Switch 2: Fuses: Difference between revisions

From Nintendo Switch Brew
Jump to navigation Jump to search
Newer edit →
Created page with "T23x has a 0x1000-byte (16384 bit) fuse block. The fuse layout can be found by reverse engineering fskp_t234.bin from the Linux4Tegra package. == Physical Layout == {| class="wikitable" border="1" |- ! Fuse Word || Bits || Value |- | 0 || 5..8 || OdmLock |- | 0 || 9 || Fa |- | 0 || 10 || SecurityMode |- | 0 || 11 || ArmJtagDisable |- | 0 || 16..20 || DebugAuthentication[0..4] |- | 1 || 5..8 || OdmLock (Shadow) |- | 1 || 9 || Fa (Shadow) |- | 1 || 10 || SecurityMode (Sh..."
 
No edit summary
Line 105: Line 105:
|-
|-
| 24 || 2..31 || SysFwRatchet0[0..29]
| 24 || 2..31 || SysFwRatchet0[0..29]
|-
| 24 || 1  || ForceDbgWithTestKeys
|-
| 25 || 1  || ForceDbgWithTestKeys
|-
|-
| 25 || 2..31 || SysFwRatchet0[0..29] (Shadow)
| 25 || 2..31 || SysFwRatchet0[0..29] (Shadow)
Line 164: Line 168:
| 37 || 21 || SecurityModeReduntant (Shadow)
| 37 || 21 || SecurityModeReduntant (Shadow)
|-
|-
| 36 || 25 || FaRedundant
| 36 || 5 || Usb2NvJtagDisable
|-
| 36  || 24 || ForceDbgWithTestKeys
|-
| 36  || 25 || FaRedundant
|-
| 36  || 26 || ForceDbgWithTestKeysDuringPscDbg
|-
| 36  || 27 || ForceDbgWithTestKeysDuringPscDbg
|-
| 37  || 5  || Usb2NvJtagDisable
|-
| 37  || 24 || ForceDbgWithTestKeys
|-
| 37  || 25 || FaRedundant (Shadow)
|-
| 37  || 26 || ForceDbgWithTestKeysDuringPscDbg
|-
|-
| 37 || 25 || FaRedundant (Shadow)
| 37 || 27 || ForceDbgWithTestKeysDuringPscDbg
|-
| 46 || 1 || EnableCrJtagSecurity
|-
|-
| 46 || 6 || ArmJtagDisableRedundant
| 46 || 6 || ArmJtagDisableRedundant
|-
|-
| 46 || 7..22 || BctFieldRatchet[0..15]
| 46 || 7..22 || BctFieldRatchet[0..15]
|-
| 47 || 1 || EnableCrJtagSecurity
|-
|-
| 47 || 6 || ArmJtagDisableRedundant (Shadow)
| 47 || 6 || ArmJtagDisableRedundant (Shadow)
Line 258: Line 282:
| 196 || 0..20  || PublicKeyHash[7][11..31]
| 196 || 0..20  || PublicKeyHash[7][11..31]
|-
|-
| 196 || 21..31 || BootDevInfo[0..10] |
| 196 || 21..31 || BootDevInfo[0..10]
|-
| 197 || 0..12  || BootDevInfo[19..31]
|-
|-
| 197 || 0..12 || BootDevInfo[19..31] |
| 198 || 5..8 || MphyOdmCalib[0..3]
|-
|-
| 198 || 9..22 || BootSecurityInfo[0..14]
| 198 || 9..22 || BootSecurityInfo[0..14]
|-
| 200 || 0..1  || SecureProvisionInfo[0..1]
|-
| 202 || 2..5  || SecureInSysBistCtrl[0..3]
|-
| 202 || 6..6  || Flw2[0..0]
|-
|-
| 199 || 0..8 || BootSecurityInfo[15..31]
| 199 || 0..8 || BootSecurityInfo[15..31]
Line 307: Line 339:
|-
|-
| 210 || 0..7  || PublicKeyHash[15][24..31]
| 210 || 0..7  || PublicKeyHash[15][24..31]
|-
| 210 || 8..31 || EvitaMvk[0..31]
|-
| 211 || 0..7  || EvitaMvk[0..31]
|-
| 211 || 8..31 || EvitaMvk[32..63]
|-
| 212 || 0..7  || EvitaMvk[32..63]
|-
| 212 || 8..31 || EvitaMvk[64..95]
|-
| 213 || 0..7  || EvitaMvk[64..95]
|-
| 213 || 8..31 || EvitaMvk[96..127]
|-
| 214 || 0..7  || EvitaMvk[96..127]
|-
| 214 || 8..31 || EvitaMvk[128..159]
|-
| 215 || 0..7  || EvitaMvk[128..159]
|-
| 215 || 8..31 || EvitaMvk[160..191]
|-
| 216 || 0..7  || EvitaMvk[160..191]
|-
| 216 || 8..31 || EvitaMvk[192..223]
|-
| 217 || 0..7  || EvitaMvk[192..223]
|-
| 217 || 8..31 || EvitaMvk[224..255]
|-
| 218 || 0..7  || EvitaMvk[224..255]
|-
| 218 || 8..31 || EvitaCsk[0..31]
|-
| 219 || 0..7  || EvitaCsk[0..31]
|-
| 219 || 8..31 || EvitaCsk[32..63]
|-
| 220 || 0..7  || EvitaCsk[32..63]
|-
| 220 || 8..31 || EvitaCsk[64..95]
|-
| 221 || 0..7  || EvitaCsk[64..95]
|-
| 221 || 8..31 || EvitaCsk[96..127]
|-
| 222 || 0..7  || EvitaCsk[96..127]
|-
| 222 || 8..31 || EvitaCsk[128..159]
|-
| 223 || 0..7  || EvitaCsk[128..159]
|-
| 223 || 8..31 || EvitaCsk[160..191]
|-
| 224 || 0..7  || EvitaCsk[160..191]
|-
| 224 || 8..31 || EvitaCsk[192..223]
|-
| 225 || 0..7  || EvitaCsk[192..223]
|-
| 225 || 8..31 || EvitaCsk[224..255]
|-
| 226 || 0..7  || EvitaCsk[224..255]
|-
|-
| 226 || 24 || OemFuseEncShadow
| 226 || 24 || OemFuseEncShadow
Line 314: Line 410:
| 259 || 0..24 || [[#H2]][7..31]
| 259 || 0..24 || [[#H2]][7..31]
|}
|}


== Fuses ==
== Fuses ==

Revision as of 08:43, 6 February 2026

T23x has a 0x1000-byte (16384 bit) fuse block.

The fuse layout can be found by reverse engineering fskp_t234.bin from the Linux4Tegra package.

Physical Layout

Fuse Word Bits Value
0 5..8 OdmLock
0 9 Fa
0 10 SecurityMode
0 11 ArmJtagDisable
0 16..20 DebugAuthentication[0..4]
1 5..8 OdmLock (Shadow)
1 9 Fa (Shadow)
1 10 SecurityMode (Shadow)
1 11 ArmJtagDisable (Shadow)
1 16..20 DebugAuthentication[0..4]
2 2..31 ReservedOdm0[0..29]
3 2..31 ReservedOdm0[0..29]
4 0..1 ReservedOdm0[30..31]
4 2..31 ReservedOdm1[0..29]
5 0..1 ReservedOdm0[30..31] (Shadow)
5 2..31 ReservedOdm1[0..29] (Shadow)
6 0..1 ReservedOdm1[30..31]
6 2..31 ReservedOdm2[0..29]
7 0..1 ReservedOdm1[30..31] (Shadow)
7 2..31 ReservedOdm2[0..29] (Shadow)
8 0..1 ReservedOdm2[30..31]
8 2..31 ReservedOdm3[0..29]
9 0..1 ReservedOdm2[30..31] (Shadow)
9 2..31 ReservedOdm3[0..29] (Shadow)
10 0..1 ReservedOdm3[30..31]
10 2..31 ReservedOdm4[0..29]
11 0..1 ReservedOdm3[30..31] (Shadow)
11 2..31 ReservedOdm4[0..29] (Shadow)
12 0..1 ReservedOdm4[30..31]
12 2..31 ReservedOdm5[0..29]
13 0..1 ReservedOdm4[30..31] (Shadow)
13 2..31 ReservedOdm5[0..29] (Shadow)
14 0..1 ReservedOdm5[30..31]
14 2..31 ReservedOdm6[0..29]
15 0..1 ReservedOdm5[30..31] (Shadow)
15 2..31 ReservedOdm6[0..29] (Shadow)
16 0..1 ReservedOdm6[30..31]
16 2..31 ReservedOdm7[0..29]
17 0..1 ReservedOdm6[30..31] (Shadow)
17 2..31 ReservedOdm7[0..29] (Shadow)
18 0..1 ReservedOdm7[30..31]
18 5 CcplexDfdAccessDisable[0]
18 12..31 HyperVoltaging[0..19]
19 0..1 ReservedOdm7[30..31] (Shadow)
19 5 CcplexDfdAccessDisable[0]
19 12..31 HyperVoltaging[0..19] (Shadow)
20 0..11 HyperVoltaging[20..31]
21 0..11 HyperVoltaging[20..31] (Shadow)
24 2..31 SysFwRatchet0[0..29]
24 1 ForceDbgWithTestKeys
25 1 ForceDbgWithTestKeys
25 2..31 SysFwRatchet0[0..29] (Shadow)
26 0..1 SysFwRatchet0[30..31]
26 2..31 SysFwRatchet1[0..29]
27 0..1 SysFwRatchet0[30..31] (Shadow)
27 2..31 SysFwRatchet1[0..29] (Shadow)
28 0..1 SysFwRatchet1[30..31]
28 2..31 SysFwRatchet2[0..29]
29 0..1 SysFwRatchet1[30..31] (Shadow)
29 2..31 SysFwRatchet2[0..29] (Shadow)
30 0..1 SysFwRatchet2[30..31]
30 2..31 SysFwRatchet3[0..29] (Shadow)
31 0..1 SysFwRatchet2[30..31]
31 2..31 SysFwRatchet3[0..29] (Shadow)
32 0..1 SysFwRatchet3[30..31]
32 2..31 CcplexUcodeFieldRatchet[0..29]
33 2..31 CcplexUcodeFieldRatchet[0..29]
34 0..1 CcplexUcodeFieldRatchet[30..31]
34 2..31 Mb1FieldRatchet[0..29]
35 0..1 CcplexUcodeFieldRatchet[30..31]
35 2..31 Mb1FieldRatchet[0..29]
36 0..1 Mb1FieldRatchet[30..31]
36 22..23 DebugAuthentication[5..6]
36 28 CcplexDfdAccessDisable
37 0..1 Mb1FieldRatchet[30..31]
37 22..23 DebugAuthentication[5..6] (Shadow)
37 28 CcplexDfdAccessDisable (Shadow)
33 0..1 SysFwRatchet3[30..31] (Shadow)
36 21 SecurityModeReduntant
37 21 SecurityModeReduntant (Shadow)
36 5 Usb2NvJtagDisable
36 24 ForceDbgWithTestKeys
36 25 FaRedundant
36 26 ForceDbgWithTestKeysDuringPscDbg
36 27 ForceDbgWithTestKeysDuringPscDbg
37 5 Usb2NvJtagDisable
37 24 ForceDbgWithTestKeys
37 25 FaRedundant (Shadow)
37 26 ForceDbgWithTestKeysDuringPscDbg
37 27 ForceDbgWithTestKeysDuringPscDbg
46 1 EnableCrJtagSecurity
46 6 ArmJtagDisableRedundant
46 7..22 BctFieldRatchet[0..15]
47 1 EnableCrJtagSecurity
47 6 ArmJtagDisableRedundant (Shadow)
47 7..22 BctFieldRatchet[0..15] (Shadow)
72 14..31 PscBlFieldRatchet[0..17]
73 14..31 PscBlFieldRatchet[0..17]
74 0..13 PscBlFieldRatchet[18..31]
75 0..13 PscBlFieldRatchet[18..31]
74 30..31 RomFeatureDisable[0..1]
75 30..31 RomFeatureDisable[0..1] (Shadow)
76 0..13 RomFeatureDisable[18..31]
76 14..19 FsiDebugAuthentication[0..5]
76 20..25 FsiDebugAuthentication[0..5]
77 0..13 RomFeatureDisable[18..31] (Shadow)
77 14..19 FsiDebugAuthentication[0..5] (Shadow)
77 20..25 FsiDebugAuthentication[0..5] (Shadow)
84 32 Sku
87 14..27 ReservedProduction
97 22..28 CcplexUcodeNvRevision[0..6]
105 18..23 MphyNvCalib[0..5]
105 24..30
106 12..31 BootNvInfo[0..19]
107 0..11 BootNvInfo[20..31]
108 13 AsyncL1aRstEnable
108 14 AsyncL0RstEnable
107 0..11 BootNvInfo[20..31]
119 14..15 BootRo
127 7 BootRomSelect
170 14..20
188 21..31 PublicKeyHash[0][0..10]
189 0..20 PublicKeyHash[0][11..31]
189 21..31 PublicKeyHash[1][0..10]
190 0..20 PublicKeyHash[1][11..31]
190 21..31 PublicKeyHash[2][0..10]
191 0..20 PublicKeyHash[2][11..31]
191 21..31 PublicKeyHash[3][0..10]
192 0..20 PublicKeyHash[3][11..31]
192 21..31 PublicKeyHash[4][0..10]
193 0..20 PublicKeyHash[4][11..31]
193 21..31 PublicKeyHash[5][0..10]
194 0..20 PublicKeyHash[5][11..31]
194 21..31 PublicKeyHash[6][0..10]
195 0..20 PublicKeyHash[6][11..31]
195 21..31 PublicKeyHash[7][0..10]
196 0..20 PublicKeyHash[7][11..31]
196 21..31 BootDevInfo[0..10]
197 0..12 BootDevInfo[19..31]
198 5..8 MphyOdmCalib[0..3]
198 9..22 BootSecurityInfo[0..14]
200 0..1 SecureProvisionInfo[0..1]
202 2..5 SecureInSysBistCtrl[0..3]
202 6..6 Flw2[0..0]
199 0..8 BootSecurityInfo[15..31]
199 9..24 OdmInfo[0..15]
200 2..31 OdmId[0][0..29]
201 0..1 OdmId[0][30..31]
201 2..31 OdmId[1][0..29]
202 0..1 OdmId[1][30..31]
202 8..31 PublicKeyHash[8][0..23]
203 0..7 PublicKeyHash[8][24..31]
203 8..31 PublicKeyHash[9][0..23]
204 0..7 PublicKeyHash[9][24..31]
204 8..31 PublicKeyHash[10][0..23]
205 0..7 PublicKeyHash[10][24..31]
205 8..31 PublicKeyHash[11][0..23]
206 0..7 PublicKeyHash[11][24..31]
206 8..31 PublicKeyHash[12][0..23]
207 0..7 PublicKeyHash[12][24..31]
207 8..31 PublicKeyHash[13][0..23]
208 0..7 PublicKeyHash[13][24..31]
208 8..31 PublicKeyHash[14][0..23]
209 0..7 PublicKeyHash[14][24..31]
209 8..31 PublicKeyHash[15][0..23]
210 0..7 PublicKeyHash[15][24..31]
210 8..31 EvitaMvk[0..31]
211 0..7 EvitaMvk[0..31]
211 8..31 EvitaMvk[32..63]
212 0..7 EvitaMvk[32..63]
212 8..31 EvitaMvk[64..95]
213 0..7 EvitaMvk[64..95]
213 8..31 EvitaMvk[96..127]
214 0..7 EvitaMvk[96..127]
214 8..31 EvitaMvk[128..159]
215 0..7 EvitaMvk[128..159]
215 8..31 EvitaMvk[160..191]
216 0..7 EvitaMvk[160..191]
216 8..31 EvitaMvk[192..223]
217 0..7 EvitaMvk[192..223]
217 8..31 EvitaMvk[224..255]
218 0..7 EvitaMvk[224..255]
218 8..31 EvitaCsk[0..31]
219 0..7 EvitaCsk[0..31]
219 8..31 EvitaCsk[32..63]
220 0..7 EvitaCsk[32..63]
220 8..31 EvitaCsk[64..95]
221 0..7 EvitaCsk[64..95]
221 8..31 EvitaCsk[96..127]
222 0..7 EvitaCsk[96..127]
222 8..31 EvitaCsk[128..159]
223 0..7 EvitaCsk[128..159]
223 8..31 EvitaCsk[160..191]
224 0..7 EvitaCsk[160..191]
224 8..31 EvitaCsk[192..223]
225 0..7 EvitaCsk[192..223]
225 8..31 EvitaCsk[224..255]
226 0..7 EvitaCsk[224..255]
226 24 OemFuseEncShadow
258 25..31 #H2[0..6]
259 0..24 #H2[7..31]


Fuses

Some fuses are mirrored in MMIO registers.

Some fuses are stored redundantly.

FuseId Name Length Mmio Notes
0 BootSecurityInfo 14 bits [0x3810268] & 0x3FFF
1 #SecBootDeviceSelect 3 bits [0x38101C0] & 7
2 Uid Complicated
3 Sku [0x3810110]
4 Tid [0x38101CC]
5 CpuSpeedo0 [0x3810114]
6 CpuSpeedo1
7 CpuSpeedo2
8 CpuIddq [0x3810478]
9 SocSpeedo0 [0x3810134]
10 SocSpeedo1
11 SocSpeedo2
12 Fa [0x38107BC]
13 Apb2JtagDisable [0x3810298]
14 TpcDisable [0x381030C]
15 Apb2JtagLock 1 bit ([0x38101F4] >> 3) & 1
16 SocIddq [0x3810140]
17 RomFeatureDisable [0x3810BF0]
18 BootNvInfo [0x3810578]
19 AsyncL1aRstEnable [0x38105B4]
20 AsyncL0RstEnable [0x38105B8]
21 OemFuseEncShadow [0x38108B8]
22 ReservedProduction [0x381014C]
23 HyperVoltaging [0x3810354]
24 MphyNvCalib [0x38104A0]
25 OptPrivSecEn [0x3810264]
26 UsbCalib [0x38101F0]
27 UsbCalibExt [0x3810350]
28 ProductionMode [0x3810100]
29 SecurityMode [0x38101A0]
30 OdmLock [0x3810108]
31 ArmJtagDisable [0x38101B8]
32 ReservedOdm0 [0x38101C8]
33 ReservedOdm1
34 ReservedOdm2 [0x38101D0]
35 ReservedOdm3 [0x38101D4]
36 ReservedOdm4 [0x38101D8]
37 ReservedOdm5 [0x38101DC]
38 ReservedOdm6 [0x38101E0]
39 ReservedOdm7 [0x38101E4]
40 BootRomSelect [0x3810868]
41 BootRo [0x381075C]
42 PublicKeyHash 512 bits [0x3810164]..[0x3810180] and [0x381065C]..[0x3810678] A SHA512 of the public key.
44 SwReserved 4 bits ([0x38101C0] >> 4) & 0xF
45 BootDevSelect 3 bits [0x38101C0] & 7
46 IgnoreBootDevStraps 1 bit ([0x38101C0] >> 3)
47 BootDevInfo [0x38101BC]
48 Mb1NvRevision [0x38104B8]
49 PscBlNvRevision [0x3810BD0]
50 SysFwRatchet0 [0x3810520]
51 SysFwRatchet1 [0x3810524]
52 SysFwRatchet2 [0x3810528]
53 SysFwRatchet3 [0x381052C]
54 Mb1FieldRatchet [0x3810534]
55 PscBlFieldRatchet [0x3810BD4]
56 CcplexUcodeFieldRatchet [0x3810530]
57 OdmId 64 bits [0x3810408]..[0x381040C]
58 #H2 [0x381043C]
59 OdmInfo [0x381029C]
60 DebugAuthentication [0x38102E4]
61 CcplexDfdAccessDisable [0x38102BC]
62 CvDisable [0x38104F8]
63 BctFieldRatchet [0x381091C]
64 CcplexUcodeNvRevision [0x3810364]
65 OptSampleType [0x3810244]
66 BootromPatchVersion [0x38104A8]
72 OptEmcDisable [0x38109C0]
73 SecureProvisionIndex [0x38102E8]
74 OptCcplexClusterDisable [0x3810314]
75 OptGpcDisable [0x3810288]
76 OptDlaDisable [0x38104F0]
77 FsiDebugAuthentication [0x3810C48]
78 EvitaMvk 256 bits [0x38107CC]..[0x38107E8]
79 EvitaCsk 256 bits [0x38107EC]..[0x3810808]
80 SecureProvisionInfo [0x38102EC]
81 MphyOdmCalib [0x3810224]
82 ForceDbgWithTestKeys [0x38104C8]
83 ForceDbgWithTestKeysDuringPscDbg [0x38107C0]
84 SecureInSysBistCtrl [0x38104CC]
85 Flw2 [0x3810568]
86 Usb2NvJtagDisable [0x3810590]
87 EnableCrJtagSecurity [0x3810884]
88 OptInEnable [0x38105A8]
89 SecuritySwOdm [0x3810840]
90 ZeroizeDis [0x38109A8]
91 IntegrityCheckEnable [0x3810540]
92 NvJtagProtectionEnable [0x38101EC]
93 PkcPubkeyHash1 512 bits [0x3810920]..[0x381095C]
94 PkcPubkeyHash2 512 bits [0x3810960]..[0x38109BC]
95 PscOdmStatic
96 EndorseKey
97 EndorseKeyTag
98 EvitaIdk
99 EvitaIdkTag
100 OemFuseIv
101 OemFuseIvTag
102 SecureBootKey
103 SecureBootKeyTag
104 Kdk0
105 Kdk0Tag
106 OemK1
107 OemK1Tag
108 OemK2
109 OemK2Tag
110 FkddSk
111 FkddSkTag
112 FkddAk
113 FkddAkTag
114 RevokePkH0 [0x38109A0]
115 RevokePkH1 [0x38109A4]
116 ObsDis [0x38101E8]
117 OptIstDisableDebug [0x38105C4]
118 [0x3810BD8]
119 [0x3810CC8]
120 [0x3810830]
121 [0x3810834]
122 [0x3810A24]
123 [0x3810A28]
124 [0x3810A2C]
125 [0x3810A30]
126 [0x3810A14]
127

SecBootDeviceSelect

Only valid if IgnoreBootDevStraps == 1.

H2

CRC32 of physical fuse words #188 bit20 and above, up to word #259 bit24. Uses polynomial 0x1EDC6F41.

Valid if SecurityMode == 1.

Retrieved from "https://switchbrew.org/w/index.php?title=Switch_2:_Fuses&oldid=14276"