Difference between revisions of "Hardware/OTP"

From WiiBrew
Jump to navigation Jump to search
m (→‎Register descriptions: changed aa to xx to make slightly less confuzzling =p)
Line 8: Line 8:
  
 
== General ==
 
== General ==
The '''o'''ne '''t'''ime '''p'''rogrammable memory is used to store 32 4byte words. It is programmed sometimes during the factory process and can never be changed afterwards. Next to the Wii's shared and public keys it also contains a random number generation seed and the boot1 hash which basically makes it impossible for us to change boot1.
+
The '''O'''ne '''T'''ime '''P'''rogrammable memory is used to store 32 4byte words. It is programmed sometime during the factory process and can never be changed afterwards. Next to the Wii's shared and public keys it also contains a random number generation seed and the boot1 hash which basically makes it impossible for us to change boot1.
  
 
== Register List ==
 
== Register List ==
Line 16: Line 16:
 
|}
 
|}
  
== Register descriptions ==
+
== General Registers ==
{{regsimple|HW_OTP_COMMAND|addr=0x0d8001ec|bits=32|access=R/W}}
+
{{reg32 | HW_VERSION | addr = 0x0d800214 | hifields = 2 | lofields = 2 |
This register contains the command sent to the OTP. Reading data is 0x8000_00xx where xx is the address of the 4byte word you want to read. It is unknown whether is register is also used during the factory process to program the OTP.
+
|1|15|
 
+
|R/W|U|
----
+
|RD|||
{{regsimple|HW_OTP_DATA|addr=0x0d8001f0|bits=32|access=R/W}}
+
|11|5|
This register contains the output data for the last issued OTP command. Changes of the HW_OTP_COMMAND register directly change this register without any delays.
+
|U|R/W|
 +
||ADDR|
 +
}}
 +
{{regdesc
 +
|RD|Set to one to execute a read command. If clear, then the data in HW_OTP_DATA is unchanged.
 +
|ADDR|Word address to read
 +
}}
 +
This register contains the command sent to the OTP. It is unknown whether is register is also used during the factory process to program the OTP.
 
----
 
----
 +
{{regsimple|HW_OTP_DATA|addr=0x0d8001f0|bits=32|access=R}}
 +
This register contains the output data for the last issued OTP read command. The execution of a read operation via the HW_OTP_COMMAND register immediately changes this register without any delay.
  
 
== OTP Contents ==
 
== OTP Contents ==
Line 38: Line 47:
 
| 9 || NG id
 
| 9 || NG id
 
|-
 
|-
| a-10 || NG private key
+
| a-11 || NG private key
 
|-
 
|-
| 11-15 || NAND HMAC
+
| 11-15 || NAND HMAC (overlaps with NG private key)
 
|-
 
|-
 
| 16-19 || NAND key
 
| 16-19 || NAND key

Revision as of 20:29, 11 March 2009

OTP
Hollywood Registers
Access
BroadwayNone
StarletFull
Registers
Base0x0d8001ec
Length0x8
Access size32 bits
Byte orderBig Endian
This box: view  talk  edit

General

The One Time Programmable memory is used to store 32 4byte words. It is programmed sometime during the factory process and can never be changed afterwards. Next to the Wii's shared and public keys it also contains a random number generation seed and the boot1 hash which basically makes it impossible for us to change boot1.

Register List

Hollywood GPIOs
Address Bits Name Description
0x0d8001ec 32 HW_OTP_COMMAND OTP command
0x0d8001f0 32 HW_OTP_DATA OTP data

General Registers

HW_VERSION (0x0d800214)
  31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16
Access R/W U
Field RD
  15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
Access U R/W
Field ADDR
Field Description
RD Set to one to execute a read command. If clear, then the data in HW_OTP_DATA is unchanged.
ADDR Word address to read

This register contains the command sent to the OTP. It is unknown whether is register is also used during the factory process to program the OTP.


HW_OTP_DATA (0x0d8001f0)
  310
Access R

This register contains the output data for the last issued OTP read command. The execution of a read operation via the HW_OTP_COMMAND register immediately changes this register without any delay.

OTP Contents

The following things are stored inside the OTP:

Address Description
0-4 Boot1 hash
5-8 common key
9 NG id
a-11 NG private key
11-15 NAND HMAC (overlaps with NG private key)
16-19 NAND key
1a-1d RNG key
1e-1f Unknown