2,928
edits
Changes
Jump to navigation
Jump to search
Line 479:
Line 479: + + + + Line 485:
Line 489: + + + + + + + + + + + + + + + + + + + +
no edit summary
| 0x52
| 0x52
| 1
| 1
|-
| [[#bootrom_ipatch|bootrom_ipatch]]
| 0x72
| 624
|-
|-
|}
|}
The first bootloader only burns fuses in this region.
The first bootloader only burns fuses in this region.
Both fuse indexes 0x3A (odm_reserved + 0x0C) and 0x3C (odm_reserved + 0x0E) are used for anti-downgrade control. These fuses will have their values cached into [[#FUSE_RESERVED_ODM6|FUSE_RESERVED_ODM6]] and [[#FUSE_RESERVED_ODM7|FUSE_RESERVED_ODM7]].
Both fuse indexes 0x3A (odm_reserved + 0x0C) and 0x3C (odm_reserved + 0x0E) are used for anti-downgrade control. These fuses will have their values cached into [[#FUSE_RESERVED_ODM6|FUSE_RESERVED_ODM6]] and [[#FUSE_RESERVED_ODM7|FUSE_RESERVED_ODM7]].
=== bootrom_ipatch ===
Tegra210 based hardware such as the Switch provides support for bootrom patches. The patch data is burned to the hardware fuse array using a specific format (see [https://gist.github.com/shuffle2/f8728159da100e9df2606d43925de0af shuffle2's ipatch decoder]) and is executed by the bootrom, replacing it's original code.
The following represents the patch data dumped from a 2.0.0 Switch console:
Patch address Patch data
0x001016AE 0xDF00 // svc #0x00 (offset 0x48)
0x00103040 0xDF22 // svc #0x22 (offset 0x8c)
0x00106F2E 0xDF26 // svc #0x26 (offset 0x94)
0x0010FB3C 0x2000 // movs r0, #0x00
0x00100856 0xDF2C // svc #0x2c (offset 0xa0)
0x00106F54 0xDF42 // svc #0x42 (offset 0xcc)
0x001012E4 0xDF4B // svc #0x4b (offset 0xde)
0x00104526 0xDF54 // svc #0x54 (offset 0xf0)
0x001043F4 0xDF5D // svc #0x5d (offset 0x102)
0x00117744 0xAC57 // data
0x00117758 0x3D19 // data
0x00103D2A 0x2001 // movs r0, #0x01
The last 4 patches are exclusive to the Switch, while the remaining ones are often included in most Tegra210 based devices.
== Anti-downgrade ==
== Anti-downgrade ==