switch2brew - User contributions [en]

Hardware

2025-06-29T23:22:46Z

Retr0id: USB hub connections

= Motherboard =
== Nintendo Switch 2 ==
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| BEE-CPU-01 || Retail Nintendo Switch 2
|}

=== DRAM Layout ===
The footprint is BGA-441 (JEDEC [https://www.jedec.org/standards-documents/docs/mo-342a MO-342]), with ballout defined by JEDEC [https://www.jedec.org/standards-documents/docs/jesd209-5c JESD209-5C] (LPDDR5X). This annotated image shows the signals routed on the top layer of the PCB, for the IC south of the SoC. The signals routed here are CS0-1, CA0-6, and CK, for each of the four channels.

[[File:Dram traces annotated.jpg|frameless|619x619px]]

= Specifications =
== Nintendo Switch 2 ==
{| class="wikitable" border="1"
|-
! Component || Description
|-
| SoC || NVIDIA GMLX30-A1 ([[T239]])
|-
| Screen || Innolux ZD079KA-03A
|-
| Storage || Toshiba/Kioxia THGJFGT1E45BAILHW0 256 GB UFS 3.1 or SKhynix HN8T15DEHKX075 256 GB UFS 3.1
|-
| Memory || SKhynix H58GE6AK8BX107 6 GB LPDDR5X DRAM x2 (12GB total)
or
Samsung K3KL2L20DM-JGCT 6 GB LPDDR5X DRAM x2 (12GB total)
|-
| Wifi/BT || MediaTek MT3681AEN (same footprint and similar pinout to [https://www.digikey.com/en/products/detail/mediatek/MT7921LEN-B/24633572 MT7921LEN])
|-
| PMIC || Maxim Integrated MAX77851SAWJ+T
|-
| Sub-PMIC || Renesas/Dialog DA9092-AIOV2
|-
| Audio || Realtek ALC5658
|-
| Voice || Intelligo Technology IG2200
|-
| USB 2.0 Hub || Genesys Logic GL852G-OHY60 (Connects to joycons, WiFi/BT IC, with upstream port to SoC)
|-
| USB-C || Cypress CYPD6228-96BZXI (CP10359AT)
|-
| GC ASIC || B2349 GCBRG HAC STD T2010423
|}

Hardware

2025-06-29T22:09:01Z

Retr0id: Note similar WiFi/bt part

= Motherboard =
== Nintendo Switch 2 ==
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| BEE-CPU-01 || Retail Nintendo Switch 2
|}

=== DRAM Layout ===
The footprint is BGA-441 (JEDEC [https://www.jedec.org/standards-documents/docs/mo-342a MO-342]), with ballout defined by JEDEC [https://www.jedec.org/standards-documents/docs/jesd209-5c JESD209-5C] (LPDDR5X). This annotated image shows the signals routed on the top layer of the PCB, for the IC south of the SoC. The signals routed here are CS0-1, CA0-6, and CK, for each of the four channels.

[[File:Dram traces annotated.jpg|frameless|619x619px]]

= Specifications =
== Nintendo Switch 2 ==
{| class="wikitable" border="1"
|-
! Component || Description
|-
| SoC || NVIDIA GMLX30-A1 ([[T239]])
|-
| Screen || Innolux ZD079KA-03A
|-
| Storage || Toshiba/Kioxia THGJFGT1E45BAILHW0 256 GB UFS 3.1 or SKhynix HN8T15DEHKX075 256 GB UFS 3.1
|-
| Memory || SKhynix H58GE6AK8BX107 6 GB LPDDR5X DRAM x2 (12GB total)
or
Samsung K3KL2L20DM-JGCT 6 GB LPDDR5X DRAM x2 (12GB total)
|-
| Wifi/BT || MediaTek MT3681AEN (same footprint and similar pinout to [https://www.digikey.com/en/products/detail/mediatek/MT7921LEN-B/24633572 MT7921LEN])
|-
| PMIC || Maxim Integrated MAX77851SAWJ+T
|-
| Sub-PMIC || Renesas/Dialog DA9092-AIOV2
|-
| Audio || Realtek ALC5658
|-
| Voice || Intelligo Technology IG2200
|-
| USB 2.0 Hub || Genesys Logic GL852G-OHY60
|-
| USB-C || Cypress CYPD6228-96BZXI (CP10359AT)
|-
| GC ASIC || B2349 GCBRG HAC STD T2010423
|}

T239

2025-06-28T21:01:00Z

Retr0id: Reformat specs into table

The NVIDIA T239 is a custom SoC designed to Nintendo's specifications. It has many aspects in common with the T234 SoC found in NVIDIA Orin products.

== Specifications ==
{| class="wikitable"
|+
!Component
!Description
|-
|CPU
|Eight 64-bit ARM Cortex [https://developer.arm.com/Processors/Cortex-A78C A78C] cores
|-
|Cache
|4 MB Shared L3 Cache, 256KB L2 Cache per core, 64KB/64KB (I/D) L1 Cache per core
|-
|Memory Bus
|LPDDR5X-3200, 128-bit (102 GB/s)
|-
|Memory Size
|12GB (2x 6GB)
|-
|GPU
|1536-core Ampere GPU
|}

== Notable Security Features ==

=== PAC ===
A78C supports Armv8.3-A Pointer Authentication and Armv8.6-A Enhanced Pointer Authentication instructions.

=== Memory Encryption ===
The T239 appears to support [https://docs.nvidia.com/jetson/archives/r35.4.1/DeveloperGuide/text/SD/Security/MemoryEncryption.html memory encryption], similar to the T234.

Memory within certain carveout regions is encrypted. The memory controller transparently encrypts data during writes and decrypts data during reads. For these regions, an attacker sniffing the external memory bus will see only ciphertext. Application memory is not encrypted, presumably for performance reasons, since encryption incurs a latency cost.

It is likely that encryption is tweaked on a per-physical-address basis. So, an attacker with control of the external memory bus cannot e.g. relocate data from one address to another.

There is no memory authentication, however. So in the event of external memory tampering, the CPU will read back garbled plaintext (effectively, random bytes). Although, it should in principle be possible to "replay" earlier values from a particular address.

=== XOM (eXecute-Only-Memory) ===
At present it is unknown if/where XOM is used, but the hardware does support it.

Hardware

2025-06-28T20:45:32Z

Retr0id: Link T239 from hardware page

= Motherboard =
== Nintendo Switch 2 ==
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| BEE-CPU-01 || Retail Nintendo Switch 2
|}

=== DRAM Layout ===
The footprint is BGA-441 (JEDEC [https://www.jedec.org/standards-documents/docs/mo-342a MO-342]), with ballout defined by JEDEC [https://www.jedec.org/standards-documents/docs/jesd209-5c JESD209-5C] (LPDDR5X). This annotated image shows the signals routed on the top layer of the PCB, for the IC south of the SoC. The signals routed here are CS0-1, CA0-6, and CK, for each of the four channels.

[[File:Dram traces annotated.jpg|frameless|619x619px]]

= Specifications =
== Nintendo Switch 2 ==
{| class="wikitable" border="1"
|-
! Component || Description
|-
| SoC || NVIDIA GMLX30-A1 ([[T239]])
|-
| Screen || Innolux ZD079KA-03A
|-
| Storage || Toshiba/Kioxia THGJFGT1E45BAILHW0 256 GB UFS 3.1 or SKhynix HN8T15DEHKX075 256 GB UFS 3.1
|-
| Memory || SKhynix H58GE6AK8BX107 6 GB LPDDR5X DRAM x2 (12GB total)
or
Samsung K3KL2L20DM-JGCT 6 GB LPDDR5X DRAM x2 (12GB total)
|-
| Wifi/BT || MediaTek MT3681AEN
|-
| PMIC || Maxim Integrated MAX77851SAWJ+T
|-
| Sub-PMIC || Renesas/Dialog DA9092-AIOV2
|-
| Audio || Realtek ALC5658
|-
| Voice || Intelligo Technology IG2200
|-
| USB 2.0 Hub || Genesys Logic GL852G-OHY60
|-
| USB-C || Cypress CYPD6228-96BZXI (CP10359AT)
|-
| GC ASIC || B2349 GCBRG HAC STD T2010423
|}

T239

2025-06-28T20:39:21Z

Retr0id: Memory Encryption caveat

NVIDIA T239 SoC Specifications

CPU
* Eight 64-bit ARM Cortex [https://developer.arm.com/Processors/Cortex-A78C A78C] cores

Cache
* 4 MB Shared L3 Cache, 256KB L2 Cache per core, 64KB/64KB (I/D) L1 Cache per core

Memory Frequency
* LPDDR5X-3200, 128-bit (102 GB/s)

Memory Size
* 12 GB

GPU
* Cores 1536-core Ampere GPU

== Notable Security Features ==

=== PAC ===
A78C supports Armv8.3-A Pointer Authentication and Armv8.6-A Enhanced Pointer Authentication instructions.

=== Memory Encryption ===
The T239 appears to support [https://docs.nvidia.com/jetson/archives/r35.4.1/DeveloperGuide/text/SD/Security/MemoryEncryption.html memory encryption], similar to the T234.

Memory within certain carveout regions is encrypted. The memory controller transparently encrypts data during writes and decrypts data during reads. For these regions, an attacker sniffing the external memory bus will see only ciphertext. Application memory is not encrypted, presumably for performance reasons, since encryption incurs a latency cost.

It is likely that encryption is tweaked on a per-physical-address basis. So, an attacker with control of the external memory bus cannot e.g. relocate data from one address to another.

There is no memory authentication, however. So in the event of external memory tampering, the CPU will read back garbled plaintext (effectively, random bytes). Although, it should in principle be possible to "replay" earlier values from a particular address.

=== XOM (eXecute-Only-Memory) ===
At present it is unknown if/where XOM is used, but the hardware does support it.

T239

2025-06-28T20:29:07Z

Retr0id: Document existence of XOM

NVIDIA T239 SoC Specifications

CPU
* Eight 64-bit ARM Cortex [https://developer.arm.com/Processors/Cortex-A78C A78C] cores

Cache
* 4 MB Shared L3 Cache, 256KB L2 Cache per core, 64KB/64KB (I/D) L1 Cache per core

Memory Frequency
* LPDDR5X-3200, 128-bit (102 GB/s)

Memory Size
* 12 GB

GPU
* Cores 1536-core Ampere GPU

== Notable Security Features ==

=== PAC ===
A78C supports Armv8.3-A Pointer Authentication and Armv8.6-A Enhanced Pointer Authentication instructions.

=== Memory Encryption ===
The T239 appears to support [https://docs.nvidia.com/jetson/archives/r35.4.1/DeveloperGuide/text/SD/Security/MemoryEncryption.html memory encryption], similar to the T234.

Memory within certain carveout regions is encrypted. The memory controller transparently encrypts data during writes and decrypts data during reads. For these regions, an attacker sniffing the external memory bus will see only ciphertext. Application memory is not encrypted, presumably for performance reasons, since encryption incurs a latency cost.

It is likely that encryption is tweaked on a per-physical-address basis. So, an attacker with control of the external memory bus cannot e.g. relocate data from one address to another.

There is no memory authentication, however. So in the event of external memory tampering, the CPU will read back garbled plaintext (effectively, random bytes).

=== XOM (eXecute-Only-Memory) ===
At present it is unknown if/where XOM is used, but the hardware does support it.

T239

2025-06-28T20:18:16Z

Retr0id: Document lack of memory authentication

T239

2025-06-28T20:10:26Z

Retr0id: Document PAC, Memory Encryption

Hardware

2025-06-25T21:32:30Z

Retr0id: Link to JEDEC MO-342 package spec

= Motherboard =
== Nintendo Switch 2 ==
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| BEE-CPU-01 || Retail Nintendo Switch 2
|}

=== DRAM Layout ===
The footprint is BGA-441 (JEDEC [https://www.jedec.org/standards-documents/docs/mo-342a MO-342]), with ballout defined by JEDEC [https://www.jedec.org/standards-documents/docs/jesd209-5c JESD209-5C] (LPDDR5X). This annotated image shows the signals routed on the top layer of the PCB, for the IC south of the SoC. The signals routed here are CS0-1, CA0-6, and CK, for each of the four channels.

[[File:Dram traces annotated.jpg|frameless|619x619px]]

= Specifications =
== Nintendo Switch 2 ==
{| class="wikitable" border="1"
|-
! Component || Description
|-
| SoC || NVIDIA GMLX30-A1
|-
| Screen || Innolux ZD079KA-03A
|-
| Storage || Toshiba/Kioxia THGJFGT1E45BAILHW0 256 GB UFS 3.1 or SKhynix HN8T15DEHKX075 256 GB UFS 3.1
|-
| Memory || SKhynix H58GE6AK8BX107 6 GB LPDDR5X DRAM x2 (12GB total)
or
Samsung K3KL2L20DM-JGCT 6 GB LPDDR5X DRAM x2 (12GB total)
|-
| Wifi/BT || MediaTek MT3681AEN
|-
| PMIC || Maxim Integrated MAX77851SAWJ+T
|-
| Sub-PMIC || Renesas/Dialog DA9092-AIOV2
|-
| Audio || Realtek ALC5658
|-
| Voice || Intelligo Technology IG2200
|-
| USB 2.0 Hub || Genesys Logic GL852G-OHY60
|-
| USB-C || Cypress CYPD6228-96BZXI (CP10359AT)
|-
| GC ASIC || B2349 GCBRG HAC STD T2010423
|}

Hardware

2025-06-24T23:17:27Z

Retr0id: Add DRAM trace annotation image

= Motherboard =
== Nintendo Switch 2 ==
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| BEE-CPU-01 || Retail Nintendo Switch 2
|}

=== DRAM Layout ===
The footprint is BGA-441, as defined by JEDEC [https://www.jedec.org/standards-documents/docs/jesd209-5c JESD209-5C] (LPDDR5X). This annotated image shows the signals routed on the top layer of the PCB, for the IC south of the SoC. The signals routed here are CS0-1, CA0-6, and CK, for each of the four channels.

[[File:Dram traces annotated.jpg|frameless|619x619px]]

= Specifications =
== Nintendo Switch 2 ==
{| class="wikitable" border="1"
|-
! Component || Description
|-
| SoC || NVIDIA GMLX30-A1
|-
| Screen || Innolux ZD079KA-03A
|-
| Storage || Toshiba/Kioxia THGJFGT1E45BAILHW0 256 GB UFS 3.1 or SKhynix HN8T15DEHKX075 256 GB UFS 3.1
|-
| Memory || SKhynix H58GE6AK8BX107 6 GB LPDDR5X DRAM x2 (12GB total)
or
Samsung K3KL2L20DM-JGCT 6 GB LPDDR5X DRAM x2 (12GB total)
|-
| Wifi/BT || MediaTek MT3681AEN
|-
| PMIC || Maxim Integrated MAX77851SAWJ+T
|-
| Sub-PMIC || Renesas/Dialog DA9092-AIOV2
|-
| Audio || Realtek ALC5658
|-
| Voice || Intelligo Technology IG2200
|-
| USB 2.0 Hub || Genesys Logic GL852G-OHY60
|-
| USB-C || Cypress CYPD6228-96BZXI (CP10359AT)
|-
| GC ASIC || B2349 GCBRG HAC STD T2010423
|}

File:Dram traces annotated.jpg

2025-06-24T23:08:06Z

Retr0id: Top PCB layer, showing traces around and under the lower DRAM IC

== Summary ==
Top PCB layer, showing traces around and under the lower DRAM IC

Hardware

2025-06-24T21:57:00Z

Retr0id: Samsung DRAM option

= Motherboard =
== Nintendo Switch 2 ==
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| BEE-CPU-01 || Retail Nintendo Switch 2
|}

= Specifications =
== Nintendo Switch 2 ==
{| class="wikitable" border="1"
|-
! Component || Description
|-
| SoC || NVIDIA GMLX30-A1
|-
| Screen || Innolux ZD079KA-03A
|-
| Storage || Toshiba/Kioxia THGJFGT1E45BAILHW0 256 GB UFS 3.1 or SKhynix HN8T15DEHKX075 256 GB UFS 3.1
|-
| Memory || SKhynix H58GE6AK8BX107 6 GB LPDDR5X DRAM x2 (12GB total)
or
Samsung K3KL2L20DM-JGCT 6 GB LPDDR5X DRAM x2 (12GB total)
|-
| Wifi/BT || MediaTek MT3681AEN
|-
| PMIC || Maxim Integrated MAX77851SAWJ+T
|-
| Sub-PMIC || Renesas/Dialog DA9092-AIOV2
|-
| Audio || Realtek ALC5658
|-
| Voice || Intelligo Technology IG2200
|-
| USB 2.0 Hub || Genesys Logic GL852G-OHY60
|-
| USB-C || Cypress CYPD6228-96BZXI (CP10359AT)
|-
| GC ASIC || B2349 GCBRG HAC STD T2010423
|}