View source for T239

The NVIDIA T239 is a custom SoC designed to Nintendo's specifications. It has many aspects in common with the T234 SoC found in NVIDIA Orin products.

== Specifications ==
{| class="wikitable"
|+
!Component
!Description
|-
|CPU
|Eight 64-bit ARM Cortex [https://developer.arm.com/Processors/Cortex-A78C A78C] cores
|-
|Cache
|4 MB Shared L3 Cache, 256KB L2 Cache per core, 64KB/64KB (I/D) L1 Cache per core
|-
|Memory Bus
|LPDDR5X-3200, 128-bit (102 GB/s)
|-
|Memory Size
|12GB (2x 6GB)
|-
|GPU
|1536-core Ampere GPU
|}

== Notable Security Features ==

=== PAC ===
A78C supports Armv8.3-A Pointer Authentication and Armv8.6-A Enhanced Pointer Authentication instructions.

=== Memory Encryption ===
The T239 appears to support [https://docs.nvidia.com/jetson/archives/r35.4.1/DeveloperGuide/text/SD/Security/MemoryEncryption.html memory encryption], similar to the T234.

Memory within certain carveout regions is encrypted. The memory controller transparently encrypts data during writes and decrypts data during reads. For these regions, an attacker sniffing the external memory bus will see only ciphertext. Application memory is not encrypted, presumably for performance reasons, since encryption incurs a latency cost.

It is likely that encryption is tweaked on a per-physical-address basis. So, an attacker with control of the external memory bus cannot e.g. relocate data from one address to another.

There is no memory authentication, however. So in the event of external memory tampering, the CPU will read back garbled plaintext (effectively, random bytes). Although, it should in principle be possible to "replay" earlier values from a particular address.

=== XOM (eXecute-Only-Memory) ===
At present it is unknown if/where XOM is used, but the hardware does support it.