516
edits
Changes
→MCU service "mcu::RTC"
|-
|-
| 0x00060000
| 0x00060000
| ReadGyroscopeValues (reads gyroscopy with corrected values)
| ReadGyroscopeValues (reads 3x s16 gyro ADC values into IPC+8)
|-
|-
| 0x00070000
| 0x00070000
| GetRaw3DSliderPosition
| GetRaw3DSliderPosition (u8 position in IPC+8)
|-
|-
| 0x00080040
| 0x00080040
|-
|-
| 0x002E0000
| 0x002E0000
| u8 GetBatteryEmptyPatternByte0
| u8 SetPowerModeIndicatorState (see [[I2C_Registers#Device_3|Register 0x29]])
|-
|-
| 0x002F0000
| 0x002F0000
|-
|-
| 0x00340000
| 0x00340000
| WriteRegister reg=0x23 value=0x72 (writing to read-only registers does nothing)
| ResetMcu
|-
|-
| 0x00350000
| 0x00350000
|-
|-
| 0x00380042
| 0x00380042
| ReadInfoRegister(u32 unused_size, translation_param size << 4 <nowiki>|</nowiki> 0xC, u8[0x13] ptr)
| Same as [[MCUHWC:GetInfoRegisters]]
|-
|-
| 0x00390082
| 0x00390082
| WriteLoop (translation parameters too complex)
| SetPlayCountRegisters (u8 index, const u8 *data, u32 size). Write to free reg bank at index+8.
|-
|-
| 0x003A0082
| 0x003A0082
| ReadLoop (translation parameters too complex)
| GetPlayCountRegisters
|-
|-
| 0x003B0640
| 0x003B0640
|-
|-
| 0x004F0040
| 0x004F0040
| SetMCUFirmUpdated(u32 flag) not used by anything
| SetMCUFirmUpdated(u32 flag) used by PTM module
|-
|-
| 0x00500000
| 0x00500000
|-
|-
| 0x00530040
| 0x00530040
| ?
| SetLgyLcdData
|-
|-
| 0x00540000
| 0x00540000
| ?
| GetLgyLcdData
|-
|-
| 0x00550040
| 0x00550040
| ?
| SetLgyNativeResolutionFlag
|-
|-
| 0x00560000
| 0x00560000
| ?
| GetLgyNativeResolutionFlag
|-
|-
| 0x00570040
| 0x00570040
| ?
| SetLocalFriendCodeCounter
|-
|-
| 0x00580000
| 0x00580000
| ?
| GetLocalFriendCodeCounter
|-
|-
| 0x00590040
| 0x00590040
| 0x005A0000
| 0x005A0000
| [[MCURTC:GetLegacyJumpProhibitedFlag|GetLegacyJumpProhibitedFlag]]
| [[MCURTC:GetLegacyJumpProhibitedFlag|GetLegacyJumpProhibitedFlag]]
|-
| 0x005B0040
| SetUUIDClockSequence
|-
| 0x005C0000
| GetUUIDClockSequence
|-
|}
|}
|-
|-
| 0x000E0080
| 0x000E0080
| ?
| GetBatteryTemperature
|-
|-
| 0x000F00C0
| 0x000F00C0
=MCU firmware versions=
=MCU firmware versions=
These reside in mcu-module .rodata, are uploaded to MCU register 0x05 and are usually 0x4003 bytes in size (the actual firmware is 0x4000 bytes preceeded by a 3 byte magic header "<code>jhl</code>" which switches the I2C comms into flash write mode).
These reside in mcu sysmodule .rodata, are uploaded to MCU register 0x05 and are usually 0x4003 bytes in size (the actual firmware is 0x4000 bytes preceeded by a 3 byte magic header "<code>jhl</code>" which switches the I2C comms into flash write mode).
Switching requires register 0x05 (at address <code>0xFFBA9</code>) to contain 0x6A ('<code>j</code>'), register 0x06 containing 0x68 ('<code>h</code>'), and writing 0x6C ('<code>l</code>') to register 0x07. The actual flashing sequence is only signaled (code at 0x3312-0x331A) when writing register 0x07, it's skipped otherwise. Register 0x07 gets written anyways, just the actual signaling is skipped if the conditions aren't met.
Switching requires register 0x05 (at address <code>0xFFBA9</code>) to contain 0x6A ('<code>j</code>'), register 0x06 containing 0x68 ('<code>h</code>'), and writing 0x6C ('<code>l</code>') to register 0x07. The actual flashing sequence is only signaled (code at 0x3312-0x331A) when writing register 0x07, it's skipped otherwise. Register 0x07 gets written anyways, just the actual signaling is skipped if the conditions aren't met.
Before the upload could commence, WiFi interrupts are turned off via GPIO command 0x00020080(0, 0x40000), then after the upload completed, the sysmodule waits exactly one second for the MCU to reboot, then turns WiFi interrupts back on via <code>gpio:MCU</code> command 0x00020080(0x40000, 0x40000).
Before the upload could commence, external MCU interrupts are turned off via GPIO command 0x00020080(0, 0x40000), then after the upload completed, the sysmodule waits exactly one second for the MCU to reboot, then turns external MCU interrupts back on via <code>gpio:MCU</code> command 0x00020080(0x40000, 0x40000).
There exists an alternate code path where uploading is done using register 0x3B (if register 0x0F is zero meaning all peripherals are turned off, and 0x10 must be 1 (power button pressed/held)). This may be a "hack" around early versions of MCU? Register 0x3B is part of the RTC alarm registers on recent versions of MCU.
There exists an alternate code path in very old MCU_FIRM versions where uploading is done using register 0x3B (if register 0x0F is zero and 0x10 is 1). Register 0x3B is part of the RTC alarm registers on recent versions of MCU.
On dev-units, the user-facing representation of this firmware version is displayed by first subtracting 0x10 from the major field (raw register 0x00). It is these user-facing versions that are displayed in the table below. It is unknown what bit4 (0x10) actually represents, but it is seemingly always set.
On dev-units, the user-facing representation of this firmware version is displayed by first subtracting 0x10 from the major field (raw register 0x00). It is these user-facing versions that are displayed in the table below. It is unknown what bit4 (0x10) actually represents, but it is seemingly always set.