Difference between revisions of "Hardware/OTP"
< Hardware
Jump to navigation
Jump to search
(add broadon patent link) |
|||
| (5 intermediate revisions by 5 users not shown) | |||
| Line 8: | Line 8: | ||
== General == | == General == | ||
| − | The ''' | + | The '''O'''ne '''T'''ime '''P'''rogrammable memory is used to store 32 4byte words. It is programmed sometime during the factory process and can never be changed afterwards. Next to the Wii's shared and public keys it also contains a random number generation seed and the boot1 hash which basically makes it impossible for us to change boot1. This memory may or may not be described in claims 141 and 142 in http://www.freepatentsonline.com/y2005/0132217.html |
== Register List == | == Register List == | ||
| Line 16: | Line 16: | ||
|} | |} | ||
| − | == | + | == General Registers == |
| − | {{ | + | {{reg32 | HW_OTP_COMMAND | addr = 0x0d8001ec | hifields = 2 | lofields = 2 | |
| − | This register contains the command sent to the OTP | + | |1|15| |
| − | + | |R/W|U| | |
| − | + | |RD||| | |
| − | + | |11|5| | |
| − | + | |U|R/W| | |
| + | ||ADDR| | ||
| + | }} | ||
| + | {{regdesc | ||
| + | |RD|Set to one to execute a read command. If clear, then the data in HW_OTP_DATA is unchanged. | ||
| + | |ADDR|Word address to read | ||
| + | }} | ||
| + | This register contains the command sent to the OTP. It is unknown whether is register is also used during the factory process to program the OTP. | ||
---- | ---- | ||
| + | {{regsimple|HW_OTP_DATA|addr=0x0d8001f0|bits=32|access=R}} | ||
| + | This register contains the output data for the last issued OTP read command. The execution of a read operation via the HW_OTP_COMMAND register immediately changes this register without any delay. | ||
== OTP Contents == | == OTP Contents == | ||
| Line 38: | Line 47: | ||
| 9 || NG id | | 9 || NG id | ||
|- | |- | ||
| − | | a- | + | | a-11 || NG private key |
|- | |- | ||
| − | | 11-15 || NAND HMAC | + | | 11-15 || NAND HMAC (overlaps with NG private key) |
|- | |- | ||
| 16-19 || NAND key | | 16-19 || NAND key | ||
| Line 49: | Line 58: | ||
|- | |- | ||
|} | |} | ||
| − | |||
Latest revision as of 06:42, 17 November 2009
| OTP | |
| Hollywood Registers | |
| Access | |
|---|---|
| Broadway | None |
| Starlet | Full |
| Registers | |
| Base | 0x0d8001ec |
| Length | 0x8 |
| Access size | 32 bits |
| Byte order | Big Endian |
General
The One Time Programmable memory is used to store 32 4byte words. It is programmed sometime during the factory process and can never be changed afterwards. Next to the Wii's shared and public keys it also contains a random number generation seed and the boot1 hash which basically makes it impossible for us to change boot1. This memory may or may not be described in claims 141 and 142 in http://www.freepatentsonline.com/y2005/0132217.html
Register List
| Hollywood GPIOs | |||
|---|---|---|---|
| Address | Bits | Name | Description |
| 0x0d8001ec | 32 | HW_OTP_COMMAND | OTP command |
| 0x0d8001f0 | 32 | HW_OTP_DATA | OTP data |
General Registers
| HW_OTP_COMMAND (0x0d8001ec) | ||||||||||||||||
| 31 | 30 | 29 | 28 | 27 | 26 | 25 | 24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | |
| Access | R/W | U | ||||||||||||||
| Field | RD | |||||||||||||||
| 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 | |
| Access | U | R/W | ||||||||||||||
| Field | ADDR | |||||||||||||||
| Field | Description |
| RD | Set to one to execute a read command. If clear, then the data in HW_OTP_DATA is unchanged. |
| ADDR | Word address to read |
This register contains the command sent to the OTP. It is unknown whether is register is also used during the factory process to program the OTP.
| HW_OTP_DATA (0x0d8001f0) | |
| 310 | |
| Access | R |
This register contains the output data for the last issued OTP read command. The execution of a read operation via the HW_OTP_COMMAND register immediately changes this register without any delay.
OTP Contents
The following things are stored inside the OTP:
| Address | Description |
|---|---|
| 0-4 | Boot1 hash |
| 5-8 | common key |
| 9 | NG id |
| a-11 | NG private key |
| 11-15 | NAND HMAC (overlaps with NG private key) |
| 16-19 | NAND key |
| 1a-1d | RNG key |
| 1e-1f | Unknown |
