Talk:SC EEPROM: Difference between revisions
Jump to navigation
Jump to search
| Line 81: | Line 81: | ||
! rowspan="3" | Area<br>Name !! rowspan="3" | Area<br>Size !! colspan="4" | [[Syscon_Hardware|SPI / UART]] !! colspan="8" | [[LV2_Functions_and_Syscalls#process_socket_service_syscalls|Syscall 863]] !! rowspan="3" | Data Name !! rowspan="3" | Notes | ! rowspan="3" | Area<br>Name !! rowspan="3" | Area<br>Size !! colspan="4" | [[Syscon_Hardware|SPI / UART]] !! colspan="8" | [[LV2_Functions_and_Syscalls#process_socket_service_syscalls|Syscall 863]] !! rowspan="3" | Data Name !! rowspan="3" | Notes | ||
|- | |- | ||
! colspan="2" | [[Mullion]] !! [[Sherwood]] !! rowspan="2" | [[Syscon_Firmware#Command_list|EEP]]<br>Whitelist !! rowspan="2" | [[SC_Communication#Syscon_Services|NVS]]<br> | ! colspan="2" | [[Mullion]] !! style="padding:0px" | [[Sherwood]] !! rowspan="2" | [[Syscon_Firmware#Command_list|EEP]]<br>Whitelist !! rowspan="2" | [[SC_Communication#Syscon_Services|NVS]]<br>ID !! rowspan="2" style="padding:0px" | Block<br>ID !! colspan="2" | [[Update_Manager|UM Whitelist]] !! colspan="2" | [[SC_Manager|SCM Whitelist]] !! rowspan="2" | Offset !! rowspan="2" | Size | ||
|- | |- | ||
! [[Syscon_CXR713_Series|CXR713]] !! [[Syscon_CXR714_Series|CXR714]] !! [[Syscon_SW_Series|SW]]/[[Syscon_SW2_Series|2]]/[[Syscon_SW3_Series|3]] !! Read !! Write !! Read !! Write | ! style="padding:0px" | [[Syscon_CXR713_Series|CXR713]] !! style="padding:0px" | [[Syscon_CXR714_Series|CXR714]] !! [[Syscon_SW_Series|SW]]/[[Syscon_SW2_Series|2]]/[[Syscon_SW3_Series|3]] !! Read !! Write !! Read !! Write | ||
|- | |- | ||
| rowspan="6" | <span style="writing-mode:vertical-lr; transform:rotate(180deg);">OS Version Area<br>a.k.a.<br>Industry Area</span> || rowspan="6" | 0x100 ||rowspan="6" | 0x2F00 || rowspan="6" | 0x2F00 || rowspan="6" | 0xE00 || rowspan="6" {{yes}} || rowspan="6" | 0x20 || rowspan="6" | 0x10 || {{yes}} || {{yes}} || {{yes}} || {{yes}} || 0x02F00 || 0x08 || Manufacturing Update Release Version || | | rowspan="6" | <span style="writing-mode:vertical-lr; transform:rotate(180deg);">OS Version Area<br>a.k.a.<br>Industry Area</span> || rowspan="6" | 0x100 ||rowspan="6" | 0x2F00 || rowspan="6" | 0x2F00 || rowspan="6" | 0xE00 || rowspan="6" {{yes}} || rowspan="6" | 0x20 || rowspan="6" | 0x10 || {{yes}} || {{yes}} || {{yes}} || {{yes}} || 0x02F00 || 0x08 || Manufacturing Update Release Version || | ||
Revision as of 23:26, 6 November 2021
Memory test diagnosis NVS flag
There is a NVS flag which enables a special diagnostic mode at startup. This flag is enabled on Proto/DECR. It allows memtest diagnose.
Pseudo-code:
def check_bootrom_diag_mode(mode, param)
diag_mode = get_eeprom_bootrom_diag()
if diag_mode & 0x1:
if diag_mode & 0x100:
return 0
mode = (diag_mode >> 3) & 0x1
param = (diag_mode >> 3) & 0x1
else:
mode = (diag_mode >> 1) & 0x1
param = -1
return 1
EEPROM Dumps
EEPROM Strings (CP memory dump, DECR)
http://pastie.org/private/usd2zi8mw3igycsh1a395q -> DEAD LINK
Bus Pirate stuff
http://i.imgur.com/48rbR51.png
(needs more wikifying)
On standby
- Note: during this time the plaintext EEPROM is never read even once!
- Additionally, the areas 0x26B0, 0x26D0 are not read
- Checks status
- Unlocks Write Command
- Reads PATCH top half region
- Reads PATCH bottom half region
- Reads 0x2790?(0x20)
- Reads 0x27B0?(0x10)
- Reads 0x26D0 (0x10)
- Reads some configs? (around >0x31XX area)
- Reads 0x0 (0x10)
- Reads some configs?
- Reads 0x10(0x280) (EID1)?
- Reads 0x3A00 (0x1)
- Reads 0x290 (0x10) (EID1 CMAC?)
- Reads 0x2A0 (0x20)
- Reads 0x2C0 (0x20)
- Reads 0x2E0 (0x20)
- Writes some stuff to 0x2C0/0x2E0/0x2A0 (mostly ff's)
- ReReads EID1 and CMAC
- Reads 0x360
- Reads 0x370
- Writes (again) mostly ff's to 0x360 and 0x370
- ReReads EID1 and CMAC
- Does same process with 0x460 and 0x470
- Reads 0x2710 and 0x2730 (0x20,0x10) ???
- Reads 0x2700 (0x10)
- fini!
MemoryMap Syscon BB Chip
0x1000-0x1FFF:PTCH Region (patch written here)
Nice read about Syscon EEPROM
http://rmscrypt.wordpress.com/2011/02/01/lets-look-at-syscon/
Experimental table
The goal is to join together all the "memory map" info in a single table
| Area Name |
Area Size |
SPI / UART | Syscall 863 | Data Name | Notes | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mullion | Sherwood | EEP Whitelist |
NVS ID |
Block ID |
UM Whitelist | SCM Whitelist | Offset | Size | |||||||
| CXR713 | CXR714 | SW/2/3 | Read | Write | Read | Write | |||||||||
| OS Version Area a.k.a. Industry Area |
0x100 | 0x2F00 | 0x2F00 | 0xE00 | Yes | 0x20 | 0x10 | Yes | Yes | Yes | Yes | 0x02F00 | 0x08 | Manufacturing Update Release Version | |
| Yes | Yes | Yes | Yes | 0x02F08 | 0x10 | Manufacturing Update Build Version + Build Date | |||||||||
| Yes | Yes | Yes | Yes | 0x02F20 | 0x08 | Manufacturing Update Build Target ID | |||||||||
| Yes | Yes | Yes | Yes | 0x02F28 | 0xD0 | Undocumented | |||||||||
| Yes | Yes | Yes | Yes | 0x02FF8 | 0x01 | Factory Bit | |||||||||
| Yes | Yes | Yes | Yes | 0x02FF9 | 0x07 | Undocumented | |||||||||