Switch 2: Fuses

From Nintendo Switch Brew
Revision as of 09:44, 6 February 2026 by Ootulp (talk | contribs)
Jump to navigation Jump to search

T23x has a 0x1000-byte (16384 bit) fuse block.

The fuse layout can be found by reverse engineering fskp_t234.bin from the Linux4Tegra package.

Physical Layout

Fuse Word Bits Value
0 5..8 OdmLock
0 9 Fa
0 10 SecurityMode
0 11 ArmJtagDisable
0 12 NvJtagProtectionEnable[0]
0 16..20 DebugAuthentication[0..4]
0 28 ZeroizeDis
1 5..8 OdmLock (Shadow)
1 9 Fa (Shadow)
1 10 SecurityMode (Shadow)
1 11 ArmJtagDisable (Shadow)
1 12 NvJtagProtectionEnable[0]
1 16..20 DebugAuthentication[0..4]
1 28 ZeroizeDis
2 2..31 ReservedOdm0[0..29]
3 2..31 ReservedOdm0[0..29]
4 0..1 ReservedOdm0[30..31]
4 2..31 ReservedOdm1[0..29]
5 0..1 ReservedOdm0[30..31] (Shadow)
5 2..31 ReservedOdm1[0..29] (Shadow)
6 0..1 ReservedOdm1[30..31]
6 2..31 ReservedOdm2[0..29]
7 0..1 ReservedOdm1[30..31] (Shadow)
7 2..31 ReservedOdm2[0..29] (Shadow)
8 0..1 ReservedOdm2[30..31]
8 2..31 ReservedOdm3[0..29]
9 0..1 ReservedOdm2[30..31] (Shadow)
9 2..31 ReservedOdm3[0..29] (Shadow)
10 0..1 ReservedOdm3[30..31]
10 2..31 ReservedOdm4[0..29]
11 0..1 ReservedOdm3[30..31] (Shadow)
11 2..31 ReservedOdm4[0..29] (Shadow)
12 0..1 ReservedOdm4[30..31]
12 2..31 ReservedOdm5[0..29]
13 0..1 ReservedOdm4[30..31] (Shadow)
13 2..31 ReservedOdm5[0..29] (Shadow)
14 0..1 ReservedOdm5[30..31]
14 2..31 ReservedOdm6[0..29]
15 0..1 ReservedOdm5[30..31] (Shadow)
15 2..31 ReservedOdm6[0..29] (Shadow)
16 0..1 ReservedOdm6[30..31]
16 2..31 ReservedOdm7[0..29]
17 0..1 ReservedOdm6[30..31] (Shadow)
17 2..31 ReservedOdm7[0..29] (Shadow)
18 0..1 ReservedOdm7[30..31]
18 5 CcplexDfdAccessDisable[0]
18 12..31 HyperVoltaging[0..19]
18 2 ObsDis
19 0..1 ReservedOdm7[30..31] (Shadow)
19 2 ObsDis
19 5 CcplexDfdAccessDisable[0]
19 12..31 HyperVoltaging[0..19] (Shadow)
20 0..11 HyperVoltaging[20..31]
21 0..11 HyperVoltaging[20..31] (Shadow)
24 2..31 SysFwRatchet0[0..29]
24 1 ForceDbgWithTestKeys
25 1 ForceDbgWithTestKeys
25 2..31 SysFwRatchet0[0..29] (Shadow)
26 0..1 SysFwRatchet0[30..31]
26 2..31 SysFwRatchet1[0..29]
27 0..1 SysFwRatchet0[30..31] (Shadow)
27 2..31 SysFwRatchet1[0..29] (Shadow)
28 0..1 SysFwRatchet1[30..31]
28 2..31 SysFwRatchet2[0..29]
29 0..1 SysFwRatchet1[30..31] (Shadow)
29 2..31 SysFwRatchet2[0..29] (Shadow)
30 0..1 SysFwRatchet2[30..31]
30 2..31 SysFwRatchet3[0..29] (Shadow)
31 0..1 SysFwRatchet2[30..31]
31 2..31 SysFwRatchet3[0..29] (Shadow)
32 0..1 SysFwRatchet3[30..31]
32 2..31 CcplexUcodeFieldRatchet[0..29]
33 0..1 SysFwRatchet3[30..31] (Shadow)
33 2..31 CcplexUcodeFieldRatchet[0..29]
34 0..1 CcplexUcodeFieldRatchet[30..31]
34 2..31 Mb1FieldRatchet[0..29]
35 0..1 CcplexUcodeFieldRatchet[30..31]
35 2..31 Mb1FieldRatchet[0..29]
36 0..1 Mb1FieldRatchet[30..31]
36 4 IntegrityCheckEnable
36 5 Usb2NvJtagDisable
36 6 OptIstDisableDebug
36 21 SecurityModeReduntant
36 22..23 DebugAuthentication[5..6]
36 24 ForceDbgWithTestKeys
36 25 FaRedundant
36 26 ForceDbgWithTestKeysDuringPscDbg
36 27 ForceDbgWithTestKeysDuringPscDbg
36 28 CcplexDfdAccessDisable
37 0..1 Mb1FieldRatchet[30..31]
37 4 IntegrityCheckEnable
37 6 OptIstDisableDebug
37 21 SecurityModeReduntant (Shadow)
37 22..23 DebugAuthentication[5..6] (Shadow)
37 28 CcplexDfdAccessDisable (Shadow)
37 5 Usb2NvJtagDisable
37 24 ForceDbgWithTestKeys
37 25 FaRedundant (Shadow)
37 26 ForceDbgWithTestKeysDuringPscDbg
37 27 ForceDbgWithTestKeysDuringPscDbg
46 1 EnableCrJtagSecurity
46 6 ArmJtagDisableRedundant
46 7..22 BctFieldRatchet[0..15]
46 23 RevokePkH0
46 24 RevokePkH1
47 1 EnableCrJtagSecurity
47 6 ArmJtagDisableRedundant (Shadow)
47 7..22 BctFieldRatchet[0..15] (Shadow)
47 23 RevokePkH0
47 24 RevokePkH1
72 14..31 PscBlFieldRatchet[0..17]
73 14..31 PscBlFieldRatchet[0..17]
74 0..13 PscBlFieldRatchet[18..31]
75 0..13 PscBlFieldRatchet[18..31]
74 30..31 RomFeatureDisable[0..1]
75 30..31 RomFeatureDisable[0..1] (Shadow)
76 0..13 RomFeatureDisable[18..31]
76 14..19 FsiDebugAuthentication[0..5]
76 20..25 FsiDebugAuthentication[0..5]
77 0..13 RomFeatureDisable[18..31] (Shadow)
77 14..19 FsiDebugAuthentication[0..5] (Shadow)
77 20..25 FsiDebugAuthentication[0..5] (Shadow)
84 32 Sku
87 14..27 ReservedProduction
97 22..28 CcplexUcodeNvRevision[0..6]
105 18..23 MphyNvCalib[0..5]
105 24..30
106 12..31 BootNvInfo[0..19]
107 0..11 BootNvInfo[20..31]
108 13 AsyncL1aRstEnable
108 14 AsyncL0RstEnable
107 0..11 BootNvInfo[20..31]
119 14..15 BootRo
127 7 BootRomSelect
170 14..20
188 21..31 PublicKeyHash[0][0..10]
189 0..20 PublicKeyHash[0][11..31]
189 21..31 PublicKeyHash[1][0..10]
190 0..20 PublicKeyHash[1][11..31]
190 21..31 PublicKeyHash[2][0..10]
191 0..20 PublicKeyHash[2][11..31]
191 21..31 PublicKeyHash[3][0..10]
192 0..20 PublicKeyHash[3][11..31]
192 21..31 PublicKeyHash[4][0..10]
193 0..20 PublicKeyHash[4][11..31]
193 21..31 PublicKeyHash[5][0..10]
194 0..20 PublicKeyHash[5][11..31]
194 21..31 PublicKeyHash[6][0..10]
195 0..20 PublicKeyHash[6][11..31]
195 21..31 PublicKeyHash[7][0..10]
196 0..20 PublicKeyHash[7][11..31]
196 21..31 BootDevInfo[0..10]
197 0..12 BootDevInfo[19..31]
198 5..8 MphyOdmCalib[0..3]
198 9..22 BootSecurityInfo[0..14]
200 0..1 SecureProvisionInfo[0..1]
202 2..5 SecureInSysBistCtrl[0..3]
202 6..6 Flw2[0..0]
199 0..8 BootSecurityInfo[15..31]
199 9..24 OdmInfo[0..15]
200 2..31 OdmId[0][0..29]
201 0..1 OdmId[0][30..31]
201 2..31 OdmId[1][0..29]
202 0..1 OdmId[1][30..31]
202 7 OptInEnable
202 8..31 PublicKeyHash[8][0..23]
203 0..7 PublicKeyHash[8][24..31]
203 8..31 PublicKeyHash[9][0..23]
204 0..7 PublicKeyHash[9][24..31]
204 8..31 PublicKeyHash[10][0..23]
205 0..7 PublicKeyHash[10][24..31]
205 8..31 PublicKeyHash[11][0..23]
206 0..7 PublicKeyHash[11][24..31]
206 8..31 PublicKeyHash[12][0..23]
207 0..7 PublicKeyHash[12][24..31]
207 8..31 PublicKeyHash[13][0..23]
208 0..7 PublicKeyHash[13][24..31]
208 8..31 PublicKeyHash[14][0..23]
209 0..7 PublicKeyHash[14][24..31]
209 8..31 PublicKeyHash[15][0..23]
210 0..7 PublicKeyHash[15][24..31]
210 8..31 EvitaMvk[0..31]
211 0..7 EvitaMvk[0..31]
211 8..31 EvitaMvk[32..63]
212 0..7 EvitaMvk[32..63]
212 8..31 EvitaMvk[64..95]
213 0..7 EvitaMvk[64..95]
213 8..31 EvitaMvk[96..127]
214 0..7 EvitaMvk[96..127]
214 8..31 EvitaMvk[128..159]
215 0..7 EvitaMvk[128..159]
215 8..31 EvitaMvk[160..191]
216 0..7 EvitaMvk[160..191]
216 8..31 EvitaMvk[192..223]
217 0..7 EvitaMvk[192..223]
217 8..31 EvitaMvk[224..255]
218 0..7 EvitaMvk[224..255]
218 8..31 EvitaCsk[0..31]
219 0..7 EvitaCsk[0..31]
219 8..31 EvitaCsk[32..63]
220 0..7 EvitaCsk[32..63]
220 8..31 EvitaCsk[64..95]
221 0..7 EvitaCsk[64..95]
221 8..31 EvitaCsk[96..127]
222 0..7 EvitaCsk[96..127]
222 8..31 EvitaCsk[128..159]
223 0..7 EvitaCsk[128..159]
223 8..31 EvitaCsk[160..191]
224 0..7 EvitaCsk[160..191]
224 8..31 EvitaCsk[192..223]
225 0..7 EvitaCsk[192..223]
225 8..31 EvitaCsk[224..255]
226 0..7 EvitaCsk[224..255]
226 8..23 SecuritySwOdm[0..15]
226 24 OemFuseEncShadow
242 25..31 PkcPubkeyHash1[0..6]
242 0..24 PkcPubkeyHash1[7..31]
243 25..31 PkcPubkeyHash1[0..6]
243 0..24 PkcPubkeyHash1[7..31]
244 25..31 PkcPubkeyHash1[0..6]
244 0..24 PkcPubkeyHash1[7..31]
245 25..31 PkcPubkeyHash1[0..6]
245 0..24 PkcPubkeyHash1[7..31]
246 25..31 PkcPubkeyHash1[0..6]
246 0..24 PkcPubkeyHash1[7..31]
247 25..31 PkcPubkeyHash1[0..6]
247 0..24 PkcPubkeyHash1[7..31]
248 25..31 PkcPubkeyHash1[0..6]
248 0..24 PkcPubkeyHash1[7..31]
249 25..31 PkcPubkeyHash1[0..6]
249 0..24 PkcPubkeyHash1[7..31]
250 25..31 PkcPubkeyHash1[0..6]
250 0..24 PkcPubkeyHash1[7..31]
251 25..31 PkcPubkeyHash1[0..6]
251 0..24 PkcPubkeyHash1[7..31]
252 25..31 PkcPubkeyHash1[0..6]
252 0..24 PkcPubkeyHash1[7..31]
253 25..31 PkcPubkeyHash1[0..6]
253 0..24 PkcPubkeyHash1[7..31]
254 25..31 PkcPubkeyHash1[0..6]
254 0..24 PkcPubkeyHash1[7..31]
255 25..31 PkcPubkeyHash1[0..6]
255 0..24 PkcPubkeyHash1[7..31]
256 25..31 PkcPubkeyHash1[0..6]
256 0..24 PkcPubkeyHash1[7..31]
257 25..31 PkcPubkeyHash1[0..6]
257 0..24 PkcPubkeyHash1[7..31]
258 0..24 PkcPubkeyHash1[7..31]
258 25..31 #H2[0..6]
259 0..24 #H2[7..31]
727 0..31 PscOdmStatic[0..31]
728 0..31 PscOdmStatic[0..31]
729 0..31 EndorseKey[0..31]
730 0..31 EndorseKey[32..63]
731 0..31 EndorseKey[64..95]
732 0..31 EndorseKey[96..127]
733 0..31 EndorseKey[128..159]
734 0..31 EndorseKey[160..191]
735 0..31 EndorseKey[192..223]
736 0..31 EndorseKey[224..255]
737 0..31 EndorseKey[256..287]
738 0..31 EndorseKey[288..319]
739 0..31 EndorseKey[320..351]
740 0..31 EndorseKey[352..383]
741 0..31 EndorseKey[384..415]
742 0..31 EndorseKey[416..447]
743 0..31 EndorseKey[448..479]
744 0..31 EndorseKey[480..511]
745 0..8 EndorseKey[512..520]
746 0..31 EndorseKeyTag[0..31]
747 0..31 EndorseKeyTag[32..63]
748 0..31 EndorseKeyTag[64..95]
749 0..31 EndorseKeyTag[96..127]
750 0..31 EvitaIdk[0..31]
751 0..31 EvitaIdk[32..63]
752 0..31 EvitaIdk[64..95]
753 0..31 EvitaIdk[96..127]
754 0..31 EvitaIdk[128..159]
755 0..31 EvitaIdk[160..191]
756 0..31 EvitaIdk[192..223]
757 0..31 EvitaIdk[224..255]
758 0..31 EvitaIdkTag[0..31]
759 0..31 EvitaIdkTag[32..63]
760 0..31 EvitaIdkTag[64..95]
761 0..31 EvitaIdkTag[96..127]
762 0..31 OemFuseIv[0..31]
763 0..31 OemFuseIv[32..63]
764 0..31 OemFuseIv[64..95]
765 0..31 OemFuseIvTag[0..31]
766 0..31 SecureBootKey[0..31]
767 0..31 SecureBootKey[32..63]
768 0..31 SecureBootKey[64..95]
769 0..31 SecureBootKey[96..127]
770 0..31 SecureBootKey[128..159]
771 0..31 SecureBootKey[160..191]
772 0..31 SecureBootKey[192..223]
773 0..31 SecureBootKey[224..255]
774 0..31 SecureBootKeyTag[0..31]
775 0..31 SecureBootKeyTag[32..63]
776 0..31 SecureBootKeyTag[64..95]
777 0..31 SecureBootKeyTag[96..127]
778 0..31 Kdk0[0..31]
779 0..31 Kdk0[32..63]
780 0..31 Kdk0[64..95]
781 0..31 Kdk0[96..127]
782 0..31 Kdk0[128..159]
783 0..31 Kdk0[160..191]
784 0..31 Kdk0[192..223]
785 0..31 Kdk0[224..255]
786 0..31 Kdk0Tag[0..31]
787 0..31 Kdk0Tag[32..63]
788 0..31 Kdk0Tag[64..95]
789 0..31 Kdk0Tag[96..127]
790 0..31 OemK1[0..31]
791 0..31 OemK1[32..63]
792 0..31 OemK1[64..95]
793 0..31 OemK1[96..127]
794 0..31 OemK1[128..159]
795 0..31 OemK1[160..191]
796 0..31 OemK1[192..223]
797 0..31 OemK1[224..255]
798 0..31 OemK1Tag[0..31]
799 0..31 OemK1Tag[32..63]
800 0..31 OemK1Tag[64..95]
801 0..31 OemK1Tag[96..127]
802 0..31 OemK2[0..31]
803 0..31 OemK2[32..63]
804 0..31 OemK2[64..95]
805 0..31 OemK2[96..127]
806 0..31 OemK2[128..159]
807 0..31 OemK2[160..191]
808 0..31 OemK2[192..223]
809 0..31 OemK2[224..255]
810 0..31 OemK2Tag[0..31]
811 0..31 OemK2Tag[32..63]
812 0..31 OemK2Tag[64..95]
813 0..31 OemK2Tag[96..127]
814 0..31 FkddSk[0..31]
815 0..31 FkddSk[32..63]
816 0..31 FkddSk[64..95]
817 0..31 FkddSk[96..127]
818 0..31 FkddSk[128..159]
819 0..31 FkddSk[160..191]
820 0..31 FkddSk[192..223]
821 0..31 FkddSk[224..255]
822 0..31 FkddSkTag[0..31]
823 0..31 FkddAk[0..31]
824 0..31 FkddAk[32..63]
825 0..31 FkddAk[64..95]
826 0..31 FkddAk[96..127]
827 0..31 FkddAk[128..159]
828 0..31 FkddAk[160..191]
829 0..31 FkddAk[192..223]
830 0..31 FkddAk[224..255]
831 0..31 FkddAkTag[0..31]


Fuses

Some fuses are mirrored in MMIO registers.

Some fuses are stored redundantly.

FuseId Name Length Mmio Notes
0 BootSecurityInfo 14 bits [0x3810268] & 0x3FFF
1 #SecBootDeviceSelect 3 bits [0x38101C0] & 7
2 Uid Complicated
3 Sku [0x3810110]
4 Tid [0x38101CC]
5 CpuSpeedo0 [0x3810114]
6 CpuSpeedo1
7 CpuSpeedo2
8 CpuIddq [0x3810478]
9 SocSpeedo0 [0x3810134]
10 SocSpeedo1
11 SocSpeedo2
12 Fa [0x38107BC]
13 Apb2JtagDisable [0x3810298]
14 TpcDisable [0x381030C]
15 Apb2JtagLock 1 bit ([0x38101F4] >> 3) & 1
16 SocIddq [0x3810140]
17 RomFeatureDisable [0x3810BF0]
18 BootNvInfo [0x3810578]
19 AsyncL1aRstEnable [0x38105B4]
20 AsyncL0RstEnable [0x38105B8]
21 OemFuseEncShadow [0x38108B8]
22 ReservedProduction [0x381014C]
23 HyperVoltaging [0x3810354]
24 MphyNvCalib [0x38104A0]
25 OptPrivSecEn [0x3810264]
26 UsbCalib [0x38101F0]
27 UsbCalibExt [0x3810350]
28 ProductionMode [0x3810100]
29 SecurityMode [0x38101A0]
30 OdmLock [0x3810108]
31 ArmJtagDisable [0x38101B8]
32 ReservedOdm0 [0x38101C8]
33 ReservedOdm1
34 ReservedOdm2 [0x38101D0]
35 ReservedOdm3 [0x38101D4]
36 ReservedOdm4 [0x38101D8]
37 ReservedOdm5 [0x38101DC]
38 ReservedOdm6 [0x38101E0]
39 ReservedOdm7 [0x38101E4]
40 BootRomSelect [0x3810868]
41 BootRo [0x381075C]
42 PublicKeyHash 512 bits [0x3810164]..[0x3810180] and [0x381065C]..[0x3810678] A SHA512 of the public key.
44 SwReserved 4 bits ([0x38101C0] >> 4) & 0xF
45 BootDevSelect 3 bits [0x38101C0] & 7
46 IgnoreBootDevStraps 1 bit ([0x38101C0] >> 3)
47 BootDevInfo [0x38101BC]
48 Mb1NvRevision [0x38104B8]
49 PscBlNvRevision [0x3810BD0]
50 SysFwRatchet0 [0x3810520]
51 SysFwRatchet1 [0x3810524]
52 SysFwRatchet2 [0x3810528]
53 SysFwRatchet3 [0x381052C]
54 Mb1FieldRatchet [0x3810534]
55 PscBlFieldRatchet [0x3810BD4]
56 CcplexUcodeFieldRatchet [0x3810530]
57 OdmId 64 bits [0x3810408]..[0x381040C]
58 #H2 [0x381043C]
59 OdmInfo [0x381029C]
60 DebugAuthentication [0x38102E4]
61 CcplexDfdAccessDisable [0x38102BC]
62 CvDisable [0x38104F8]
63 BctFieldRatchet [0x381091C]
64 CcplexUcodeNvRevision [0x3810364]
65 OptSampleType [0x3810244]
66 BootromPatchVersion [0x38104A8]
72 OptEmcDisable [0x38109C0]
73 SecureProvisionIndex [0x38102E8]
74 OptCcplexClusterDisable [0x3810314]
75 OptGpcDisable [0x3810288]
76 OptDlaDisable [0x38104F0]
77 FsiDebugAuthentication [0x3810C48]
78 EvitaMvk 256 bits [0x38107CC]..[0x38107E8]
79 EvitaCsk 256 bits [0x38107EC]..[0x3810808]
80 SecureProvisionInfo [0x38102EC]
81 MphyOdmCalib [0x3810224]
82 ForceDbgWithTestKeys [0x38104C8]
83 ForceDbgWithTestKeysDuringPscDbg [0x38107C0]
84 SecureInSysBistCtrl [0x38104CC]
85 Flw2 [0x3810568]
86 Usb2NvJtagDisable [0x3810590]
87 EnableCrJtagSecurity [0x3810884]
88 OptInEnable [0x38105A8]
89 SecuritySwOdm [0x3810840]
90 ZeroizeDis [0x38109A8]
91 IntegrityCheckEnable [0x3810540]
92 NvJtagProtectionEnable [0x38101EC]
93 PkcPubkeyHash1 512 bits [0x3810920]..[0x381095C]
94 PkcPubkeyHash2 512 bits [0x3810960]..[0x38109BC]
95 PscOdmStatic
96 EndorseKey
97 EndorseKeyTag
98 EvitaIdk
99 EvitaIdkTag
100 OemFuseIv
101 OemFuseIvTag
102 SecureBootKey
103 SecureBootKeyTag
104 Kdk0
105 Kdk0Tag
106 OemK1
107 OemK1Tag
108 OemK2
109 OemK2Tag
110 FkddSk
111 FkddSkTag
112 FkddAk
113 FkddAkTag
114 RevokePkH0 [0x38109A0]
115 RevokePkH1 [0x38109A4]
116 ObsDis [0x38101E8]
117 OptIstDisableDebug [0x38105C4]
118 [0x3810BD8]
119 [0x3810CC8]
120 [0x3810830]
121 [0x3810834]
122 [0x3810A24]
123 [0x3810A28]
124 [0x3810A2C]
125 [0x3810A30]
126 [0x3810A14]
127

SecBootDeviceSelect

Only valid if IgnoreBootDevStraps == 1.

H2

CRC32 of physical fuse words #188 bit20 and above, up to word #259 bit24. Uses polynomial 0x1EDC6F41.

Valid if SecurityMode == 1.