Skip to content

Instantly share code, notes, and snippets.

@justtryingthingsout
Last active May 3, 2026 21:49
Show Gist options
  • Select an option

  • Save justtryingthingsout/81b8ba5d91d2b34ba5c032799b73f5c4 to your computer and use it in GitHub Desktop.

Select an option

Save justtryingthingsout/81b8ba5d91d2b34ba5c032799b73f5c4 to your computer and use it in GitHub Desktop.
Graphics AGX ASC Debug Override (0xFFFFFC1100170000 -> 0x292150000 in Rocket)
The top 7 bits of `rsvd_38_29`, `force_core_ret_reset`, all bits of `rsvd_42_40`, `dis_so_c_glb_time`, `res`, and all bits of `rsvd_63_45` were set in the Rocket exploit in the Coruna exploit framework.
It is currently unknown why the reserved bits of the fields were set as well.
On A14, this would be located at 0x206150000, and this Gist shows the fields as defined for the A17 Pro.
0x292150000:
b[63:45]: rsvd_63_45
b[44]: res
b[43]: dis_so_c_glb_time
b[42:40]: rsvd_42_40 // Was: b[41:40]: swcpm_quis on A15
b[39]: force_core_ret_reset
b[38:29]: rsvd_38_29 // Was: b[31]: spare_cpm and b[38]: en_l2_flush_td on A14
b[28:27]: cpm_wake_up
b[26:25]: ok2_pwr_dn_cpm
b[24:23]: rsvd_24_23
b[22]: skip_init
b[21:19]: rsvd_21_19 // Was: b[21:20]: spiden on A14
b[18:17]: ok2_tr_dn_lnk
b[16]: rsvd_16
b[15]: l2_retention // Reserved on A14
b[14:12]: rsvd_14_12 // Was: b[12]: swcpm_quis and b[13:14]: ok2_pwr_dn_srm on A14
b[11]: dis_tb_push
b[10]: sync_tb // Reserved on A14
b[9]: tb_synced // Reserved on A14
b[8]: en_clk_gate_wfe // Reserved on A14
b[7]: en_m_amode_opt
b[6]: tb_update_clk_en // Reserved on A14
b[5]: bypass_tb_fifo // Reserved on A14~A15
b[4:0]: rsvd_4_0
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment