Nintendo Switch Brew

Fuses: Difference between revisions

← Older editNewer edit →
No edit summary
Line 664: Line 664:
| 0x7000FA18
| 0x7000FA18
|-
|-
| FUSE_OPT_SEC_DEBUG_EN
| [[#FUSE_OPT_SEC_DEBUG_EN|FUSE_OPT_SEC_DEBUG_EN]]
| 0x7000FA1C
| 0x7000FA1C
|-
|-
Line 718: Line 718:
| 0x7000FA60
| 0x7000FA60
|-
|-
| FUSE_OPT_PRIV_SEC_EN
| [[#FUSE_OPT_PRIV_SEC_EN|FUSE_OPT_PRIV_SEC_EN]]
| 0x7000FA64
| 0x7000FA64
|-
|-
Line 969: Line 969:


Original launch units have this value set to 0xA0 (revision 5.0). The first batch of patched units have this value set to 0xC0 (revision 6.0). The second batch of patched units have this value set to 0xE0 (revision 7.0)
Original launch units have this value set to 0xA0 (revision 5.0). The first batch of patched units have this value set to 0xC0 (revision 6.0). The second batch of patched units have this value set to 0xE0 (revision 7.0)
==== FUSE_SOC_SPEEDO_1_CALIB ====
Stores the bootrom patch version.


==== FUSE_FA ====
==== FUSE_FA ====
Stores failure analysis mode.
Stores failure analysis mode.


==== FUSE_SOC_SPEEDO_1_CALIB ====
==== FUSE_PUBLIC_KEY ====
Stores the bootrom patch version.
Stores the SHA256 hash of the 2048-bit RSA key expected at BCT+0x210.
 
==== FUSE_OPT_CP_REV ====
Stores the CP (Chip Probing) revision.
 
Original launch units have this value set to 0xA0 (revision 5.0). Patched units have this value set to 0x103 (revision 8.3).
 
==== FUSE_PRIVATE_KEY ====
Stores the 160-bit private key (128 bit SBK + 32-bit device key).
 
Reads to these registers after the SBK is locked out produce all-FF output.
 
==== FUSE_RESERVED_SW ====
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0-2
| Boot device
|-
| 3
| Skip device selection straps (0 = don't skip; 1 = skip)
|-
| 4
| ENABLE_CHARGER_DETECT
|-
| 5
| ENABLE_WATCHDOG
|-
| 6
| Forced RCM two button mode (0 = Only VOLUME_UP; 1 = VOLUME_UP + HOME)
|-
| 7
| RCM USB controller mode (0 = USB 2.0; 1 = XUSB)
|}
 
Caches the value of the reserved_sw fuse from the hardware bitmap.
 
Original launch units have the RCM USB controller mode set to USB 2.0, while the first batch of patched units have the RCM USB controller mode set to XUSB.


==== FUSE_RESERVED_ODM0 ====
==== FUSE_RESERVED_ODM0 ====
This stores an hardware ID.
Stores an hardware ID.


==== FUSE_RESERVED_ODM1 ====
==== FUSE_RESERVED_ODM1 ====
This stores an hardware ID.
Stores an hardware ID.


==== FUSE_RESERVED_ODM2 ====
==== FUSE_RESERVED_ODM2 ====
Line 991: Line 1,032:
|}
|}


This stores an hardware ID in original launch units, but in patched units it stores a single value (key generation).
Stores an hardware ID in original launch units, but in patched units it stores a single value (key generation).


==== FUSE_RESERVED_ODM3 ====
==== FUSE_RESERVED_ODM3 ====
This stores an hardware ID in original launch units, but in patched units it's empty.
Stores an hardware ID in original launch units, but is empty in patched units.


==== FUSE_RESERVED_ODM4 ====
==== FUSE_RESERVED_ODM4 ====
Line 1,027: Line 1,068:
|}
|}


This stores some device configuration parameters.
Stores some device configuration parameters.
 
==== FUSE_RESERVED_ODM5 ====
Empty and unused.


==== FUSE_RESERVED_ODM6 ====
==== FUSE_RESERVED_ODM6 ====
This register returns the value programmed into fuse [[#reserved_odm6|reserved_odm6]].
Returns the value of the [[#reserved_odm6|reserved_odm6]] anti-downgrade fuse.


==== FUSE_RESERVED_ODM7 ====
==== FUSE_RESERVED_ODM7 ====
This register returns the value programmed into fuse [[#reserved_odm7|reserved_odm7]].
Returns the value of the [[#reserved_odm7|reserved_odm7]] anti-downgrade fuse.


==== FUSE_PUBLIC_KEY ====
==== FUSE_OPT_SEC_DEBUG_EN ====
This stores the SHA256 hash of the 2048-bit RSA key expected at BCT+0x210.
Controls the [[TSEC#TSEC_SCP_CTL_STAT|Falcon SCP]] debug mode.


==== FUSE_OPT_CP_REV ====
==== FUSE_OPT_PRIV_SEC_EN ====
Stores the CP (Chip Probing) revision.
Controls the [[TSEC#FALCON_SCTL|Falcon Light Secure]] feature.


Original launch units have this value set to 0xA0 (revision 5.0). Patched units have this value set to 0x103 (revision 8.3).
==== FUSE_PKC_DISABLE ====
Returns if public key crypto is used or not.


==== FUSE_PRIVATE_KEY ====
==== FUSE_ECO_RESERVE_0 ====
This stores the 160-bit private key (128 bit SBK + 32-bit device key).
Returns the chip unique AID.
Reads to these registers after the SBK is locked out produce all-FF output.


==== FUSE_RESERVED_SW ====
==== FUSE_SPARE_BIT_2 ====
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
!  Description
!  Description
|-
|-
| 0-2
| 0
| Boot device
| Speedo fusing revision
|-
| 3
| Skip device selection straps (0 = don't skip; 1 = skip)
|-
| 4
| ENABLE_CHARGER_DETECT
|-
| 5
| ENABLE_WATCHDOG
|-
| 6
| Forced RCM two button mode (0 = Only VOLUME_UP; 1 = VOLUME_UP + HOME)
|-
| 7
| RCM USB controller mode (0 = USB 2.0; 1 = XUSB)
|}
|}
This caches the value of the reserved_sw fuse from the hardware bitmap.
Original launch units have the RCM USB controller mode set to USB 2.0, while the first batch of patched units have the RCM USB controller mode set to XUSB.
==== FUSE_PKC_DISABLE ====
This caches the value of the pkc_disable fuse from the hardware bitmap.
==== FUSE_SPARE_BIT_2 ====
Stores part of the speedo fusing revision.


==== FUSE_SPARE_BIT_3 ====
==== FUSE_SPARE_BIT_3 ====
Stores part of the speedo fusing revision.
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0
| Speedo fusing revision
|}


==== FUSE_SPARE_BIT_4 ====
==== FUSE_SPARE_BIT_4 ====
Stores part of the speedo fusing revision.
{| class="wikitable" border="1"
!  Bits
!  Description
|-
| 0
| Speedo fusing revision
|}


==== FUSE_SPARE_BIT_5 ====
==== FUSE_SPARE_BIT_5 ====
Line 1,096: Line 1,127:
The actual hardware fuses are stored in a bitmap and may be programmed through the fuse driver after enabling fuse programming.
The actual hardware fuses are stored in a bitmap and may be programmed through the fuse driver after enabling fuse programming.


Fuse numbers are relative to the start of the fuse bitmap where each element is a 4 byte word and has a redundant alias. A single fuse write operation must always write the same value to '''fuse_bitmap + ((fuse_number + 0) << 2)''' (PRIMARY_ALIAS) and '''fuse_bitmap + ((fuse_number + 1) << 2)''' (REDUNDANT_ALIAS). However, after offset 0x180 in the fuse bitmap, fuses no longer have a redundant alias.
Fuse numbers are relative to the start of the fuse bitmap where each element is a 4 byte word and has a redundant alias. A single fuse write operation must always write the same value to '''fuse_bitmap + ((fuse_number + 0) << 2)''' (PRIMARY_ALIAS) and '''fuse_bitmap + ((fuse_number + 1) << 2)''' (REDUNDANT_ALIAS). However, spare bits and all fuses afterwards in the fuse bitmap, no longer have a redundant alias.


Below is a list of common fuses used by Tegra devices (and applicable to the Switch).
Below is a list of common fuses used by Tegra devices (and applicable to the Switch).
Line 1,485: Line 1,516:
| 91
| 91
| 28-29
| 28-29
|-
| spare_bit_0
| 100
| None
| 16
|-
| spare_bit_1
| 100
| None
| 17
|-
| spare_bit_2
| 100
| None
| 18
|-
| spare_bit_3
| 100
| None
| 19
|-
| spare_bit_4
| 100
| None
| 20
|-
| spare_bit_5
| 100
| None
| 21
|-
| spare_bit_6
| 100
| None
| 22
|-
| spare_bit_7
| 100
| None
| 23
|-
| spare_bit_8
| 100
| None
| 24
|-
| spare_bit_9
| 100
| None
| 25
|-
| spare_bit_10
| 100
| None
| 26
|-
| spare_bit_11
| 100
| None
| 27
|-
| spare_bit_12
| 100
| None
| 28
|-
| spare_bit_13
| 100
| None
| 29
|-
| spare_bit_14
| 100
| None
| 30
|-
| spare_bit_15
| 100
| None
| 31
|-
| spare_bit_16
| 101
| None
| 16
|-
| spare_bit_17
| 101
| None
| 17
|-
| spare_bit_18
| 101
| None
| 18
|-
| spare_bit_19
| 101
| None
| 19
|-
| spare_bit_20
| 101
| None
| 20
|-
| spare_bit_21
| 101
| None
| 21
|-
| spare_bit_22
| 101
| None
| 22
|-
| spare_bit_23
| 101
| None
| 23
|-
| spare_bit_24
| 101
| None
| 24
|-
| spare_bit_25
| 101
| None
| 25
|-
| spare_bit_26
| 101
| None
| 26
|-
| spare_bit_27
| 101
| None
| 27
|-
| spare_bit_28
| 101
| None
| 28
|-
| spare_bit_29
| 101
| None
| 29
|-
| spare_bit_30
| 101
| None
| 30
|-
| spare_bit_31
| 101
| None
| 31
|-
|-
| aid
| aid
| 103
| 103
| None
| None
| 0-31
| 2-31
|-
| aid
| 104
| None
| 0-1
|-
|-
| ramrepair_record0
| ramrepair_record0
| 104
| 105
| None
| None
| 0-31
| 0-31
|-
|-
| ramrepair_record1
| ramrepair_record1
| 105
| 106
| None
| None
| 0-31
| 0-31
|-
|-
| ramrepair_record2
| ramrepair_record2
| 106
| 107
| None
| None
| 0-31
| 0-31
|-
|-
| ramrepair_record3
| ramrepair_record3
| 107
| 108
| None
| None
| 0-31
| 0-31
|-
|-
| ramrepair_record4
| ramrepair_record4
| 108
| 109
| None
| None
| 0-31
| 0-31
|-
|-
| ramrepair_record5
| ramrepair_record5
| 109
| 110
| None
| 0-31
|-
| ramrepair_record6
| 111
| None
| 0-31
|-
| ramrepair_record7
| 112
| None
| 0-31
|-
| ramrepair_record8
| 113
| None
| None
| 0-31
| 0-31
Retrieved from "https://switchbrew.org/wiki/Fuses"