Switch 2: Tegra T239 - Revision history

Yellows8: Moved to page Security_Mitigations.

2025-11-03T01:18:01Z

Moved to page Security_Mitigations.

← Older revision		Revision as of 04:18, 3 November 2025
Line 36:		Line 36:

	There is no memory authentication, however. So in the event of external memory tampering, the CPU will read back garbled plaintext (effectively, random bytes). Although, it should in principle be possible to "replay" earlier values from a particular address.		There is no memory authentication, however. So in the event of external memory tampering, the CPU will read back garbled plaintext (effectively, random bytes). Although, it should in principle be possible to "replay" earlier values from a particular address.

	~~=== XOM (eXecute-Only-Memory) ===~~
	~~The hardware supports XOM.~~

	~~Sysmodules have --X .text, at least as of system-version 20.x.~~

	~~=== CFI (Control-Flow-Integrity) ===~~
	~~Besides the CFI used by [[Internet_Browser\|web-applets]], sysmodules seem to use a version of CFI which validate vtable-ptrs (the value of the ptr, without accessing the data located there).~~

Yellows8: /* XOM (eXecute-Only-Memory) */

2025-11-01T22:41:14Z

XOM (eXecute-Only-Memory)

← Older revision		Revision as of 01:41, 2 November 2025
Line 40:		Line 40:
	The hardware supports XOM.		The hardware supports XOM.

	Sysmodules ~~appear to~~ have --X .text.		Sysmodules have --X .text, at least as of system-version 20.x.

	=== CFI (Control-Flow-Integrity) ===		=== CFI (Control-Flow-Integrity) ===
	Besides the CFI used by [[Internet_Browser\|web-applets]], sysmodules seem to use a version of CFI which validate vtable-ptrs (the value of the ptr, without accessing the data located there).		Besides the CFI used by [[Internet_Browser\|web-applets]], sysmodules seem to use a version of CFI which validate vtable-ptrs (the value of the ptr, without accessing the data located there).

Yellows8: /* XOM (eXecute-Only-Memory) */

2025-10-20T21:24:32Z

XOM (eXecute-Only-Memory)

← Older revision		Revision as of 01:24, 21 October 2025
Line 40:		Line 40:
	The hardware supports XOM.		The hardware supports XOM.

	Sysmodules appear to have ~~this [[NPDM\|enabled]]~~.		Sysmodules appear to have --X .text.

	=== CFI (Control-Flow-Integrity) ===		=== CFI (Control-Flow-Integrity) ===
	Besides the CFI used by [[Internet_Browser\|web-applets]], sysmodules seem to use a version of CFI which validate vtable-ptrs (the value of the ptr, without accessing the data located there).		Besides the CFI used by [[Internet_Browser\|web-applets]], sysmodules seem to use a version of CFI which validate vtable-ptrs (the value of the ptr, without accessing the data located there).

Yellows8: /* Notable Security Features */

2025-10-20T14:43:35Z

Notable Security Features

← Older revision		Revision as of 18:43, 20 October 2025
Line 38:		Line 38:

	=== XOM (eXecute-Only-Memory) ===		=== XOM (eXecute-Only-Memory) ===
	~~At present it is unknown if/where~~ XOM is used, ~~but~~ the ~~hardware does support it~~.		The hardware supports XOM.

			Sysmodules appear to have this [[NPDM\|enabled]].

			=== CFI (Control-Flow-Integrity) ===
			Besides the CFI used by [[Internet_Browser\|web-applets]], sysmodules seem to use a version of CFI which validate vtable-ptrs (the value of the ptr, without accessing the data located there).

Ootulp: Created page with "The NVIDIA T239 is a custom SoC designed to Nintendo's specifications. It has many aspects in common with the T234 SoC found in NVIDIA Orin products. == Specifications == {| class="wikitable" |+ !Component !Description |- |CPU |Eight 64-bit ARM Cortex [https://developer.arm.com/Processors/Cortex-A78C A78C] cores |- |Cache |4 MB Shared L3 Cache, 256KB L2 Cache per core, 64KB/64KB (I/D) L1 Cache per core |- |Memory Bus |LPDDR5X-3200, 128-bit (102 GB/s) |- |Memory Size |12..."

2025-08-07T00:33:32Z

Created page with "The NVIDIA T239 is a custom SoC designed to Nintendo's specifications. It has many aspects in common with the T234 SoC found in NVIDIA Orin products. == Specifications == {| class="wikitable" |+ !Component !Description |- |CPU |Eight 64-bit ARM Cortex [https://developer.arm.com/Processors/Cortex-A78C A78C] cores |- |Cache |4 MB Shared L3 Cache, 256KB L2 Cache per core, 64KB/64KB (I/D) L1 Cache per core |- |Memory Bus |LPDDR5X-3200, 128-bit (102 GB/s) |- |Memory Size |12..."

New page

The NVIDIA T239 is a custom SoC designed to Nintendo's specifications. It has many aspects in common with the T234 SoC found in NVIDIA Orin products.

== Specifications ==
{| class="wikitable"
|+
!Component
!Description
|-
|CPU
|Eight 64-bit ARM Cortex [https://developer.arm.com/Processors/Cortex-A78C A78C] cores
|-
|Cache
|4 MB Shared L3 Cache, 256KB L2 Cache per core, 64KB/64KB (I/D) L1 Cache per core
|-
|Memory Bus
|LPDDR5X-3200, 128-bit (102 GB/s)
|-
|Memory Size
|12GB (2x 6GB)
|-
|GPU
|1536-core Ampere GPU
|}

== Notable Security Features ==

=== PAC ===
A78C supports Armv8.3-A Pointer Authentication and Armv8.6-A Enhanced Pointer Authentication instructions.

=== Memory Encryption ===
The T239 appears to support [https://docs.nvidia.com/jetson/archives/r35.4.1/DeveloperGuide/text/SD/Security/MemoryEncryption.html memory encryption], similar to the T234.

Memory within certain carveout regions is encrypted. The memory controller transparently encrypts data during writes and decrypts data during reads. For these regions, an attacker sniffing the external memory bus will see only ciphertext. Application memory is not encrypted, presumably for performance reasons, since encryption incurs a latency cost.

It is likely that encryption is tweaked on a per-physical-address basis. So, an attacker with control of the external memory bus cannot e.g. relocate data from one address to another.

There is no memory authentication, however. So in the event of external memory tampering, the CPU will read back garbled plaintext (effectively, random bytes). Although, it should in principle be possible to "replay" earlier values from a particular address.

=== XOM (eXecute-Only-Memory) ===
At present it is unknown if/where XOM is used, but the hardware does support it.