Line 1: |
Line 1: |
− | == Registers ==
| + | = Registers = |
| {| class="wikitable" border="1" | | {| class="wikitable" border="1" |
− | ! Old3dS | + | ! Old3DS |
| ! Name | | ! Name |
| ! Address | | ! Address |
| ! Width | | ! Width |
| + | ! Used by |
| |- | | |- |
− | | Yes | + | | style="background: green" | Yes |
− | | REG_SYSPROT9 | + | | [[#CFG9_SYSPROT9|CFG9_SYSPROT9]] |
| | 0x10000000 | | | 0x10000000 |
| | 1 | | | 1 |
| + | | Boot9 |
| |- | | |- |
− | | Yes | + | | style="background: green" | Yes |
− | | REG_SYSPROT11 | + | | [[#CFG9_SYSPROT11|CFG9_SYSPROT11]] |
| | 0x10000001 | | | 0x10000001 |
| | 1 | | | 1 |
| + | | Boot9 |
| |- | | |- |
− | | Yes | + | | style="background: green" | Yes |
− | | ? | + | | [[#CFG9_RST11|CFG9_RST11]] |
| + | | 0x10000002 |
| + | | 1 |
| + | | Boot9 |
| + | |- |
| + | | style="background: green" | Yes |
| + | | CFG9_DEBUGCTL |
| | 0x10000004 | | | 0x10000004 |
| | 4 | | | 4 |
| + | | |
| + | |- |
| + | | style="background: green" | Yes |
| + | | [[#CFG9_XDMA_CNT|CFG9_XDMA_CNT]] |
| + | | 0x10000008 |
| + | | 1 |
| + | | Boot9, Process9, TwlProcess9 |
| |- | | |- |
− | | Yes | + | | style="background: green" | Yes |
− | | REG_CARDCONF | + | | [[#CFG9_CARDCTL|CFG9_CARDCTL]] |
| | 0x1000000C | | | 0x1000000C |
| | 2 | | | 2 |
| + | | Process9 |
| |- | | |- |
− | | Yes | + | | style="background: green" | Yes |
− | | REG_CARDCTRL | + | | [[#CFG9_CARDSTATUS|CFG9_CARDSTATUS]] |
| | 0x10000010 | | | 0x10000010 |
| | 1 | | | 1 |
| + | | Process9 |
| |- | | |- |
− | | Yes | + | | style="background: green" | Yes |
− | | ?
| + | | CFG9_CARDCYCLES0 |
− | | 0x10000011
| |
− | | 1
| |
− | |-
| |
− | | Yes | |
− | | ? | |
| | 0x10000012 | | | 0x10000012 |
| | 2 | | | 2 |
| + | | Boot9, Process9 |
| |- | | |- |
− | | Yes | + | | style="background: green" | Yes |
− | | ? | + | | CFG9_CARDCYCLES1 |
| | 0x10000014 | | | 0x10000014 |
| | 2 | | | 2 |
| + | | Boot9, Process9 |
| |- | | |- |
− | | Yes | + | | style="background: green" | Yes |
− | | ? | + | | [[#CFG9_SDMMCCTL|CFG9_SDMMCCTL]] |
| | 0x10000020 | | | 0x10000020 |
| | 2 | | | 2 |
| + | | Process9 |
| |- | | |- |
− | | Yes | + | | style="background: green" | Yes |
| | ? | | | ? |
| | 0x10000100 | | | 0x10000100 |
| | 2 | | | 2 |
| + | | |
| |- | | |- |
− | | No | + | | style="background: red" | No |
− | | REG_EXTMEMCNT9 | + | | [[#CFG9_EXTMEMCNT9|CFG9_EXTMEMCNT9]] |
| | 0x10000200 | | | 0x10000200 |
| | 1 | | | 1 |
| + | | NewKernel9 |
| |- | | |- |
− | | Yes | + | | style="background: green" | Yes |
− | | REG_MPCORECFG? | + | | [[#CFG9_MPCORECFG|CFG9_MPCORECFG]] |
| | 0x10000FFC | | | 0x10000FFC |
| | 4 | | | 4 |
| + | | |
| |- | | |- |
− | | Yes | + | | style="background: green" | Yes |
− | | REG_BOOTENV | + | | [[#CFG9_BOOTENV|CFG9_BOOTENV]] |
| | 0x10010000 | | | 0x10010000 |
| | 4 | | | 4 |
| + | | |
| |- | | |- |
− | | Yes | + | | style="background: green" | Yes |
− | | REG_UNITINFO | + | | [[#CFG9_UNITINFO|CFG9_UNITINFO]] |
| | 0x10010010 | | | 0x10010010 |
| | 1 | | | 1 |
| + | | Process9 |
| |- | | |- |
− | | Yes | + | | style="background: green" | Yes |
− | | ? | + | | [[#CFG9_TWLUNITINFO|CFG9_TWLUNITINFO]] |
| | 0x10010014 | | | 0x10010014 |
| | 1 | | | 1 |
| + | | Process9 |
| |} | | |} |
| | | |
− | == REG_SYSPROT9 == | + | == CFG9_SYSPROT9 == |
− | Writing values to SYSPROT sets the specified bitmask. The ARM9 [[Memory_layout|bootrom]](+0x8000) is disabled by writing bit0. bit1 is used by NATIVE_FIRM to make sure console-unique TWL AES-keys are only set at hard-boot. It is not possible to set any other bits.
| + | CFG9_SYSPROT9 is used to permanently disable certain security-sensitive ARM9 memory areas until the next hard reset. |
| | | |
− | From disassembly of the New3DS process9, it appears that setting bit1 disables the 0x10012000+ region.
| + | {| class="wikitable" border="1" |
| + | ! Bit |
| + | ! Description |
| + | ! Used by |
| + | |- |
| + | | 0 |
| + | | Disables ARM9 [[Memory_layout|bootrom]](+0x8000) when set to 1, and enables access to [[Memory_layout|FCRAM]]. Cannot be cleared to 0 once set to 1. |
| + | | Boot9 |
| + | |- |
| + | | 1 |
| + | | Disables [[OTP_Registers|OTP area]] when set to 1. Cannot be cleared to 0 once set to 1. |
| + | | NewKernel9Loader, Process9 |
| + | |- |
| + | | 31-2 |
| + | | Not used |
| + | | |
| + | |} |
| | | |
− | == REG_SYSPROT11 ==
| + | On Old 3DS, NATIVE_FIRM reads CFG9_SYSPROT9 to know whether it has previously initialized the TWL console-unique keys using the OTP data. After setting the TWL console-unique keys, NATIVE_FIRM sets CFG9_SYSPROT9 bit 1 to disable the OTP area. In subsequent FIRM launches prior to the next reset, NATIVE_FIRM will see that the OTP area is disabled, and skip this step. |
− | ARM11 bootrom (+0x8000) is disabled by writing bit0. It is not possible to set any other bits.
| + | |
| + | On New 3DS, the above is instead done by the [[FIRM#New_3DS_FIRM|Kernel9 loader]]. In addition to using the OTP data for initializing the TWL console-unique keys, the Kernel9 loader will generate the decryption key for NATIVE_FIRM. The final keyslot for NATIVE_FIRM is preserved, so that at a non-reset FIRM launch, the keyslot can be reused, since the OTP would then be inaccessible. |
| + | |
| + | == CFG9_SYSPROT11 == |
| | | |
− | == REG_CARDCONF ==
| |
| {| class="wikitable" border="1" | | {| class="wikitable" border="1" |
| ! Bit | | ! Bit |
| ! Description | | ! Description |
| + | ! Used by |
| + | |- |
| + | | 0 |
| + | | Disables ARM11 [[Memory_layout|bootrom]](+0x8000) when set to 1, and enables access to [[Memory_layout|FCRAM]]. Cannot be cleared to 0 once set to 1. |
| + | | Boot9 |
| + | |- |
| + | | 31-1 |
| + | | Not used |
| + | | |
| + | |} |
| + | |
| + | == CFG9_RST11 == |
| + | |
| + | {| class="wikitable" border="1" |
| + | ! Bit |
| + | ! Description |
| + | ! Used by |
| + | |- |
| + | | 0 |
| + | | Presumably takes ARM11 out of reset. Cannot be set to 1 once it has been cleared. |
| + | | Boot9 |
| + | |- |
| + | | 31-1 |
| + | | Not used |
| + | | |
| + | |} |
| + | |
| + | == CFG9_XDMA_CNT == |
| + | |
| + | Write 1 to enable XDMA for the device, 0 to disable. Always enabled for CTRCARD (ids 0 and 1), NTRCARD (id 8), and SHA (id 6 for infifo and 7 for outfifo). |
| + | |
| + | {| class="wikitable" border="1" |
| + | ! Bit |
| + | ! Description |
| + | ! Used by |
| + | |- |
| + | | 0 |
| + | | SDIO controller 1 (eMMC and usually SD card; XDMA device ID: 2) |
| + | | |
| + | |- |
| + | | 1 |
| + | | SDIO controller 3 (SD card if configured so; ID: 3) |
| + | | |
| + | |- |
| + | | 2 |
| + | | AES Input FIFO (ID: 4) |
| + | | Boot9, Process9, TwlProcess9 |
| + | |- |
| + | | 3 |
| + | | AES Output FIFO (ID: 5) |
| + | | Boot9, Process9, TwlProcess9 |
| + | |- |
| + | | 31-4 |
| + | | Reserved |
| + | | |
| + | |} |
| + | |
| + | == CFG9_CARDCTL == |
| + | {| class="wikitable" border="1" |
| + | ! Bit |
| + | ! Description |
| + | ! Used by |
| |- | | |- |
| | 1-0 | | | 1-0 |
− | | Gamecard active controller select (0=NTRCARD, 1=?, 2=CTRCARD1, 3=CTRCARD2) | + | | Gamecard active controller select (0=NTRCARD, 1=?, 2=CTRCARD0, 3=CTRCARD1) |
| + | | Process9 |
| |- | | |- |
| | 8 | | | 8 |
− | | ? | + | | 1 = Switch to [[SPICARD_Registers|SPICARD]] interface (savegames). |
| + | | Process9 |
| |} | | |} |
| | | |
| Depending on the gamecard controller that has been selected, one of the following gamecard registers will become active: | | Depending on the gamecard controller that has been selected, one of the following gamecard registers will become active: |
| * Selecting NTRCARD will activate the register space at [[NTRCARD|0x10164000]]. | | * Selecting NTRCARD will activate the register space at [[NTRCARD|0x10164000]]. |
− | * Selecting CTRCARD1 will activate the register space at [[CTRCARD|0x10004000]]. | + | * Selecting CTRCARD0 will activate the register space at [[CTRCARD|0x10004000]]. |
− | * Selecting CTRCARD2 will activate the register space at [[CTRCARD|0x10005000]]. | + | * Selecting CTRCARD1 will activate the register space at [[CTRCARD|0x10005000]]. |
| | | |
− | == REG_EXTMEMCNT9 == | + | == CFG9_CARDSTATUS == |
− | This register is presumably New3DS-only. Only bit0 is writable: 0 = disable New3DS ARM9 memory at 0x08100000 size 0x80000, 1 = enable. | + | {| class="wikitable" border="1" |
| + | ! Bit |
| + | ! Description |
| + | ! Used by |
| + | |- |
| + | | 0 |
| + | | Cartridge-slot empty (0=inserted, 1=empty) |
| + | | Process9 |
| + | |- |
| + | | 3-2 |
| + | | Cartridge-slot power supply (0=off, 1=prepare power regulator, 2=enable output, 3=request power down) |
| + | | Process9 |
| + | |} |
| + | |
| + | When the power supply is in the "request power down" state, the power bits will be reset to 0=off after some time. |
| + | |
| + | == CFG9_SDMMCCTL == |
| + | This register controls power of multiple ports/controllers and allows to map controller 3 to ARM9 or ARM11. The SD card can be accessed on ARM11 by setting bit 8 and clearing bit 9. |
| + | |
| + | {| class="wikitable" border="1" |
| + | ! Bit |
| + | ! Description |
| + | ! Used by |
| + | |- |
| + | | 0 |
| + | | Controller 1/3 port 0 power (SD card) (1=off) |
| + | | Process9 |
| + | |- |
| + | | 1 |
| + | | Controller 1 port 1 power (eMMC) (1=off) |
| + | | Process9 |
| + | |- |
| + | | 2 |
| + | | Controller 2 port 0 power (WiFi SDIO) (1=off) |
| + | | Process9 |
| + | |- |
| + | | 3 |
| + | | Controller 3 port 1 power? Set at cold boot. |
| + | | - |
| + | |- |
| + | | 4-5 |
| + | | Unused. |
| + | | - |
| + | |- |
| + | | 6 |
| + | | Wifi port related? Pull up? Set at cold boot. |
| + | | - |
| + | |- |
| + | | 8 |
| + | | Controller 3 mapping (0=ARM9 0x10007000, 1=ARM11 0x10100000) |
| + | | Process9 |
| + | |- |
| + | | 9 |
| + | | SD card controller select (0=0x10007000/0x10100000, 1=0x10006000) |
| + | | Process9 |
| + | |- |
| + | | 10-15 |
| + | | Unused. |
| + | | - |
| + | |} |
| | | |
− | This bit is set by New3DS ARM9-kernel crt0. | + | == CFG9_EXTMEMCNT9 == |
| + | This register is New3DS-only. |
| | | |
− | The data in this extended memory doesn't change when disabling the memory, then re-enabling the memory. Reading this extended memory while disabled results in zeros.
| + | {| class="wikitable" border="1" |
| + | ! Bit |
| + | ! Description |
| + | ! Used by |
| + | |- |
| + | | 0 |
| + | | Hide extended ARM9 memory (0=hidden, 1=shown) |
| + | | Kernel9 (New3DS) |
| + | |- |
| + | | 31-1 |
| + | | Reserved |
| + | | |
| + | |} |
| | | |
− | == REG_BOOTENV == | + | == CFG9_MPCORECFG == |
− | Initially this is value zero. NATIVE_FIRM writes value 1 here when a FIRM launch begins. The [[Legacy_FIRM_PXI|LGY]] FIRM writes value 3 here when handling PXI command 0x00020080(first TWL PXI command), it also writes value 7 here when handling PXI command 0x00030080(first AGB PXI command). This register can be read to determine what "mode" the system is running under: hard-boot, FIRM launch, or TWL/AGB FIRM.
| + | Identical to [[PDN#PDN_MPCORE_CFG|PDN_MPCORE_CFG]]. |
| | | |
− | 0=Cold boot, 1=CTR, 3=TWL, 5=NTR, 7=AGB
| + | == CFG9_BOOTENV == |
| + | This register is used to determine what the previous running FIRM was. Its value is kept following an MCU reboot. Its initial value (on a cold boot) is 0. NATIVE_FIRM [[Development_Services_PXI|sets it to 1]] on shutdown/FIRM launch. [[Legacy_FIRM_PXI|LGY FIRM]] writes value 3 here when launching a TWL title, and writes value 7 when launching an AGB title. |
| | | |
− | It is unknown if this register controls anything.
| + | NATIVE_FIRM will only launch titles if this is not value 0, and will only save the [[Flash_Filesystem|AGB_FIRM savegame]] to SD if this is value 7. |
| | | |
− | == REG_UNITINFO == | + | == CFG9_UNITINFO == |
| This 8-bit register is value zero for retail, non-zero for dev/debug units. | | This 8-bit register is value zero for retail, non-zero for dev/debug units. |
| + | |
| + | == CFG9_TWLUNITINFO == |
| + | In the console-unique TWL key-init/etc function the ARM9 copies the u8 value from REG_UNITINFO to this register. |
| + | |
| + | This is also used by TWL_FIRM Process9. |