Editing Talk:SC EEPROM

== Memory test diagnosis NVS flag ==

There is a NVS flag which enables a special diagnostic mode at startup. This flag is enabled on Proto/DECR. It allows memtest diagnose.

Pseudo-code:
<source lang="python">
def check_bootrom_diag_mode(mode, param)
        diag_mode = get_eeprom_bootrom_diag()
        if diag_mode & 0x1:
                if diag_mode & 0x100:
                        return 0
                mode = (diag_mode >> 3) & 0x1
                param = (diag_mode >> 3) & 0x1
        else:
                mode = (diag_mode >> 1) & 0x1
                param = -1
        return 1
</source>

== EEPROM Dumps ==

* https://mega.co.nz/#!Bk1ESBZT!pqAB6riHhZSCPAftvjm2MFf3j0It61huT3WT2AbWS-A -> DEAD LINK

== EEPROM Strings (CP memory dump, DECR) ==

http://pastie.org/private/usd2zi8mw3igycsh1a395q -> DEAD LINK

== Bus Pirate stuff ==

http://i.imgur.com/48rbR51.png

(needs more wikifying)

== On standby ==

* Note: during this time the plaintext EEPROM is never read even once!
* Additionally, the areas 0x26B0, 0x26D0 are not read

* Checks status
* Unlocks Write Command
* Reads PATCH top half region
* Reads PATCH bottom half region
* Reads 0x2790?(0x20)
* Reads 0x27B0?(0x10)
* Reads 0x26D0 (0x10)
* Reads some configs? (around >0x31XX area)
* Reads 0x0 (0x10)
* Reads some configs?
* Reads 0x10(0x280) (EID1)?
* Reads 0x3A00 (0x1)
* Reads 0x290 (0x10) (EID1 CMAC?)
* Reads 0x2A0 (0x20)
* Reads 0x2C0 (0x20)
* Reads 0x2E0 (0x20)
* Writes some stuff to 0x2C0/0x2E0/0x2A0 (mostly ff's)
* ReReads EID1 and CMAC
* Reads 0x360
* Reads 0x370
* Writes (again) mostly ff's to 0x360 and 0x370
* ReReads EID1 and CMAC
* Does same process with 0x460 and 0x470
* Reads 0x2710 and 0x2730 (0x20,0x10) ???
* Reads 0x2700 (0x10)
* fini!

= MemoryMap Syscon BB Chip =

<pre>
0x1000-0x1FFF:PTCH Region (patch written here)
</pre>

= Nice read about Syscon EEPROM =

http://rmscrypt.wordpress.com/2011/02/01/lets-look-at-syscon/

= BE Count region =
The format of this region is weird, in mullions have a size of 0x200 but it was reduced to 0x100 for sherwoods<br>
In sherwoods it seems to start with 2 bytes (bringup counter), 2 bytes (shutdown counter), 4 bytes (total runtime in seconds), 4 bytes (unknown, but the last 2 bytes are always 0000), then value 0x3CEF0000 (unknown, seems to be static). The rest of the region is filled with FF, some consoles have 2 bytes used at relative offset 0x20 (as example, with value 0x55AA)

= Experimental table =
The goal is to join together all the "memory map" info in a single table

{| class="wikitable sortable" style="line-height:100%; font-size:85%"
|+ Round 2
! colspan="3" | Area !! colspan="4" | [[Syscon_Hardware|<abbr title="Only Mullion syscons have a direct SPI access to the EEPROM>SPI</abbr> / <abbr title="All syscons have a UART access>UART</abbr>]] !! colspan="6" | [[LV2_Functions_and_Syscalls#process_socket_service_syscalls|Syscall 863]] !! class="unsortable" rowspan="3" | Data Name !! class="unsortable" rowspan="3" | Wikitable builder Notes (temporal)
|-
! class="unsortable" rowspan="2" | Name !! class="unsortable" rowspan="2" | Size !! class="unsortable" style="padding:1px" rowspan="2" | [[Template:Syscon_checksums|<Abbr title="Checksum">csum</abbr>]] !! colspan="2" | [[Mullion]] !! style="padding:1px" | [[Sherwood]] !! style="padding:1px" | whitelist !! class="unsortable" style="padding:1px" rowspan="2" | [[SC_Communication#Syscon_Services|Block ID<br>NVS Region]] !! colspan="3" | whitelist !! rowspan="2" | Offset !! class="unsortable" rowspan="2" | Size
|-
! <abbr title="201GB, 202GB">32KB</abbr> !! <abbr title="203GB, 301GB, 302GB, 303GB, 304GB">20KB</abbr> !! [[Syscon_SW_Series|SW]]/[[Syscon_SW2_Series|2]]/[[Syscon_SW3_Series|3]]<small><abbr title="Emulated EEPROM">(emu)</abbr></small> !! class="unsortable" | [[Syscon_Firmware#Command_list|EEP]] !! class="unsortable" | lv1/[[Dispatcher_Manager|DM]] !! class="unsortable" | [[Update_Manager|UM]] !! class="unsortable" | [[SC_Manager|SCM]]
|- class="sorttop"
! colspan="15" style="padding:0px" |
|-
! Authenticated Data !! 0x2560 !! {{no}}
| 0x0000 || 0x0000 || ? || {{exploitable}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || ? ||  ||  || Data table (0x160+(0x9*0x400)) ?
|- {{cellcolors|#e3e3e3}}
! ? !! 0x150 !! {{no}}
| 0x2560 || 0x2560 || ? || {{exploitable}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || ? ||  ||  || Filled with FF's ?
|- {{cellcolors|#ddddff}}
! System Info !! 0x150 !! {{no}}
| 0x26B0 || 0x26B0 || 0x0000~ ? || {{exploitable}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || ? ||  ||  || This wikitable row needs to be splitted up to 5+ rows
|- {{cellcolors|#ffffcc}}
! Patch 1 !! 0x400 !! {{No}}
| <abbr title="Encrypted">0x2800</abbr> || <abbr title="Encrypted">0x2800</abbr> || <abbr title="The patch, in decrypted format, is stored in FLASH, offset 0x2000, length 0x1000>0x2000<small>(flash)</small></abbr> || {{exploitable}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || ? || 0x400 || [[Syscon_Firmware#Syscon_patches|Syscon Firmware Patch]] (top half) || 
|- {{cellcolors|lightgrey}}
! - !! 0x300 !! {{No}}
| 0x2C00 || 0x2C00 || 0x0B00 || {{yes}}/UART || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || ? || 0x300 || style="text-align:center" | ''not used'' || Filled with FF's
|-
! Industry Area !! 0x100 !! {{no}}
| 0x2F00 || 0x2F00 || 0x0E00 || {{yes}}/UART || 0x10 || {{patchable}} || {{yes}} || {{yes}} || 0x02F00 ||  ||  || This wikitable row needs to be splitted up to 20+ rows
|- {{cellcolors|#e3e3e3}}
! Customer Service Area !! 0x100 !! {{no}}
| 0x3000 || 0x3000 || 0x0F00 || {{yes}}/UART || 0x20 || {{patchable}} || {{yes}} || {{yes}} || 0x03000 || 0x100 ||  || Filled with FF's ?
|-
! Platform Config !! 0x100 !! {{yes}}
| 0x3100 || 0x3100 || 0x0040~ || {{yes}}/UART || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || ? || 0x100 ||  || This wikitable row needs to be splitted up to 5+ rows
|-
! Hardware Config !! 0x100 !! {{yes}}
| 0x3200 || 0x3200 || 0x0140~ || {{yes}}/UART || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || ? || 0x100 ||  || This wikitable row needs to be splitted up to 40+ rows
|-
! Thermal Config !! 0x200<!-- size reduced to 0x1B0 for sherwoods ? --> !! {{yes}}
| 0x3300 || 0x3300 || 0x0250~ || {{yes}}/UART || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || ? || 0x200 || [[Syscon_Thermal_Configs/structs|Data table]]. See: [[Syscon Thermal Configs]] || 
|-
! BE Count !! 0x200<!-- size reduced to 0x100 for sherwoods ? --> !! {{no}}
| 0x3500 || 0x3500 || 0x0800 (size 0x100) || {{yes}}/UART || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || ? || 0x200 || Data table || 
|-
! Error Log !! 0x100 !! {{no}}
| 0x3700 || 0x3700 || 0x0900 || {{yes}}/UART || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || ? || 0x100 || Data table. See: [[Syscon Error Codes]] || 
|- {{cellcolors|lightgrey}}
! - !! 0x100 !! {{No}}
| 0x3800 || 0x3800 || N/A ? || {{yes}}/UART || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || ? || 0x100 || style="text-align:center" | ''not used'' || Filled with FF's
|-
! Board Config/Debug !! 0x100 !! {{yes}}
| 0x3900 || 0x3900 || 0x0000~ ? || {{yes}}/UART || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || ? || 0x100 ||  || This wikitable row needs to be splitted up to 15+ rows
|-
! HDMI/DVE Config !! 0x100 !! {{no}}
| 0x3A00 || 0x3A00 || 0x0A00 || {{yes}}/UART || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || ? || 0x100 ||  || This wikitable row needs to be splitted up to 5+ rows
|- {{cellcolors|lightgrey}}
! - !! 0x100 !! {{No}}
| 0x3B00 || 0x3B00 || N/A ? || {{yes}}/UART || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || ? || 0x100 || style="text-align:center" | ''not used'' || Filled with FF's
|- {{cellcolors|lightgrey}}
! Config Ring !! 0x200 !! {{yes}}
| 0x3C00 || 0x3C00 || 0x0400 ? || {{yes}}/UART || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || ? || 0x200 || style="text-align:center" | ''not used'' || <abbr title="When filled with 0xFF's the checksum at the last 2 bytes is 0xFF00">Filled with FF's</abbr>
|- {{cellcolors|lightgrey}}
! Debug 2 !! 0x200 !! {{yes}}
| 0x3E00 || 0x3E00 || 0x0600 ? || {{yes}}/UART || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || ? || 0x200 || style="text-align:center" | ''not used'' || <abbr title="When filled with 0xFF's the checksum at the last 2 bytes is 0xFF00">Filled with FF's</abbr>
|- {{cellcolors|#888}}
! - !! 0x3000 !! {{No}}
| 0x4000 || N/A || N/A || {{yes}}/UART || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || ? || 0x3000 || style="text-align:center" | ''reserved'' || Filled with FF's
|- {{cellcolors|#e3e3e3}}
! System Config ? !! 0x100 !! {{no}}
| 0x7000 || 0x4000 || 0x1000 || {{yes}}/UART || 0x0 || {{patchable}} || {{patchable}} || {{yes}} || 0x48000 || 0x100 ||  || Filled with FF's ?
|-
! System Event Log ? !! 0x100 !! {{no}}
| 0x7100 || 0x4100 || 0x1100 || {{yes}}/UART || 0x1 || {{patchable}} || {{patchable}} || {{yes}} || 0x48800 ||  || Data table (0x10+(0x6*0x28)) || <abbr title="It looks like a data table with a 0x10 header and six entries of 0x28 bytes lenght">Header + Data table ?</abbr>
|-
! Flags and Tokens !! 0x100 !! {{no}}
| 0x7200 || 0x4200 || 0x1200 || {{yes}}/UART || 0x2 || {{patchable}} || <abbr title="Every individual value needs a specific tag">Yes<br>or<br>Patch*</abbr> || {{yes}} || 0x48C00 ||  ||  || This wikitable row needs to be splitted up to 50+ rows
|- {{cellcolors|#e3e3e3}}
! System Data ? !! 0x100 !! {{no}}
| 0x7300 || 0x4300 || 0x1300 || {{yes}}/UART || 0x3 || {{patchable}} || {{patchable}} || {{yes}} || 0x48D00 || 0x100 ||  || Filled with FF's ?
|- {{cellcolors|#ffffcc}}
! Patch 2 !! 0xC00 !! {{No}}
| <abbr title="Encrypted">0x7400</abbr> || <abbr title="Encrypted">0x4400</abbr> || <abbr title="The patch, in decrypted format, is stored in FLASH, offset 0x2000, length 0x1000>0x2000<small>(flash)</small></abbr> || {{exploitable}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || ? || 0xC00 || [[Syscon_Firmware#Syscon_patches|Syscon Firmware Patch]] (bottom half) ||
|}