2,928
edits
Changes
Jump to navigation
Jump to search
Line 161:
Line 161: − + Line 239:
Line 239: − + Line 644:
Line 644: + + + + + Line 652:
Line 657: − + − + Line 663:
Line 668: − + − + − + Line 684:
Line 689: − + Line 696:
Line 701: − + Line 710:
Line 715: − + − Stores part of the speedo fusing revision.+ − + − + − ==== FUSE_SPARE_BIT_4 ====+ − Stores part of the speedo fusing revision. − − ==== FUSE_SPARE_BIT_5 ==== − Must be non-zero on retail units, otherwise the first bootloader panics. − On debug units it can be zero, which tells the bootloader to choose from two debug master key seeds. If set to non-zero on a debug unit, it tells the bootloader to choose from two retail master key seeds (only the last one matches the retail master key seed). − − ==== FUSE_PUBLIC_KEY ==== − This stores the SHA256 hash of the 2048-bit RSA key expected at BCT+0x210. Line 755:
Line 752: + + + + + + + + + + + + + + + + + Line 836:
Line 850: − +
no edit summary
| 0x7000F924
| 0x7000F924
|-
|-
| FUSE_OPT_FT_REV
| [[#FUSE_OPT_FT_REV|FUSE_OPT_FT_REV]]
| 0x7000F928
| 0x7000F928
|-
|-
| 0x7000F98C
| 0x7000F98C
|-
|-
| FUSE_OPT_CP_REV
| [[#FUSE_OPT_CP_REV|FUSE_OPT_CP_REV]]
| 0x7000F990
| 0x7000F990
|-
|-
==== FUSE_SKU_INFO ====
==== FUSE_SKU_INFO ====
Stores the SKU ID (must be 0x83).
Stores the SKU ID (must be 0x83).
==== FUSE_OPT_FT_REV ====
Stores the FT (Final Test) revision.
Original launch units have this value set to 0xA0 (revision 5.0). The first batch of patched units have this value set to 0xC0 (revision 6.0).
==== FUSE_FA ====
==== FUSE_FA ====
==== FUSE_RESERVED_ODM0 ====
==== FUSE_RESERVED_ODM0 ====
This appears to store a hardware ID.
This stores an hardware ID.
==== FUSE_RESERVED_ODM1 ====
==== FUSE_RESERVED_ODM1 ====
This appears to store a hardware ID.
This stores an hardware ID.
==== FUSE_RESERVED_ODM2 ====
==== FUSE_RESERVED_ODM2 ====
|-
|-
| 0-4
| 0-4
| [5.0.0+] Used as key generation
| [5.0.0+] Used as key generation (patched units only)
|}
|}
This appears to store a hardware ID.
This stores an hardware ID in original launch units, but in patched units it stores a single value (key generation).
==== FUSE_RESERVED_ODM3 ====
==== FUSE_RESERVED_ODM3 ====
This appears to store a hardware ID.
This stores an hardware ID in original launch units, but in patched units it's empty.
==== FUSE_RESERVED_ODM4 ====
==== FUSE_RESERVED_ODM4 ====
| [1.0.0-3.0.2] 3-5
| [1.0.0-3.0.2] 3-5
[4.0.0+] 3-7
[4.0.0+] 3-7
| DRAM id
| DRAM ID
|-
|-
| 8
| 8
|-
|-
| 11
| 11
| [5.0.0+] SoC variant (0 = T210; 1 = T214)
| [5.0.0+] Unit patch flag (0 = unpatched; 1 = patched)
|-
|-
| 16-19
| 16-19
This register returns the value programmed into index 0x3C of the fuse array.
This register returns the value programmed into index 0x3C of the fuse array.
==== FUSE_SPARE_BIT_2 ====
==== FUSE_PUBLIC_KEY ====
This stores the SHA256 hash of the 2048-bit RSA key expected at BCT+0x210.
==== FUSE_SPARE_BIT_3 ====
==== FUSE_OPT_CP_REV ====
Stores part of the speedo fusing revision.
Stores the CP (Chip Probing) revision.
Original launch units have this value set to 0xA0 (revision 5.0). The first batch of patched units have this value set to 0x103 (revision 8.3).
==== FUSE_PRIVATE_KEY ====
==== FUSE_PRIVATE_KEY ====
This stores the 160-bit private key (128 bit SBK + 32-bit device key).
This stores the 160-bit private key (128 bit SBK + 32-bit device key).
Reads to these registers after the SBK is locked out produce all-FF output.
Reads to these registers after the SBK is locked out produce all-FF output.
==== FUSE_RESERVED_SW ====
==== FUSE_RESERVED_SW ====
This caches the value of the sw_reserved fuse from the hardware array.
This caches the value of the sw_reserved fuse from the hardware array.
Original launch units have the RCM USB controller mode set to USB 2.0, while the first batch of patched units have the RCM USB controller mode set to XUSB.
==== FUSE_PKC_DISABLE ====
==== FUSE_PKC_DISABLE ====
This caches the value of the pkc_disable fuse from the hardware array.
This caches the value of the pkc_disable fuse from the hardware array.
==== FUSE_SPARE_BIT_2 ====
Stores part of the speedo fusing revision.
==== FUSE_SPARE_BIT_3 ====
Stores part of the speedo fusing revision.
==== FUSE_SPARE_BIT_4 ====
Stores part of the speedo fusing revision.
==== FUSE_SPARE_BIT_5 ====
Must be non-zero on retail units, otherwise the first bootloader panics.
On debug units it can be zero, which tells the bootloader to choose from two debug master key seeds. If set to non-zero on a debug unit, it tells the bootloader to choose from two master key seeds (with the second one being the retail master key seed).
[4.0.0+] This value is no longer used during boot.
== eFuses ==
== eFuses ==
=== bootrom_ipatch ===
=== bootrom_ipatch ===
Tegra210 based hardware such as the Switch provides support for bootrom patches. The patch data is burned to the hardware fuse array using a specific format (see [https://gist.github.com/shuffle2/f8728159da100e9df2606d43925de0af shuffle2's ipatch decoder]). The bootrom reads these fuses in order to initialize the IPATCH hardware, which allows overriding data returned for code and data fetches done by BPMP. The revision stored in FUSE_CP_REV indicates the unique set of values stored in ipatch fuses.
Tegra210 based hardware such as the Switch provides support for bootrom patches. The patch data is burned to the hardware fuse array using a specific format (see [https://gist.github.com/shuffle2/f8728159da100e9df2606d43925de0af shuffle2's ipatch decoder]). The bootrom reads these fuses in order to initialize the IPATCH hardware, which allows overriding data returned for code and data fetches done by BPMP.
The following represents the patch data dumped from a Switch console:
The following represents the patch data dumped from a Switch console: