Fuses: Difference between revisions

Line 479:

| 0x52

| 1

|-

| [[#bootrom_ipatch|bootrom_ipatch]]

| 0x72

| 624

|-

|}

Line 485:

Line 489:

The first bootloader only burns fuses in this region.

Both fuse indexes 0x3A (odm_reserved + 0x0C) and 0x3C (odm_reserved + 0x0E) are used for anti-downgrade control. These fuses will have their values cached into [[#FUSE_RESERVED_ODM6|FUSE_RESERVED_ODM6]] and [[#FUSE_RESERVED_ODM7|FUSE_RESERVED_ODM7]].

=== bootrom_ipatch ===

Tegra210 based hardware such as the Switch provides support for bootrom patches. The patch data is burned to the hardware fuse array using a specific format (see [https://gist.github.com/shuffle2/f8728159da100e9df2606d43925de0af shuffle2's ipatch decoder]) and is executed by the bootrom, replacing it's original code.

The following represents the patch data dumped from a 2.0.0 Switch console:

Patch address Patch data

0x001016AE 0xDF00 // svc #0x00 (offset 0x48)

0x00103040 0xDF22 // svc #0x22 (offset 0x8c)

0x00106F2E 0xDF26 // svc #0x26 (offset 0x94)

0x0010FB3C 0x2000 // movs r0, #0x00

0x00100856 0xDF2C // svc #0x2c (offset 0xa0)

0x00106F54 0xDF42 // svc #0x42 (offset 0xcc)

0x001012E4 0xDF4B // svc #0x4b (offset 0xde)

0x00104526 0xDF54 // svc #0x54 (offset 0xf0)

0x001043F4 0xDF5D // svc #0x5d (offset 0x102)

0x00117744 0xAC57 // data

0x00117758 0x3D19 // data

0x00103D2A 0x2001 // movs r0, #0x01

The last 4 patches are exclusive to the Switch, while the remaining ones are often included in most Tegra210 based devices.

== Anti-downgrade ==

@@ Line 479: / Line 479: @@
 | 0x52
 | 1
+|-
+| [[#bootrom_ipatch|bootrom_ipatch]]
+| 0x72
+| 624
 |-
 |}
@@ Line 485: / Line 489: @@
 The first bootloader only burns fuses in this region.
 Both fuse indexes 0x3A (odm_reserved + 0x0C) and 0x3C (odm_reserved + 0x0E) are used for anti-downgrade control. These fuses will have their values cached into [[#FUSE_RESERVED_ODM6|FUSE_RESERVED_ODM6]] and [[#FUSE_RESERVED_ODM7|FUSE_RESERVED_ODM7]].
+=== bootrom_ipatch ===
+Tegra210 based hardware such as the Switch provides support for bootrom patches. The patch data is burned to the hardware fuse array using a specific format (see [https://gist.github.com/shuffle2/f8728159da100e9df2606d43925de0af shuffle2's ipatch decoder]) and is executed by the bootrom, replacing it's original code.
+The following represents the patch data dumped from a 2.0.0 Switch console:
+ Patch address       Patch data
+x001016AE          0xDF00    // svc #0x00 (offset 0x48)
+x00103040          0xDF22    // svc #0x22 (offset 0x8c)
+x00106F2E          0xDF26    // svc #0x26 (offset 0x94)
+x0010FB3C          0x2000    // movs r0, #0x00
+x00100856          0xDF2C    // svc #0x2c (offset 0xa0)
+x00106F54          0xDF42    // svc #0x42 (offset 0xcc)
+x001012E4          0xDF4B    // svc #0x4b (offset 0xde)
+x00104526          0xDF54    // svc #0x54 (offset 0xf0)
+x001043F4          0xDF5D    // svc #0x5d (offset 0x102)
+x00117744          0xAC57    // data
+x00117758          0x3D19    // data
+x00103D2A          0x2001    // movs r0, #0x01
+The last 4 patches are exclusive to the Switch, while the remaining ones are often included in most Tegra210 based devices.
 == Anti-downgrade ==