PDN Registers - Revision history

TuxSH: /* PDN_LGR_CPU_CNT */

2021-01-26T23:32:28Z

PDN_LGR_CPU_CNT

← Older revision		Revision as of 02:32, 27 January 2021
Line 491:		Line 491:
	The overlay should be enabled by setting bit0 in [[CONFIG11_Registers#CFG11_BOOTROM_OVERLAY_CNT\|CFG11_BOOTROM_OVERLAY_CNT]] and configured by setting the entrypoint address to [[CONFIG11_Registers#CFG11_BOOTROM_OVERLAY_VAL\|CFG11_BOOTROM_OVERLAY_VAL]].		The overlay should be enabled by setting bit0 in [[CONFIG11_Registers#CFG11_BOOTROM_OVERLAY_CNT\|CFG11_BOOTROM_OVERLAY_CNT]] and configured by setting the entrypoint address to [[CONFIG11_Registers#CFG11_BOOTROM_OVERLAY_VAL\|CFG11_BOOTROM_OVERLAY_VAL]].

	The ~~overlays~~ overrides all ''instruction'' reads from phyiscal addresses 0xFFFF0000-0xFFFF1000 and 0x10000-0x11000 to the following (figured out by using low exception vectors and configuring the b11 veeners accordingly):		The overlay overrides all ''instruction'' reads from phyiscal addresses 0xFFFF0000-0xFFFF1000 and 0x10000-0x11000 to the following (figured out by using low exception vectors and configuring the b11 veeners accordingly):
	ldr pc, [pc, #(0x20 - 8)]		ldr pc, [pc, #(0x20 - 8)]

	and all ''data'' reads from the same ranges to [[CONFIG11_Registers#CFG11_BOOTROM_OVERLAY_VAL\|CFG11_BOOTROM_OVERLAY_VAL]].		and all ''data'' reads from the same ranges to [[CONFIG11_Registers#CFG11_BOOTROM_OVERLAY_VAL\|CFG11_BOOTROM_OVERLAY_VAL]].

TuxSH: Credits: nocash for figuring out the instruction overlay /* PDN_LGR_CPU_CNT */

2021-01-26T23:31:14Z

Credits: nocash for figuring out the instruction overlay PDN_LGR_CPU_CNT

← Older revision		Revision as of 02:31, 27 January 2021
Line 469:		Line 469:
	\|-		\|-
	\| 0		\| 0
	\| ~~nRESET~~, 0 = ~~reset. Also enable the bootrom instruction overlay.~~		\| Power request: 0 = power off, 1 = power on
	\|-		\|-
	\| 1		\| 1
	\| ~~Enable bootrom data overlay~~		\| Handshake bit
			Needs to be set before powering on the core. It is meant to be cleared by software on the powered-on core, to signal itself.
	\|-		\|-
	\| 4		\| 4
	\| ~~Reset operation in progress~~		\| Power status: 0 = off, 1 = on
	\|-		\|-
	\| 5		\| 5
	\| ~~Always 1~~?		\| Core present?
	\|}		\|}

	Only usable for core2 and core3.		Only usable for core2 and core3. Core 0 and 1 have a fixed, read-only value of 0x30 for this register.

			* On power-on, software should switch the affected core to Normal Mode on the SCU
			* On power-off, software '''must''' switch the affected core to Powered Off mode on the SCU (otherwise the core won't go off)

	The normal Arm11 bootrom checks cpuid and hangs if cpuid >= 2. This is a problem when booting the 2 additional New3DS Arm11 MPCores. NewKernel11 solves this by using a hardware feature to overlay the bootrom with a configurable branch to a kernel function. This overlay feature was added with the New3DS.		The normal Arm11 bootrom checks cpuid and hangs if cpuid >= 2. This is a problem when booting the 2 additional New3DS Arm11 MPCores. NewKernel11 solves this by using a hardware feature to overlay the bootrom with a configurable branch to a kernel function. This overlay feature was added with the New3DS.

	~~Bit1~~ in ~~register above enables a bootrom data-override for physical addresses 0xFFFF0000-0xFFFF1000~~ and ~~0x10000-0x11000. All _data reads_ made~~ to ~~those regions now read the 32-bit value provided in~~ [[~~CONFIG11 Registers~~ #CFG11_BOOTROM_OVERLAY_VAL\|CFG11_BOOTROM_OVERLAY_VAL]].		The overlay should be enabled by setting bit0 in [[CONFIG11_Registers#CFG11_BOOTROM_OVERLAY_CNT\|CFG11_BOOTROM_OVERLAY_CNT]] and configured by setting the entrypoint address to [[CONFIG11_Registers#CFG11_BOOTROM_OVERLAY_VAL\|CFG11_BOOTROM_OVERLAY_VAL]].

	~~Bit0 sets the core out of reset and enables a bootrom~~ instruction-overlay which means that _instruction reads_ made to the bootrom region are overridden. We have not been able to dump what instructions are actually placed at bootrom by this switch (because reading the area only yields data-reads~~). Jumping randomly into the~~ 0xFFFF0000-0xFFFF1000 ~~region works fine~~ and ~~jumps~~ to the ~~value provided~~ by the ~~data overlay [[CONFIG11 Registers #CFG11_BOOTROM_OVERLAY_VAL\|CFG11_BOOTROM_OVERLAY_VAL]]. Thus we may predict that the entire bootrom region is filled by~~:		The overlays overrides all ''instruction'' reads from phyiscal addresses 0xFFFF0000-0xFFFF1000 and 0x10000-0x11000 to the following (figured out by using low exception vectors and configuring the b11 veeners accordingly):
	ldr pc, [pc]		ldr pc, [pc, #(0x20 - 8)]

	~~Or equivalent. However, jumping to some high addresses such as 0xFFFF0FF0+ will crash the core. This may be explained by prefetching in the Arm pipeline,~~ and ~~might help us identify what instructions are placed by~~ the ~~instruction-overlay~~.		and all ''data'' reads from the same ranges to [[CONFIG11_Registers#CFG11_BOOTROM_OVERLAY_VAL\|CFG11_BOOTROM_OVERLAY_VAL]].

TuxSH: /* PDN_LGR_SOCMODE */

2021-01-26T23:02:16Z

PDN_LGR_SOCMODE

← Older revision		Revision as of 02:02, 27 January 2021
Line 433:		Line 433:
	N3DS modes (LGR1/LGR2) enable the New 3DS FCRAM extension and are needed to access N3DS-only devices.		N3DS modes (LGR1/LGR2) enable the New 3DS FCRAM extension and are needed to access N3DS-only devices.

	* CTR: ~~O3DSS~~		* CTR: O3DS
	* LGR1: N3DS prototype, 2 ~~cores~~, no L2C		* LGR1: N3DS prototype, 4 cores (originally 2), no L2C
	* LGR2: retail N3DS, 4 cores, has L2C		* LGR2: retail N3DS, 4 cores, has L2C
	\|-		\|-
	\| 15		\| 15
	\| ~~Busy~~		\| Interrupt status (read) / clear (write)
	\|}		\|}

			'''All currently powered-on cores must be (and remain) in WFI state to trigger the SoC mode switch.'''

			Kernel code suggests that devices that support LGR1 but not LGR2 only had 2 cores. All cores (the number of which can be read from MPCORE SCU registers) are usable in LGR1 mode.

	On firmlaunch, the kernel sets the mode to O3DS.		On firmlaunch, the kernel sets the mode to O3DS.

TuxSH: Cleanup /PDN_LGR_SOCMODE/

2021-01-22T19:34:22Z

Cleanup PDN_LGR_SOCMODE

@@ Line 429: / Line 429: @@
 =CTR+256MHz
 =LGR2+256MHz, 5=LGR2+804MHz
-=LGR+256MHz, 3=LGR+536MHz
+=LGR1+256MHz, 3=LGR1+536MHz
 N3DS modes (LGR1/LGR2) enable the New 3DS FCRAM extension and are needed to access N3DS-only devices.
@@ Line 443: / Line 443: @@
 On firmlaunch, the kernel sets the mode to O3DS.
-[[SVC#KernelSetState|svcKernelSetState]] type10, only implemented on New3DS, uses this register. That code writes the following values to this register, depending on the input Param0 bit0 state, and the state of [[CONFIG11 Registers#CFG11_SOCINFO|CFG11_SOCINFO]]:
+[[SVC#KernelSetState|svcKernelSetState]] type10, only implemented on New3DS, uses this register. This piece of code choses the mode matching the input Param0 bit0 state (1 for higher clock), using the state of [[CONFIG11 Registers#CFG11_SOCINFO|CFG11_SOCINFO]] to determine which mode is the best (which is always LGR2 on all released New 3DS units).
 == PDN_LGR_CNT ==

TuxSH: consistency

2021-01-20T10:42:04Z

consistency

← Older revision		Revision as of 13:42, 20 January 2021
Line 32:		Line 32:
	\|-		\|-
	\| style="background: green" \| Yes		\| style="background: green" \| Yes
	\| [[#~~LGY_SLEEP~~\|~~LGY_SLEEP~~]]		\| [[#LGY_SLEEP_CNT\|LGY_SLEEP_CNT]]
	\| 0x10141104		\| 0x10141104
	\| 2		\| 2
Line 44:		Line 44:
	\|-		\|-
	\| style="background: green" \| Yes		\| style="background: green" \| Yes
	\| [[#~~LGY_PADCNT~~\|~~LGY_PADCNT~~]]		\| [[#LGY_PAD_CNT\|LGY_PAD_CNT]]
	\| 0x1014110A		\| 0x1014110A
	\| 2		\| 2
Line 183:		Line 183:
	\|-		\|-
	\| 1		\| 1
	\| [[HID_Registers#~~HID_PADCNT~~\|~~HID_PADCNT~~]]		\| [[HID_Registers#HID_PAD_CNT\|HID_PAD_CNT]]
	\|-		\|-
	\| 3		\| 3
Line 237:		Line 237:
	The very last 3DS-mode register poke the [[FIRM\|TWL_FIRM]] Process9 does before it gets switched into TWL-mode, is writing 0x8000 to this register. Before writing this register, TWL Process9 waits for ARM7 to change the value of this register. The Process9 code for this runs from ITCM, since switching into TWL-mode includes remapping all ARM9 physical memory.		The very last 3DS-mode register poke the [[FIRM\|TWL_FIRM]] Process9 does before it gets switched into TWL-mode, is writing 0x8000 to this register. Before writing this register, TWL Process9 waits for ARM7 to change the value of this register. The Process9 code for this runs from ITCM, since switching into TWL-mode includes remapping all ARM9 physical memory.

	==~~LGY_SLEEP~~==		==LGY_SLEEP_CNT==
	{\| class="wikitable" border="1"		{\| class="wikitable" border="1"
	! Bits		! Bits
Line 262:		Line 262:
	[[ARM11_Interrupts\|Arm11 interrupt]] enable bits for legacy interrupts, same bit layout as the GPIOEMU regs below.		[[ARM11_Interrupts\|Arm11 interrupt]] enable bits for legacy interrupts, same bit layout as the GPIOEMU regs below.

	==~~LGY_PADCNT~~==		==LGY_PAD_CNT==
	Also named "KEYCNT" on certain other DS(i)/GBA documentations.		Also named "KEYCNT" on certain other DS(i)/GBA documentations.
	The value of this register is copied to [[HID_Registers\|~~HID_PADCNT~~]] when GBA mode enters sleep.		The value of this register is copied to [[HID_Registers\|HID_PAD_CNT]] when GBA mode enters sleep.

	==LGY_HIDEMU_MASK==		==LGY_HIDEMU_MASK==

TuxSH at 11:33, 20 January 2021

2021-01-20T10:33:47Z

← Older revision		Revision as of 13:33, 20 January 2021
Line 8:		Line 8:
	\|-		\|-
	\| style="background: green" \| Yes		\| style="background: green" \| Yes
	\| [[#~~PDN_CNT~~\|~~PDN_CNT~~]]		\| [[#PDN_SLEEP_CNT\|PDN_SLEEP_CNT]]
	\| 0x10141000		\| 0x10141000
	\| 2		\| 2
Line 160:		Line 160:

	=Sleep registers=		=Sleep registers=
	==~~PDN_CNT~~==		==PDN_SLEEP_CNT==
	{\| class="wikitable" border="1"		{\| class="wikitable" border="1"
	! Bits		! Bits

TuxSH: Cleanup

2021-01-19T22:01:25Z

Cleanup

Show changes

TuxSH: Small cleanup

2021-01-19T15:43:20Z

Small cleanup

← Older revision		Revision as of 18:43, 19 January 2021
Line 8:		Line 8:
	\|-		\|-
	\| style="background: green" \| Yes		\| style="background: green" \| Yes
	\| [[#~~PDN_CNT~~\|~~PDN_CNT~~]]		\| [[#PDN_SLEEP_CNT\|PDN_SLEEP_CNT]]
	\| 0x10141000		\| 0x10141000
	\| 2		\| 2
	\| Kernel11~~, TwlBg~~		\| Kernel11
	\|-		\|-
	\| style="background: green" \| Yes		\| style="background: green" \| Yes
Line 129:		Line 129:
	\|-style="border-top: double"		\|-style="border-top: double"
	\| style="background: red" \| No		\| style="background: red" \| No
	\| [[#~~PDN_MPCORE_SOCMODE~~\|~~PDN_MPCORE_SOCMODE~~]]		\| [[#PDN_LGR_SOCMODE\|PDN_LGR_SOCMODE]]
	\| 0x10141300		\| 0x10141300
	\| 2		\| 2
Line 135:		Line 135:
	\|-		\|-
	\| style="background: red" \| No		\| style="background: red" \| No
	\| [[#~~PDN_MPCORE_CNT~~\|~~PDN_MPCORE_CNT~~]]		\| [[#PDN_LGR_CNT\|PDN_LGR_CNT]]
	\| 0x10141304		\| 0x10141304
	\| 2		\| 2
Line 141:		Line 141:
	\|-		\|-
	\| style="background: red" \| No		\| style="background: red" \| No
	\| [[#~~PDN_MPCORE_BOOTCNT~~<0-3>\|~~PDN_MPCORE_BOOTCNT~~]]<0-3>		\| [[#PDN_LGR_CPU_CNT<0-3>\|PDN_LGR_CPU_CNT]]<0-3>
	\| 0x10141310		\| 0x10141310
	\| 1*4		\| 1*4
Line 147:		Line 147:
	\|}		\|}

	==~~PDN_CNT~~==		==PDN_SLEEP_CNT==
	{\| class="wikitable" border="1"		{\| class="wikitable" border="1"
	! Bits		! Bits
Line 159:		Line 159:
	\|-		\|-
	\| 15		\| 15
	\| 1 = VRAM is ~~in self-refresh mode~~		\| 1 = VRAM is powered down
	\|}		\|}

	Kernel11 ~~puts~~ VRAM in self-refresh mode ~~(before going to sleep~~) by first disabling the 8 banks using [[GPU/External_Registers#Map\|GX register 0x10400030]], then by disabling the GPU clock using [[#PDN_GPU_CNT\|PDN_GPU_CNT]] bit 16 and finally polls this register.		Kernel11 powers down VRAM (it's unclear whether bit15 is power-down or self-refresh mode) by first disabling the 8 banks using [[GPU/External_Registers#Map\|GX register 0x10400030]], then by disabling the GPU clock using [[#PDN_GPU_CNT\|PDN_GPU_CNT]] bit 16 and finally writes to and polls this register.

	==PDN_WAKE_ENABLE==		==PDN_WAKE_ENABLE==
Line 204:		Line 204:

	For each bit, write 1 to acknowledge, and 0 to clear (?).		For each bit, write 1 to acknowledge, and 0 to clear (?).

	~~==PDN_WIFICNT==~~
	~~{\| class="wikitable" border="1"~~
	~~! Old3DS~~
	~~! Bits~~
	~~! Description~~
	\|-
	~~\| style="background: green" \| Yes~~
	~~\| 0~~
	~~\| Enable wifi subsystem~~
	\|}

	==LGY_MODE==		==LGY_MODE==
Line 360:		Line 349:
	PDN services holds reset for 0x30 Arm11 cycles.		PDN services holds reset for 0x30 Arm11 cycles.

	== ~~PDN_MPCORE_SOCMODE~~ ==		== PDN_LGR_SOCMODE ==
	This is used for configuring the New3DS ARM11 CPU clock-rate. This register is New3DS-only: reading from here on Old3DS always returns all-zeros even when one tried writing data here prior to the read.		This is used for configuring the New3DS ARM11 CPU clock-rate. This register is New3DS-only: reading from here on Old3DS always returns all-zeros even when one tried writing data here prior to the read.

Line 443:		Line 432:
	* 0x1F, 0x2F, 0x4F, 0x8F, 0xFF: Same result as 0x05.		* 0x1F, 0x2F, 0x4F, 0x8F, 0xFF: Same result as 0x05.

	== ~~PDN_MPCORE_CNT~~ ==		== PDN_LGR_CNT ==
	{\| class="wikitable" border="1"		{\| class="wikitable" border="1"
	! Bits		! Bits
Line 455:		Line 444:
	\|}		\|}

	Kernel11 sets this to 0x101 when bit 2 in [[CONFIG11 Registers#CFG11_SOCINFO\|CFG11_SOCINFO]] is set otherwise 1.		Kernel11 sets this to 0x101 when bit 2 in [[CONFIG11 Registers#CFG11_SOCINFO\|CFG11_SOCINFO]] (LGR2 supported) is set otherwise 1.

	== ~~PDN_MPCORE_BOOTCNT~~<0-3> ==		== PDN_LGR_CPU_CNT<0-3> ==
	{\| class="wikitable" border="1"		{\| class="wikitable" border="1"
	! Bits		! Bits

TuxSH: typo fix

2021-01-19T15:01:51Z

typo fix

@@ Line 262: / Line 262: @@
 Also named "KEYCNT" on certain other DS(i)/GBA documentations.
 The value of this register is copied to [[HID_Registers|HID_PADCNT]] when GBA mode enters sleep.
 ==LGY_HIDEMU_MASK==

TuxSH: /* Registers */

2021-01-18T17:35:10Z

Registers

← Older revision		Revision as of 20:35, 18 January 2021
Line 105:		Line 105:
	\|-		\|-
	\| style="background: green" \| Yes		\| style="background: green" \| Yes
	\| PDN_FCRAM_CNT		\| [[#PDN_FCRAM_CNT\|PDN_FCRAM_CNT]]
	\| 0x10141210		\| 0x10141210
	\| 2		\| 2