Changes

Jump to navigation Jump to search
9,879 bytes added ,  10:49, 13 October 2019
Updated MCU pointer table register info
| 7
| Start/busy (0=Ready, 1=Start/busy)
|}
 
== I2C_CNTEX ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 0-1
| ? Set to 2 normally.
|}
 
== I2C_SCL ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 0-5
| ?
|-
| 8-12
| ? Set to 5 normally.
|}
| 0xa0
| "i2c::EEP"
| eeprom?HWCAL EEPROM ([[Hardware_calibration#Header|only present on dev units where SHA256 is used for HWCAL verification]])
|-
| 15
== Device 3 ==
ro = read-only (writing is no-op)
rw = read-write
wo = write-only (reading will yield 00, FF, or unpredictable data)
 
d* = dynamic register (explaination below this table)
s* = shared register (explaination below this table)
ds = dynamic shared (explaination below this table)
{| class="wikitable" border="1"
! REGISTER
! WIDTH
! INFO
! DESCRIPTION
|-
| 0x00
| 1s| ro
| Version high
|-
| 0x01
| 1s| ro
| Version low
|-
| 0x02
| d
| rw
| 2bit value, writing will mask away/"acknowledge" the event, set to 3 by mcuMainLoop on reset if reset source is Watchdog
bit0: RTC clock value got reset to defaults
bit1: Watchdog reset happened
|-
| 0x03
| 8ds| ?rw| Top screen Vcom
|-
| 0x04
| 8ds| ?rw| Bottom screen Vcom
|-
| 0x05
- 0x07| s| 0x4003?rw| Danger zone - [[MCU_Services#MCU_firmware_versions|MCU firmwareunlock sequence]] is uploaded written here.
|-
| 0x08
| 1s| ro| Raw 3D slider position 0x9..0xFB
|-
| 0x09
| 1s| Sound volumero| Volume slider state (0x00 - 0x3F)This is the same value returned by [[MCUHWC:GetSoundVolume|MCUHWC: 0x0..0x3F.GetSoundVolume]]|-| 0x0A| s| ro| ? (seems to be power management related?)|-| 0x0B| s| ro| Battery percentage|-| 0x0C| s| ro| ? (changes to 0 for a second when the charger is plugged in then it resets to its previous value)|-| 0x0D| s| ro| System voltage
|-
| 0xB0x0E| 1s| Battery level: 0x0..0x40.ro| ?
|-
| 0xF0x0F| 1s| ro| Flags: bit7-5 are read via [[MCU_Services|mcu::GPU]]. The rest of these them are read via [[MCU_Services|mcu::RTC]]. bit01: ShellState bit03: AdapterState bit04: bit4 = BatteryChargeState. bit3 = AdapterState. bit1 = ShellState. bit05: Bottom screen backlight on bit06: Top screen backlight on bit07: GPU on(?)
|-
| 0x10
- 0x13| s| 1ro| Special HID status flags: bit0 = power button pressedReceived interrupt bitmask, bit1 = power button pressed long, bit2 = home button pressed, bit3 = home button released, bit4 = wifi slider enabled, bit5 = shell got closed, bit6 = shell got opened. see register 0x18 for possible values If nothing has changed no interrupt was received this register is 0.|-| 0x14| s| ro| Unused and unwritable byte :(
|-
| 0x120x15- 0x17| s| 1rw| 0x40 if volume slider position changedUnused and unreferenced free RAM! Good for userdata.
|-
| 0x18
- 0x1B| s| rw| 8Interrupt mask for register 0x10 (0=enabled,1=disabled) bit00: Power button press (for 27 "ticks") bit01: Power button held (for 375 "ticks"; the 3DS turns off regardless after a fixed time) bit02: HOME button press (for 5 "ticks") bit03: HOME button release bit04: WiFi switch button bit05: Shell close bit06: Shell open bit07: Fatal hardware condition([[Services#Notifications| ?]]) (sent when the MCU gets reset by the Watchdog timer) bit08: Charger removed bit09: Charger plugged in bit10: RTC alarm (when some conditions are met it's sent when the current day and month and year matches the current RTC time) bit11: ??? (accelerometer related) bit12: HID update bit13: Battery percentage status change (triggered at 10%, 5%, and 0% while discharging) bit14: Battery stopped charging (independent of charger state) bit15: Battery started chargingNonmaskable(?) interrupts bit16: ??? bit17: ??? (opposite even for bit16) bit22: Volume slider position change bit23: ??? Register 0x0E update bit24: ??? (the off event for below bit) bit25: ??? (triggered when something related to the GPU is turned on, most likely backlight) bit26: ??? (???) bit27: ??? (???) bit28: ??? (???) bit29: ??? backlight on? bit30: bit set by mcu sysmodule bit31: bit set by mcu sysmodule|-| 0x1C- 0x1F| s| rw| Unused and unreferenced free RAM! Good for userdata.
|-
| 0x20
| 8d| Writing u8 value wo| System power control: bit0: power off bit1: reboot (unused?) bit2: reboot (used by mcu sysmodule and LgyBg) bit3: used by LgyBg to power off, causes hangs in 3DS-mode bit4: an mcu::RTC command uses this, seems to do something with the watchdogBit 4 here triggers sets a hardware system rebootbit at a RAM address which seems to control the watcdog timer state, then this bit is immediately unmasked. Writing u8 value 1 (repeatedly) triggers This field has a shutdown via powerbitmask of 0x0F. |-off| 0x21| d| wo| ???switches up input bits from <code>0123456--</code> to <code>12-0435-</code> then writes them to REG[0x5D] (<code>0xFFC02</code>)
|-
| 0x22
| 8d| wo| Used to set LCD states. bit0 = : don't push to LCDs, bit1 = : push to LCDs, bit2 = : bottom screen backlight off, bit3 = : bottom screen backlight on, bit4 = : top screen backlight off, bit5 = : top screen backlight on Bits 4 and 5 have no effect on a 2DS because the backlight source is the bottom screen.The rest of the bits are masked away.
|-
| 0x23
| 8??| wo| ??? Seems to be stubbed, just returns the written value from the write handler function.
|-
| 0x24
| 8s| rw
| Watchdog timer. This must be set *before* the timer is triggered, otherwise the old value is used. Value zero disables the watchdog.
|-
| 0x25
| s
| rw
| ?
|-
| 0x26
| s
| rw
| ?
|-
| 0x27
| sd
| rw
| Raw volume slider state
|-
| 0x28
| 8s| ?rw| Brightness of the WiFi/Power LED
|-
| 0x29
| 8sd(5)| ??| Power mode indicator state (read-write) 1 = forced default blue 2 = sleep mode animation 3 = "power off" mode 4 = disable blue power LED and turn on red power LED 5 = disable red power LED and turn on blue power LED 6 = animate blue power LED off and flash red power LED anything else = automatic modeThe other 4 bytes (32bits) affect the pattern of the red power LED (write only)
|-
| 0x2A
| 8s| ?rw| WiFi LED state, non-0 value turns on the WiFi LED, 4 bits wide
|-
| 0x2B
| 8s| ?rw| Camera LED state, 4bits wide, 0, 3, 6-0xF = off 1 = slowly blinking 2 = constantly on 3 = "TWL" mode 4 = flash once 5 = delay before changing to 2
|-
| 0x2C
| 8s| setting bits 1rw| 3D LED state, 3 and 4 turn on the 3D LED on the original 3dsbits wide
|-
| 0x2D
| 0x64
| wo| This is used for [[MCURTC:SetInfoLEDPattern|controlling]] the notification LED(see [[MCURTC:SetInfoLEDPatternHeader]] as well), when this register is written. It's possible to write data here with size less than 0x64, and only that portion of the pattern data will get overwritten. Reading from this register only returns zeroes, so it's considered write-only. Writing past the size of this register seems to do nothing.
|-
| 0x2E
| 1s| ro| This [[MCURTC:GetInfoLEDStatus|returns]] the notification LED status when read(1 means new cycle started)|-| 0x2F| s| wo?| ??? The write function for this register is stubbed.
|-
| 0x30
- 0x36| ds| 8rw| RTC time (system clock). 7 bytes are read from this. The upper nibble of each byte encodes 10s (BCD), so each byte is post-processed with (byte & 0xF) + (10 * (byte >> 4)). byte 0: seconds byte 1: minutes byte 2: hours byte 3: current week (unused) byte 4: days byte 5: months byte 6: years|-| 0x37| s| rw| RTC time byte 7: leap year counter / "watch error correction" register (unused in code)|-| 0x38- 0x3C| s| rw| RTC alarm registers byte 0: minutes byte 1: hours byte 2: day byte 3: month byte 4: year
|-
| 0x310x3B| 8s| ?rw| Could be used on very old MCU_FIRM versions to upload [[MCU_Services#MCU_firmware_versions|MCU firmware]] if some conditions are met.
|-
| 0x320x3D0x3E| ds| 8ro| ?RTC tick counter / "ITMC" (when resets to 0 the seconds increase)Only reading 0x3D will update the in-RAM value
|-
| 0x330x3F| 8s| ?wo| 2 bits bit0: turns off P00 and sets it to output mode (seems to kill the entire SoC) bit1: turns on a prohibited bit in an RTC Control register and turns P12 into an output
|-
| 0x340x40| 8s| ?rw| Gyro sampling mode. Bits 0 and 1 control the gyro. If bits 0 or 1 are non-zero then gyro sampling is enabled.
|-
| 0x350x41| 8s| ?rw| Index selector for register 0x44
|-
| 0x360x42| 8s| rw| Unused?
|-
| 0x370x43| 8s| rw| Unused???, accelometer related
|-
| 0x380x44| 8s| rw| ???, pedoometer related(?)
|-
| 0x390x45- 0x4A| 8s| ?ro| Gyroscope 3D rotation from the 12bit ADC, left shifted 4 to fit in a 16bit signed short{| class="wikitable" border="1"! AXIS! V=0x00! V=0x40! V=0xC0
|-
| 0x3AX (left/right)| 8held vertically| ?rotated or tilted left| rotated or tilted right
|-
| 0x3BY (forwards/backwards)| 8laid flat| ?held up| helf up upside-down
|-
| 0x3CZ (???)| 8???| ???| ???|}
|-
| 0x410x4B| 8s| ?rw| PedometerStepCount (for the current day)
|-
| 0x430x4C0x4D| ??| 8??| ??
|-
| 0x4E
| 8d| rw| ??? this = (0xFFE9E & 1) ?0x10 : 0|-| 0x4F| d(6)| ro|
|-
| 0x50
| 8s| rw| ???
|-
| 0x51
| 8s| rw| ???|-| 0x52- 0x57| s| rw
| ?
|-
| 0x58
| 8s| ?rw| Register-mapped ADC registerDSP volume slider 0% volume offset (setting this to 0xFF will esentially mute the DSP as it's the volume slider's maximum raw value)|-| 0x59| s| rw| Register-mapped ADC registerDSP volume slider 100% volume offset (setting both this and the above to 0 will disable the volume slider with 100% volume, setting this to a lower value than the above will make the volume slider have only 2 states; on and off)|-| 0x5A| s| ro/rw| Invalid, do not use! On newer MCU_FIRM versions this is unused, but on older MCU_FIRM versions this is a read-only counter.|-| 0x5B- 0x5F| s| - | These registers are out of bounds (0xFFC00 and up), they don't exist, writing is no-op, reading will yield FFs.
|-
| 0x60
| 8ds| Offset in u8 array accessed via address 0x61 rw| Looping queue registerWriting to first byte resets the queue position to the nth elementReading from this register causes the values to shift up by `readsize-1`(needs confirmation) bytes after returning `readsize-1` bytes from the top of the stack (written before any first byte is read/write below-only, so is always zero)
|-
| 0x61
| ds(0x100)| Readsrw| Writing to this register pushes values on top of register 0x60's stack. Reading from this register doesn't advance the stack.The first byte is used to store flags for managing FIRM/writes NS state - bit0 = "WirelessDisabled", bit1 = "SoftwareClosed", bit2 = "PowerOffInitiated", bit4 = "LegacyJumpProhibited". This register survives a power-off, but it resides in RAM, so its contents get lost on battery pulls. This register doesn't seem to an actually control MCU u8 arraybehaviour by itself, it just seems to be used for storing arbitrary data.|-| 0x62 - 0x7E| s| -| These registers don't exist, writing is no-op, reading will yield FFs.|-| 0x7F| d(9-0x13)| ro| Various system state information (debug pointer table) byte 0x06: battery related? (seems to decrease while charging and increase while discharging) byte 0x09: system model (see [[Cfg:GetSystemModel#System_Model_Values|Cfg:GetSystemModel]] for values) byte 0x0A: Red Power LED mode (0 = off, repeats after 0x100 bytes1 = on) byte 0x0B: Blue Power LED intensity (0x00 - 0xFF) byte 0x0D: RGB LED red intensity byte 0x0E: RGB LED green intensity byte 0x0F: RGB LED blue intensity byte 0x11: WiFi LED brightness byte 0x12: raw button states? bit0: unset while Power button is held bit1: unset while HOME button is held bit2: unset while WiFi slider is held bit5: unset while the charging LED is active bit6: unset while charger is plugged in On MCU_FIRM major version 1 the size of this is 9, reading past the 9th byte will yield AA instead of FF.|-| 0x80- 0xFF| s| -| These registers don't exist, writing is no-op, reading will yield FFs.
|}
 
Shared register: the letter "s" means that the given register is in a "shared register pool", meaning the resgister is in the register pool in RAM at address <code>0xFFBA4 + registernumber</code>.
 
Dynamic register: these registers aren't in the shared pool, they just "pretend" to be there. These registers often don't retain their set value, change rapidly, or control various hardware.
 
Non-shared (dynamic) register: it's a register whose contents separate from the shared register pool. Messing with these registers will not affect the shared register pool at all.
 
On old versions of MCU_FIRM none of the invalid registers are masked away by the read handler function, but are still read-only. Newer MCU_FIRM versions return the hardcoded value FF instead.
== Device 5 & 6 ==
See the [http://www.alldatasheet.net/datasheet-pdf/pdf/347838/NXP/SC16IS750IBS.html datasheet] linked to on the [[Hardware]] page for reference. From that datasheet, for the structure of the I2C register address u8: "Bit 0 is not used, bits 2:1 select the channel, bits 6:3 select one of the UART internal registers. Bit 7 is not used with the I2C-bus interface, but it is used by the SPI interface to indicate a read or a write operation."
 
== Device 14 ==
 
Used by [[Config_Services|Cfg]]-sysmodule via the i2c::EEP service. This is presumably EEPROM going by the service name.
 
The Cfg-module code which loads the [[Flash_Filesystem|CCAL]](nandro:/sys/{HWCAL0.dat/HWCAL1.dat}) file from NAND will load it from I2C instead, if a certain state flag is non-zero. Likewise for the function which writes CCAL to NAND. HMAC/hash verification after loading is skipped when the CCAL was loaded from I2C.
== Device 15 ==
181

edits

Navigation menu