215
edits
Changes
Jump to navigation
Jump to search
Line 105:
Line 105: + + + + + + + + + + + + + + + + + + + + + Line 203:
Line 224: − + Line 227:
Line 248: + + + + + + + Line 244:
Line 272: − + − + − + + + − + − + − + − + − | s / 0x4003?+ − | rw / ? − | Danger zone - [[MCU_Services#MCU_firmware_versions|MCU firmware]] is uploaded here (???) − |- − | 0x06 − | s − | rw − | ? − |- − | 0x07 − + Line 312:
Line 333: − + + + + + + + + − + − Needs confirmation (or some flags to enable).+ − |- − | 0x11 − | s − | ro − | ? − |- − | 0x12 − | s − | ro − | 0x40 if volume slider position changed − Needs confirmation (or some flags to enable). − |- − | 0x13 − | s − | ro − | ? − + + − + − |- − | 0x16 − | s − | rw − | ? − |- − | 0x17 − | s − | rw − | ? + − + − |-+ − | 0x19+ − | s+ − | rw+ − | RTC interrupt mask+ − |-+ − | 0x1A+ − | s+ − | rw+ − | ?+ − |-+ − | 0x1B+ − | s+ − | rw+ − | ?+ + + + + + + + + + + + + + + + − + − |- − | 0x1D − | s − | rw − | ? − |- − | 0x1E − | s − | rw − | ? − |- − | 0x1F − | s − | rw − | ? − + − + + + + + + + − + − + − + − + − + + + + + + + + + + − + − + − + − + Line 432:
Line 451: − + − + Line 442:
Line 461: − + − + − + + + + + + + + + − + − + + + + + + + − + − + Line 473:
Line 506: − + − + − + − + + + + + + + + − + Line 492:
Line 532: + + + + + + + + + + − + − + + − + + + − + − + − + − + − + + − + − + + + + + + − + − + − + − + − + − + − + − + − + − + − + − + + Line 555:
Line 615: − + + + + + + + − + + + + + + − + − + − + − + − |- − | 0x4F − | 6(?) − | ro − | Unkonwn. Reading past the 6th byte is FF-filled, so register size of 6 is assumed. − + Line 583:
Line 649: − + + − + + − + − + − + − + − + − + − first byte is wo Line 610:
Line 677: − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + + − + − this byte is reset to 0 before an svcBreak takes effect+ − + − + − Note: the letter "s" in the size field means that the given register is in a "shared register pool", meaning if you read/write with size more than 1 you can read the next `readamount-1` of shared registers. It's possible to corrupt the shared value of a "non-shared" register by writing into a shared register with a size bigger than one. Writing more than 0x100 bytes into a shared register will corrupt all writable registers, including the shared portion of "non-shared" registers.+ + + + + − Non-shared register: it's a register separate from the shared register pool. Messing with these registers will not affect the shared register pool at all.+
Updated MCU pointer table register info
| 7
| 7
| Start/busy (0=Ready, 1=Start/busy)
| Start/busy (0=Ready, 1=Start/busy)
|}
== I2C_CNTEX ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 0-1
| ? Set to 2 normally.
|}
== I2C_SCL ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 0-5
| ?
|-
| 8-12
| ? Set to 5 normally.
|}
|}
| 0xa0
| 0xa0
| "i2c::EEP"
| "i2c::EEP"
| eeprom?
| HWCAL EEPROM ([[Hardware_calibration#Header|only present on dev units where SHA256 is used for HWCAL verification]])
|-
|-
| 15
| 15
== Device 3 ==
== Device 3 ==
ro = read-only (writing is no-op)
rw = read-write
wo = write-only (reading will yield 00, FF, or unpredictable data)
d* = dynamic register (explaination below this table)
s* = shared register (explaination below this table)
ds = dynamic shared (explaination below this table)
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! REGISTER
! REGISTER
|-
|-
| 0x02
| 0x02
| s
| d
| ro
| rw
| ?
| 2bit value, writing will mask away/"acknowledge" the event, set to 3 by mcuMainLoop on reset if reset source is Watchdog
bit0: RTC clock value got reset to defaults
bit1: Watchdog reset happened
|-
|-
| 0x03
| 0x03
| s
| ds
| rw
| rw
| Top screen flicker
| Top screen Vcom
|-
|-
| 0x04
| 0x04
| s
| ds
| rw
| rw
| Bottom screen flicker
| Bottom screen Vcom
|-
|-
| 0x05
| 0x05
- 0x07
| s
| s
| rw
| rw
| ?
| Danger zone - [[MCU_Services#MCU_firmware_versions|MCU unlock sequence]] is written here.
|-
|-
| 0x08
| 0x08
| s
| s
| ro
| ro
| Flags: bit7-5 are read via [[MCU_Services|mcu::GPU]]. The rest of these are read via [[MCU_Services|mcu::RTC]]: bit4 = BatteryChargeState. bit3 = AdapterState. bit1 = ShellState.
| Flags: bit7-5 are read via [[MCU_Services|mcu::GPU]]. The rest of them are read via [[MCU_Services|mcu::RTC]].
bit01: ShellState
bit03: AdapterState
bit04: BatteryChargeState
bit05: Bottom screen backlight on
bit06: Top screen backlight on
bit07: GPU on(?)
|-
|-
| 0x10
| 0x10
- 0x13
| s
| s
| ro
| ro
| Special HID status flags: bit0 = power button pressed, bit1 = power button pressed long, bit2 = home button pressed, bit3 = home button released, bit4 = wifi slider enabled, bit5 = shell got closed, bit6 = shell got opened. If nothing has changed this register is 0.
| Received interrupt bitmask, see register 0x18 for possible values
If no interrupt was received this register is 0
|-
|-
| 0x14
| 0x14
| s
| s
| ro
| ro
| ?
| Unused and unwritable byte :(
|-
|-
| 0x15
| 0x15
- 0x17
| s
| s
| rw
| rw
| ?
| Unused and unreferenced free RAM! Good for userdata.
|-
|-
| 0x18
| 0x18
- 0x1B
| s
| s
| rw
| rw
| ?
| Interrupt mask for register 0x10 (0=enabled,1=disabled)
bit00: Power button press (for 27 "ticks")
bit01: Power button held (for 375 "ticks"; the 3DS turns off regardless after a fixed time)
bit02: HOME button press (for 5 "ticks")
bit03: HOME button release
bit04: WiFi switch button
bit05: Shell close
bit06: Shell open
bit07: Fatal hardware condition([[Services#Notifications|?]]) (sent when the MCU gets reset by the Watchdog timer)
bit08: Charger removed
bit09: Charger plugged in
bit10: RTC alarm (when some conditions are met it's sent when the current day and month and year matches the current RTC time)
bit11: ??? (accelerometer related)
bit12: HID update
bit13: Battery percentage status change (triggered at 10%, 5%, and 0% while discharging)
bit14: Battery stopped charging (independent of charger state)
bit15: Battery started charging
Nonmaskable(?) interrupts
bit16: ???
bit17: ??? (opposite even for bit16)
bit22: Volume slider position change
bit23: ??? Register 0x0E update
bit24: ??? (the off event for below bit)
bit25: ??? (triggered when something related to the GPU is turned on, most likely backlight)
bit26: ??? (???)
bit27: ??? (???)
bit28: ??? (???)
bit29: ??? backlight on?
bit30: bit set by mcu sysmodule
bit31: bit set by mcu sysmodule
|-
|-
| 0x1C
| 0x1C
- 0x1F
| s
| s
| rw
| rw
| ?
| Unused and unreferenced free RAM! Good for userdata.
|-
|-
| 0x20
| 0x20
| s
| d
| wo
| wo
| System power control - bit0 = power off, bit1 = reboot (unused?). bit2 = reboot (used by mcu-module and LgyBg). bit3 = used by LgyBg to power off, causes hangs in 3DS-mode. bit4 = doesn't seem to do anything, but an mcu::RTC command uses this. Other bits are unused, and seem to do nothing.
| System power control:
bit0: power off
bit1: reboot (unused?)
bit2: reboot (used by mcu sysmodule and LgyBg)
bit3: used by LgyBg to power off, causes hangs in 3DS-mode
bit4: an mcu::RTC command uses this, seems to do something with the watchdog
Bit 4 sets a bit at a RAM address which seems to control the watcdog timer state, then this bit is immediately unmasked. This field has a bitmask of 0x0F.
|-
|-
| 0x21
| 0x21
| s
| d
| ro(?)
| wo
| ?
| ??? switches up input bits from <code>0123456--</code> to <code>12-0435-</code> then writes them to REG[0x5D] (<code>0xFFC02</code>)
|-
|-
| 0x22
| 0x22
| s
| d
| wo
| wo
| Used to set LCD states. bit0 = don't push to LCDs, bit1 = push to LCDs, bit2 = bottom screen backlight off, bit3 = bottom screen backlight on, bit4 = top screen backlight off, bit5 = top screen backlight on
| Used to set LCD states
bit0: don't push to LCDs
bit1: push to LCDs
bit2: bottom screen backlight off
bit3: bottom screen backlight on
bit4: top screen backlight off
bit5: top screen backlight on
Bits 4 and 5 have no effect on a 2DS because the backlight source is the bottom screen.
The rest of the bits are masked away.
|-
|-
| 0x23
| 0x23
| s
| ??
| ro(?)
| wo
| ?
| ??? Seems to be stubbed, just returns the written value from the write handler function.
|-
|-
| 0x24
| 0x24
| s
| s
| ??
| rw
| Watchdog timer. This must be set *before* the timer is triggered, otherwise the old value is used. Value zero disables the watchdog.
| Watchdog timer. This must be set *before* the timer is triggered, otherwise the old value is used. Value zero disables the watchdog.
|-
|-
|-
|-
| 0x27
| 0x27
| s
| sd
| ro
| rw
| Raw volume slider state
| Raw volume slider state
|-
|-
|-
|-
| 0x29
| 0x29
| dynamic / s
| sd(5)
| ro / rw
| ??
| Repeat register, any byte written in the first byte gets repeated indefinitely(?, needs confirmation past 0xFF). The rest of the bytes are read-only. Setting the shared byte of this register (via overflow glitches) will also work, confirming that this is a semi-dynamic register as the first byte is stored in the shared register pool, but the rest of the bytes are fake.
| Power mode indicator state (read-write)
1 = forced default blue
2 = sleep mode animation
3 = "power off" mode
4 = disable blue power LED and turn on red power LED
5 = disable red power LED and turn on blue power LED
6 = animate blue power LED off and flash red power LED
anything else = automatic mode
The other 4 bytes (32bits) affect the pattern of the red power LED (write only)
|-
|-
| 0x2A
| 0x2A
| s
| s
| rw
| rw
| WiFi LED state, non-0 value turns on the WiFi LED, capped at 0x0F
| WiFi LED state, non-0 value turns on the WiFi LED, 4 bits wide
|-
|-
| 0x2B
| 0x2B
| s
| s
| rw
| rw
| Camera LED state, 0, 3, 6-0xF = off, 1 = slowly blinking, 2 = constantly on, 4 = flash once, 5 = delay before changing to 2
| Camera LED state, 4bits wide,
0, 3, 6-0xF = off
1 = slowly blinking
2 = constantly on
3 = "TWL" mode
4 = flash once
5 = delay before changing to 2
|-
|-
| 0x2C
| 0x2C
| s
| s
| rw
| rw
| 3D LED state, capped at 0x0F
| 3D LED state, 4 bits wide
|-
|-
| 0x2D
| 0x2D
| 0x64
| 0x64
| wo
| wo
| This is used for [[MCURTC:SetInfoLEDPattern|controlling]] the notification LED (see [[MCURTC:SetInfoLEDPatternHeader]] as well), when this register is written. It's possible to write data here with size less than 0x64, and only that portion of the pattern data will get overwritten. Reading from this register only returns zeroes, so it's considered write-only.
| This is used for [[MCURTC:SetInfoLEDPattern|controlling]] the notification LED (see [[MCURTC:SetInfoLEDPatternHeader]] as well), when this register is written. It's possible to write data here with size less than 0x64, and only that portion of the pattern data will get overwritten. Reading from this register only returns zeroes, so it's considered write-only. Writing past the size of this register seems to do nothing.
|-
|-
| 0x2E
| 0x2E
| 0x2F
| 0x2F
| s
| s
| ro(?)
| wo?
| ?
| ??? The write function for this register is stubbed.
|-
|-
| 0x30
| 0x30
- 0x36
- 0x36
| s
| ds
| rw
| rw
| RTC time (system clock). 7 bytes are read from this. The upper nibble of each byte encodes 10s (BCD), so each byte is post-processed with (byte & 0xF) + (10 * (byte >> 4)). Byte 0 encodes seconds, byte 1 minutes, byte 2 hours, byte 3 is either the current day of the week or current week of month (not used by anything though), byte 4 days, byte 5 months and byte 6 years
| RTC time (system clock). 7 bytes are read from this. The upper nibble of each byte encodes 10s (BCD), so each byte is post-processed with (byte & 0xF) + (10 * (byte >> 4)).
byte 0: seconds
byte 1: minutes
byte 2: hours
byte 3: current week (unused)
byte 4: days
byte 5: months
byte 6: years
|-
|-
| 0x37
| 0x37
| s
| s
| rw
| rw
| ?
| RTC time byte 7: leap year counter / "watch error correction" register (unused in code)
|-
|-
| 0x38
| 0x38
| rw
| rw
| RTC alarm registers
| RTC alarm registers
byte 0: minutes
byte 1: hours
byte 2: day
byte 3: month
byte 4: year
|-
| 0x3B
| s
| rw
| Could be used on very old MCU_FIRM versions to upload [[MCU_Services#MCU_firmware_versions|MCU firmware]] if some conditions are met.
|-
|-
| 0x3D
| 0x3D
0x3E
0x3E
| s (2)
| ds
| ro
| ro
| RTC tick counter (resets to 0 when the seconds increase)
| RTC tick counter / "ITMC" (when resets to 0 the seconds increase)
Only reading 0x3D will update the in-RAM value
|-
|-
| 0x3F
| 0x3F
| s
| s
| wo
| wo
| Peripheral power related? bit0 seems to depower everything, pressing the power key afterwards instantly turns the whole 3DS off
| 2 bits
bit0: turns off P00 and sets it to output mode (seems to kill the entire SoC)
bit1: turns on a prohibited bit in an RTC Control register and turns P12 into an output
|-
|-
| 0x40
| 0x40
| s
| s
| rw
| rw
| ?
| Gyro sampling mode. Bits 0 and 1 control the gyro. If bits 0 or 1 are non-zero then gyro sampling is enabled.
|-
|-
| 0x41
| 0x41
| s
| s
| rw
| rw
| ?
| Index selector for register 0x44
|-
|-
| 0x42
| 0x42
| s
| s
| rw
| rw
| ?
| Unused?
|-
|-
| 0x43
| 0x43
| s
| s
| rw
| rw
| ?
| Unused???, accelometer related
|-
|-
| 0x44
| 0x44
| s
| s
| rw
| rw
| ? (setting this seems to freeze the system for a second)
| ???, pedoometer related(?)
|-
|-
| 0x45
| 0x45
- 0x4A
| s
| s
| rw
| ro
| ?
| Gyroscope 3D rotation from the 12bit ADC, left shifted 4 to fit in a 16bit signed short
{| class="wikitable" border="1"
! AXIS
! V=0x00
! V=0x40
! V=0xC0
|-
|-
| 0x46
| X (left/right)
| s
| held vertically
| ro
| rotated or tilted left
| Gyro Y(?) axis rotation (0x00 = flat, 0x40 = 3DS standing on right side, 0xBE = 3DS standing on left side)
| rotated or tilted right
|-
|-
| 0x48
| Y (forwards/backwards)
| s
| laid flat
| ro
| held up
| Gyro Z(?) axis rotation (0x00 = flat, 0x40 = 3DS standing horizontally, 0xBE = 3DS base is horizontally upside-down)
| helf up upside-down
|-
|-
| 0x4A
| Z (???)
| s
| ???
| ro
| ???
| Gyro X(?) axis rotation (0x00 = 3DS base facing upwards, 0x40 = face-down flat, 0xBE = standing(?) flat)
| ???
|}
|-
|-
| 0x4B
| 0x4B
|-
|-
| 0x4C
| 0x4C
| s
0x4D
| ??
| ??
| ??
|-
| 0x4E
| d
| rw
| rw
| ?
| ??? this = (0xFFE9E & 1) ? 0x10 : 0
|-
| 0x4F
| d(6)
| ro
|
|-
|-
| 0x4D
| 0x50
| s
| s
| rw
| rw
| ?
| ???
|-
|-
| 0x4E
| 0x51
| s
| s
| rw
| rw
| ?
| ???
|-
|-
| 0x50
| 0x52
- 0x57
- 0x57
| s
| s
| s
| s
| rw
| rw
| DSP volume slider 0% volume offset (setting this to 0xFF will esentially mute the DSP as it's the volume slider's maximum raw value)
| Register-mapped ADC register
DSP volume slider 0% volume offset (setting this to 0xFF will esentially mute the DSP as it's the volume slider's maximum raw value)
|-
|-
| 0x59
| 0x59
| s
| s
| rw
| rw
| DSP volume slider 100% volume offset (setting both this and the above to 0 will disable the volume slider with 100% volume, setting this to a lower value than the above will make the volume slider have only 2 states; on and off)
| Register-mapped ADC register
DSP volume slider 100% volume offset (setting both this and the above to 0 will disable the volume slider with 100% volume, setting this to a lower value than the above will make the volume slider have only 2 states; on and off)
|-
|-
| 0x5A
| 0x5A
| s
| s
| rw
| ro/rw
| ?
| Invalid, do not use! On newer MCU_FIRM versions this is unused, but on older MCU_FIRM versions this is a read-only counter.
|-
|-
| 0x5B
| 0x5B
- 0x5F
- 0x5F
| s
| s
| ro(?)
| -
| ? (these seem to be invalid regsiters)
| These registers are out of bounds (0xFFC00 and up), they don't exist, writing is no-op, reading will yield FFs.
|-
|-
| 0x60
| 0x60
| 0x100
| ds
| ro
| rw
| Looping queue register
| Looping queue register
Writing to first byte resets the queue position to the nth element
Writing to first byte resets the queue position to the nth element
|-
|-
| 0x61
| 0x61
| 0x100
| ds(0x100)
| rw
| rw
| Writing to this register pushes values on top of register 0x60's stack. Reading from this register doesn't advance the stack.
| Writing to this register pushes values on top of register 0x60's stack. Reading from this register doesn't advance the stack.
The first byte is used to store flags for managing FIRM/NS state - bit0 = "WirelessDisabled", bit1 = "SoftwareClosed", bit2 = "PowerOffInitiated", bit4 = "LegacyJumpProhibited". This register survives power-off, but does not seem to be saved to non-volatile storage (does not survive battery pulls). This register doesn't seem to actually control MCU behaviour by itself, it just seems to be used for storing arbitrary data.
The first byte is used to store flags for managing FIRM/NS state - bit0 = "WirelessDisabled", bit1 = "SoftwareClosed", bit2 = "PowerOffInitiated", bit4 = "LegacyJumpProhibited". This register survives a power-off, but it resides in RAM, so its contents get lost on battery pulls. This register doesn't seem to actually control MCU behaviour by itself, it just seems to be used for storing arbitrary data.
|-
|-
| 0x62 - 0x7E
| 0x62 - 0x7E
| s
| s
| invalid (ro)
| -
| These registers don't exist at all, thus reading them will yield 0xFF
| These registers don't exist, writing is no-op, reading will yield FFs.
|-
|-
| 0x7F
| 0x7F
| 19(?)
| d(9-0x13)
| ro
| ro
| Various system state information.
| Various system state information (debug pointer table)
byte 06: battery related? (seems to decrease while charging and increase while discharging)
byte 0x06: battery related? (seems to decrease while charging and increase while discharging)
byte 09: system model (see [[Cfg:GetSystemModel#System_Model_Values|Cfg:GetSystemModel]] for values)
byte 0x09: system model (see [[Cfg:GetSystemModel#System_Model_Values|Cfg:GetSystemModel]] for values)
byte 10: power LED related? 0 is off, 1 is red
byte 0x0A: Red Power LED mode (0 = off, 1 = on)
byte 13: RGB LED red factor
byte 0x0B: Blue Power LED intensity (0x00 - 0xFF)
byte 14: RGB LED green factor
byte 0x0D: RGB LED red intensity
byte 15: RGB LED blue factor
byte 0x0E: RGB LED green intensity
byte 17: WiFi LED brightness
byte 0x0F: RGB LED blue intensity
byte 18: raw button states?
byte 0x11: WiFi LED brightness
bit0: unset while power button is held
byte 0x12: raw button states?
bit1: unset while home button is held
bit0: unset while Power button is held
bit2: unset while Wifi slider is held
bit1: unset while HOME button is held
bit2: unset while WiFi slider is held
bit5: unset while the charging LED is active
bit5: unset while the charging LED is active
bit6: unset while charger is plugged in
bit6: unset while charger is plugged in
On MCU_FIRM major version 1 the size of this is 9, reading past the 9th byte will yield AA instead of FF.
|-
|-
| 0x80
| 0x80
- 0xFF
- 0xFF
| s
| s
| invalid (ro)
| -
| These registers don't exist at all, thus reading them will yield 0xFF
| These registers don't exist, writing is no-op, reading will yield FFs.
|}
|}
Shared register: the letter "s" means that the given register is in a "shared register pool", meaning the resgister is in the register pool in RAM at address <code>0xFFBA4 + registernumber</code>.
Dynamic register: these registers aren't in the shared pool, they just "pretend" to be there. These registers often don't retain their set value, change rapidly, or control various hardware.
Non-shared (dynamic) register: it's a register whose contents separate from the shared register pool. Messing with these registers will not affect the shared register pool at all.
On old versions of MCU_FIRM none of the invalid registers are masked away by the read handler function, but are still read-only. Newer MCU_FIRM versions return the hardcoded value FF instead.
== Device 5 & 6 ==
== Device 5 & 6 ==