Nintendo Switch Brew

Switch 2: Fuses: Difference between revisions

← Older edit
No edit summary
No edit summary
 
(2 intermediate revisions by the same user not shown)
Line 3: Line 3:
The fuse layout can be found by reverse engineering fskp_t234.bin from the Linux4Tegra package.
The fuse layout can be found by reverse engineering fskp_t234.bin from the Linux4Tegra package.


== Physical Layout ==
= Physical Layout =
 
== Fuse words ==
Fuses are laid out in 32-bit words.
 
{| class="wikitable" border="1"
{| class="wikitable" border="1"
|-
|-
! Fuse Word || Bits || Value
! Fuse Word || Bits || Value
|-
|-
| 0 || 5..8 || OdmLock
| style="background: yellow" |
| style="background: yellow" |
| style="background: yellow" | [[#Shadowed Fuses]] Begin
|-
| 0 || 5..8 || [[#OdmLock]]
|-
|-
| 0 || 9 || Fa
| 0 || 9 || [[#Fa]]
|-
|-
| 0 || 10 || SecurityMode
| 0 || 10 || [[#SecurityMode]]
|-
|-
| 0 || 11 || ArmJtagDisable
| 0 || 11 || [[#ArmJtagDisable]]
|-
|-
| 0 || 12 || NvJtagProtectionEnable[0]
| 0 || 12 || [[#NvJtagProtectionEnable]]
|-
|-
| 0 || 16..20 || DebugAuthentication[0..4]
| 0 || 16..20 || [[#DebugAuthentication]]
|-
|-
| 0 || 28 || ZeroizeDis
| 0 || 28 || ZeroizeDis
|-
| 1 || 5..8 || OdmLock (Shadow)
|-
| 1 || 9 || Fa (Shadow)
|-
| 1 || 10 || SecurityMode (Shadow)
|-
| 1 || 11 || ArmJtagDisable (Shadow)
|-
| 1 || 12 || NvJtagProtectionEnable[0]
|-
| 1 || 16..20 || DebugAuthentication[0..4]
|-
| 1 || 28 || ZeroizeDis
|-
|-
| 2 || 2..31 || ReservedOdm0[0..29]
| 2 || 2..31 || ReservedOdm0[0..29]
|-
| 3 || 2..31 || ReservedOdm0[0..29]
|-
|-
| 4 || 0..1 || ReservedOdm0[30..31]
| 4 || 0..1 || ReservedOdm0[30..31]
|-
|-
| 4 || 2..31 || ReservedOdm1[0..29]
| 4 || 2..31 || ReservedOdm1[0..29]
|-
| 5 || 0..1 || ReservedOdm0[30..31] (Shadow)
|-
| 5 || 2..31 || ReservedOdm1[0..29] (Shadow)
|-
|-
| 6 || 0..1 || ReservedOdm1[30..31]
| 6 || 0..1 || ReservedOdm1[30..31]
|-
|-
| 6 || 2..31 || ReservedOdm2[0..29]
| 6 || 2..31 || ReservedOdm2[0..29]
|-
| 7 || 0..1 || ReservedOdm1[30..31] (Shadow)
|-
| 7 || 2..31 || ReservedOdm2[0..29] (Shadow)
|-
|-
| 8 || 0..1 || ReservedOdm2[30..31]
| 8 || 0..1 || ReservedOdm2[30..31]
|-
|-
| 8 || 2..31 || ReservedOdm3[0..29]
| 8 || 2..31 || ReservedOdm3[0..29]
|-
| 9 || 0..1 || ReservedOdm2[30..31] (Shadow)
|-
| 9 || 2..31 || ReservedOdm3[0..29] (Shadow)
|-
|-
| 10 || 0..1 || ReservedOdm3[30..31]
| 10 || 0..1 || ReservedOdm3[30..31]
|-
|-
| 10 || 2..31 || ReservedOdm4[0..29]
| 10 || 2..31 || ReservedOdm4[0..29]
|-
| 11 || 0..1 || ReservedOdm3[30..31] (Shadow)
|-
| 11 || 2..31 || ReservedOdm4[0..29] (Shadow)
|-
|-
| 12 || 0..1 || ReservedOdm4[30..31]
| 12 || 0..1 || ReservedOdm4[30..31]
|-
|-
| 12 || 2..31 || ReservedOdm5[0..29]
| 12 || 2..31 || ReservedOdm5[0..29]
|-
| 13 || 0..1 || ReservedOdm4[30..31] (Shadow)
|-
| 13 || 2..31 || ReservedOdm5[0..29] (Shadow)
|-
|-
| 14 || 0..1 || ReservedOdm5[30..31]
| 14 || 0..1 || ReservedOdm5[30..31]
|-
|-
| 14 || 2..31 || ReservedOdm6[0..29]
| 14 || 2..31 || ReservedOdm6[0..29]
|-
| 15 || 0..1 || ReservedOdm5[30..31] (Shadow)
|-
| 15 || 2..31 || ReservedOdm6[0..29]  (Shadow)
|-
|-
| 16 || 0..1 || ReservedOdm6[30..31]
| 16 || 0..1 || ReservedOdm6[30..31]
|-
|-
| 16 || 2..31 || ReservedOdm7[0..29]
| 16 || 2..31 || ReservedOdm7[0..29]
|-
| 17 || 0..1 || ReservedOdm6[30..31] (Shadow)
|-
| 17 || 2..31 || ReservedOdm7[0..29]  (Shadow)
|-
|-
| 18 || 0..1 || ReservedOdm7[30..31]
| 18 || 0..1 || ReservedOdm7[30..31]
Line 103: Line 67:
|-
|-
| 18 || 2 || ObsDis
| 18 || 2 || ObsDis
|-
| 19 || 0..1 || ReservedOdm7[30..31] (Shadow)
|-
| 19 || 2 || ObsDis
|-
| 19 || 5 || CcplexDfdAccessDisable[0]
|-
| 19 || 12..31 || HyperVoltaging[0..19] (Shadow)
|-
|-
| 20 || 0..11 || HyperVoltaging[20..31]
| 20 || 0..11 || HyperVoltaging[20..31]
|-
|-
| 21 || 0..11 || HyperVoltaging[20..31] (Shadow)
| 24 || 1  || ForceDbgWithTestKeys
|-
|-
| 24 || 2..31 || SysFwRatchet0[0..29]
| 24 || 2..31 || SysFwRatchet0[0..29]
|-
| 24 || 1  || ForceDbgWithTestKeys
|-
| 25 || 1  || ForceDbgWithTestKeys
|-
| 25 || 2..31 || SysFwRatchet0[0..29] (Shadow)
|-
|-
| 26 || 0..1  || SysFwRatchet0[30..31]
| 26 || 0..1  || SysFwRatchet0[30..31]
|-
|-
| 26 || 2..31 || SysFwRatchet1[0..29]
| 26 || 2..31 || SysFwRatchet1[0..29]
|-
| 27 || 0..1  || SysFwRatchet0[30..31] (Shadow)
|-
| 27 || 2..31 || SysFwRatchet1[0..29] (Shadow)
|-
|-
| 28 || 0..1  || SysFwRatchet1[30..31]
| 28 || 0..1  || SysFwRatchet1[30..31]
|-
|-
| 28 || 2..31 || SysFwRatchet2[0..29]
| 28 || 2..31 || SysFwRatchet2[0..29]
|-
| 29 || 0..1  || SysFwRatchet1[30..31] (Shadow)
|-
| 29 || 2..31 || SysFwRatchet2[0..29]  (Shadow)
|-
|-
| 30 || 0..1  || SysFwRatchet2[30..31]
| 30 || 0..1  || SysFwRatchet2[30..31]
|-
|-
| 30 || 2..31 || SysFwRatchet3[0..29] (Shadow)
| 30 || 2..31 || SysFwRatchet3[0..29] (Shadow)
|-
| 31 || 0..1  || SysFwRatchet2[30..31]
|-
| 31 || 2..31 || SysFwRatchet3[0..29] (Shadow)
|-
|-
| 32 || 0..1  || SysFwRatchet3[30..31]
| 32 || 0..1  || SysFwRatchet3[30..31]
|-
|-
| 32 || 2..31 || CcplexUcodeFieldRatchet[0..29]
| 32 || 2..31 || CcplexUcodeFieldRatchet[0..29]
|-
| 33 || 2..31 || CcplexUcodeFieldRatchet[0..29]
|-
|-
| 34 || 0..1 || CcplexUcodeFieldRatchet[30..31]
| 34 || 0..1 || CcplexUcodeFieldRatchet[30..31]
|-
|-
| 34 || 2..31 || Mb1FieldRatchet[0..29]
| 34 || 2..31 || Mb1FieldRatchet[0..29]
|-
| 35 || 0..1 || CcplexUcodeFieldRatchet[30..31]
|-
| 35 || 2..31 || Mb1FieldRatchet[0..29]
|-
|-
| 36 || 0..1 || Mb1FieldRatchet[30..31]
| 36 || 0..1 || Mb1FieldRatchet[30..31]
|-
|-
| 36 || 4 || IntegrityCheckEnable
| 36 || 4 || IntegrityCheckEnable
|-
| 36 || 5 || Usb2NvJtagDisable
|-
|-
| 36 || 6 || OptIstDisableDebug
| 36 || 6 || OptIstDisableDebug
|-
| 36 || 22..23 || DebugAuthentication[5..6]
|-
| 36 || 28 || CcplexDfdAccessDisable
|-
| 37 || 0..1 || Mb1FieldRatchet[30..31]
|-
| 37 || 4 || IntegrityCheckEnable
|-
| 37 || 6 || OptIstDisableDebug
|-
| 37 || 22..23 || DebugAuthentication[5..6] (Shadow)
|-
| 37 || 28 || CcplexDfdAccessDisable (Shadow)
|-
| 33 || 0..1  || SysFwRatchet3[30..31] (Shadow)
|-
|-
| 36 || 21 || SecurityModeReduntant
| 36 || 21 || SecurityModeReduntant
|-
|-
| 37 || 21 || SecurityModeReduntant (Shadow)
| 36 || 22..23 || DebugAuthentication[5..6]
|-
|-
| 36 || 5 || Usb2NvJtagDisable
| 36 || 24 || ForceDbgWithTestKeys
|-
|-
| 36 || 24 || ForceDbgWithTestKeys
| 36 || 25 || FaRedundant
|-
|-
| 36 || 25 || FaRedundant
| 36 || 26 || ForceDbgWithTestKeysDuringPscDbg
|-
|-
| 36 || 26 || ForceDbgWithTestKeysDuringPscDbg
| 36 || 27 || ForceDbgWithTestKeysDuringPscDbg
|-
|-
| 36 || 27 || ForceDbgWithTestKeysDuringPscDbg
| 36 || 28 || CcplexDfdAccessDisable
|-
| 37  || 5  || Usb2NvJtagDisable
|-
| 37  || 24 || ForceDbgWithTestKeys
|-
| 37  || 25 || FaRedundant (Shadow)
|-
| 37  || 26 || ForceDbgWithTestKeysDuringPscDbg
|-
| 37  || 27 || ForceDbgWithTestKeysDuringPscDbg
|-
|-
| 46 || 1 || EnableCrJtagSecurity
| 46 || 1 || EnableCrJtagSecurity
Line 217: Line 125:
|-
|-
| 46 || 24 || RevokePkH1
| 46 || 24 || RevokePkH1
|-
| 47 || 1 || EnableCrJtagSecurity
|-
| 47 || 6 || ArmJtagDisableRedundant (Shadow)
|-
| 47 || 7..22 || BctFieldRatchet[0..15] (Shadow)
|-
| 47 || 23 || RevokePkH0
|-
| 47 || 24 || RevokePkH1
|-
|-
| 72 || 14..31 || PscBlFieldRatchet[0..17]
| 72 || 14..31 || PscBlFieldRatchet[0..17]
|-
| 73 || 14..31 || PscBlFieldRatchet[0..17]
|-
|-
| 74 || 0..13 || PscBlFieldRatchet[18..31]
| 74 || 0..13 || PscBlFieldRatchet[18..31]
|-
| 75 || 0..13 || PscBlFieldRatchet[18..31]
|-
|-
| 74 || 30..31 || RomFeatureDisable[0..1]
| 74 || 30..31 || RomFeatureDisable[0..1]
|-
| 75 || 30..31 || RomFeatureDisable[0..1] (Shadow)
|-
|-
| 76 || 0..13 || RomFeatureDisable[18..31]
| 76 || 0..13 || RomFeatureDisable[18..31]
Line 246: Line 138:
| 76 || 20..25 || FsiDebugAuthentication[0..5]
| 76 || 20..25 || FsiDebugAuthentication[0..5]
|-
|-
| 77 || 0..13 || RomFeatureDisable[18..31] (Shadow)
| style="background: yellow" |
|-
| style="background: yellow" |
| 77 || 14..19 || FsiDebugAuthentication[0..5] (Shadow)
| style="background: yellow" | [[#Shadowed Fuses]] End
|-
| 77 || 20..25 || FsiDebugAuthentication[0..5] (Shadow)
|-
|-
| 84 || 32 || Sku
| 84 || 32 || Sku
Line 277: Line 167:
|-
|-
| 170 || 14..20 || PscBlNvRevision[0..6] |
| 170 || 14..20 || PscBlNvRevision[0..6] |
|-
| style="background: yellow" |
| style="background: yellow" |
| style="background: yellow" | [[#H2]] CRC32 Begin
|-
|-
| 188 || 21..31 || PublicKeyHash[0][0..10]
| 188 || 21..31 || PublicKeyHash[0][0..10]
Line 507: Line 401:
|-
|-
| 259 || 0..24 || [[#H2]][7..31]
| 259 || 0..24 || [[#H2]][7..31]
|-
| style="background: yellow" |
| style="background: yellow" |
| style="background: yellow" | [[#H2]] CRC32 End
|-
|-
|-
| 727 || 0..31 || PscOdmStatic[0..31]
| 727 || 0..31 || PscOdmStatic[0..31]
Line 719: Line 618:
|}
|}


=== Shadowed Fuses ===
The first 80 fuse words are 40 pairs redundantly stored next to each other. These fuses are field-updatable. One bit inside a word can be programmed at a time.
Many security sensitive fuses are in this region.
Both shadowed values should always agree with each other, and they should be programmed together without a reset in-between.
The two redundant bits are OR'd together which protects 1 from becoming a 0.


== Fuses ==
=== H2 Fuses ===
These fuses are protected by the H2 CRC32. Once programmed, they cannot be updatable arbitrarily.
 
= Fuses =
Some fuses are mirrored in MMIO registers.
Some fuses are mirrored in MMIO registers.


Line 973: Line 883:
| 127 || ||  
| 127 || ||  
|}
|}
== OdmLock ==
OdmLock is a 4-bit wide field that allows locking 32-bit fields of: ReservedOdm0, ReservedOdm1, ReservedOdm2, ReservedOdm3.
ReservedOdm Banks 4-7 do not have this lock feature.
ReservedOdm Banks 4-7 are ratchet fuses (used for anti-downgrade).
== Fa ==
Failure analysis mode.
== NvJtagProtectionEnable ==
If set, [[#Fa]] cannot be used.
== SecurityMode ==
According to documentation, this acts as a lock for "all manufacturing fuses", and prevents them from being read or modified.
Also known as the "ODM production mode" fuse.
== ArmJtagDisable ==
External debug paths disable for both Arm JTAG and USB SWD.
== DebugAuthentication ==
Fine-grained disables on debug signals.
bit0: Forces dbgen to 0
bit1: Forces niden to 0
bit2: Forces spiden to 0
bit3: Forces spniden to 0
bit4: Forces deviceen to 0


== SecBootDeviceSelect ==
== SecBootDeviceSelect ==
Line 979: Line 923:
== H2 ==
== H2 ==
CRC32 of physical fuse words #188 bit20 and above, up to word #259 bit24. Uses polynomial 0x1EDC6F41.
CRC32 of physical fuse words #188 bit20 and above, up to word #259 bit24. Uses polynomial 0x1EDC6F41.
Valid if SecurityMode == 1.
Retrieved from "https://switchbrew.org/wiki/Switch_2:_Fuses"