Difference between revisions of "eFuse"

From Rare Gaming Dump
m (Hallowizer moved page EFuse to eFuse: Case-sensitive first letter at RGD)
 
(3 intermediate revisions by 2 users not shown)
Line 1: Line 1:
 
{{DISPLAYTITLE:eFuse}}
 
{{DISPLAYTITLE:eFuse}}
  
 +
{{Template:Wikipedia|https://en.wikipedia.org/wiki/eFuse}}
 +
 +
On Nintendo consoles, '''eFuse'''s are used as irreversible data storage for keeping values which are set while the chip is being manufactured and will never be updated again. They are mostly used to store information which is sensitive and cannot be changed for security purposes.
 +
 +
==Wii==
 
<span style="background: #F1EBEB; border: 2px #CACACA solid; padding: 2px 1px 2px 4px;">
 
<span style="background: #F1EBEB; border: 2px #CACACA solid; padding: 2px 1px 2px 4px;">
 
[[File:Wii.png |30px]] This topic has a Wiibrew article. For more information, check [https://wiibrew.org/wiki/Hardware/OTP here].</span>
 
[[File:Wii.png |30px]] This topic has a Wiibrew article. For more information, check [https://wiibrew.org/wiki/Hardware/OTP here].</span>
  
−
The '''eFuses''' (also known as 'OTP' unofficially) are a region of non-volatile memory on various Nintendo systems which can only be written once. Depending on the system, this area may only be writable at the time of chip manufacturing, or it might be writable at any time but with bits only ever being flippable once (referred to as 'cutting fuses'). This is used to store various secure information such as hashes, encryption keys, and downgrade protection (on the Switch).
+
In the Wii homebrew community, the term "OTP" (one-time programmable) is usually used to refer to the console's eFuses. Official documentation & code uses the "eFuse" name.
 +
 
 +
The Wii has 128 bytes of eFuses within the [[Hollywood]] package, which all have a default value of 0. The final byte of the eFuses, which reverse engineering efforts were unable to document, has been revealed by leaked documentation to be used for toggling certain debugging features.<ref>[[emeralds.7z]]/doc/hw/chip/vegas_clocks_resets.doc - pg 44</ref>
 +
 
 +
Bits 4-7 of the final eFuse byte each have a function:
 +
 
 +
Bit 4 - when set, disables trace
  
−
==Wii==
+
Bit 5 - when set, disables debug boot (booting directly from [[EXI]] as done on the [[GameCube]], rather than through the [[IOP]])
−
The Wii stores a small amount of data here; some of it is Wii-specific (such as NAND keys), but the hash of the version of boot1 used in that Wii is also stored (making boot1 impossible to update) and the common key used in the Wii.
+
 
−
===eFuse Contents===
+
Bit 6 - when set, disables scan
−
The following things are stored inside the eFuses:
+
 
−
{| style="border: 1px solid #bbb; border-collapse: collapse; background-color: #eef; padding: 0.2em 0.2em 0.2em 0.2em;" border="1" cellpadding="2"
+
Bit 7 - when set, disables JTAG
−
|- style="background-color: #ddd;"
+
 
−
!Address
+
Retail consoles typically have everything disabled except for trace, resulting in a byte value of 0x07.
−
!Description
 
−
|-
 
−
|0-4||[[boot1]] hash
 
−
|-
 
−
|5-8||common key
 
−
|-
 
−
|9||NG ([[NNGC]]) id
 
−
|-
 
−
|a-11||NG private key
 
−
|-
 
−
|11-15||NAND HMAC (overlaps with NG private key)
 
−
|-
 
−
|16-19||NAND key
 
−
|-
 
−
|1a-1d||RNG key
 
−
|-
 
−
|1e-1f||Feature enable flags (JTAG, debug boot, etc)
 
−
|-
 
−
|}
 
  
−
=== eFuse Programming ===
+
[[boot0]] checks the integrity of boot1 by ensuring that it matches the hash stored in eFuses, but it will skip verification if the hash is blank.<ref>[[unsorted.7z]]/d1/routefree/ng/depot/sw/rvl/boot/boot0/bootc.c - loop at line 458 enables verification only if the hash is not blank</ref>
−
The Wii's eFuses are programmed via JTAG at chip manufacture time with a special power pin. Since the JTAG has a disabling flag in the eFuse region itself which is normally set on most [[Hollywood]] chips, the eFuses can never be programmed again once this flag is set and this is the case for almost all Wii units in existence (including final devkits).
 
  
−
There are known to be 3 types of Hollywood chips marked based on their eFuse configuration; 'fully programmed' (used for retail systems), 'partially programmed' (boot1 hash and possibly other things absent, used for devkits), and 'blank' (used for prototypes and possibly other internal/bringup chips). Blank chips are extremely rare and there are not known to be any in the wild; if there was such a chip, it could be used for unrestricted access to the Wii's hardware and software.
+
The Wii's eFuses are normally programmed (or "cut") during production of the Hollywood package. They cannot be programmed afterwards on most systems, as the only mechanism to do so is through the JTAG, which is locked out by the eFuses on retail consoles.<ref>[[emeralds.7z]]/052306/doc/hw/chip/vegas_datasheet.doc - pg 20</ref><ref>[[emeralds.7z]]/052306/hw/sys/jtag/jtag_bfm.v - has code to cut an eFuse at line 655</ref>
  
−
One of the features toggled in the Wii's eFuse is "debug boot", which allows for the [[Broadway]] to be booted directly from [[EXI]] (as with the GameCube) using a [[Barnacle]]. This is disabled in all known non-blank configurations.{{Template:WiiNavbox}}
+
{{Template:WiiNavbox}}
  
 
[[Category:Wii]]
 
[[Category:Wii]]
  
 
[[Category:Hardware]]
 
[[Category:Hardware]]
 +
<references />

Latest revision as of 00:16, 19 September 2021


1200px-Wikipedia-logo-v2.svg.png This topic has a Wikipedia article. For more information, check the article.

On Nintendo consoles, eFuses are used as irreversible data storage for keeping values which are set while the chip is being manufactured and will never be updated again. They are mostly used to store information which is sensitive and cannot be changed for security purposes.

Wii

Wii.png This topic has a Wiibrew article. For more information, check here.

In the Wii homebrew community, the term "OTP" (one-time programmable) is usually used to refer to the console's eFuses. Official documentation & code uses the "eFuse" name.

The Wii has 128 bytes of eFuses within the Hollywood package, which all have a default value of 0. The final byte of the eFuses, which reverse engineering efforts were unable to document, has been revealed by leaked documentation to be used for toggling certain debugging features.[1]

Bits 4-7 of the final eFuse byte each have a function:

Bit 4 - when set, disables trace

Bit 5 - when set, disables debug boot (booting directly from EXI as done on the GameCube, rather than through the IOP)

Bit 6 - when set, disables scan

Bit 7 - when set, disables JTAG

Retail consoles typically have everything disabled except for trace, resulting in a byte value of 0x07.

boot0 checks the integrity of boot1 by ensuring that it matches the hash stored in eFuses, but it will skip verification if the hash is blank.[2]

The Wii's eFuses are normally programmed (or "cut") during production of the Hollywood package. They cannot be programmed afterwards on most systems, as the only mechanism to do so is through the JTAG, which is locked out by the eFuses on retail consoles.[3][4]

  1. ↑ emeralds.7z/doc/hw/chip/vegas_clocks_resets.doc - pg 44
  2. ↑ unsorted.7z/d1/routefree/ng/depot/sw/rvl/boot/boot0/bootc.c - loop at line 458 enables verification only if the hash is not blank
  3. ↑ emeralds.7z/052306/doc/hw/chip/vegas_datasheet.doc - pg 20
  4. ↑ emeralds.7z/052306/hw/sys/jtag/jtag_bfm.v - has code to cut an eFuse at line 655
Retrieved from "https://wiki.raregamingdump.ca/index.php?title=eFuse&oldid=4457"