Line 105: |
Line 105: |
| | 7 | | | 7 |
| | Start/busy (0=Ready, 1=Start/busy) | | | Start/busy (0=Ready, 1=Start/busy) |
| + | |} |
| + | |
| + | == I2C_CNTEX == |
| + | {| class="wikitable" border="1" |
| + | ! BIT |
| + | ! DESCRIPTION |
| + | |- |
| + | | 0-1 |
| + | | ? Set to 2 normally. |
| + | |} |
| + | |
| + | == I2C_SCL == |
| + | {| class="wikitable" border="1" |
| + | ! BIT |
| + | ! DESCRIPTION |
| + | |- |
| + | | 0-5 |
| + | | ? |
| + | |- |
| + | | 8-12 |
| + | | ? Set to 5 normally. |
| |} | | |} |
| | | |
Line 173: |
Line 194: |
| | 0xa6 | | | 0xa6 |
| | "i2c::HID" | | | "i2c::HID" |
− | | Unknown. The device table in I2C-module had the device address changed from 0xA6 to 0xD6 with [[8.0.0-18]]. | + | | Gyroscope. The device table in I2C-module had the device address changed from 0xA6 to 0xD6 with [[8.0.0-18]]. |
| |- | | |- |
| | 10 | | | 10 |
Line 179: |
Line 200: |
| | 0xd0 | | | 0xd0 |
| | "i2c::HID" | | | "i2c::HID" |
− | | Gyroscope | + | | Gyroscope (old3DS) |
| |- | | |- |
| | 11 | | | 11 |
Line 185: |
Line 206: |
| | 0xd2 | | | 0xd2 |
| | "i2c::HID" | | | "i2c::HID" |
− | | ? | + | | Gyroscope (2DS, new3DSXL, new2DSXL) |
| |- | | |- |
| | 12 | | | 12 |
Line 191: |
Line 212: |
| | 0xa4 | | | 0xa4 |
| | "i2c::HID" | | | "i2c::HID" |
− | | DebugPad | + | | DebugPad (slightly modified [https://wiibrew.org/wiki/Wiimote/Extension_Controllers/Classic_Controller_Pro Wii Classic Controller Pro]) |
| |- | | |- |
| | 13 | | | 13 |
Line 203: |
Line 224: |
| | 0xa0 | | | 0xa0 |
| | "i2c::EEP" | | | "i2c::EEP" |
− | | eeprom? | + | | HWCAL EEPROM ([[Hardware_calibration#Header|only present on dev units where SHA256 is used for HWCAL verification]]) |
| |- | | |- |
| | 15 | | | 15 |
Line 234: |
Line 255: |
| s* = shared register (explaination below this table) | | s* = shared register (explaination below this table) |
| ds = dynamic shared (explaination below this table) | | ds = dynamic shared (explaination below this table) |
− | *v = volatile (survives reboots)
| + | |
| + | Reading or writing multiple bytes from/to single-byte registers increments the register ID along with it. For example reading two bytes from reg 0x00 reads regs 0x00 and 0x01. |
| + | |
| + | This is not the case for multibyte regs (0x29, 0x2D, 0x4F, 0x61 and 0x7F), plus reg 0x60. |
| + | |
| {| class="wikitable" border="1" | | {| class="wikitable" border="1" |
| ! REGISTER | | ! REGISTER |
Line 254: |
Line 279: |
| | d | | | d |
| | rw | | | rw |
− | | 2bit value, writing will mask away/"acknowledge" the event, set to 3 by mcuMainLoop on reset if reset source is Watchdog | + | | For bit0 and 1 values, writing will mask away/"acknowledge" the event, set to 3 by mcuMainLoop on reset if reset source is Watchdog |
| bit0: RTC clock value got reset to defaults | | bit0: RTC clock value got reset to defaults |
| bit1: Watchdog reset happened | | bit1: Watchdog reset happened |
| + | bit5: TWL MCU reg: volume mode (0: 8-step, 1: 32-step) |
| + | bit6: TWL MCU reg: NTR (0) vs TWL mode (1) |
| + | bit7: TWL MCU reg: Uses NAND |
| |- | | |- |
| | 0x03 | | | 0x03 |
| | ds | | | ds |
| | rw | | | rw |
− | | Top screen flicker | + | | Top screen Vcom |
| |- | | |- |
| | 0x04 | | | 0x04 |
| | ds | | | ds |
| | rw | | | rw |
− | | Bottom screen flicker | + | | Bottom screen Vcom |
| |- | | |- |
| | 0x05 | | | 0x05 |
Line 288: |
Line 316: |
| | s | | | s |
| | ro | | | ro |
− | | ? (seems to be power management related?) | + | | Battery temperature (in Celcius?) |
| |- | | |- |
| | 0x0B | | | 0x0B |
Line 298: |
Line 326: |
| | s | | | s |
| | ro | | | ro |
− | | ? (changes to 0 for a second when the charger is plugged in then it resets to its previous value) | + | | Battery percentage, fractional part (seems to have a resolution of around 0.1% according to tests) |
| |- | | |- |
| | 0x0D | | | 0x0D |
Line 313: |
Line 341: |
| | s | | | s |
| | ro | | | ro |
− | | Flags: bit7-5 are read via [[MCU_Services|mcu::GPU]]. The rest of these are read via [[MCU_Services|mcu::RTC]]: bit4 = BatteryChargeState. bit3 = AdapterState. bit1 = ShellState. | + | | Flags: bit7-5 are read via [[MCU_Services|mcu::GPU]]. The rest of them are read via [[MCU_Services|mcu::RTC]]. |
| + | bit01: ShellState |
| + | bit03: AdapterState |
| + | bit04: BatteryChargeState |
| + | bit05: Bottom screen backlight on |
| + | bit06: Top screen backlight on |
| + | bit07: GPU on(?) |
| |- | | |- |
| | 0x10 | | | 0x10 |
Line 330: |
Line 364: |
| - 0x17 | | - 0x17 |
| | s | | | s |
− | | rw v | + | | rw |
| | Unused and unreferenced free RAM! Good for userdata. | | | Unused and unreferenced free RAM! Good for userdata. |
| |- | | |- |
Line 338: |
Line 372: |
| | rw | | | rw |
| | Interrupt mask for register 0x10 (0=enabled,1=disabled) | | | Interrupt mask for register 0x10 (0=enabled,1=disabled) |
− | bit00: Power button press | + | bit00: Power button press (for 27 "ticks") |
− | bit01: Power button held (the 3DS turns off regardless after a fixed time) | + | bit01: Power button held (for 375 "ticks"; the 3DS turns off regardless after a fixed time) |
− | bit02: HOME button press | + | bit02: HOME button press (for 5 "ticks") |
| bit03: HOME button release | | bit03: HOME button release |
| bit04: WiFi switch button | | bit04: WiFi switch button |
| bit05: Shell close | | bit05: Shell close |
| bit06: Shell open | | bit06: Shell open |
− | bit07: Fatal hardware condition([[Services#Notifications|?]]) | + | bit07: Fatal hardware condition([[Services#Notifications|?]]) (sent when the MCU gets reset by the Watchdog timer) |
| bit08: Charger removed | | bit08: Charger removed |
| bit09: Charger plugged in | | bit09: Charger plugged in |
− | bit10: ??? (Power Management related?) | + | bit10: RTC alarm (when some conditions are met it's sent when the current day and month and year matches the current RTC time) |
− | bit11: ??? (HID related) | + | bit11: ??? (accelerometer related) |
| bit12: HID update | | bit12: HID update |
− | bit13: Battery dead(?) | + | bit13: Battery percentage status change (triggered at 10%, 5%, and 0% while discharging) |
− | bit14: ??? (Power Management related?) | + | bit14: Battery stopped charging (independent of charger state) |
− | bit15: ??? (Power Management related?) | + | bit15: Battery started charging |
| + | Nonmaskable(?) interrupts |
| + | bit16: ??? |
| + | bit17: ??? (opposite even for bit16) |
| bit22: Volume slider position change | | bit22: Volume slider position change |
− | bit24: ??? (???) | + | bit23: ??? Register 0x0E update |
− | bit25: ??? (???) | + | bit24: ??? (the off event for below bit) |
| + | bit25: ??? (triggered when something related to the GPU is turned on, most likely backlight) |
| bit26: ??? (???) | | bit26: ??? (???) |
| bit27: ??? (???) | | bit27: ??? (???) |
| bit28: ??? (???) | | bit28: ??? (???) |
− | bit29: ??? (???) | + | bit29: ??? backlight on? |
− | bit30: forced off by mcu sysmodule | + | bit30: bit set by mcu sysmodule |
− | bit31: forced off by mcu sysmodule | + | bit31: bit set by mcu sysmodule |
| |- | | |- |
| | 0x1C | | | 0x1C |
| - 0x1F | | - 0x1F |
| | s | | | s |
− | | rw v | + | | rw |
| | Unused and unreferenced free RAM! Good for userdata. | | | Unused and unreferenced free RAM! Good for userdata. |
| |- | | |- |
Line 375: |
Line 413: |
| | System power control: | | | System power control: |
| bit0: power off | | bit0: power off |
− | bit1: reboot (unused?) | + | bit1: full reboot (unused). Discards things like [[CONFIG9_Registers#CFG9_BOOTENV|CFG9_BOOTENV]] |
− | bit2: reboot (used by mcu sysmodule and LgyBg) | + | - Asserts RESET1 via PMIC command (?) (deasserts nRESET1). This could be the reset that controls some CFG9 registers |
− | bit3: used by LgyBg to power off, causes hangs in 3DS-mode | + | - Asserts RESET2 (P0.1 = 0, PM0.1 = 0 (output)) (deasserts nRESET2) |
− | bit4: an mcu::RTC command uses this, seems to do something with the watchdog | + | - Asserts FCRAM_RESET (P3.0 = 0) (deasserts nFCRAM_RESET) |
− | Bit 4 sets a bit at a RAM address which seems to control the watcdog timer state, then this bit is immediately unmasked. This field has a bitmask of 0x0F. | + | bit2: normal reboot. Preserves [[CONFIG9_Registers#CFG9_BOOTENV|CFG9_BOOTENV]], etc. |
| + | - Asserts RESET2 (P0.1 = 0, PM0.1 = 0) |
| + | - If in NTR emulation mode (see reg 0x02), asserts FCRAM_RESET (P3.0 = 0) |
| + | - Resets TWL MCU i2c registers |
| + | bit3: FCRAM reset (present in by LgyBg. Unused because a system reboot does the same thing & a PDN reg also possibly implements this function) |
| + | - Asserts FCRAM_RESET (P3.0 = 0) |
| + | bit4: signal that sleep mode is about to be entered (used by PTM) |
| + | Bit 4 sets a bit at a RAM address which seems to control the watcdog timer state, then this bit is immediately unmasked. This field has a bitmask of 0x0F. |
| + | |
| + | If any of the reset bits is set, the MCU waits for 5ms, then deasserts RESET1 (via PMIC), RESET2 (PM0.1 = 1 (input)) and FCRAM_RESET (P3.0 = 1), and reinitializes some other various registers after a 100ms delay. |
| |- | | |- |
| | 0x21 | | | 0x21 |
| | d | | | d |
| | wo | | | wo |
− | | ??? switches up input bits from <code>0123456--</code> to <code>12-0435-</code> then writes them to REG[0x5D] (<code>0xFFC02</code>) | + | | Used in legacy mode to signal events for TWL MCU "emulation" (written to REG[0x5D])? Software then asserts the TWL MCU IRQ pin via [[#LGY_GPIOEMU_MASK|Legacy I/O registers]]. |
| + | bit0: Signal TWL POWER button click |
| + | bit1: Signal TWL reset |
| + | bit2: Signal TWL power off |
| + | bit3: Signal TWL battery low |
| + | bit4: Signal TWL battery empty |
| + | bit5: Signal TWL volume button click |
| |- | | |- |
| | 0x22 | | | 0x22 |
Line 401: |
Line 454: |
| |- | | |- |
| | 0x23 | | | 0x23 |
− | | ?? | + | | d |
| | wo | | | wo |
− | | ??? Seems to be stubbed, just returns the written value from the write handler function. | + | | Writing 0x72 ('r') resets the MCU, but this is stubbed on retail? |
| |- | | |- |
| | 0x24 | | | 0x24 |
Line 433: |
Line 486: |
| | sd(5) | | | sd(5) |
| | rw | | | rw |
− | | Power LED state + some extra data | + | | Power mode indicator state (read-write) |
| + | 1 = forced default blue |
| + | 2 = sleep mode animation |
| + | 3 = "power off" mode |
| + | 4 = disable blue power LED and turn on red power LED |
| + | 5 = disable red power LED and turn on blue power LED |
| + | 6 = animate blue power LED off and flash red power LED |
| + | anything else = automatic mode |
| + | The other 4 bytes (32bits) affect the pattern of the red power LED (write only) |
| |- | | |- |
| | 0x2A | | | 0x2A |
Line 447: |
Line 508: |
| 1 = slowly blinking | | 1 = slowly blinking |
| 2 = constantly on | | 2 = constantly on |
| + | 3 = "TWL" mode |
| 4 = flash once | | 4 = flash once |
| 5 = delay before changing to 2 | | 5 = delay before changing to 2 |
Line 471: |
Line 533: |
| |- | | |- |
| | 0x30 | | | 0x30 |
− | - 0x37 | + | - 0x36 |
− | | s | + | | ds |
| | rw | | | rw |
| | RTC time (system clock). 7 bytes are read from this. The upper nibble of each byte encodes 10s (BCD), so each byte is post-processed with (byte & 0xF) + (10 * (byte >> 4)). | | | RTC time (system clock). 7 bytes are read from this. The upper nibble of each byte encodes 10s (BCD), so each byte is post-processed with (byte & 0xF) + (10 * (byte >> 4)). |
Line 482: |
Line 544: |
| byte 5: months | | byte 5: months |
| byte 6: years | | byte 6: years |
− | byte 7: leap year counter / "watch error correction" register (unused)
| + | |- |
| + | | 0x37 |
| + | | s |
| + | | rw |
| + | | RTC time byte 7: leap year counter / "watch error correction" register (unused in code) |
| |- | | |- |
| | 0x38 | | | 0x38 |
− | - 0x3A | + | - 0x3C |
| | s | | | s |
| | rw | | | rw |
Line 491: |
Line 557: |
| byte 0: minutes | | byte 0: minutes |
| byte 1: hours | | byte 1: hours |
− | byte 2: week | + | byte 2: day |
| + | byte 3: month |
| + | byte 4: year |
| |- | | |- |
| | 0x3B | | | 0x3B |
| | s | | | s |
| | rw | | | rw |
− | | Register 0x3B could be used to upload [[MCU_Services#MCU_firmware_versions|MCU firmware]] if some conditions are met. | + | | Could be used on extremely old MCU_FIRM versions to upload [[MCU_Services#MCU_firmware_versions|MCU firmware]] if reg 0xF == 0 and reg 0x10 == 1 (presumably major and minor version fields for mcufw 0.1 which largely predates factory firm). |
− | |-
| |
− | | 0x3C
| |
− | | s
| |
− | | ro
| |
− | | ???
| |
| |- | | |- |
| | 0x3D | | | 0x3D |
| 0x3E | | 0x3E |
− | | s | + | | ds |
| | ro | | | ro |
| | RTC tick counter / "ITMC" (when resets to 0 the seconds increase) | | | RTC tick counter / "ITMC" (when resets to 0 the seconds increase) |
Line 511: |
Line 574: |
| |- | | |- |
| | 0x3F | | | 0x3F |
− | | s | + | | d |
| | wo | | | wo |
| | 2 bits | | | 2 bits |
− | bit0: turns off P00 and sets it to output mode (seems to kill the entire SoC) | + | bit0: Asserts RESET1 (P0.0 = 0, PM0.0 = 0 (output)) but does NOT deassert it (wtf?). This seems to kill the entire SoC: is it because it doesn't deassert it, or does it not deassert it because the SoC hangs anyway? This is the pin that controls some security-critical regs like CFG9_BOOTENV! |
| bit1: turns on a prohibited bit in an RTC Control register and turns P12 into an output | | bit1: turns on a prohibited bit in an RTC Control register and turns P12 into an output |
| |- | | |- |
Line 520: |
Line 583: |
| | s | | | s |
| | rw | | | rw |
− | | Pedometer state (?) | + | | Tilt sensor sampling mode. Bits 0 and 1 control the mode. If bits 0 or 1 are set then the tilt sensor is enabled and sampled. |
| |- | | |- |
| | 0x41 | | | 0x41 |
Line 540: |
Line 603: |
| | s | | | s |
| | rw | | | rw |
− | | ???, accelometer related | + | | ???, pedoometer related(?) |
| |- | | |- |
| | 0x45 | | | 0x45 |
Line 546: |
Line 609: |
| | s | | | s |
| | ro | | | ro |
− | | Gyroscope 3D rotation from the 12bit ADC, left shifted 4 to fit in a 16bit signed short | + | | Tilt sensor 3D rotation from the 12bit ADC, left shifted 4 to fit in a 16bit signed short, relative to the 3DS bottom screen |
| {| class="wikitable" border="1" | | {| class="wikitable" border="1" |
| ! AXIS | | ! AXIS |
Line 553: |
Line 616: |
| ! V=0xC0 | | ! V=0xC0 |
| |- | | |- |
− | | Y (=roll) | + | | X (left/right) |
− | | held vertically | + | | held up vertically |
− | | vertical right side | + | | rotated left 90° like a steering wheel |
− | | vertical left side | + | | rotated right 90° like a steering wheel |
| + | |- |
| + | | Y (forwards/backwards) |
| + | | laid flat on the desk with the screen facing up |
| + | | held up vertically |
| + | | held up vertically with screen facing upside-down |
| |- | | |- |
− | | Z? (=yaw) | + | | Z (???) |
− | | ???
| |
| | ??? | | | ??? |
− | | ???
| |
− | |-
| |
− | | X? (=pitch)
| |
− | | held vertically
| |
| | ??? | | | ??? |
| | ??? | | | ??? |
Line 620: |
Line 683: |
| | 0x5A | | | 0x5A |
| | s | | | s |
− | | rw | + | | ro/rw |
− | | ? | + | | Invalid, do not use! On newer MCU_FIRM versions this is unused, but on older MCU_FIRM versions this is a read-only counter. |
| |- | | |- |
| | 0x5B | | | 0x5B |
Line 630: |
Line 693: |
| |- | | |- |
| | 0x60 | | | 0x60 |
− | | ds(1) | + | | d |
− | | ro | + | | rw |
− | first byte is wo
| + | | Free register bank address (index) select |
− | | Looping queue register | + | Selects the index to read from in the free register bank, up to 200. Used in conjunction with reg 0x61. |
− | Writing to first byte resets the queue position to the nth element
| + | |
− | Reading from this register causes the values to shift up by `readsize-1`(needs confirmation) bytes after returning `readsize-1` bytes from the top of the stack (first byte is read-only, so is always zero)
| + | byte 0: bit0 = "WirelessDisabled", bit1 = "SoftwareClosed", bit2 = "PowerOffInitiated", bit3 = "LgyNativeResolution", bit4 = "LegacyJumpProhibited" |
| + | byte 1: Legacy LCD data |
| + | bytes 2 and 3: Local Friend Code counter |
| + | bytes 4 and 5: UUID clock sequence |
| + | bytes 6 and 7: Unused |
| + | bytes 8 to 175: Playtime data for legacy titles |
| + | bytes 176 to 188: Playtime data |
| + | bytes 188 to 199: Unused |
| |- | | |- |
| | 0x61 | | | 0x61 |
− | | ds(0x100) | + | | d(200) |
| | rw | | | rw |
− | | Writing to this register pushes values on top of register 0x60's stack. Reading from this register doesn't advance the stack. | + | | Free register bank, data is read from/written to here. |
− | The first byte is used to store flags for managing FIRM/NS state - bit0 = "WirelessDisabled", bit1 = "SoftwareClosed", bit2 = "PowerOffInitiated", bit4 = "LegacyJumpProhibited". This register survives power-off, but does not seem to be saved to non-volatile storage (does not survive battery pulls). This register doesn't seem to actually control MCU behaviour by itself, it just seems to be used for storing arbitrary data.
| + | |
| + | Accessing N bytes of this register increments the selected index by N. |
| |- | | |- |
| | 0x62 - 0x7E | | | 0x62 - 0x7E |
Line 649: |
Line 720: |
| |- | | |- |
| | 0x7F | | | 0x7F |
− | | d(0x13) | + | | d(9-0x13) |
| | ro | | | ro |
− | | Various system state information. | + | | Various system state information (debug pointer table) |
| + | byte 0x00: Console type, see [[Configuration_Memory#MCU_HW_INFO|here]] |
| + | byte 0x01: PMIC vendor code |
| + | byte 0x02: Battery vendor code |
| + | byte 0x03: MGIC version (major?) |
| + | byte 0x04: MGIC version (minor?) |
| + | byte 0x05: RCOMP(?) |
| byte 0x06: battery related? (seems to decrease while charging and increase while discharging) | | byte 0x06: battery related? (seems to decrease while charging and increase while discharging) |
| byte 0x09: system model (see [[Cfg:GetSystemModel#System_Model_Values|Cfg:GetSystemModel]] for values) | | byte 0x09: system model (see [[Cfg:GetSystemModel#System_Model_Values|Cfg:GetSystemModel]] for values) |
− | byte 0x0A: power LED related? 0 is off, 1 is red | + | byte 0x0A: Red Power LED mode (0 = off, 1 = on) |
| + | byte 0x0B: Blue Power LED intensity (0x00 - 0xFF) |
| byte 0x0D: RGB LED red intensity | | byte 0x0D: RGB LED red intensity |
| byte 0x0E: RGB LED green intensity | | byte 0x0E: RGB LED green intensity |
Line 660: |
Line 738: |
| byte 0x11: WiFi LED brightness | | byte 0x11: WiFi LED brightness |
| byte 0x12: raw button states? | | byte 0x12: raw button states? |
− | bit0: unset while power button is held | + | bit0: unset while Power button is held |
− | bit1: unset while home button is held | + | bit1: unset while HOME button is held |
− | bit2: unset while Wifi slider is held | + | bit2: unset while WiFi slider is held |
| bit5: unset while the charging LED is active | | bit5: unset while the charging LED is active |
| bit6: unset while charger is plugged in | | bit6: unset while charger is plugged in |
− |
| + | |
− | this byte is reset to 0 before an svcBreak takes effect
| + | On MCU_FIRM major version 1 the size of this is 9, reading past the 9th byte will yield AA instead of FF. |
| |- | | |- |
| | 0x80 | | | 0x80 |
Line 680: |
Line 758: |
| | | |
| Non-shared (dynamic) register: it's a register whose contents separate from the shared register pool. Messing with these registers will not affect the shared register pool at all. | | Non-shared (dynamic) register: it's a register whose contents separate from the shared register pool. Messing with these registers will not affect the shared register pool at all. |
| + | |
| + | On old versions of MCU_FIRM none of the invalid registers are masked away by the read handler function, but are still read-only. Newer MCU_FIRM versions return the hardcoded value FF instead. |
| | | |
| == Device 5 & 6 == | | == Device 5 & 6 == |
Line 727: |
Line 807: |
| | | |
| == Device 10 == | | == Device 10 == |
| + | See the datasheet linked to on the [[Hardware]] page for reference. |
| + | |
| + | == Device 11 == |
| See the datasheet linked to on the [[Hardware]] page for reference. | | See the datasheet linked to on the [[Hardware]] page for reference. |
| | | |
Line 740: |
Line 823: |
| |} | | |} |
| | | |
− | This is the DebugPad device, see [[HID_Shared_Memory|here]]. | + | This is a [https://wiibrew.org/wiki/Wiimote/Extension_Controllers/Classic_Controller_Pro Wii Classic Controller Pro] which was slightly modified to have an encrypted device type of 0xF0 [https://wiibrew.org/wiki/Wiimote/Extension_Controllers#The_New_Way instead of 0xFD]. |
| + | |
| + | See [[HID_Shared_Memory#Offset_0x238|here]] for the HID shared memory report format. |
| | | |
| == Device 13 == | | == Device 13 == |