Line 1,228: |
Line 1,228: |
| | | |
| === Driver === | | === Driver === |
− | Same registers as in the Erista's fuse [[#Driver|driver]].
| + | {| class="wikitable" border="1" |
| + | ! Name |
| + | ! Address |
| + | |- |
| + | | [[#FUSE_FUSECTRL|FUSE_FUSECTRL]] |
| + | | 0x7000F800 |
| + | |- |
| + | | [[#FUSE_FUSEADDR|FUSE_FUSEADDR]] |
| + | | 0x7000F804 |
| + | |- |
| + | | [[#FUSE_FUSERDATA|FUSE_FUSERDATA]] |
| + | | 0x7000F808 |
| + | |- |
| + | | [[#FUSE_FUSEWDATA|FUSE_FUSEWDATA]] |
| + | | 0x7000F80C |
| + | |- |
| + | | [[#FUSE_FUSETIME_RD1|FUSE_FUSETIME_RD1]] |
| + | | 0x7000F810 |
| + | |- |
| + | | [[#FUSE_FUSETIME_RD2|FUSE_FUSETIME_RD2]] |
| + | | 0x7000F814 |
| + | |- |
| + | | [[#FUSE_FUSETIME_PGM1|FUSE_FUSETIME_PGM1]] |
| + | | 0x7000F818 |
| + | |- |
| + | | [[#FUSE_FUSETIME_PGM2|FUSE_FUSETIME_PGM2]] |
| + | | 0x7000F81C |
| + | |- |
| + | | [[#FUSE_PRIV2INTFC_START|FUSE_PRIV2INTFC_START]] |
| + | | 0x7000F820 |
| + | |- |
| + | | [[#FUSE_FUSEBYPASS|FUSE_FUSEBYPASS]] |
| + | | 0x7000F824 |
| + | |- |
| + | | [[#FUSE_PRIVATEKEYDISABLE|FUSE_PRIVATEKEYDISABLE]] |
| + | | 0x7000F828 |
| + | |- |
| + | | [[#FUSE_DISABLEREGPROGRAM|FUSE_DISABLEREGPROGRAM]] |
| + | | 0x7000F82C |
| + | |- |
| + | | [[#FUSE_WRITE_ACCESS_SW|FUSE_WRITE_ACCESS_SW]] |
| + | | 0x7000F830 |
| + | |- |
| + | | [[#FUSE_PRIV2RESHIFT|FUSE_PRIV2RESHIFT]] |
| + | | 0x7000F83C |
| + | |- |
| + | | [[#FUSE_FUSETIME_RD3|FUSE_FUSETIME_RD3]] |
| + | | 0x7000F84C |
| + | |- |
| + | | [[#FUSE_SPARE_ADDR_START|FUSE_SPARE_ADDR_START]] |
| + | | 0x7000F860 |
| + | |- |
| + | | [[#FUSE_PRIVATE_KEY0_NONZERO|FUSE_PRIVATE_KEY0_NONZERO]] |
| + | | 0x7000F880 |
| + | |- |
| + | | [[#FUSE_PRIVATE_KEY1_NONZERO|FUSE_PRIVATE_KEY1_NONZERO]] |
| + | | 0x7000F884 |
| + | |- |
| + | | [[#FUSE_PRIVATE_KEY2_NONZERO|FUSE_PRIVATE_KEY2_NONZERO]] |
| + | | 0x7000F888 |
| + | |- |
| + | | [[#FUSE_PRIVATE_KEY3_NONZERO|FUSE_PRIVATE_KEY3_NONZERO]] |
| + | | 0x7000F88C |
| + | |- |
| + | | [[#FUSE_PRIVATE_KEY4_NONZERO|FUSE_PRIVATE_KEY4_NONZERO]] |
| + | | 0x7000F890 |
| + | |} |
| + | |
| + | ==== FUSE_SPARE_ADDR_START ==== |
| + | {| class="wikitable" border="1" |
| + | ! Bits |
| + | ! Description |
| + | |- |
| + | | 0-31 |
| + | | FUSE_SPARE_ADDR_START_DATA |
| + | |} |
| + | |
| + | Returns the offset of the spare bit fuse registers (always 0x380). |
| | | |
| === Cache === | | === Cache === |
Line 1,301: |
Line 1,378: |
| | 0x7000F8EC | | | 0x7000F8EC |
| |- | | |- |
− | | | + | | FUSE_OPT_RAM_RTSEL_TSMCSP_PO4SVT |
| | 0x7000F8F0 | | | 0x7000F8F0 |
| |- | | |- |
− | | | + | | FUSE_OPT_RAM_WTSEL_TSMCSP_PO4SVT |
| | 0x7000F8F4 | | | 0x7000F8F4 |
| |- | | |- |
− | | | + | | FUSE_OPT_RAM_RTSEL_TSMCPDP_PO4SVT |
| | 0x7000F8F8 | | | 0x7000F8F8 |
| |- | | |- |
− | | | + | | FUSE_OPT_RAM_MTSEL_TSMCPDP_PO4SVT |
| | 0x7000F8FC | | | 0x7000F8FC |
| |- | | |- |
Line 1,586: |
Line 1,663: |
| | 0x7000FA68 | | | 0x7000FA68 |
| |- | | |- |
− | | | + | | FUSE_OPT_RAM_RTSEL_TSMCSP_PO4HVT |
| | 0x7000FA6C | | | 0x7000FA6C |
| |- | | |- |
− | | | + | | FUSE_OPT_RAM_WTSEL_TSMCSP_PO4HVT |
| | 0x7000FA70 | | | 0x7000FA70 |
| |- | | |- |
− | | | + | | FUSE_OPT_RAM_RTSEL_TSMCPDP_PO4HVT |
| | 0x7000FA74 | | | 0x7000FA74 |
| |- | | |- |
− | | | + | | FUSE_OPT_RAM_MTSEL_TSMCPDP_PO4HVT |
| | 0x7000FA78 | | | 0x7000FA78 |
| |- | | |- |
Line 1,628: |
Line 1,705: |
| | 0x7000FAA8 | | | 0x7000FAA8 |
| |- | | |- |
− | | | + | | FUSE_OPT_RAM_WTSEL_TSMCPDP_PO4SVT |
| | 0x7000FAB0 | | | 0x7000FAB0 |
| |- | | |- |
− | | | + | | FUSE_OPT_RAM_RCT_TSMCDP_PO4SVT |
| | 0x7000FAB4 | | | 0x7000FAB4 |
| |- | | |- |
− | | | + | | FUSE_OPT_RAM_WCT_TSMCDP_PO4SVT |
| | 0x7000FAB8 | | | 0x7000FAB8 |
| |- | | |- |
− | | | + | | FUSE_OPT_RAM_KP_TSMCDP_PO4SVT |
| | 0x7000FABC | | | 0x7000FABC |
| |- | | |- |
Line 1,706: |
Line 1,783: |
| | 0x7000FB20 | | | 0x7000FB20 |
| |- | | |- |
− | | | + | | FUSE_OPT_RAM_WTSEL_TSMCPDP_PO4HVT |
| | 0x7000FB24 | | | 0x7000FB24 |
| |- | | |- |
− | | | + | | FUSE_OPT_RAM_RCT_TSMCDP_PO4HVT |
| | 0x7000FB28 | | | 0x7000FB28 |
| |- | | |- |
− | | | + | | FUSE_OPT_RAM_WCT_TSMCDP_PO4HVT |
| | 0x7000FB2C | | | 0x7000FB2C |
| |- | | |- |
− | | | + | | FUSE_OPT_RAM_KP_TSMCDP_PO4HVT |
| | 0x7000FB30 | | | 0x7000FB30 |
| |- | | |- |
Line 2,781: |
Line 2,858: |
| | | |
| ==== IROM patch 1 ==== | | ==== IROM patch 1 ==== |
− | This patch is a bugfix. | + | This patch sets APBDEV_PMC_SCRATCH190_0 to 0x01, which LP0 resume code expects. |
− | | |
− | LP0 resume code expects APBDEV_PMC_SCRATCH190_0 to be set to 0x01, but the bootrom didn't set it. | |
| | | |
| <syntaxhighlight lang="c"> | | <syntaxhighlight lang="c"> |
Line 2,861: |
Line 2,936: |
| | | |
| ==== IROM patch 6 ==== | | ==== IROM patch 6 ==== |
− | This patch is a factory backdoor. | + | This patch allows controlling the debug authentication configuration using a fuse. |
− | | |
− | It allows controlling the debug authentication configuration using a fuse.
| |
| | | |
| <syntaxhighlight lang="c"> | | <syntaxhighlight lang="c"> |
Line 2,884: |
Line 2,957: |
| | | |
| ==== IROM patch 7 ==== | | ==== IROM patch 7 ==== |
− | This patch is a bugfix. | + | This patch prevents overflowing IRAM (0x40010000) when copying the warmboot binary from DRAM. |
− | | |
− | It prevents overflowing IRAM (0x40010000) when copying the warmboot binary from DRAM.
| |
| | | |
| <syntaxhighlight lang="c"> | | <syntaxhighlight lang="c"> |
Line 2,916: |
Line 2,987: |
| | | |
| ==== IROM patch 8 ==== | | ==== IROM patch 8 ==== |
− | This patch is a bugfix. | + | This patch sets the correct warmboot binary entrypoint address for RSA signature verification, which would be done in DRAM instead of IRAM without this patch. |
− | | |
− | It sets the correct warmboot binary entrypoint address for RSA signature verification, which would be done in DRAM instead of IRAM without this patch.
| |
| | | |
| <syntaxhighlight lang="c"> | | <syntaxhighlight lang="c"> |
Line 3,346: |
Line 3,415: |
| RAM:00000000 ; 6: 0x4103df2b 0x00108206 0x0000df2b : svc #0x2b (offset 0x9e) | | RAM:00000000 ; 6: 0x4103df2b 0x00108206 0x0000df2b : svc #0x2b (offset 0x9e) |
| RAM:00000000 ; 7: 0x495c0060 0x001092b8 0x00000060 : lsls r0, r4, #1 | | RAM:00000000 ; 7: 0x495c0060 0x001092b8 0x00000060 : lsls r0, r4, #1 |
− | RAM:00000000 ; 8: 0x62e3ef5b 0x0010c5c6 0x0000ef5b | + | RAM:00000000 ; 8: 0x62e3ef5b 0x0010c5c6 0x0000ef5b : svc #0x5b (offset 0xfe) |
| RAM:00000000 ; 9: 0x10d1df6a 0x001021a2 0x0000df6a : svc #0x6a (offset 0x11c) | | RAM:00000000 ; 9: 0x10d1df6a 0x001021a2 0x0000df6a : svc #0x6a (offset 0x11c) |
| RAM:00000004 MOV R2, LR | | RAM:00000004 MOV R2, LR |
Line 3,545: |
Line 3,614: |
| RAM:000000FE | | RAM:000000FE |
| RAM:000000FE | | RAM:000000FE |
− | RAM:000000FE sub_FE | + | RAM:000000FE sub_FE ; 8: 0x62e3ef5b 0x0010c5c6 0x0000ef5b : svc #0x5b (offset 0xfe) |
| RAM:000000FE POP {R2} | | RAM:000000FE POP {R2} |
| RAM:00000100 MOV R4, SP | | RAM:00000100 MOV R4, SP |