Editing Talk:SC EEPROM

== Memory test diagnosis NVS flag ==

There is a NVS flag which enables a special diagnostic mode at startup. This flag is enabled on Proto/DECR. It allows memtest diagnose.

Pseudo-code:
<syntaxhighlight lang="python">
def check_bootrom_diag_mode(mode, param)
        diag_mode = get_eeprom_bootrom_diag()
        if diag_mode & 0x1:
                if diag_mode & 0x100:
                        return 0
                mode = (diag_mode >> 3) & 0x1
                param = (diag_mode >> 3) & 0x1
        else:
                mode = (diag_mode >> 1) & 0x1
                param = -1
        return 1
</syntaxhighlight>

== EEPROM Dumps ==

* https://mega.co.nz/#!Bk1ESBZT!pqAB6riHhZSCPAftvjm2MFf3j0It61huT3WT2AbWS-A -> DEAD LINK

== EEPROM Strings (CP memory dump, DECR) ==

http://pastie.org/private/usd2zi8mw3igycsh1a395q -> DEAD LINK

== Bus Pirate stuff ==

https://www.psdevwiki.com/ps3/File:48rbR51.png

(needs more wikifying)

== On standby ==

* Note: during this time the plaintext EEPROM is never read even once!
* Additionally, the areas 0x26B0, 0x26D0 are not read

* Checks status
* Unlocks Write Command
* Reads PATCH top half region
* Reads PATCH bottom half region
* Reads 0x2790?(0x20)
* Reads 0x27B0?(0x10)
* Reads 0x26D0 (0x10)
* Reads some configs? (around >0x31XX area)
* Reads 0x0 (0x10)
* Reads some configs?
* Reads 0x10(0x280) (EID1)?
* Reads 0x3A00 (0x1)
* Reads 0x290 (0x10) (EID1 CMAC?)
* Reads 0x2A0 (0x20)
* Reads 0x2C0 (0x20)
* Reads 0x2E0 (0x20)
* Writes some stuff to 0x2C0/0x2E0/0x2A0 (mostly ff's)
* ReReads EID1 and CMAC
* Reads 0x360
* Reads 0x370
* Writes (again) mostly ff's to 0x360 and 0x370
* ReReads EID1 and CMAC
* Does same process with 0x460 and 0x470
* Reads 0x2710 and 0x2730 (0x20,0x10) ???
* Reads 0x2700 (0x10)
* fini!

= MemoryMap Syscon BB Chip =

<pre>
0x1000-0x1FFF:PTCH Region (patch written here)
</pre>

= Nice read about Syscon EEPROM =

http://rmscrypt.wordpress.com/2011/02/01/lets-look-at-syscon/

= BE Count region =
The format of this region is weird, in mullions have a size of 0x200 but it was reduced to 0x100 for sherwoods<br>
In sherwoods it seems to start with 2 bytes (bringup counter), 2 bytes (shutdown counter), 4 bytes (total runtime in seconds), 4 bytes (unknown, but the last 2 bytes are always 0000), then value 0x3CEF0000 (unknown, seems to be static). The rest of the region is filled with FF, some consoles have 2 bytes used at relative offset 0x20 (as example, with value 0x55AA)

Example (CokR40, REX-001emmc, SW3-304)
<pre>
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000800  05 B6 05 23 00 3D AD FA F4 80 00 00 3C EF 00 00  .¶.#.=úô€..<ï..
00000810  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000820  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000830  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000840  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000850  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000860  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000870  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000880  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000890  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000008A0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000008B0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000008C0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000008D0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000008E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000008F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>

Example (CokG11, DYN-001, SW2-301)
<pre>
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000800  07 C8 07 94 00 9E 23 A6 F4 80 00 00 3C EF 00 00  .È.”.ž#¦ô€..<ï..
00000810  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000820  55 AA FF FF FF FF FF FF FF FF FF FF FF FF FF FF  Uªÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000830  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000840  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000850  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000860  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000870  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000880  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000890  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000008A0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000008B0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000008C0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000008D0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000008E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000008F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
*Note the bytes at relative offset 0x20 with value 0x55AA, this bytes are a rarity, only found in 1 syscon dump from 10 checked

= Experimental table =
The goal is to join together all the "memory map" info in a single table

{| class="wikitable sortable" style="line-height:100%; font-size:85%"
|+ Round 3
! colspan="3" | Area !! colspan="4" | [[Syscon_Hardware|<abbr title="Only Mullion syscons have a direct SPI access to the EEPROM>SPI</abbr> / <abbr title="All syscons have a UART access>UART</abbr>]] !! colspan="5" | [[LV2_Functions_and_Syscalls#process_socket_service_syscalls|Syscall 863]] (sys_ss_update_manager) !! class="unsortable" rowspan="3" | Data Name !! class="unsortable" rowspan="3" | Wikitable builder Notes (temporal)
|-
! class="unsortable" rowspan="2" | Name !! class="unsortable" rowspan="2" | Size !! class="unsortable" style="padding:1px" rowspan="2" | [[Template:Syscon_checksums|<Abbr title="Checksum">csum</abbr>]] !! colspan="2" | [[Mullion]] !! style="padding:1px" | [[Sherwood]] !! style="padding:1px" | Whitelist !! class="unsortable" style="padding:1px" colspan="2" | [[SC_Manager#0x900B_-_SC_Read_EPROM|Block Access]] !! colspan="3" | Whitelist
|-
! <abbr title="201GB, 202GB">32KB</abbr> !! <abbr title="203GB, 301GB, 302GB, 303GB, 304GB">20KB</abbr> !! [[Syscon_SW_Series|SW]]/[[Syscon_SW2_Series|2]]/[[Syscon_SW3_Series|3]]<small><abbr title="Emulated EEPROM">(emu)</abbr></small> !! class="unsortable" | [[Syscon_Firmware#Command_list|EEP]] !! ID !! Offset !! class="unsortable" | [[SC_Manager|SCM]] !! class="unsortable" | [[Update_Manager|UM]] !! class="unsortable" | [[Dispatcher_Manager|DM]]
|- class="sorttop"
! colspan="14" style="padding:0px" |
|-
! Authenticated Data !! 0x2600 !! {{no}}
| 0x0000 || 0x0000 || ? || {{exploitable}} || {{no}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} ||  || Data table (0x160+(0x9*0x400)) ?
|- {{cellcolors|#ddddff}}
! System Info !! 0x200 !! {{no}}
| 0x2600 || 0x2600 || <abbr title="SW at 0x70000, or SW2/3 at 0xB0000">0x70000</abbr> ? || {{exploitable}} || {{no}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} ||  || This wikitable row needs to be splitted up to 5+ rows
|- {{cellcolors|#ffffcc}}
! Patch 1 !! 0x400 !! {{No}}
| <abbr title="Encrypted">0x2800</abbr> || <abbr title="Encrypted">0x2800</abbr> || <abbr title="The patch, in decrypted format, is stored in a contiguos area in FLASH, offset 0x2000, length 0x1000>0x2000</abbr> || {{exploitable}} || {{no}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || [[Syscon_Firmware#Syscon_patches|Syscon Firmware Patch]] (top half) || 
|- {{cellcolors|lightgrey}}
! - !! 0x300 !! {{No}}
| 0x2C00 || 0x2C00 || 0x0B00 || {{yes}} || {{no}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || style="text-align:center" | ''not used'' || Filled with FF's
|-
! Industry Area !! 0x100 !! {{no}}
| 0x2F00 || 0x2F00 || 0x0E00 || {{yes}} || 0x10 || 0x02F00 || {{yes}} || {{yes}} || {{patchable}} ||  || This wikitable row needs to be splitted up to 20+ rows
|- {{cellcolors|#e3e3e3}}
! Customer Service Area !! 0x100 !! {{no}}
| 0x3000 || 0x3000 || 0x0F00 || {{yes}} || 0x20 || 0x03000 || {{yes}} || {{yes}} || {{patchable}} ||  || Filled with FF's ?
|-
! Platform Config !! 0x100 !! {{yes}}
| 0x3100 || 0x3100 || 0x0040~ || {{yes}} || {{no}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} ||  || This wikitable row needs to be splitted up to 5+ rows
|-
! Hardware Config !! 0x100 !! {{yes}}
| 0x3200 || 0x3200 || 0x0140~ || {{yes}} || {{no}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} ||  || This wikitable row needs to be splitted up to 40+ rows
|-
! Thermal Config !! 0x200<!-- size reduced to 0x1B0 for sherwoods ? --> !! {{yes}}
| 0x3300 || 0x3300 || 0x0250 (size 0x1B0) || {{yes}} || {{no}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || [[Syscon_Thermal_Configs/structs|Data table]]. See: [[Syscon Thermal Configs]] || 
|-
! BE Count !! 0x200<!-- size reduced to 0x100 for sherwoods ? --> !! {{no}}
| 0x3500 || 0x3500 || 0x0800 (size 0x100) || {{yes}} || {{no}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || Data table || 
|-
! Error Log !! 0x100 !! {{no}}
| 0x3700 || 0x3700 || 0x0900 || {{yes}} || {{no}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || Data table. See: [[Syscon Error Codes]] || 
|- {{cellcolors|lightgrey}}
! - !! 0x100 !! {{No}}
| 0x3800 || 0x3800 || N/A ? || {{yes}} || {{no}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || style="text-align:center" | ''not used'' || Filled with FF's
|-
! Board Config/Debug !! 0x100 !! {{yes}}
| 0x3900 || 0x3900 || 0x0000~ ? || {{yes}} || {{no}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} ||  || This wikitable row needs to be splitted up to 15+ rows
|-
! HDMI/DVE Config !! 0x100 !! {{no}}
| 0x3A00 || 0x3A00 || 0x0A00 || {{yes}} || {{no}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} ||  || This wikitable row needs to be splitted up to 5+ rows
|- {{cellcolors|lightgrey}}
! - !! 0x100 !! {{No}}
| 0x3B00 || 0x3B00 || N/A ? || {{yes}} || {{no}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || style="text-align:center" | ''not used'' || Filled with FF's
|- {{cellcolors|lightgrey}}
! Config Ring !! 0x200 !! {{yes}}
| 0x3C00 || 0x3C00 || 0x0400 ? || {{yes}} || {{no}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || style="text-align:center" | ''not used'' || <abbr title="When filled with 0xFF's the checksum at the last 2 bytes is 0xFF00">Filled with FF's</abbr>
|- {{cellcolors|lightgrey}}
! Debug 2 !! 0x200 !! {{yes}}
| 0x3E00 || 0x3E00 || 0x0600 ? || {{yes}} || {{no}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || style="text-align:center" | ''not used'' || <abbr title="When filled with 0xFF's the checksum at the last 2 bytes is 0xFF00">Filled with FF's</abbr>
|- {{cellcolors|#888}}
! - !! 0x3000 !! {{No}}
| 0x4000 || N/A || N/A || {{yes}} || {{no}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || style="text-align:center" | ''reserved'' || Filled with FF's
|- {{cellcolors|#e3e3e3}}
! System Config ? !! 0x100 !! {{no}}
| 0x7000 || 0x4000 || 0x1000 || {{yes}} || 0x0 || 0x48000 || {{yes}} || {{patchable}} || {{patchable}} ||  || Filled with FF's ?
|-
! Event Log ? !! 0x100 !! {{no}}
| 0x7100 || 0x4100 || 0x1100 || {{yes}} || 0x1 || 0x48800 || {{yes}} || {{patchable}} || {{patchable}} || Data table (0x10+(0x6*0x28)) || <abbr title="It looks like a data table with a 0x10 header and six entries of 0x28 bytes lenght">Header + Data table ?</abbr>
|-
! Flags and Tokens !! 0x100 !! {{no}}
| 0x7200 || 0x4200 || 0x1200 || {{yes}} || 0x2 || 0x48C00 || {{yes}} || <abbr title="Every individual value needs a specific tag, either yes or patch">varies</abbr> || {{patchable}} ||  || This wikitable row needs to be splitted up to 50+ rows
|- {{cellcolors|#e3e3e3}}
! System Data ? !! 0x100 !! {{no}}
| 0x7300 || 0x4300 || 0x1300 || {{yes}} || 0x3 || 0x48D00 || {{yes}} || {{patchable}} || {{patchable}} ||  || Filled with FF's ?
|- {{cellcolors|#ffffcc}}
! Patch 2 !! 0xC00 !! {{No}}
| <abbr title="Encrypted">0x7400</abbr> || <abbr title="Encrypted">0x4400</abbr> || <abbr title="The patch, in decrypted format, is stored in a contiguos area in FLASH, offset 0x2000, length 0x1000>0x2400</abbr> || {{exploitable}} || {{no}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || [[Syscon_Firmware#Syscon_patches|Syscon Firmware Patch]] (bottom half) ||
|}