Nintendo Switch Brew

Fuses: Difference between revisions

← Older editNewer edit →
(2 intermediate revisions by the same user not shown)
Line 1,228: Line 1,228:


=== Driver ===
=== Driver ===
Same registers as in the Erista's fuse [[#Driver|driver]].
{| class="wikitable" border="1"
!  Name
!  Address
|-
| [[#FUSE_FUSECTRL|FUSE_FUSECTRL]]
| 0x7000F800
|-
| [[#FUSE_FUSEADDR|FUSE_FUSEADDR]]
| 0x7000F804
|-
| [[#FUSE_FUSERDATA|FUSE_FUSERDATA]]
| 0x7000F808
|-
| [[#FUSE_FUSEWDATA|FUSE_FUSEWDATA]]
| 0x7000F80C
|-
| [[#FUSE_FUSETIME_RD1|FUSE_FUSETIME_RD1]]
| 0x7000F810
|-
| [[#FUSE_FUSETIME_RD2|FUSE_FUSETIME_RD2]]
| 0x7000F814
|-
| [[#FUSE_FUSETIME_PGM1|FUSE_FUSETIME_PGM1]]
| 0x7000F818
|-
| [[#FUSE_FUSETIME_PGM2|FUSE_FUSETIME_PGM2]]
| 0x7000F81C
|-
| [[#FUSE_PRIV2INTFC_START|FUSE_PRIV2INTFC_START]]
| 0x7000F820
|-
| [[#FUSE_FUSEBYPASS|FUSE_FUSEBYPASS]]
| 0x7000F824
|-
| [[#FUSE_PRIVATEKEYDISABLE|FUSE_PRIVATEKEYDISABLE]]
| 0x7000F828
|-
| [[#FUSE_DISABLEREGPROGRAM|FUSE_DISABLEREGPROGRAM]]
| 0x7000F82C
|-
| [[#FUSE_WRITE_ACCESS_SW|FUSE_WRITE_ACCESS_SW]]
| 0x7000F830
|-
| [[#FUSE_PRIV2RESHIFT|FUSE_PRIV2RESHIFT]]
| 0x7000F83C
|-
| [[#FUSE_FUSETIME_RD3|FUSE_FUSETIME_RD3]]
| 0x7000F84C
|-
| [[#FUSE_SPARE_ADDR_START|FUSE_SPARE_ADDR_START]]
| 0x7000F860
|-
| [[#FUSE_PRIVATE_KEY0_NONZERO|FUSE_PRIVATE_KEY0_NONZERO]]
| 0x7000F880
|-
| [[#FUSE_PRIVATE_KEY1_NONZERO|FUSE_PRIVATE_KEY1_NONZERO]]
| 0x7000F884
|-
| [[#FUSE_PRIVATE_KEY2_NONZERO|FUSE_PRIVATE_KEY2_NONZERO]]
| 0x7000F888
|-
| [[#FUSE_PRIVATE_KEY3_NONZERO|FUSE_PRIVATE_KEY3_NONZERO]]
| 0x7000F88C
|-
| [[#FUSE_PRIVATE_KEY4_NONZERO|FUSE_PRIVATE_KEY4_NONZERO]]
| 0x7000F890
|}
 
==== FUSE_SPARE_ADDR_START ====
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-31
| FUSE_SPARE_ADDR_START_DATA
|}
 
Returns the offset of the spare bit fuse registers (always 0x380).


=== Cache ===
=== Cache ===
Line 1,301: Line 1,378:
| 0x7000F8EC
| 0x7000F8EC
|-
|-
|  
| FUSE_OPT_RAM_RTSEL_TSMCSP_PO4SVT
| 0x7000F8F0
| 0x7000F8F0
|-
|-
|  
| FUSE_OPT_RAM_WTSEL_TSMCSP_PO4SVT
| 0x7000F8F4
| 0x7000F8F4
|-
|-
|  
| FUSE_OPT_RAM_RTSEL_TSMCPDP_PO4SVT
| 0x7000F8F8
| 0x7000F8F8
|-
|-
|  
| FUSE_OPT_RAM_MTSEL_TSMCPDP_PO4SVT
| 0x7000F8FC
| 0x7000F8FC
|-
|-
Line 1,586: Line 1,663:
| 0x7000FA68
| 0x7000FA68
|-
|-
|  
| FUSE_OPT_RAM_RTSEL_TSMCSP_PO4HVT
| 0x7000FA6C
| 0x7000FA6C
|-
|-
|  
| FUSE_OPT_RAM_WTSEL_TSMCSP_PO4HVT
| 0x7000FA70
| 0x7000FA70
|-
|-
|  
| FUSE_OPT_RAM_RTSEL_TSMCPDP_PO4HVT
| 0x7000FA74
| 0x7000FA74
|-
|-
|  
| FUSE_OPT_RAM_MTSEL_TSMCPDP_PO4HVT
| 0x7000FA78
| 0x7000FA78
|-
|-
Line 1,628: Line 1,705:
| 0x7000FAA8
| 0x7000FAA8
|-
|-
|  
| FUSE_OPT_RAM_WTSEL_TSMCPDP_PO4SVT
| 0x7000FAB0
| 0x7000FAB0
|-
|-
|  
| FUSE_OPT_RAM_RCT_TSMCDP_PO4SVT
| 0x7000FAB4
| 0x7000FAB4
|-
|-
|  
| FUSE_OPT_RAM_WCT_TSMCDP_PO4SVT
| 0x7000FAB8
| 0x7000FAB8
|-
|-
|  
| FUSE_OPT_RAM_KP_TSMCDP_PO4SVT
| 0x7000FABC
| 0x7000FABC
|-
|-
Line 1,706: Line 1,783:
| 0x7000FB20
| 0x7000FB20
|-
|-
|  
| FUSE_OPT_RAM_WTSEL_TSMCPDP_PO4HVT
| 0x7000FB24
| 0x7000FB24
|-
|-
|  
| FUSE_OPT_RAM_RCT_TSMCDP_PO4HVT
| 0x7000FB28
| 0x7000FB28
|-
|-
|  
| FUSE_OPT_RAM_WCT_TSMCDP_PO4HVT
| 0x7000FB2C
| 0x7000FB2C
|-
|-
|  
| FUSE_OPT_RAM_KP_TSMCDP_PO4HVT
| 0x7000FB30
| 0x7000FB30
|-
|-
Line 2,781: Line 2,858:


==== IROM patch 1 ====
==== IROM patch 1 ====
This patch is a bugfix.
This patch sets APBDEV_PMC_SCRATCH190_0 to 0x01, which LP0 resume code expects.
 
LP0 resume code expects APBDEV_PMC_SCRATCH190_0 to be set to 0x01, but the bootrom didn't set it.


<syntaxhighlight lang="c">
<syntaxhighlight lang="c">
Line 2,861: Line 2,936:


==== IROM patch 6 ====
==== IROM patch 6 ====
This patch is a factory backdoor.
This patch allows controlling the debug authentication configuration using a fuse.
 
It allows controlling the debug authentication configuration using a fuse.


<syntaxhighlight lang="c">
<syntaxhighlight lang="c">
Line 2,884: Line 2,957:


==== IROM patch 7 ====
==== IROM patch 7 ====
This patch is a bugfix.
This patch prevents overflowing IRAM (0x40010000) when copying the warmboot binary from DRAM.
 
It prevents overflowing IRAM (0x40010000) when copying the warmboot binary from DRAM.


<syntaxhighlight lang="c">
<syntaxhighlight lang="c">
Line 2,916: Line 2,987:


==== IROM patch 8 ====
==== IROM patch 8 ====
This patch is a bugfix.
This patch sets the correct warmboot binary entrypoint address for RSA signature verification, which would be done in DRAM instead of IRAM without this patch.
 
It sets the correct warmboot binary entrypoint address for RSA signature verification, which would be done in DRAM instead of IRAM without this patch.


<syntaxhighlight lang="c">
<syntaxhighlight lang="c">
Line 3,346: Line 3,415:
RAM:00000000                                        ;  6: 0x4103df2b 0x00108206 0x0000df2b : svc #0x2b (offset 0x9e)
RAM:00000000                                        ;  6: 0x4103df2b 0x00108206 0x0000df2b : svc #0x2b (offset 0x9e)
RAM:00000000                                        ;  7: 0x495c0060 0x001092b8 0x00000060 : lsls r0, r4, #1
RAM:00000000                                        ;  7: 0x495c0060 0x001092b8 0x00000060 : lsls r0, r4, #1
RAM:00000000                                        ;  8: 0x62e3ef5b 0x0010c5c6 0x0000ef5b
RAM:00000000                                        ;  8: 0x62e3ef5b 0x0010c5c6 0x0000ef5b : svc #0x5b (offset 0xfe)
RAM:00000000                                        ;  9: 0x10d1df6a 0x001021a2 0x0000df6a : svc #0x6a (offset 0x11c)
RAM:00000000                                        ;  9: 0x10d1df6a 0x001021a2 0x0000df6a : svc #0x6a (offset 0x11c)
RAM:00000004  MOV    R2, LR
RAM:00000004  MOV    R2, LR
Line 3,545: Line 3,614:
RAM:000000FE
RAM:000000FE
RAM:000000FE
RAM:000000FE
RAM:000000FE sub_FE
RAM:000000FE sub_FE                                 ;  8: 0x62e3ef5b 0x0010c5c6 0x0000ef5b : svc #0x5b (offset 0xfe)
RAM:000000FE  POP    {R2}
RAM:000000FE  POP    {R2}
RAM:00000100  MOV    R4, SP
RAM:00000100  MOV    R4, SP
Retrieved from "https://switchbrew.org/wiki/Fuses"