215
edits
Changes
Jump to navigation
Jump to search
Line 105:
Line 105: + + + + + + + + + + + + + + + + + + + + + Line 173:
Line 194: − + Line 179:
Line 200: − + Line 185:
Line 206: − + Line 191:
Line 212: − + Line 203:
Line 224: − + Line 234:
Line 255: + + + + + Line 253:
Line 279: − + + + + − + − + Line 287:
Line 316: − + Line 297:
Line 326: − + Line 312:
Line 341: − + + + + + + + Line 337:
Line 372: − + − + − + − + − + − + − + − + − bit15: ??? (Power Management related?) + + + + − bit24: ??? (???) + − + + − + − + − + Line 374:
Line 413: − + − + − + − + − + + + + + + + + + + − + + + + + + + Line 400:
Line 454: − + − + Line 432:
Line 486: − + + + + + + + + + Line 446:
Line 508: + Line 470:
Line 533: − + − + Line 481:
Line 544: − byte 7: leap year counter / "watch error correction" register (unused)+ + + + + − + Line 490:
Line 557: − + + + − + − |- − | 0x3C − | s − | ro − | ??? − + Line 510:
Line 574: − + − + Line 519:
Line 583: − + Line 539:
Line 603: − + Line 545:
Line 609: − + Line 552:
Line 616: − + − + − + − + − + + + + + + − | ??? − | ??? − |- − | X? (=pitch) − | held vertically Line 629:
Line 693: − + − + − first byte is wo+ − + − Writing to first byte resets the queue position to the nth element+ − Reading from this register causes the values to shift up by `readsize-1`(needs confirmation) bytes after returning `readsize-1` bytes from the top of the stack (first byte is read-only, so is always zero)+ + + + + + + + − + − + − The first byte is used to store flags for managing FIRM/NS state - bit0 = "WirelessDisabled", bit1 = "SoftwareClosed", bit2 = "PowerOffInitiated", bit4 = "LegacyJumpProhibited". This register survives power-off, but does not seem to be saved to non-volatile storage (does not survive battery pulls). This register doesn't seem to actually control MCU behaviour by itself, it just seems to be used for storing arbitrary data.+ + Line 650:
Line 722: − + + + + + + + − + + Line 659:
Line 738: − + − + − + − − this byte is reset to 0 before an svcBreak takes effect Line 730:
Line 807: + + + Line 743:
Line 823: − + + +
Added info on DebugPad
| 7
| 7
| Start/busy (0=Ready, 1=Start/busy)
| Start/busy (0=Ready, 1=Start/busy)
|}
== I2C_CNTEX ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 0-1
| ? Set to 2 normally.
|}
== I2C_SCL ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 0-5
| ?
|-
| 8-12
| ? Set to 5 normally.
|}
|}
| 0xa6
| 0xa6
| "i2c::HID"
| "i2c::HID"
| Unknown. The device table in I2C-module had the device address changed from 0xA6 to 0xD6 with [[8.0.0-18]].
| Gyroscope. The device table in I2C-module had the device address changed from 0xA6 to 0xD6 with [[8.0.0-18]].
|-
|-
| 10
| 10
| 0xd0
| 0xd0
| "i2c::HID"
| "i2c::HID"
| Gyroscope
| Gyroscope (old3DS)
|-
|-
| 11
| 11
| 0xd2
| 0xd2
| "i2c::HID"
| "i2c::HID"
| ?
| Gyroscope (2DS, new3DSXL, new2DSXL)
|-
|-
| 12
| 12
| 0xa4
| 0xa4
| "i2c::HID"
| "i2c::HID"
| DebugPad
| DebugPad (slightly modified [https://wiibrew.org/wiki/Wiimote/Extension_Controllers/Classic_Controller_Pro Wii Classic Controller Pro])
|-
|-
| 13
| 13
| 0xa0
| 0xa0
| "i2c::EEP"
| "i2c::EEP"
| eeprom?
| HWCAL EEPROM ([[Hardware_calibration#Header|only present on dev units where SHA256 is used for HWCAL verification]])
|-
|-
| 15
| 15
s* = shared register (explaination below this table)
s* = shared register (explaination below this table)
ds = dynamic shared (explaination below this table)
ds = dynamic shared (explaination below this table)
Reading or writing multiple bytes from/to single-byte registers increments the register ID along with it. For example reading two bytes from reg 0x00 reads regs 0x00 and 0x01.
This is not the case for multibyte regs (0x29, 0x2D, 0x4F, 0x61 and 0x7F), plus reg 0x60.
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! REGISTER
! REGISTER
| d
| d
| rw
| rw
| 2bit value, writing will mask away/"acknowledge" the event, set to 3 by mcuMainLoop on reset if reset source is Watchdog
| For bit0 and 1 values, writing will mask away/"acknowledge" the event, set to 3 by mcuMainLoop on reset if reset source is Watchdog
bit0: RTC clock value got reset to defaults
bit0: RTC clock value got reset to defaults
bit1: Watchdog reset happened
bit1: Watchdog reset happened
bit5: TWL MCU reg: volume mode (0: 8-step, 1: 32-step)
bit6: TWL MCU reg: NTR (0) vs TWL mode (1)
bit7: TWL MCU reg: Uses NAND
|-
|-
| 0x03
| 0x03
| ds
| ds
| rw
| rw
| Top screen flicker
| Top screen Vcom
|-
|-
| 0x04
| 0x04
| ds
| ds
| rw
| rw
| Bottom screen flicker
| Bottom screen Vcom
|-
|-
| 0x05
| 0x05
| s
| s
| ro
| ro
| ? (seems to be power management related?)
| Battery temperature (in Celcius?)
|-
|-
| 0x0B
| 0x0B
| s
| s
| ro
| ro
| ? (changes to 0 for a second when the charger is plugged in then it resets to its previous value)
| Battery percentage, fractional part (seems to have a resolution of around 0.1% according to tests)
|-
|-
| 0x0D
| 0x0D
| s
| s
| ro
| ro
| Flags: bit7-5 are read via [[MCU_Services|mcu::GPU]]. The rest of these are read via [[MCU_Services|mcu::RTC]]: bit4 = BatteryChargeState. bit3 = AdapterState. bit1 = ShellState.
| Flags: bit7-5 are read via [[MCU_Services|mcu::GPU]]. The rest of them are read via [[MCU_Services|mcu::RTC]].
bit01: ShellState
bit03: AdapterState
bit04: BatteryChargeState
bit05: Bottom screen backlight on
bit06: Top screen backlight on
bit07: GPU on(?)
|-
|-
| 0x10
| 0x10
| rw
| rw
| Interrupt mask for register 0x10 (0=enabled,1=disabled)
| Interrupt mask for register 0x10 (0=enabled,1=disabled)
bit00: Power button press
bit00: Power button press (for 27 "ticks")
bit01: Power button held (the 3DS turns off regardless after a fixed time)
bit01: Power button held (for 375 "ticks"; the 3DS turns off regardless after a fixed time)
bit02: HOME button press
bit02: HOME button press (for 5 "ticks")
bit03: HOME button release
bit03: HOME button release
bit04: WiFi switch button
bit04: WiFi switch button
bit05: Shell close
bit05: Shell close
bit06: Shell open
bit06: Shell open
bit07: Fatal hardware condition([[Services#Notifications|?]])
bit07: Fatal hardware condition([[Services#Notifications|?]]) (sent when the MCU gets reset by the Watchdog timer)
bit08: Charger removed
bit08: Charger removed
bit09: Charger plugged in
bit09: Charger plugged in
bit10: ??? (Power Management related?)
bit10: RTC alarm (when some conditions are met it's sent when the current day and month and year matches the current RTC time)
bit11: ??? (HID related)
bit11: ??? (accelerometer related)
bit12: HID update
bit12: HID update
bit13: Battery dead(?)
bit13: Battery percentage status change (triggered at 10%, 5%, and 0% while discharging)
bit14: ??? (Power Management related?)
bit14: Battery stopped charging (independent of charger state)
bit15: Battery started charging
Nonmaskable(?) interrupts
bit16: ???
bit17: ??? (opposite even for bit16)
bit22: Volume slider position change
bit22: Volume slider position change
bit23: ??? Register 0x0E update
bit25: ??? (???)
bit24: ??? (the off event for below bit)
bit25: ??? (triggered when something related to the GPU is turned on, most likely backlight)
bit26: ??? (???)
bit26: ??? (???)
bit27: ??? (???)
bit27: ??? (???)
bit28: ??? (???)
bit28: ??? (???)
bit29: ??? (???)
bit29: ??? backlight on?
bit30: forced off by mcu sysmodule
bit30: bit set by mcu sysmodule
bit31: forced off by mcu sysmodule
bit31: bit set by mcu sysmodule
|-
|-
| 0x1C
| 0x1C
| System power control:
| System power control:
bit0: power off
bit0: power off
bit1: reboot (unused?)
bit1: full reboot (unused). Discards things like [[CONFIG9_Registers#CFG9_BOOTENV|CFG9_BOOTENV]]
bit2: reboot (used by mcu sysmodule and LgyBg)
- Asserts RESET1 via PMIC command (?) (deasserts nRESET1). This could be the reset that controls some CFG9 registers
bit3: used by LgyBg to power off, causes hangs in 3DS-mode
- Asserts RESET2 (P0.1 = 0, PM0.1 = 0 (output)) (deasserts nRESET2)
bit4: an mcu::RTC command uses this, seems to do something with the watchdog
- Asserts FCRAM_RESET (P3.0 = 0) (deasserts nFCRAM_RESET)
Bit 4 sets a bit at a RAM address which seems to control the watcdog timer state, then this bit is immediately unmasked. This field has a bitmask of 0x0F.
bit2: normal reboot. Preserves [[CONFIG9_Registers#CFG9_BOOTENV|CFG9_BOOTENV]], etc.
- Asserts RESET2 (P0.1 = 0, PM0.1 = 0)
- If in NTR emulation mode (see reg 0x02), asserts FCRAM_RESET (P3.0 = 0)
- Resets TWL MCU i2c registers
bit3: FCRAM reset (present in by LgyBg. Unused because a system reboot does the same thing & a PDN reg also possibly implements this function)
- Asserts FCRAM_RESET (P3.0 = 0)
bit4: signal that sleep mode is about to be entered (used by PTM)
Bit 4 sets a bit at a RAM address which seems to control the watcdog timer state, then this bit is immediately unmasked. This field has a bitmask of 0x0F.
If any of the reset bits is set, the MCU waits for 5ms, then deasserts RESET1 (via PMIC), RESET2 (PM0.1 = 1 (input)) and FCRAM_RESET (P3.0 = 1), and reinitializes some other various registers after a 100ms delay.
|-
|-
| 0x21
| 0x21
| d
| d
| wo
| wo
| ??? switches up input bits from <code>0123456--</code> to <code>12-0435-</code> then writes them to REG[0x5D] (<code>0xFFC02</code>)
| Used in legacy mode to signal events for TWL MCU "emulation" (written to REG[0x5D])? Software then asserts the TWL MCU IRQ pin via [[#LGY_GPIOEMU_MASK|Legacy I/O registers]].
bit0: Signal TWL POWER button click
bit1: Signal TWL reset
bit2: Signal TWL power off
bit3: Signal TWL battery low
bit4: Signal TWL battery empty
bit5: Signal TWL volume button click
|-
|-
| 0x22
| 0x22
|-
|-
| 0x23
| 0x23
| ??
| d
| wo
| wo
| ??? Seems to be stubbed, just returns the written value from the write handler function.
| Writing 0x72 ('r') resets the MCU, but this is stubbed on retail?
|-
|-
| 0x24
| 0x24
| sd(5)
| sd(5)
| rw
| rw
| Power LED state + some extra data
| Power mode indicator state (read-write)
1 = forced default blue
2 = sleep mode animation
3 = "power off" mode
4 = disable blue power LED and turn on red power LED
5 = disable red power LED and turn on blue power LED
6 = animate blue power LED off and flash red power LED
anything else = automatic mode
The other 4 bytes (32bits) affect the pattern of the red power LED (write only)
|-
|-
| 0x2A
| 0x2A
1 = slowly blinking
1 = slowly blinking
2 = constantly on
2 = constantly on
3 = "TWL" mode
4 = flash once
4 = flash once
5 = delay before changing to 2
5 = delay before changing to 2
|-
|-
| 0x30
| 0x30
- 0x37
- 0x36
| s
| ds
| rw
| rw
| RTC time (system clock). 7 bytes are read from this. The upper nibble of each byte encodes 10s (BCD), so each byte is post-processed with (byte & 0xF) + (10 * (byte >> 4)).
| RTC time (system clock). 7 bytes are read from this. The upper nibble of each byte encodes 10s (BCD), so each byte is post-processed with (byte & 0xF) + (10 * (byte >> 4)).
byte 5: months
byte 5: months
byte 6: years
byte 6: years
|-
| 0x37
| s
| rw
| RTC time byte 7: leap year counter / "watch error correction" register (unused in code)
|-
|-
| 0x38
| 0x38
- 0x3A
- 0x3C
| s
| s
| rw
| rw
byte 0: minutes
byte 0: minutes
byte 1: hours
byte 1: hours
byte 2: week
byte 2: day
byte 3: month
byte 4: year
|-
|-
| 0x3B
| 0x3B
| s
| s
| rw
| rw
| Register 0x3B could be used to upload [[MCU_Services#MCU_firmware_versions|MCU firmware]] if some conditions are met.
| Could be used on extremely old MCU_FIRM versions to upload [[MCU_Services#MCU_firmware_versions|MCU firmware]] if reg 0xF == 0 and reg 0x10 == 1 (presumably major and minor version fields for mcufw 0.1 which largely predates factory firm).
|-
|-
| 0x3D
| 0x3D
0x3E
0x3E
| s
| ds
| ro
| ro
| RTC tick counter / "ITMC" (when resets to 0 the seconds increase)
| RTC tick counter / "ITMC" (when resets to 0 the seconds increase)
|-
|-
| 0x3F
| 0x3F
| s
| d
| wo
| wo
| 2 bits
| 2 bits
bit0: turns off P00 and sets it to output mode (seems to kill the entire SoC)
bit0: Asserts RESET1 (P0.0 = 0, PM0.0 = 0 (output)) but does NOT deassert it (wtf?). This seems to kill the entire SoC: is it because it doesn't deassert it, or does it not deassert it because the SoC hangs anyway? This is the pin that controls some security-critical regs like CFG9_BOOTENV!
bit1: turns on a prohibited bit in an RTC Control register and turns P12 into an output
bit1: turns on a prohibited bit in an RTC Control register and turns P12 into an output
|-
|-
| s
| s
| rw
| rw
| Pedometer state (?)
| Tilt sensor sampling mode. Bits 0 and 1 control the mode. If bits 0 or 1 are set then the tilt sensor is enabled and sampled.
|-
|-
| 0x41
| 0x41
| s
| s
| rw
| rw
| ???, accelometer related
| ???, pedoometer related(?)
|-
|-
| 0x45
| 0x45
| s
| s
| ro
| ro
| Gyroscope 3D rotation from the 12bit ADC, left shifted 4 to fit in a 16bit signed short
| Tilt sensor 3D rotation from the 12bit ADC, left shifted 4 to fit in a 16bit signed short, relative to the 3DS bottom screen
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! AXIS
! AXIS
! V=0xC0
! V=0xC0
|-
|-
| Y (=roll)
| X (left/right)
| held vertically
| held up vertically
| vertical right side
| rotated left 90° like a steering wheel
| vertical left side
| rotated right 90° like a steering wheel
|-
|-
| Z? (=yaw)
| Y (forwards/backwards)
| laid flat on the desk with the screen facing up
| held up vertically
| held up vertically with screen facing upside-down
|-
| Z (???)
| ???
| ???
| ???
| ???
| ???
| ???
|-
|-
| 0x60
| 0x60
| ds(1)
| d
| ro
| rw
| Free register bank address (index) select
| Looping queue register
Selects the index to read from in the free register bank, up to 200. Used in conjunction with reg 0x61.
byte 0: bit0 = "WirelessDisabled", bit1 = "SoftwareClosed", bit2 = "PowerOffInitiated", bit3 = "LgyNativeResolution", bit4 = "LegacyJumpProhibited"
byte 1: Legacy LCD data
bytes 2 and 3: Local Friend Code counter
bytes 4 and 5: UUID clock sequence
bytes 6 and 7: Unused
bytes 8 to 175: Playtime data for legacy titles
bytes 176 to 188: Playtime data
bytes 188 to 199: Unused
|-
|-
| 0x61
| 0x61
| ds(0x100)
| d(200)
| rw
| rw
| Writing to this register pushes values on top of register 0x60's stack. Reading from this register doesn't advance the stack.
| Free register bank, data is read from/written to here.
Accessing N bytes of this register increments the selected index by N.
|-
|-
| 0x62 - 0x7E
| 0x62 - 0x7E
| d(9-0x13)
| d(9-0x13)
| ro
| ro
| Various system state information.
| Various system state information (debug pointer table)
byte 0x00: Console type, see [[Configuration_Memory#MCU_HW_INFO|here]]
byte 0x01: PMIC vendor code
byte 0x02: Battery vendor code
byte 0x03: MGIC version (major?)
byte 0x04: MGIC version (minor?)
byte 0x05: RCOMP(?)
byte 0x06: battery related? (seems to decrease while charging and increase while discharging)
byte 0x06: battery related? (seems to decrease while charging and increase while discharging)
byte 0x09: system model (see [[Cfg:GetSystemModel#System_Model_Values|Cfg:GetSystemModel]] for values)
byte 0x09: system model (see [[Cfg:GetSystemModel#System_Model_Values|Cfg:GetSystemModel]] for values)
byte 0x0A: power LED related? 0 is off, 1 is red
byte 0x0A: Red Power LED mode (0 = off, 1 = on)
byte 0x0B: Blue Power LED intensity (0x00 - 0xFF)
byte 0x0D: RGB LED red intensity
byte 0x0D: RGB LED red intensity
byte 0x0E: RGB LED green intensity
byte 0x0E: RGB LED green intensity
byte 0x11: WiFi LED brightness
byte 0x11: WiFi LED brightness
byte 0x12: raw button states?
byte 0x12: raw button states?
bit0: unset while power button is held
bit0: unset while Power button is held
bit1: unset while home button is held
bit1: unset while HOME button is held
bit2: unset while Wifi slider is held
bit2: unset while WiFi slider is held
bit5: unset while the charging LED is active
bit5: unset while the charging LED is active
bit6: unset while charger is plugged in
bit6: unset while charger is plugged in
On MCU_FIRM major version 1 the size of this is 9, reading past the 9th byte will yield AA instead of FF.
On MCU_FIRM major version 1 the size of this is 9, reading past the 9th byte will yield AA instead of FF.
== Device 10 ==
== Device 10 ==
See the datasheet linked to on the [[Hardware]] page for reference.
== Device 11 ==
See the datasheet linked to on the [[Hardware]] page for reference.
See the datasheet linked to on the [[Hardware]] page for reference.
|}
|}
This is the DebugPad device, see [[HID_Shared_Memory|here]].
This is a [https://wiibrew.org/wiki/Wiimote/Extension_Controllers/Classic_Controller_Pro Wii Classic Controller Pro] which was slightly modified to have an encrypted device type of 0xF0 [https://wiibrew.org/wiki/Wiimote/Extension_Controllers#The_New_Way instead of 0xFD].
See [[HID_Shared_Memory#Offset_0x238|here]] for the HID shared memory report format.
== Device 13 ==
== Device 13 ==