; background-color: #eef; padding: 0.2em 0.2em 0.2em 0.2em;" border="1" cellpadding="2"
Line 238: Line 211:  
|}
 
|}
   −
== FuseType ==
+
=== FuseType ===
 
{| class="wikitable" border="1"
 
{| class="wikitable" border="1"
 
|-
 
|-
Line 263: Line 236:  
|}
 
|}
   −
== LattePackageId ==
+
=== LattePackageId ===
 
This identifier is composed by a three digit date code, followed by two letters (possibly identifying the manufacturing site) and three characters (possibly a lot trace code). The Latte SoC includes this identifier in its shield's markings, but prefixed with the number "1".
 
This identifier is composed by a three digit date code, followed by two letters (possibly identifying the manufacturing site) and three characters (possibly a lot trace code). The Latte SoC includes this identifier in its shield's markings, but prefixed with the number "1".
   Line 269: Line 242:     
"226" translates to the 26th week of year 2012, while "LP" appears to indicate the manufacturing site and "734" appears to be a lot trace code.
 
"226" translates to the 26th week of year 2012, while "LP" appears to indicate the manufacturing site and "734" appears to be a lot trace code.
 +
 +
= Espresso =
 +
{{Infobox MMIO
 +
| arm = Full
 +
| ppc = Full
 +
| base = 0x0c320000
 +
| len = 0x40
 +
| bits = 32
 +
}}
 +
 +
== Contents ==
 +
All data here is written during manufacturing. Items listed as reserved are not known to be used and are either empty or random.
 +
{| style="border: 1px solid #bbb; border-collapse: collapse; background-color: #eef; padding: 0.2em 0.2em 0.2em 0.2em;" border="1" cellpadding="2"
 +
|- style="background-color: #ddd;"
 +
! Offset
 +
! Size
 +
! Description
 +
|-
 +
| 0x000 || 0x10 bytes || Espresso Wii U ancast key
 +
|-
 +
| 0x010 || 0x10 bytes || Espresso vWii ancast key
 +
|-
 +
| 0x020 || 0x1C bytes || Reserved
 +
|-
 +
| 0x03C || 0x4 bytes || FuseType
 +
Production: 0xB4000001
 +
|}
 +
 +
=== FuseType ===
 +
{| class="wikitable" border="1"
 +
|-
 +
! Bits
 +
! Description
 +
|-
 +
| 0
 +
|
 +
|-
 +
| 1-25
 +
| Reserved
 +
|-
 +
| 26
 +
| Disables evaluation mode
 +
|-
 +
| 27
 +
| Development
 +
|-
 +
| 28
 +
| Production
 +
|-
 +
| 29
 +
|
 +
|-
 +
| 30
 +
|
 +
|-
 +
| 31
 +
|
 +
|}
Retrieved from "https://wiiubrew.org/wiki/Special:MobileDiff/3866"