2,800
edits
Changes
Jump to navigation
Jump to search
Line 1,228:
Line 1,228: − Same registers as in the Erista's fuse [[#Driver|driver]].+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Line 1,301:
Line 1,378: − + − + − + − + Line 1,586:
Line 1,663: − + − + − + − + Line 1,628:
Line 1,705: − + − + − + − + Line 1,706:
Line 1,783: − + − + − + − + Line 2,781:
Line 2,858: − + − − Line 2,861:
Line 2,936: − + − − It allows controlling the debug authentication configuration using a fuse. Line 2,884:
Line 2,957: − + − − It prevents overflowing IRAM (0x40010000) when copying the warmboot binary from DRAM. Line 2,916:
Line 2,987: − + − − It sets the correct warmboot binary entrypoint address for RSA signature verification, which would be done in DRAM instead of IRAM without this patch. Line 3,346:
Line 3,415: − + Line 3,545:
Line 3,614: − +
→irom_patch
=== Driver ===
=== Driver ===
{| class="wikitable" border="1"
! Name
! Address
|-
| [[#FUSE_FUSECTRL|FUSE_FUSECTRL]]
| 0x7000F800
|-
| [[#FUSE_FUSEADDR|FUSE_FUSEADDR]]
| 0x7000F804
|-
| [[#FUSE_FUSERDATA|FUSE_FUSERDATA]]
| 0x7000F808
|-
| [[#FUSE_FUSEWDATA|FUSE_FUSEWDATA]]
| 0x7000F80C
|-
| [[#FUSE_FUSETIME_RD1|FUSE_FUSETIME_RD1]]
| 0x7000F810
|-
| [[#FUSE_FUSETIME_RD2|FUSE_FUSETIME_RD2]]
| 0x7000F814
|-
| [[#FUSE_FUSETIME_PGM1|FUSE_FUSETIME_PGM1]]
| 0x7000F818
|-
| [[#FUSE_FUSETIME_PGM2|FUSE_FUSETIME_PGM2]]
| 0x7000F81C
|-
| [[#FUSE_PRIV2INTFC_START|FUSE_PRIV2INTFC_START]]
| 0x7000F820
|-
| [[#FUSE_FUSEBYPASS|FUSE_FUSEBYPASS]]
| 0x7000F824
|-
| [[#FUSE_PRIVATEKEYDISABLE|FUSE_PRIVATEKEYDISABLE]]
| 0x7000F828
|-
| [[#FUSE_DISABLEREGPROGRAM|FUSE_DISABLEREGPROGRAM]]
| 0x7000F82C
|-
| [[#FUSE_WRITE_ACCESS_SW|FUSE_WRITE_ACCESS_SW]]
| 0x7000F830
|-
| [[#FUSE_PRIV2RESHIFT|FUSE_PRIV2RESHIFT]]
| 0x7000F83C
|-
| [[#FUSE_FUSETIME_RD3|FUSE_FUSETIME_RD3]]
| 0x7000F84C
|-
| [[#FUSE_SPARE_ADDR_START|FUSE_SPARE_ADDR_START]]
| 0x7000F860
|-
| [[#FUSE_PRIVATE_KEY0_NONZERO|FUSE_PRIVATE_KEY0_NONZERO]]
| 0x7000F880
|-
| [[#FUSE_PRIVATE_KEY1_NONZERO|FUSE_PRIVATE_KEY1_NONZERO]]
| 0x7000F884
|-
| [[#FUSE_PRIVATE_KEY2_NONZERO|FUSE_PRIVATE_KEY2_NONZERO]]
| 0x7000F888
|-
| [[#FUSE_PRIVATE_KEY3_NONZERO|FUSE_PRIVATE_KEY3_NONZERO]]
| 0x7000F88C
|-
| [[#FUSE_PRIVATE_KEY4_NONZERO|FUSE_PRIVATE_KEY4_NONZERO]]
| 0x7000F890
|}
==== FUSE_SPARE_ADDR_START ====
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| FUSE_SPARE_ADDR_START_DATA
|}
Returns the offset of the spare bit fuse registers (always 0x380).
=== Cache ===
=== Cache ===
| 0x7000F8EC
| 0x7000F8EC
|-
|-
|
| FUSE_OPT_RAM_RTSEL_TSMCSP_PO4SVT
| 0x7000F8F0
| 0x7000F8F0
|-
|-
|
| FUSE_OPT_RAM_WTSEL_TSMCSP_PO4SVT
| 0x7000F8F4
| 0x7000F8F4
|-
|-
|
| FUSE_OPT_RAM_RTSEL_TSMCPDP_PO4SVT
| 0x7000F8F8
| 0x7000F8F8
|-
|-
|
| FUSE_OPT_RAM_MTSEL_TSMCPDP_PO4SVT
| 0x7000F8FC
| 0x7000F8FC
|-
|-
| 0x7000FA68
| 0x7000FA68
|-
|-
|
| FUSE_OPT_RAM_RTSEL_TSMCSP_PO4HVT
| 0x7000FA6C
| 0x7000FA6C
|-
|-
|
| FUSE_OPT_RAM_WTSEL_TSMCSP_PO4HVT
| 0x7000FA70
| 0x7000FA70
|-
|-
|
| FUSE_OPT_RAM_RTSEL_TSMCPDP_PO4HVT
| 0x7000FA74
| 0x7000FA74
|-
|-
|
| FUSE_OPT_RAM_MTSEL_TSMCPDP_PO4HVT
| 0x7000FA78
| 0x7000FA78
|-
|-
| 0x7000FAA8
| 0x7000FAA8
|-
|-
|
| FUSE_OPT_RAM_WTSEL_TSMCPDP_PO4SVT
| 0x7000FAB0
| 0x7000FAB0
|-
|-
|
| FUSE_OPT_RAM_RCT_TSMCDP_PO4SVT
| 0x7000FAB4
| 0x7000FAB4
|-
|-
|
| FUSE_OPT_RAM_WCT_TSMCDP_PO4SVT
| 0x7000FAB8
| 0x7000FAB8
|-
|-
|
| FUSE_OPT_RAM_KP_TSMCDP_PO4SVT
| 0x7000FABC
| 0x7000FABC
|-
|-
| 0x7000FB20
| 0x7000FB20
|-
|-
|
| FUSE_OPT_RAM_WTSEL_TSMCPDP_PO4HVT
| 0x7000FB24
| 0x7000FB24
|-
|-
|
| FUSE_OPT_RAM_RCT_TSMCDP_PO4HVT
| 0x7000FB28
| 0x7000FB28
|-
|-
|
| FUSE_OPT_RAM_WCT_TSMCDP_PO4HVT
| 0x7000FB2C
| 0x7000FB2C
|-
|-
|
| FUSE_OPT_RAM_KP_TSMCDP_PO4HVT
| 0x7000FB30
| 0x7000FB30
|-
|-
==== IROM patch 1 ====
==== IROM patch 1 ====
This patch is a bugfix.
This patch sets APBDEV_PMC_SCRATCH190_0 to 0x01, which LP0 resume code expects.
LP0 resume code expects APBDEV_PMC_SCRATCH190_0 to be set to 0x01, but the bootrom didn't set it.
<syntaxhighlight lang="c">
<syntaxhighlight lang="c">
==== IROM patch 6 ====
==== IROM patch 6 ====
This patch is a factory backdoor.
This patch allows controlling the debug authentication configuration using a fuse.
<syntaxhighlight lang="c">
<syntaxhighlight lang="c">
==== IROM patch 7 ====
==== IROM patch 7 ====
This patch is a bugfix.
This patch prevents overflowing IRAM (0x40010000) when copying the warmboot binary from DRAM.
<syntaxhighlight lang="c">
<syntaxhighlight lang="c">
==== IROM patch 8 ====
==== IROM patch 8 ====
This patch is a bugfix.
This patch sets the correct warmboot binary entrypoint address for RSA signature verification, which would be done in DRAM instead of IRAM without this patch.
<syntaxhighlight lang="c">
<syntaxhighlight lang="c">
RAM:00000000 ; 6: 0x4103df2b 0x00108206 0x0000df2b : svc #0x2b (offset 0x9e)
RAM:00000000 ; 6: 0x4103df2b 0x00108206 0x0000df2b : svc #0x2b (offset 0x9e)
RAM:00000000 ; 7: 0x495c0060 0x001092b8 0x00000060 : lsls r0, r4, #1
RAM:00000000 ; 7: 0x495c0060 0x001092b8 0x00000060 : lsls r0, r4, #1
RAM:00000000 ; 8: 0x62e3ef5b 0x0010c5c6 0x0000ef5b
RAM:00000000 ; 8: 0x62e3ef5b 0x0010c5c6 0x0000ef5b : svc #0x5b (offset 0xfe)
RAM:00000000 ; 9: 0x10d1df6a 0x001021a2 0x0000df6a : svc #0x6a (offset 0x11c)
RAM:00000000 ; 9: 0x10d1df6a 0x001021a2 0x0000df6a : svc #0x6a (offset 0x11c)
RAM:00000004 MOV R2, LR
RAM:00000004 MOV R2, LR
RAM:000000FE
RAM:000000FE
RAM:000000FE
RAM:000000FE
RAM:000000FE sub_FE
RAM:000000FE sub_FE ; 8: 0x62e3ef5b 0x0010c5c6 0x0000ef5b : svc #0x5b (offset 0xfe)
RAM:000000FE POP {R2}
RAM:000000FE POP {R2}
RAM:00000100 MOV R4, SP
RAM:00000100 MOV R4, SP