Switch 2: Fuses: Difference between revisions
No edit summary |
No edit summary |
||
| (5 intermediate revisions by the same user not shown) | |||
| Line 3: | Line 3: | ||
The fuse layout can be found by reverse engineering fskp_t234.bin from the Linux4Tegra package. | The fuse layout can be found by reverse engineering fskp_t234.bin from the Linux4Tegra package. | ||
= Physical Layout = | |||
== Fuse words == | |||
Fuses are laid out in 32-bit words. | |||
{| class="wikitable" border="1" | {| class="wikitable" border="1" | ||
|- | |- | ||
! Fuse Word || Bits || Value | ! Fuse Word || Bits || Value | ||
|- | |- | ||
| | | style="background: yellow" | | ||
| | | style="background: yellow" | | ||
| | | style="background: yellow" | [[#Shadowed Fuses]] Begin | ||
|- | |- | ||
| 0 || | | 0 || 5..8 || [[#OdmLock]] | ||
|- | |- | ||
| 0 || | | 0 || 9 || [[#Fa]] | ||
|- | |- | ||
| 0 || | | 0 || 10 || [[#SecurityMode]] | ||
|- | |- | ||
| | | 0 || 11 || [[#ArmJtagDisable]] | ||
|- | |- | ||
| | | 0 || 12 || [[#NvJtagProtectionEnable]] | ||
|- | |- | ||
| | | 0 || 16..20 || [[#DebugAuthentication]] | ||
|- | |- | ||
| | | 0 || 28 || ZeroizeDis | ||
|- | |- | ||
| 2 || 2..31 || ReservedOdm0[0..29] | | 2 || 2..31 || ReservedOdm0[0..29] | ||
|- | |- | ||
| 4 || 0..1 || ReservedOdm0[30..31] | | 4 || 0..1 || ReservedOdm0[30..31] | ||
|- | |- | ||
| 4 || 2..31 || ReservedOdm1[0..29] | | 4 || 2..31 || ReservedOdm1[0..29] | ||
|- | |- | ||
| 6 || 0..1 || ReservedOdm1[30..31] | | 6 || 0..1 || ReservedOdm1[30..31] | ||
|- | |- | ||
| 6 || 2..31 || ReservedOdm2[0..29] | | 6 || 2..31 || ReservedOdm2[0..29] | ||
|- | |- | ||
| 8 || 0..1 || ReservedOdm2[30..31] | | 8 || 0..1 || ReservedOdm2[30..31] | ||
|- | |- | ||
| 8 || 2..31 || ReservedOdm3[0..29] | | 8 || 2..31 || ReservedOdm3[0..29] | ||
|- | |- | ||
| 10 || 0..1 || ReservedOdm3[30..31] | | 10 || 0..1 || ReservedOdm3[30..31] | ||
|- | |- | ||
| 10 || 2..31 || ReservedOdm4[0..29] | | 10 || 2..31 || ReservedOdm4[0..29] | ||
|- | |- | ||
| 12 || 0..1 || ReservedOdm4[30..31] | | 12 || 0..1 || ReservedOdm4[30..31] | ||
|- | |- | ||
| 12 || 2..31 || ReservedOdm5[0..29] | | 12 || 2..31 || ReservedOdm5[0..29] | ||
|- | |- | ||
| 14 || 0..1 || ReservedOdm5[30..31] | | 14 || 0..1 || ReservedOdm5[30..31] | ||
|- | |- | ||
| 14 || 2..31 || ReservedOdm6[0..29] | | 14 || 2..31 || ReservedOdm6[0..29] | ||
|- | |- | ||
| 16 || 0..1 || ReservedOdm6[30..31] | | 16 || 0..1 || ReservedOdm6[30..31] | ||
|- | |- | ||
| 16 || 2..31 || ReservedOdm7[0..29] | | 16 || 2..31 || ReservedOdm7[0..29] | ||
|- | |- | ||
| 18 || 0..1 || ReservedOdm7[30..31] | | 18 || 0..1 || ReservedOdm7[30..31] | ||
| Line 94: | Line 66: | ||
| 18 || 12..31 || HyperVoltaging[0..19] | | 18 || 12..31 || HyperVoltaging[0..19] | ||
|- | |- | ||
| | | 18 || 2 || ObsDis | ||
|- | |- | ||
| 20 || 0..11 || HyperVoltaging[20..31] | | 20 || 0..11 || HyperVoltaging[20..31] | ||
|- | |- | ||
| | | 24 || 1 || ForceDbgWithTestKeys | ||
|- | |- | ||
| 24 || 2..31 || SysFwRatchet0[0..29] | | 24 || 2..31 || SysFwRatchet0[0..29] | ||
|- | |- | ||
| 26 || 0..1 || SysFwRatchet0[30..31] | | 26 || 0..1 || SysFwRatchet0[30..31] | ||
|- | |- | ||
| 26 || 2..31 || SysFwRatchet1[0..29] | | 26 || 2..31 || SysFwRatchet1[0..29] | ||
|- | |- | ||
| 28 || 0..1 || SysFwRatchet1[30..31] | | 28 || 0..1 || SysFwRatchet1[30..31] | ||
|- | |- | ||
| 28 || 2..31 || SysFwRatchet2[0..29] | | 28 || 2..31 || SysFwRatchet2[0..29] | ||
|- | |- | ||
| 30 || 0..1 || SysFwRatchet2[30..31] | | 30 || 0..1 || SysFwRatchet2[30..31] | ||
|- | |- | ||
| 30 || 2..31 || SysFwRatchet3[0..29] (Shadow) | | 30 || 2..31 || SysFwRatchet3[0..29] (Shadow) | ||
|- | |- | ||
| 32 || 0..1 || SysFwRatchet3[30..31] | | 32 || 0..1 || SysFwRatchet3[30..31] | ||
|- | |- | ||
| 32 || 2..31 || CcplexUcodeFieldRatchet[0..29] | | 32 || 2..31 || CcplexUcodeFieldRatchet[0..29] | ||
|- | |- | ||
| 34 || 0..1 || CcplexUcodeFieldRatchet[30..31] | | 34 || 0..1 || CcplexUcodeFieldRatchet[30..31] | ||
|- | |- | ||
| 34 || 2..31 || Mb1FieldRatchet[0..29] | | 34 || 2..31 || Mb1FieldRatchet[0..29] | ||
|- | |- | ||
| 36 || 0..1 || Mb1FieldRatchet[30..31] | | 36 || 0..1 || Mb1FieldRatchet[30..31] | ||
|- | |- | ||
| 36 || | | 36 || 4 || IntegrityCheckEnable | ||
|- | |- | ||
| | | 36 || 5 || Usb2NvJtagDisable | ||
|- | |- | ||
| | | 36 || 6 || OptIstDisableDebug | ||
|- | |- | ||
| 36 || 21 || SecurityModeReduntant | | 36 || 21 || SecurityModeReduntant | ||
|- | |- | ||
| | | 36 || 22..23 || DebugAuthentication[5..6] | ||
|- | |- | ||
| 36 | | 36 || 24 || ForceDbgWithTestKeys | ||
|- | |- | ||
| 36 | | 36 || 25 || FaRedundant | ||
|- | |- | ||
| 36 | | 36 || 26 || ForceDbgWithTestKeysDuringPscDbg | ||
|- | |- | ||
| 36 | | 36 || 27 || ForceDbgWithTestKeysDuringPscDbg | ||
|- | |- | ||
| 36 | | 36 || 28 || CcplexDfdAccessDisable | ||
|- | |- | ||
| 46 || 1 || EnableCrJtagSecurity | | 46 || 1 || EnableCrJtagSecurity | ||
| Line 194: | Line 122: | ||
| 46 || 7..22 || BctFieldRatchet[0..15] | | 46 || 7..22 || BctFieldRatchet[0..15] | ||
|- | |- | ||
| | | 46 || 23 || RevokePkH0 | ||
|- | |- | ||
| | | 46 || 24 || RevokePkH1 | ||
|- | |- | ||
| 72 || 14..31 || PscBlFieldRatchet[0..17] | | 72 || 14..31 || PscBlFieldRatchet[0..17] | ||
|- | |- | ||
| 74 || 0..13 || PscBlFieldRatchet[18..31] | | 74 || 0..13 || PscBlFieldRatchet[18..31] | ||
|- | |- | ||
| 74 || 30..31 || RomFeatureDisable[0..1] | | 74 || 30..31 || RomFeatureDisable[0..1] | ||
|- | |- | ||
| 76 || 0..13 || RomFeatureDisable[18..31] | | 76 || 0..13 || RomFeatureDisable[18..31] | ||
| Line 218: | Line 138: | ||
| 76 || 20..25 || FsiDebugAuthentication[0..5] | | 76 || 20..25 || FsiDebugAuthentication[0..5] | ||
|- | |- | ||
| | | style="background: yellow" | | ||
| | | style="background: yellow" | | ||
| | | style="background: yellow" | [[#Shadowed Fuses]] End | ||
|- | |- | ||
| 84 || 32 || Sku | | 84 || 32 || Sku | ||
| Line 249: | Line 167: | ||
|- | |- | ||
| 170 || 14..20 || PscBlNvRevision[0..6] | | | 170 || 14..20 || PscBlNvRevision[0..6] | | ||
|- | |||
| style="background: yellow" | | |||
| style="background: yellow" | | |||
| style="background: yellow" | [[#H2]] CRC32 Begin | |||
|- | |- | ||
| 188 || 21..31 || PublicKeyHash[0][0..10] | | 188 || 21..31 || PublicKeyHash[0][0..10] | ||
| Line 307: | Line 229: | ||
|- | |- | ||
| 202 || 0..1 || OdmId[1][30..31] | | 202 || 0..1 || OdmId[1][30..31] | ||
|- | |||
| 202 || 7 || OptInEnable | |||
|- | |- | ||
| 202 || 8..31 || PublicKeyHash[8][0..23] | | 202 || 8..31 || PublicKeyHash[8][0..23] | ||
| Line 403: | Line 327: | ||
|- | |- | ||
| 226 || 0..7 || EvitaCsk[224..255] | | 226 || 0..7 || EvitaCsk[224..255] | ||
|- | |||
| 226 || 8..23 || SecuritySwOdm[0..15] | |||
|- | |- | ||
| 226 || 24 || OemFuseEncShadow | | 226 || 24 || OemFuseEncShadow | ||
|- | |||
| 242 || 25..31 || PkcPubkeyHash1[0..6] | |||
|- | |||
| 242 || 0..24 || PkcPubkeyHash1[7..31] | |||
|- | |||
| 243 || 25..31 || PkcPubkeyHash1[0..6] | |||
|- | |||
| 243 || 0..24 || PkcPubkeyHash1[7..31] | |||
|- | |||
| 244 || 25..31 || PkcPubkeyHash1[0..6] | |||
|- | |||
| 244 || 0..24 || PkcPubkeyHash1[7..31] | |||
|- | |||
| 245 || 25..31 || PkcPubkeyHash1[0..6] | |||
|- | |||
| 245 || 0..24 || PkcPubkeyHash1[7..31] | |||
|- | |||
| 246 || 25..31 || PkcPubkeyHash1[0..6] | |||
|- | |||
| 246 || 0..24 || PkcPubkeyHash1[7..31] | |||
|- | |||
| 247 || 25..31 || PkcPubkeyHash1[0..6] | |||
|- | |||
| 247 || 0..24 || PkcPubkeyHash1[7..31] | |||
|- | |||
| 248 || 25..31 || PkcPubkeyHash1[0..6] | |||
|- | |||
| 248 || 0..24 || PkcPubkeyHash1[7..31] | |||
|- | |||
| 249 || 25..31 || PkcPubkeyHash1[0..6] | |||
|- | |||
| 249 || 0..24 || PkcPubkeyHash1[7..31] | |||
|- | |||
| 250 || 25..31 || PkcPubkeyHash1[0..6] | |||
|- | |||
| 250 || 0..24 || PkcPubkeyHash1[7..31] | |||
|- | |||
| 251 || 25..31 || PkcPubkeyHash1[0..6] | |||
|- | |||
| 251 || 0..24 || PkcPubkeyHash1[7..31] | |||
|- | |||
| 252 || 25..31 || PkcPubkeyHash1[0..6] | |||
|- | |||
| 252 || 0..24 || PkcPubkeyHash1[7..31] | |||
|- | |||
| 253 || 25..31 || PkcPubkeyHash1[0..6] | |||
|- | |||
| 253 || 0..24 || PkcPubkeyHash1[7..31] | |||
|- | |||
| 254 || 25..31 || PkcPubkeyHash1[0..6] | |||
|- | |||
| 254 || 0..24 || PkcPubkeyHash1[7..31] | |||
|- | |||
| 255 || 25..31 || PkcPubkeyHash1[0..6] | |||
|- | |||
| 255 || 0..24 || PkcPubkeyHash1[7..31] | |||
|- | |||
| 256 || 25..31 || PkcPubkeyHash1[0..6] | |||
|- | |||
| 256 || 0..24 || PkcPubkeyHash1[7..31] | |||
|- | |||
| 257 || 25..31 || PkcPubkeyHash1[0..6] | |||
|- | |||
| 257 || 0..24 || PkcPubkeyHash1[7..31] | |||
|- | |||
| 258 || 0..24 || PkcPubkeyHash1[7..31] | |||
|- | |- | ||
| 258 || 25..31 || [[#H2]][0..6] | | 258 || 25..31 || [[#H2]][0..6] | ||
|- | |- | ||
| 259 || 0..24 || [[#H2]][7..31] | | 259 || 0..24 || [[#H2]][7..31] | ||
|- | |||
| style="background: yellow" | | |||
| style="background: yellow" | | |||
| style="background: yellow" | [[#H2]] CRC32 End | |||
|- | |||
|- | |||
| 727 || 0..31 || PscOdmStatic[0..31] | |||
|- | |||
| 728 || 0..31 || PscOdmStatic[0..31] | |||
|- | |||
| 729 || 0..31 || EndorseKey[0..31] | |||
|- | |||
| 730 || 0..31 || EndorseKey[32..63] | |||
|- | |||
| 731 || 0..31 || EndorseKey[64..95] | |||
|- | |||
| 732 || 0..31 || EndorseKey[96..127] | |||
|- | |||
| 733 || 0..31 || EndorseKey[128..159] | |||
|- | |||
| 734 || 0..31 || EndorseKey[160..191] | |||
|- | |||
| 735 || 0..31 || EndorseKey[192..223] | |||
|- | |||
| 736 || 0..31 || EndorseKey[224..255] | |||
|- | |||
| 737 || 0..31 || EndorseKey[256..287] | |||
|- | |||
| 738 || 0..31 || EndorseKey[288..319] | |||
|- | |||
| 739 || 0..31 || EndorseKey[320..351] | |||
|- | |||
| 740 || 0..31 || EndorseKey[352..383] | |||
|- | |||
| 741 || 0..31 || EndorseKey[384..415] | |||
|- | |||
| 742 || 0..31 || EndorseKey[416..447] | |||
|- | |||
| 743 || 0..31 || EndorseKey[448..479] | |||
|- | |||
| 744 || 0..31 || EndorseKey[480..511] | |||
|- | |||
| 745 || 0..8 || EndorseKey[512..520] | |||
|- | |||
| 746 || 0..31 || EndorseKeyTag[0..31] | |||
|- | |||
| 747 || 0..31 || EndorseKeyTag[32..63] | |||
|- | |||
| 748 || 0..31 || EndorseKeyTag[64..95] | |||
|- | |||
| 749 || 0..31 || EndorseKeyTag[96..127] | |||
|- | |||
| 750 || 0..31 || EvitaIdk[0..31] | |||
|- | |||
| 751 || 0..31 || EvitaIdk[32..63] | |||
|- | |||
| 752 || 0..31 || EvitaIdk[64..95] | |||
|- | |||
| 753 || 0..31 || EvitaIdk[96..127] | |||
|- | |||
| 754 || 0..31 || EvitaIdk[128..159] | |||
|- | |||
| 755 || 0..31 || EvitaIdk[160..191] | |||
|- | |||
| 756 || 0..31 || EvitaIdk[192..223] | |||
|- | |||
| 757 || 0..31 || EvitaIdk[224..255] | |||
|- | |||
| 758 || 0..31 || EvitaIdkTag[0..31] | |||
|- | |||
| 759 || 0..31 || EvitaIdkTag[32..63] | |||
|- | |||
| 760 || 0..31 || EvitaIdkTag[64..95] | |||
|- | |||
| 761 || 0..31 || EvitaIdkTag[96..127] | |||
|- | |||
| 762 || 0..31 || OemFuseIv[0..31] | |||
|- | |||
| 763 || 0..31 || OemFuseIv[32..63] | |||
|- | |||
| 764 || 0..31 || OemFuseIv[64..95] | |||
|- | |||
| 765 || 0..31 || OemFuseIvTag[0..31] | |||
|- | |||
| 766 || 0..31 || SecureBootKey[0..31] | |||
|- | |||
| 767 || 0..31 || SecureBootKey[32..63] | |||
|- | |||
| 768 || 0..31 || SecureBootKey[64..95] | |||
|- | |||
| 769 || 0..31 || SecureBootKey[96..127] | |||
|- | |||
| 770 || 0..31 || SecureBootKey[128..159] | |||
|- | |||
| 771 || 0..31 || SecureBootKey[160..191] | |||
|- | |||
| 772 || 0..31 || SecureBootKey[192..223] | |||
|- | |||
| 773 || 0..31 || SecureBootKey[224..255] | |||
|- | |||
| 774 || 0..31 || SecureBootKeyTag[0..31] | |||
|- | |||
| 775 || 0..31 || SecureBootKeyTag[32..63] | |||
|- | |||
| 776 || 0..31 || SecureBootKeyTag[64..95] | |||
|- | |||
| 777 || 0..31 || SecureBootKeyTag[96..127] | |||
|- | |||
| 778 || 0..31 || Kdk0[0..31] | |||
|- | |||
| 779 || 0..31 || Kdk0[32..63] | |||
|- | |||
| 780 || 0..31 || Kdk0[64..95] | |||
|- | |||
| 781 || 0..31 || Kdk0[96..127] | |||
|- | |||
| 782 || 0..31 || Kdk0[128..159] | |||
|- | |||
| 783 || 0..31 || Kdk0[160..191] | |||
|- | |||
| 784 || 0..31 || Kdk0[192..223] | |||
|- | |||
| 785 || 0..31 || Kdk0[224..255] | |||
|- | |||
| 786 || 0..31 || Kdk0Tag[0..31] | |||
|- | |||
| 787 || 0..31 || Kdk0Tag[32..63] | |||
|- | |||
| 788 || 0..31 || Kdk0Tag[64..95] | |||
|- | |||
| 789 || 0..31 || Kdk0Tag[96..127] | |||
|- | |||
| 790 || 0..31 || OemK1[0..31] | |||
|- | |||
| 791 || 0..31 || OemK1[32..63] | |||
|- | |||
| 792 || 0..31 || OemK1[64..95] | |||
|- | |||
| 793 || 0..31 || OemK1[96..127] | |||
|- | |||
| 794 || 0..31 || OemK1[128..159] | |||
|- | |||
| 795 || 0..31 || OemK1[160..191] | |||
|- | |||
| 796 || 0..31 || OemK1[192..223] | |||
|- | |||
| 797 || 0..31 || OemK1[224..255] | |||
|- | |||
| 798 || 0..31 || OemK1Tag[0..31] | |||
|- | |||
| 799 || 0..31 || OemK1Tag[32..63] | |||
|- | |||
| 800 || 0..31 || OemK1Tag[64..95] | |||
|- | |||
| 801 || 0..31 || OemK1Tag[96..127] | |||
|- | |||
| 802 || 0..31 || OemK2[0..31] | |||
|- | |||
| 803 || 0..31 || OemK2[32..63] | |||
|- | |||
| 804 || 0..31 || OemK2[64..95] | |||
|- | |||
| 805 || 0..31 || OemK2[96..127] | |||
|- | |||
| 806 || 0..31 || OemK2[128..159] | |||
|- | |||
| 807 || 0..31 || OemK2[160..191] | |||
|- | |||
| 808 || 0..31 || OemK2[192..223] | |||
|- | |||
| 809 || 0..31 || OemK2[224..255] | |||
|- | |||
| 810 || 0..31 || OemK2Tag[0..31] | |||
|- | |||
| 811 || 0..31 || OemK2Tag[32..63] | |||
|- | |||
| 812 || 0..31 || OemK2Tag[64..95] | |||
|- | |||
| 813 || 0..31 || OemK2Tag[96..127] | |||
|- | |||
| 814 || 0..31 || FkddSk[0..31] | |||
|- | |||
| 815 || 0..31 || FkddSk[32..63] | |||
|- | |||
| 816 || 0..31 || FkddSk[64..95] | |||
|- | |||
| 817 || 0..31 || FkddSk[96..127] | |||
|- | |||
| 818 || 0..31 || FkddSk[128..159] | |||
|- | |||
| 819 || 0..31 || FkddSk[160..191] | |||
|- | |||
| 820 || 0..31 || FkddSk[192..223] | |||
|- | |||
| 821 || 0..31 || FkddSk[224..255] | |||
|- | |||
| 822 || 0..31 || FkddSkTag[0..31] | |||
|- | |||
| 823 || 0..31 || FkddAk[0..31] | |||
|- | |||
| 824 || 0..31 || FkddAk[32..63] | |||
|- | |||
| 825 || 0..31 || FkddAk[64..95] | |||
|- | |||
| 826 || 0..31 || FkddAk[96..127] | |||
|- | |||
| 827 || 0..31 || FkddAk[128..159] | |||
|- | |||
| 828 || 0..31 || FkddAk[160..191] | |||
|- | |||
| 829 || 0..31 || FkddAk[192..223] | |||
|- | |||
| 830 || 0..31 || FkddAk[224..255] | |||
|- | |||
| 831 || 0..31 || FkddAkTag[0..31] | |||
|} | |} | ||
=== Shadowed Fuses === | |||
The first 80 fuse words are 40 pairs redundantly stored next to each other. These fuses are field-updatable. One bit inside a word can be programmed at a time. | |||
== Fuses == | Many security sensitive fuses are in this region. | ||
Both shadowed values should always agree with each other, and they should be programmed together without a reset in-between. | |||
The two redundant bits are OR'd together which protects 1 from becoming a 0. | |||
=== H2 Fuses === | |||
These fuses are protected by the H2 CRC32. Once programmed, they cannot be updatable arbitrarily. | |||
= Fuses = | |||
Some fuses are mirrored in MMIO registers. | Some fuses are mirrored in MMIO registers. | ||
| Line 665: | Line 883: | ||
| 127 || || | | 127 || || | ||
|} | |} | ||
== OdmLock == | |||
OdmLock is a 4-bit wide field that allows locking 32-bit fields of: ReservedOdm0, ReservedOdm1, ReservedOdm2, ReservedOdm3. | |||
ReservedOdm Banks 4-7 do not have this lock feature. | |||
ReservedOdm Banks 4-7 are ratchet fuses (used for anti-downgrade). | |||
== Fa == | |||
Failure analysis mode. | |||
== NvJtagProtectionEnable == | |||
If set, [[#Fa]] cannot be used. | |||
== SecurityMode == | |||
According to documentation, this acts as a lock for "all manufacturing fuses", and prevents them from being read or modified. | |||
Also known as the "ODM production mode" fuse. | |||
== ArmJtagDisable == | |||
External debug paths disable for both Arm JTAG and USB SWD. | |||
== DebugAuthentication == | |||
Fine-grained disables on debug signals. | |||
bit0: Forces dbgen to 0 | |||
bit1: Forces niden to 0 | |||
bit2: Forces spiden to 0 | |||
bit3: Forces spniden to 0 | |||
bit4: Forces deviceen to 0 | |||
== SecBootDeviceSelect == | == SecBootDeviceSelect == | ||
| Line 671: | Line 923: | ||
== H2 == | == H2 == | ||
CRC32 of physical fuse words #188 bit20 and above, up to word #259 bit24. Uses polynomial 0x1EDC6F41. | CRC32 of physical fuse words #188 bit20 and above, up to word #259 bit24. Uses polynomial 0x1EDC6F41. | ||