Fuses
The Nintendo Switch makes use of Tegra's fuse driver for a number of operations. This driver is mapped to physical address 0x7000F800 with a total size of 0x400 bytes and exposes several registers for fuse programming.
Registers from 0x7000F800 to 0x7000F800 + 0xFF can be used to directly program the hardware fuse array, while registers from 0x7000F800 + 0x100 (FUSE_CHIP_REG_START_OFFSET) to 0x7000F800 + 0x3FC (FUSE_CHIP_REG_END_OFFSET) represent cached values read from certain fuses.
Registers
Below is a list of fuse driver registers used by the Switch's bootloaders.
Driver registers
| Name | Address |
|---|---|
| FUSE_CTRL | 0x7000F800 |
| FUSE_REG_ADDR | 0x7000F804 |
| FUSE_REG_READ | 0x7000F808 |
| FUSE_REG_WRITE | 0x7000F80C |
| FUSE_TIME_RD1 | 0x7000F810 |
| FUSE_TIME_RD2 | 0x7000F814 |
| FUSE_TIME_PGM1 | 0x7000F818 |
| FUSE_TIME_PGM2 | 0x7000F81C |
| FUSE_PRIV2INTFC | 0x7000F820 |
| FUSE_FUSEBYPASS | 0x7000F824 |
| FUSE_PRIVATEKEYDISABLE | 0x7000F828 |
| FUSE_DIS_PGM | 0x7000F82C |
| FUSE_WRITE_ACCESS | 0x7000F830 |
| FUSE_PWR_GOOD_SW | 0x7000F834 |
FUSE_CTRL
| Bits | Description |
|---|---|
| 0-1 | Fuse command (1 = FUSE_READ; 2 = FUSE_WRITE; 3 = FUSE_SENSE) |
| 26 | Fuse power down mode flag (FUSE_CTRL_PD) |
Before fuse reading/writing the power down mode must be disabled. FUSE_SENSE mode flushes programmed values into the cache registers.
FUSE_REG_ADDR
This register takes the address of the fuse to be read/written/sensed.
FUSE_REG_READ
This register receives the value read from the fuse.
FUSE_REG_WRITE
This register takes the value to be written to the fuse.
FUSE_TIME_PGM2
This register takes the fuse programming pulse (0xC0 == 19200 kHz).
FUSE_DIS_PGM
If set to 0x01, this register disables fuse programming.
FUSE_WRITE_ACCESS
If set to 0x01, this register disables software writes to the fuse driver registers.
Cache registers
| Name | Address |
|---|---|
| FUSE_PRODUCTION_MODE | 0x7000F900 |
| FUSE_SKU_INFO | 0x7000F910 |
| FUSE_CPU_SPEEDO_0 | 0x7000F914 |
| FUSE_CPU_IDDQ | 0x7000F918 |
| FUSE_FT_REV | 0x7000F928 |
| FUSE_CPU_SPEEDO_1 | 0x7000F92C |
| FUSE_CPU_SPEEDO_2 | 0x7000F930 |
| FUSE_SOC_SPEEDO_0 | 0x7000F934 |
| FUSE_SOC_SPEEDO_1 | 0x7000F938 |
| FUSE_SOC_SPEEDO_2 | 0x7000F93C |
| FUSE_SOC_IDDQ | 0x7000F940 |
| FUSE_FA | 0x7000F948 |
| FUSE_PUBLIC_KEY0 | 0x7000F964 |
| FUSE_PUBLIC_KEY1 | 0x7000F968 |
| FUSE_PUBLIC_KEY2 | 0x7000F96C |
| FUSE_PUBLIC_KEY3 | 0x7000F970 |
| FUSE_PUBLIC_KEY4 | 0x7000F974 |
| FUSE_PUBLIC_KEY5 | 0x7000F978 |
| FUSE_PUBLIC_KEY6 | 0x7000F97C |
| FUSE_PUBLIC_KEY7 | 0x7000F980 |
| FUSE_TSENSOR_1 | 0x7000F984 |
| FUSE_TSENSOR_2 | 0x7000F988 |
| FUSE_CP_REV | 0x7000F990 |
| FUSE_TSENSOR_0 | 0x7000F998 |
| FUSE_FIRST_BOOTROM_PATCH_SIZE_REG | 0x7000F99C |
| FUSE_SECURITY_MODE | 0x7000F9A0 |
| FUSE_PRIVATE_KEY0 | 0x7000F9A4 |
| FUSE_PRIVATE_KEY1 | 0x7000F9A8 |
| FUSE_PRIVATE_KEY2 | 0x7000F9AC |
| FUSE_PRIVATE_KEY3 | 0x7000F9B0 |
| FUSE_PRIVATE_KEY4 | 0x7000F9B4 |
| FUSE_RESERVED_SW | 0x7000F9C0 |
| FUSE_VP8_ENABLE | 0x7000F9C4 |
| FUSE_RESERVED_ODM0 | 0x7000F9C8 |
| FUSE_RESERVED_ODM1 | 0x7000F9CC |
| FUSE_RESERVED_ODM2 | 0x7000F9D0 |
| FUSE_RESERVED_ODM3 | 0x7000F9D4 |
| FUSE_RESERVED_ODM4 | 0x7000F9D8 |
| FUSE_RESERVED_ODM5 | 0x7000F9DC |
| FUSE_RESERVED_ODM6 | 0x7000F9E0 |
| FUSE_RESERVED_ODM7 | 0x7000F9E4 |
| FUSE_SKU_USB_CALIB | 0x7000F9F0 |
| FUSE_SKU_DIRECT_CONFIG | 0x7000F9F4 |
| FUSE_VENDOR_CODE | 0x7000FA00 |
| FUSE_FAB_CODE | 0x7000FA04 |
| FUSE_LOT_CODE_0 | 0x7000FA08 |
| FUSE_LOT_CODE_1 | 0x7000FA0C |
| FUSE_WAFER_ID | 0x7000FA10 |
| FUSE_X_COORDINATE | 0x7000FA14 |
| FUSE_Y_COORDINATE | 0x7000FA18 |
| FUSE_SATA_CALIB | 0x7000FA24 |
| FUSE_GPU_IDDQ | 0x7000FA28 |
| FUSE_TSENSOR_3 | 0x7000FA2C |
| FUSE_OPT_SUBREVISION | 0x7000FA48 |
| FUSE_TSENSOR_4 | 0x7000FA54 |
| FUSE_TSENSOR_5 | 0x7000FA58 |
| FUSE_TSENSOR_6 | 0x7000FA5C |
| FUSE_TSENSOR_7 | 0x7000FA60 |
| FUSE_OPT_PRIV_SEC_DIS | 0x7000FA64 |
| FUSE_PKC_DISABLE | 0x7000FA68 |
| FUSE_TSENSOR_COMMON | 0x7000FA80 |
| FUSE_DEBUG_AUTH_OVERRIDE | 0x7000FA9C |
| FUSE_TSENSOR_8 | 0x7000FAD4 |
| FUSE_RESERVED_CALIB | 0x7000FB04 |
| FUSE_TSENSOR_9 | 0x7000FB1C |
| FUSE_USB_CALIB_EXT | 0x7000FB50 |
| FUSE_SPARE_BIT_0 | 0x7000FB80 |
| FUSE_SPARE_BIT_1 | 0x7000FB84 |
| FUSE_SPARE_BIT_2 | 0x7000FB88 |
| FUSE_SPARE_BIT_3 | 0x7000FB8C |
| FUSE_SPARE_BIT_4 | 0x7000FB90 |
| FUSE_SPARE_BIT_5 | 0x7000FB94 |
| FUSE_SPARE_BIT_6 | 0x7000FB98 |
| FUSE_SPARE_BIT_7 | 0x7000FB9C |
| FUSE_SPARE_BIT_8 | 0x7000FBA0 |
| FUSE_SPARE_BIT_9 | 0x7000FBA4 |
| FUSE_SPARE_BIT_10 | 0x7000FBA8 |
| FUSE_SPARE_BIT_11 | 0x7000FBAC |
| FUSE_SPARE_BIT_12 | 0x7000FBB0 |
| FUSE_SPARE_BIT_13 | 0x7000FBB4 |
| FUSE_SPARE_BIT_14 | 0x7000FBB8 |
| FUSE_SPARE_BIT_15 | 0x7000FBBC |
| FUSE_SPARE_BIT_16 | 0x7000FBC0 |
| FUSE_SPARE_BIT_17 | 0x7000FBC4 |
| FUSE_SPARE_BIT_18 | 0x7000FBC8 |
| FUSE_SPARE_BIT_19 | 0x7000FBCC |
| FUSE_SPARE_BIT_20 | 0x7000FBD0 |
| FUSE_SPARE_BIT_21 | 0x7000FBD4 |
| FUSE_SPARE_BIT_22 | 0x7000FBD8 |
| FUSE_SPARE_BIT_23 | 0x7000FBDC |
| FUSE_SPARE_BIT_24 | 0x7000FBE0 |
| FUSE_SPARE_BIT_25 | 0x7000FBE4 |
| FUSE_SPARE_BIT_26 | 0x7000FBE8 |
| FUSE_SPARE_BIT_27 | 0x7000FBEC |
| FUSE_SPARE_BIT_28 | 0x7000FBF0 |
| FUSE_SPARE_BIT_29 | 0x7000FBF4 |
| FUSE_SPARE_BIT_30 | 0x7000FBF8 |
| FUSE_SPARE_BIT_31 | 0x7000FBFC |
FUSE_SKU_INFO
Stores the SKU ID (must be 0x83).
FUSE_FA
Stores failure analysis mode.
FUSE_SOC_SPEEDO_1
Stores the bootrom patch version.
FUSE_RESERVED_ODM4
| Bits | Description |
|---|---|
| 0-1 | Unit type (3 = debug; 0 = retail) |
| 2 | Unknown config (must be 1 on retail) |
| 3-5 | DRAM id |
| 8 | Unknown config mask (must be 0 on retail) |
| 9 | Unit type mask (0 = debug; 1 = retail) |
| 10 | [4.0.0+] Unknown, returned by smcGetConfig(14) |
| 16-19 | [4.0.0+] Unknown config (hardware-type-related) |
This stores some device configuration parameters.
FUSE_RESERVED_ODM6
This register returns the value programmed into index 0x3A of the fuse array.
FUSE_RESERVED_ODM7
This register returns the value programmed into index 0x3C of the fuse array.
FUSE_SPARE_BIT_5
Must be non-zero on retail units, otherwise the first bootloader panics. On debug units it can be zero, which tells the bootloader to choose from two debug master key seeds. If set to non-zero on a debug unit, it tells the bootloader to choose from two retail master key seeds (only the last one matches the retail master key seed).
FUSE_PRIVATE_KEY
This stores the 160-bit private key (128 bit SBK + 32-bit device key). Reads to these registers after the SBK is locked out produce all-FF output.
FUSE_PUBLIC_KEY
This stores the SHA256 hash of the 2048-bit RSA key expected at BCT+0x210.
FUSE_RESERVED_SW
| Bits | Description |
|---|---|
| 5 | ENABLE_WATCHDOG |
| 6 | Forced RCM two button mode (0 = Only VOLUME_UP; 1 = VOLUME_UP + HOME) |
| 7 | RCM USB controller mode (0 = USB 2.0; 1 = XUSB) |
This caches the value of the sw_reserved fuse from the hardware array.
FUSE_PKC_DISABLE
This caches the value of the pkc_disable fuse from the hardware array.
eFuses
The actual hardware fuses can be programmed through the fuse driver after enabling fuse programming.
Below is a list of common fuse indexes used by Tegra devices (and applicable to the Switch). Note that the indexes are relative to the start of the fuse array and each element is a 4 byte word. A single fuse write operation always writes the same word at both fuse_array + 0 (PRIMARY_ALIAS) and fuse_array + 1 (REDUNDANT_ALIAS).
| Name | Index | Bits |
|---|---|---|
| jtag_disable | 0x00 | 1 |
| odm_production_mode | 0x00 | 1 |
| odm_lock | 0x00 | 4 |
| public_key | 0x0C | 256 |
| secure_boot_key | 0x22 | 128 |
| device_key | 0x2A | 32 |
| sec_boot_dev_cfg | 0x2C | 16 |
| sec_boot_dev_sel | 0x2C | 3 |
| sw_reserved | 0x2E | 12 |
| ignore_dev_sel_straps | 0x2E | 1 |
| odm_reserved | 0x2E | 256 |
| pkc_disable | 0x52 | 1 |
| bootrom_ipatch | 0x72 | 624 |
odm_reserved
The first bootloader only burns fuses in this region. Both fuse indexes 0x3A (odm_reserved + 0x0C) and 0x3C (odm_reserved + 0x0E) are used for anti-downgrade control. These fuses will have their values cached into FUSE_RESERVED_ODM6 and FUSE_RESERVED_ODM7.
bootrom_ipatch
Tegra210 based hardware such as the Switch provides support for bootrom patches. The patch data is burned to the hardware fuse array using a specific format (see shuffle2's ipatch decoder). The bootrom reads these fuses in order to initialize the IPATCH hardware, which allows overriding data returned for code and data fetches done by BPMP.
The revision stored in FUSE_CP_REV indicates the unique set of values stored in ipatch fuses.
The following represents the patch data dumped from a 2.0.0 Switch console:
Patch address Patch data 0x001016AE 0xDF00 // svc #0x00 (offset 0x48) 0x00103040 0xDF22 // svc #0x22 (offset 0x8c) 0x00106F2E 0xDF26 // svc #0x26 (offset 0x94) 0x0010FB3C 0x2000 // movs r0, #0x00 0x00100856 0xDF2C // svc #0x2c (offset 0xa0) 0x00106F54 0xDF42 // svc #0x42 (offset 0xcc) 0x001012E4 0xDF4B // svc #0x4b (offset 0xde) 0x00104526 0xDF54 // svc #0x54 (offset 0xf0) 0x001043F4 0xDF5D // svc #0x5d (offset 0x102) 0x00117744 0xAC57 // data 0x00117758 0x3D19 // data 0x00103D2A 0x2001 // movs r0, #0x01
The last 4 patches are exclusive to the Switch, while the remaining ones are often included in most Tegra210 based devices.
Anti-downgrade
The first bootloader verifies FUSE_RESERVED_ODM7 to prevent downgrading. How many fuses are expected to be burnt depends the device's unit type as below.
| System version | Expected number of burnt fuses (retail) | Expected number of burnt fuses (non-retail) |
|---|---|---|
| 1.0.0 | 1 | 0 |
| 2.0.0-2.3.0 | 2 | 0 |
| 3.0.0 | 3 | 1 |
| 3.0.1-3.0.2 | 4 | 1 |
| 4.0.0-4.1.0 | 5 | 1 |
| 5.0.0 | 6 | 1 |
If too many fuses are burnt the bootloader will panic immediately.
If too few are burnt, the bootloader will enable fuse programming and write the expected value to fuse indexes 0x3A and 0x3C. Afterwards, fuse programming is disabled and the panic value 0x21 is written to PMC_SCRATCH200 register (0x7000EC40). Finally, the watchdog timer is initialized and programmed to force a reset.
On a subsequent boot, after the anti-downgrade fuses are checked again, the PMC_RST_STATUS register (0x7000E5B4) is checked and if set to 0x01 (watchdog reset) the PMC_SCRATCH200 register (0x7000EC40) will be checked for the panic value 0x21. PMC_RST_STATUS will only be set back to 0 (power on reset) if the fuse count matches the new expected value, otherwise the system will panic.