3dbrew

PDN Registers: Difference between revisions

← Older edit
No edit summary
 
(4 intermediate revisions by the same user not shown)
Line 32: Line 32:
|-
|-
| style="background: green" | Yes
| style="background: green" | Yes
| [[#LGY_SLEEP|LGY_SLEEP]]
| [[#LGY_SLEEP_CNT|LGY_SLEEP_CNT]]
| 0x10141104
| 0x10141104
| 2
| 2
Line 44: Line 44:
|-
|-
| style="background: green" | Yes
| style="background: green" | Yes
| [[#LGY_PADCNT|LGY_PADCNT]]
| [[#LGY_PAD_CNT|LGY_PAD_CNT]]
| 0x1014110A
| 0x1014110A
| 2
| 2
Line 183: Line 183:
|-
|-
| 1
| 1
| [[HID_Registers#HID_PADCNT|HID_PADCNT]]
| [[HID_Registers#HID_PAD_CNT|HID_PAD_CNT]]
|-
|-
| 3
| 3
Line 237: Line 237:
The very last 3DS-mode register poke the [[FIRM|TWL_FIRM]] Process9 does before it gets switched into TWL-mode, is writing 0x8000 to this register. Before writing this register, TWL Process9 waits for ARM7 to change the value of this register. The Process9 code for this runs from ITCM, since switching into TWL-mode includes remapping all ARM9 physical memory.
The very last 3DS-mode register poke the [[FIRM|TWL_FIRM]] Process9 does before it gets switched into TWL-mode, is writing 0x8000 to this register. Before writing this register, TWL Process9 waits for ARM7 to change the value of this register. The Process9 code for this runs from ITCM, since switching into TWL-mode includes remapping all ARM9 physical memory.


==LGY_SLEEP==
==LGY_SLEEP_CNT==
{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Bits
Line 262: Line 262:
[[ARM11_Interrupts|Arm11 interrupt]] enable bits for legacy interrupts, same bit layout as the GPIOEMU regs below.
[[ARM11_Interrupts|Arm11 interrupt]] enable bits for legacy interrupts, same bit layout as the GPIOEMU regs below.


==LGY_PADCNT==
==LGY_PAD_CNT==
Also named "KEYCNT" on certain other DS(i)/GBA documentations.
Also named "KEYCNT" on certain other DS(i)/GBA documentations.
The value of this register is copied to [[HID_Registers|HID_PADCNT]] when GBA mode enters sleep.
The value of this register is copied to [[HID_Registers|HID_PAD_CNT]] when GBA mode enters sleep.


==LGY_HIDEMU_MASK==
==LGY_HIDEMU_MASK==
Line 429: Line 429:
   0=CTR+256MHz
   0=CTR+256MHz
   1=LGR2+256MHz, 5=LGR2+804MHz
   1=LGR2+256MHz, 5=LGR2+804MHz
   2=LGR+256MHz, 3=LGR+536MHz
   2=LGR1+256MHz, 3=LGR1+536MHz


N3DS modes (LGR1/LGR2) enable the New 3DS FCRAM extension and are needed to access N3DS-only devices.
N3DS modes (LGR1/LGR2) enable the New 3DS FCRAM extension and are needed to access N3DS-only devices.


* CTR: O3DSS
* CTR: O3DS
* LGR1: N3DS prototype, 2 cores, no L2C
* LGR1: N3DS prototype, 4 cores (originally 2), no L2C
* LGR2: retail N3DS, 4 cores, has L2C
* LGR2: retail N3DS, 4 cores, has L2C
|-
|-
| 15
| 15
| Busy
| Interrupt status (read) / clear (write)
|}
|}


On firmlaunch, the kernel sets the mode to O3DS.
'''All currently powered-on cores must be (and remain) in WFI state to trigger the SoC mode switch.'''


[[SVC#KernelSetState|svcKernelSetState]] type10, only implemented on New3DS, uses this register. That code writes the following values to this register, depending on the input Param0 bit0 state, and the state of [[CONFIG11 Registers#CFG11_SOCINFO|CFG11_SOCINFO]]:
Kernel code suggests that devices that support LGR1 but not LGR2 only had 2 cores. All cores (the number of which can be read from MPCORE SCU registers) are usable in LGR1 mode.
{| class="wikitable" border="1"
!  Register value
!  Higher-clockrate bit set in svcKernelSetState Param0
!  CFG11_SOCINFO bit2 set
!  MPCore timer/watchdog prescaler value, prior to subtracting it by 0x1 when writing it into hw/state
!  Clock-rate multiplier
!  Description
|-
| 0x01
| No
| Yes
| 0x01
| 1x
| 268MHz
|-
| 0x02
| No
| No
| 0x01
| 1x
| 268MHz
|-
| 0x05
| Yes
| Yes
| 0x03
| 3x
| 804MHz
|-
| 0x03
| Yes
| No
| 0x02
| 2x
| 536MHz (tested on New3DS)
|}


Note that the above CFG11_SOCINFO bit is 1 on New3DS, and 0 on Old3DS. Since this SVC is only available with the New3DS ARM11-kernel, the only additional available clock-rate is 804MHz when running on New3DS(with official kernel code).
On firmlaunch, the kernel sets the mode to O3DS.


The following register value(s) were tested on New3DS by patching the kernel:
[[SVC#KernelSetState|svcKernelSetState]] type10, only implemented on New3DS, uses this register. This piece of code choses the mode matching the input Param0 bit0 state (1 for higher clock), using the state of [[CONFIG11 Registers#CFG11_SOCINFO|CFG11_SOCINFO]] to determine which mode is the best (which is always LGR2 on all released New 3DS units).
* 0x00: Entire system hangs.
* 0x02: Entire system hangs.
* 0x03: ARM11 runs at 536MHz.
* 0x04: Entire system hangs.
* 0x06: Entire system hangs.
* 0x07: Same result as 0x05.
* 0x08: Entire system hangs.
* 0x09: Entire system hangs.
* 0x0A: Entire system hangs.
* 0x0B: Same result as 0x03.
* 0x0C: Entire system hangs.
* 0x0D: Same result as 0x05.
* 0x0E: Entire system hangs.
* 0x0F: Same result as 0x05.
* 0x1F, 0x2F, 0x4F, 0x8F, 0xFF: Same result as 0x05.


== PDN_LGR_CNT ==
== PDN_LGR_CNT ==
Line 520: Line 469:
|-
|-
| 0
| 0
| nRESET, 0 = reset. Also enable the bootrom instruction overlay.
| Power request: 0 = power off, 1 = power on
|-
|-
| 1
| 1
| Enable bootrom data overlay
| Handshake bit
Needs to be set before powering on the core. It is meant to be cleared by software on the powered-on core, to signal itself.
|-
|-
| 4
| 4
| Reset operation in progress
| Power status: 0 = off, 1 = on
|-
|-
| 5
| 5
| Always 1?
| Core present?
|}
|}


Only usable for core2 and core3.
Only usable for core2 and core3. Core 0 and 1 have a fixed, read-only value of 0x30 for this register.
 
* On power-on, software should switch the affected core to Normal Mode on the SCU
* On power-off, software '''must''' switch the affected core to Powered Off mode on the SCU (otherwise the core won't go off)


The normal Arm11 bootrom checks cpuid and hangs if cpuid >= 2. This is a problem when booting the 2 additional New3DS Arm11 MPCores. NewKernel11 solves this by using a hardware feature to overlay the bootrom with a configurable branch to a kernel function. This overlay feature was added with the New3DS.
The normal Arm11 bootrom checks cpuid and hangs if cpuid >= 2. This is a problem when booting the 2 additional New3DS Arm11 MPCores. NewKernel11 solves this by using a hardware feature to overlay the bootrom with a configurable branch to a kernel function. This overlay feature was added with the New3DS.


Bit1 in register above enables a bootrom data-override for physical addresses 0xFFFF0000-0xFFFF1000 and 0x10000-0x11000. All _data reads_ made to those regions now read the 32-bit value provided in [[CONFIG11 Registers #CFG11_BOOTROM_OVERLAY_VAL|CFG11_BOOTROM_OVERLAY_VAL]].
The overlay should be enabled by setting bit0 in [[CONFIG11_Registers#CFG11_BOOTROM_OVERLAY_CNT|CFG11_BOOTROM_OVERLAY_CNT]] and configured by setting the entrypoint address to [[CONFIG11_Registers#CFG11_BOOTROM_OVERLAY_VAL|CFG11_BOOTROM_OVERLAY_VAL]].


Bit0 sets the core out of reset and enables a bootrom instruction-overlay which means that _instruction reads_ made to the bootrom region are overridden. We have not been able to dump what instructions are actually placed at bootrom by this switch (because reading the area only yields data-reads). Jumping randomly into the 0xFFFF0000-0xFFFF1000 region works fine and jumps to the value provided by the data overlay [[CONFIG11 Registers #CFG11_BOOTROM_OVERLAY_VAL|CFG11_BOOTROM_OVERLAY_VAL]]. Thus we may predict that the entire bootrom region is filled by:
The overlay overrides all ''instruction'' reads from phyiscal addresses 0xFFFF0000-0xFFFF1000 and 0x10000-0x11000 to the following (figured out by using low exception vectors and configuring the b11 veeners accordingly):
ldr pc, [pc]
  ldr pc, [pc, #(0x20 - 8)]


Or equivalent. However, jumping to some high addresses such as 0xFFFF0FF0+ will crash the core. This may be explained by prefetching in the Arm pipeline, and might help us identify what instructions are placed by the instruction-overlay.
and all ''data'' reads from the same ranges to [[CONFIG11_Registers#CFG11_BOOTROM_OVERLAY_VAL|CFG11_BOOTROM_OVERLAY_VAL]].
Retrieved from "https://www.3dbrew.org/wiki/PDN_Registers"