Changes

Jump to navigation Jump to search
2,989 bytes added ,  10:49, 13 October 2019
Updated MCU pointer table register info
| 7
| Start/busy (0=Ready, 1=Start/busy)
|}
 
== I2C_CNTEX ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 0-1
| ? Set to 2 normally.
|}
 
== I2C_SCL ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 0-5
| ?
|-
| 8-12
| ? Set to 5 normally.
|}
| 0xa0
| "i2c::EEP"
| eeprom?HWCAL EEPROM ([[Hardware_calibration#Header|only present on dev units where SHA256 is used for HWCAL verification]])
|-
| 15
== Device 3 ==
ro = read-only (writing is no-op)
rw = read-write
wo = write-only (reading will yield 00, FF, or unpredictable data)
 
d* = dynamic register (explaination below this table)
s* = shared register (explaination below this table)
ds = dynamic shared (explaination below this table)
{| class="wikitable" border="1"
! REGISTER
|-
| 0x02
| sd| rorw| ?2bit value, writing will mask away/"acknowledge" the event, set to 3 by mcuMainLoop on reset if reset source is Watchdog bit0: RTC clock value got reset to defaults bit1: Watchdog reset happened
|-
| 0x03
| sds
| rw
| Top screen flickerVcom
|-
| 0x04
| sds
| rw
| Bottom screen flickerVcom
|-
| 0x05
- 0x07
| s(3)
| rw
| Danger zone - [[MCU_Services#MCU_firmware_versions|MCU unlock sequence]] is written here.
|-
| 0x08
| s
| ro
| Flags: bit7-5 are read via [[MCU_Services|mcu::GPU]]. The rest of these them are read via [[MCU_Services|mcu::RTC]]. bit01: ShellState bit03: AdapterState bit04: bit4 = BatteryChargeState. bit3 = AdapterState. bit1 = ShellState. bit05: Bottom screen backlight on bit06: Top screen backlight on bit07: GPU on(?)
|-
| 0x10
| s
| ro
| Special HID status flags: bit00: power button pressed bit01: power button pressed long bit02: home button pressed bit03: home button released bit04: wifi slider pressed bit05: shell got closed bit06: shell got opened bit07: ???Received interrupt bitmask, sends srv notification 0x20C bit08: charger plugged in bit09: charger plugged out bit11: ???, signals an event bit14: ???, sends srv notification 0x210 bit15: ???, sends srv notification 0x20F bit22: volume slider position changedsee register 0x18 for possible values If nothing has changed no interrupt was received this register is 0
|-
| 0x14
| s
| ro
| ?Unused and unwritable byte :(
|-
| 0x15
- 0x17
| s
| rw
| ?|-| 0x16| s| rw| ?|-| 0x17| s| rw| ?Unused and unreferenced free RAM! Good for userdata.
|-
| 0x18
| s
| rw
| Interrupt mask for register 0x10 (0=enabled,1=disabled) bit00: Power button press (for 27 "ticks") bit01: Power button held (for 375 "ticks"; the 3DS turns off regardless after a fixed time) bit02: HOME button press (for 5 "ticks") bit03: HOME button release bit04: WiFi switch button bit05: Shell close bit06: Shell open bit07: Fatal hardware condition([[Services#Notifications|?]]) (sent when the MCU gets reset by the Watchdog timer) bit08: Charger removed bit09: Charger plugged in bit10: RTC alarm (when some conditions are met it's sent when the current day and month and year matches the current RTC time) bit11: ??? (HID accelerometer related) bit12: Accelerometer HID update bit13: Battery percentage status change (triggered at 10%, 5%, and 0% while discharging) bit14: Battery stopped charging (independent of charger state) bit15: Battery started chargingNonmaskable(?) interrupts bit16: ??? bit17: ??? (opposite even for bit16) bit22: Volume slider position change bit23: ??? Register 0x0E update bit24: ??? (the off event for below bit) bit25: ??? (triggered when something related to the GPU is turned on, most likely backlight) bit26: ??? (???) bit27: ??? (???) bit28: ??? (???) bit29: ??? backlight on? bit30: forced off my bit set by mcu sysmodule bit31: forced off my bit set by mcu sysmodule
|-
| 0x1C
- 0x1F
| s
| rw
| ?|-| 0x1D| s| rw| ?|-| 0x1E| s| rw| ?|-| 0x1F| s| rw| ?Unused and unreferenced free RAM! Good for userdata.
|-
| 0x20
| sd
| wo
| System power control:
bit2: reboot (used by mcu sysmodule and LgyBg)
bit3: used by LgyBg to power off, causes hangs in 3DS-mode
bit4: doesn't seem to do anything, but an mcu::RTC command uses thisOther bits are unused, and seem seems to do nothingsomething with the watchdogBit 4 sets a bit at a RAM address which seems to control the watcdog timer state, then this bit is immediately unmasked. This field has a bitmask of 0x0F.
|-
| 0x21
| sd| ro(?)wo| ??? switches up input bits from <code>0123456--</code> to <code>12-0435-</code> then writes them to REG[0x5D] (<code>0xFFC02</code>)
|-
| 0x22
| sd
| wo
| Used to set LCD states
bit4: top screen backlight off
bit5: top screen backlight on
 
Bits 4 and 5 have no effect on a 2DS because the backlight source is the bottom screen.
The rest of the bits are masked away.
|-
| 0x23
| s??| ro(?)wo| ??? Seems to be stubbed, just returns the written value from the write handler function.
|-
| 0x24
| s
| ??rw
| Watchdog timer. This must be set *before* the timer is triggered, otherwise the old value is used. Value zero disables the watchdog.
|-
|-
| 0x27
| ssd| rorw
| Raw volume slider state
|-
|-
| 0x29
| dynamic / ssd(5)| ro / rw??| Repeat register, any byte written in the first byte gets repeated indefinitelyPower mode indicator state (?, needs confirmation past 0xFFread-write). 1 = forced default blue 2 = sleep mode animation 3 = "power off" mode 4 = disable blue power LED and turn on red power LED 5 = disable red power LED and turn on blue power LED 6 = animate blue power LED off and flash red power LED anything else = automatic modeThe rest of the other 4 bytes are read-only. Setting the shared byte of this register (via overflow glitches32bits) will also work, confirming that this is a semi-dynamic register as the first byte is stored in the shared register pool, but affect the rest pattern of the bytes are fake.red power LED (write only)
|-
| 0x2A
| s
| rw
| WiFi LED state, non-0 value turns on the WiFi LED, capped at 0x0F4 bits wide
|-
| 0x2B
| s
| rw
| Camera LED state, 4bits wide, 0, 3, 6-0xF = off, 1 = slowly blinking, 2 = constantly on, 3 = "TWL" mode 4 = flash once, 5 = delay before changing to 2
|-
| 0x2C
| s
| rw
| 3D LED state, capped at 0x0F4 bits wide
|-
| 0x2D
| 0x2F
| s
| ro(wo?)| ??? The write function for this register is stubbed.
|-
| 0x30
- 0x36
| sds
| rw
| RTC time (system clock). 7 bytes are read from this. The upper nibble of each byte encodes 10s (BCD), so each byte is post-processed with (byte & 0xF) + (10 * (byte >> 4)). Byte byte 0 encodes : seconds, byte 1 : minutes, byte 2 : hours, byte 3 is either the current day of the week or : current week of month (not used by anything thoughunused), byte 4 : days, byte 5 : months and byte 6 : years
|-
| 0x37
| s
| rw
| ?RTC time byte 7: leap year counter / "watch error correction" register (unused in code)
|-
| 0x38
| rw
| RTC alarm registers
Register byte 0: minutes byte 1: hours byte 2: day byte 3: month byte 4: year|-| 0x3B could | s| rw| Could be used on very old MCU_FIRM versions to upload [[MCU_Services#MCU_firmware_versions|MCU firmware]] if some conditions are met.
|-
| 0x3D
0x3E
| s (2)ds
| ro
| RTC tick counter / "ITMC" (when resets to 0 when the seconds increase)Only reading 0x3D will update the in-RAM value
|-
| 0x3F
| s
| wo
| Peripheral power related? 2 bits bit0 : turns off P00 and sets it to output mode (seems to depower everything, pressing kill the power key afterwards instantly entire SoC) bit1: turns on a prohibited bit in an RTC Control register and turns the whole 3DS offP12 into an output
|-
| 0x40
| s
| rw
| ?Gyro sampling mode. Bits 0 and 1 control the gyro. If bits 0 or 1 are non-zero then gyro sampling is enabled.
|-
| 0x41
| s
| rw
| Unused?
|-
| 0x43
| s
| rw
| Unused???, accelometer related
|-
| 0x44
| s
| rw
| ???, accelometer pedoometer related(?)
|-
| 0x45
- 0x4A
| s
| rwro| ?Gyroscope 3D rotation from the 12bit ADC, left shifted 4 to fit in a 16bit signed short{| class="wikitable" border="1"! AXIS! V=0x00! V=0x40! V=0xC0
|-
| 0x46X (left/right)| sheld vertically| rorotated or tilted left| Gyro Y(?) axis rotation (0x00 = flat, 0x40 = 3DS standing on rotated or tilted right side, 0xBE = 3DS standing on left side)
|-
| 0x48Y (forwards/backwards)| slaid flat| roheld up| Gyro Z(?) axis rotation (0x00 = flat, 0x40 = 3DS standing horizontally, 0xBE = 3DS base is horizontally helf up upside-down)
|-
| 0x4AZ (???)| s???| ro???| Gyro X(?) axis rotation (0x00 = 3DS base facing upwards, 0x40 = face-down flat, 0xBE = standing(?) flat)?|}
|-
| 0x4B
|-
| 0x4C
0x4D| s??| ??| ??|-| 0x4E| d
| rw
| ??? this = (0xFFE9E & 1) ? 0x10 : 0|-| 0x4F| d(6)| ro|
|-
| 0x4D0x50
| s
| rw
| ???
|-
| 0x4E0x51
| s
| rw
| ?|-| 0x4F| 6(?)| ro| Unkonwn. Reading past the 6th byte is FF-filled, so register size of 6 is assumed.?
|-
| 0x500x52
- 0x57
| s
| s
| rw
| Register-mapped ADC registerDSP volume slider 0% volume offset (setting this to 0xFF will esentially mute the DSP as it's the volume slider's maximum raw value)
|-
| 0x59
| s
| rw
| Register-mapped ADC registerDSP volume slider 100% volume offset (setting both this and the above to 0 will disable the volume slider with 100% volume, setting this to a lower value than the above will make the volume slider have only 2 states; on and off)
|-
| 0x5A
| s
| ro/rw| ?Invalid, do not use! On newer MCU_FIRM versions this is unused, but on older MCU_FIRM versions this is a read-only counter.
|-
| 0x5B
- 0x5F
| s
| ro(?)- | ? These registers are out of bounds (these seem to be invalid regsiters0xFFC00 and up), they don't exist, writing is no-op, reading will yield FFs.
|-
| 0x60
| 0x100ds| rofirst byte is worw
| Looping queue register
Writing to first byte resets the queue position to the nth element
|-
| 0x61
| ds(0x100)
| rw
| Writing to this register pushes values on top of register 0x60's stack. Reading from this register doesn't advance the stack.
The first byte is used to store flags for managing FIRM/NS state - bit0 = "WirelessDisabled", bit1 = "SoftwareClosed", bit2 = "PowerOffInitiated", bit4 = "LegacyJumpProhibited". This register survives a power-off, but does not seem to be saved to non-volatile storage (does not survive it resides in RAM, so its contents get lost on battery pulls). This register doesn't seem to actually control MCU behaviour by itself, it just seems to be used for storing arbitrary data.
|-
| 0x62 - 0x7E
| s
| invalid (ro)-| These registers don't exist at all, thus writing is no-op, reading them will yield 0xFFFFs.
|-
| 0x7F
| 19d(?9-0x13)
| ro
| Various system state information.(debug pointer table) byte 060x06: battery related? (seems to decrease while charging and increase while discharging) byte 090x09: system model (see [[Cfg:GetSystemModel#System_Model_Values|Cfg:GetSystemModel]] for values) byte 100x0A: power Red Power LED related? mode (0 is = off, 1 is red= on) byte 0x0B: Blue Power LED intensity (0x00 - 0xFF) byte 130x0D: RGB LED red intensity byte 140x0E: RGB LED green intensity byte 150x0F: RGB LED blue intensity byte 170x11: WiFi LED brightness byte 180x12: raw button states? bit0: unset while power Power button is held bit1: unset while home HOME button is held bit2: unset while Wifi WiFi slider is held
bit5: unset while the charging LED is active
bit6: unset while charger is plugged in
On MCU_FIRM major version 1 the size of this is 9, reading past the 9th byte is reset to 0 before an svcBreak takes effectwill yield AA instead of FF.
|-
| 0x80
- 0xFF
| s
| invalid (ro)-| These registers don't exist at all, thus writing is no-op, reading them will yield 0xFFFFs.
|}
NoteShared register: the letter "s" in the size field means that the given register is in a "shared register pool", meaning if you readthe resgister is in the register pool in RAM at address <code>0xFFBA4 + registernumber</write with size more than 1 you can read code>. Dynamic register: these registers aren't in the next `readamount-1` of shared pool, they just "pretend" to be there. These registers. Itoften don's possible to corrupt the shared t retain their set value of a "non, change rapidly, or control various hardware. Non-shared" (dynamic) register by writing into : it's a register whose contents separate from the shared register pool. Messing with a size bigger than one. Writing more than 0x100 bytes into a these registers will not affect the shared register will corrupt pool at all writable registers, including the shared portion of "non-shared" registers.
NonOn old versions of MCU_FIRM none of the invalid registers are masked away by the read handler function, but are still read-shared register: it's a register separate from the shared register poolonly. Messing with these registers will not affect Newer MCU_FIRM versions return the shared register pool at allhardcoded value FF instead.
== Device 5 & 6 ==
181

edits

Navigation menu