3dbrew - User contributions [en]

QTM Services

2025-05-13T18:53:04Z

TuxSH: /* QTM system service "qtm:s" */

[[Category:Services]]

QTM is the [[New_3DS]] system module in charge of handling head tracking. A maximum of three (only two until [[9.3.0-21]]) sessions for *all* QTM services combined.

Head tracking is not usable when any other process is using any of the cameras, QTM returns error 0xC8A18008 for this.

QTM only tracks the position of the user's two eyes, but does not track the area they are focusing at. Hence, "eye-tracking" is sometimes used to refer to this feature on 3DS, even though it means something else outside the 3DS hacking scene.

Refer to this libctru commit for more details: https://github.com/devkitPro/libctru/commit/8e55cdf05d1f2c07f350ec678d0f0d6a7a2df214

=QTM services=

= QTM user service "qtm:u" =
{| class="wikitable"
! Command ID !! Description
|-
| 0x00010080 || GetRawTrackingDataEx
|-
| 0x00020080 || GetTrackingDataEx
|-
| 0x00030000 || EnableManualIrLedControl
|-
| 0x00040000 || DisableManualIrLedControl
|-
| 0x00050040 || SetIrLedStatus
|-
| 0x00060000 || IsCurrentAppBlacklisted
|}

= QTM system service "qtm:s" =
"qtm:s" has access to all "qtm:u" commands and more:

{| class="wikitable"
! Command ID !! Description
|-
| 0x04010040 || SetCentralBarrierPosition
|-
| 0x04020000 || GetCameraLux
|-
| 0x04030000 || EnableAutoBarrierControl
|-
| 0x04040000 || DisableAutoBarrierControl
|-
| 0x04050040 || SetBarrierPosition
|-
| 0x04060000 || GetCurrentBarrierPosition
|-
| 0x04070040 || SetIrLedStatusOverride
|-
| 0x040801C0 || SetCalibrationData
|-
| 0x04090000 || GetQtmStatus
|-
| 0x040A0040 || SetQtmStatus
|}

= QTM service "qtm:sp" =
qtm:sp has access to all "qtm:u", "qtm:s" commands and more:

{| class="wikitable"
! Command ID !! Description
|-
| 0x08010040 || NotifyTopLcdModeChange
|-
| 0x08020000 || NotifyTopLcdPowerOn
|-
| 0x08030000 || IsExpanderInUse
|-
| 0x08040000 || NotifyTopLcdPowerOff
|}

GSP always keeps an handle to this service open. NS sometimes uses this service (to blacklist some internal test applications, see [[NS_CFA]]), but when it does it opens then immediately closes the session thereafter.

= QTM "hardware check" service "qtm:c" =
{| class="wikitable"
! Command ID !! Description
|-
| 0x00010000 || StartHardwareCheck
|-
| 0x00020000 || StopHardwareCheck
|-
| 0x00030040 || SetBarrierPattern
|-
| 0x00040000 || WaitAndCheckExpanderWorking
|-
| 0x00050040 || SetIrLedStatusOverride
|}

The commands for this service are separate from all the other services documented above.

3DS Virtual Console

2025-01-05T22:54:12Z

TuxSH: Fix confusion about CAA descriptor type

There are several types of VC titles: NES/GB/GBC VC titles, SNES VC titles, GameGear VC titles and GBA VC titles.
Except for GBA VC, the games are ran using emulators.

=NES/GB/GBC VC=
An emulator application + VC ROM in the NCCH [[RomFS]] (among other things in the RomFS).

The original emulator builds include support for all these three platforms, not specific to just the included ROM platform. However, releases intended for NES games have a red menu, optional switching between the two controllers, a different X button mapping (B instead of menu), optional [[Download Play]] support, and [http://s27.postimg.org/60v4yuw8z/IMG_20140921_001103.jpg a never used multi-rom support]; while Game Boy versions have a green theme and optional 3D border.

Early builds (of Ambassador NES games at least) did not support savestates.

The emulator officially used for Pokemon games removes savestate support in favor of a Link Cable "implementation" involving hooking the games' network functions according to the patch files. ([https://gbatemp.net/attachments/vc-wireless-link-patch-documentation-txt.72966/ Partial documentation of the patch format])

This emulator includes GBA support, however the GBA emulation for this this is somewhat slow. This was presumably implemented before AGB_FIRM was.

Unlike Wii VC, the 3DS VC ROMs for NES use [http://pastebin.com/KLeWt2W3 the "TNES" header].

==RomFS==
* "rom:/rom/" This directory contains the ROM file(s). Filenames used under here don't matter: the filename is determined by the emulator app by doing a directory read.
* "rom:/shaders/" This directory contains GPU shaders used by the emulator app: .shbin, .csdr, and .obj.
* "rom:/VCM/" This directory contains graphics, audio, and text used by the emulator app.
* "rom:/agb.bin" GBA BIOS.
* "rom:/buildtime.txt" Emulator app build timestamp.
* "rom:/config.ini" Emulator configuration .ini, contains sections for all supported 3DS VC platforms.
* "rom:/<rom_name>.patch" rom_name = filename from the rom directory. This .ini contains patches for the ROM.
* "rom:/shader.shbin" GPU shader.

==Savedata==
The savedata can contain:
* "rsm1.dat": Same format as the below rsm2.dat. Probably used for the "restore-point".
* "rsm2.dat": Current emulator save-state, for storing/loading state at VC-title launch/exit.
* "sav.dat": The actual savedata used by the emulated ROM.
* "SecureValue": The random number used by [[Anti Savegame Restore]]. No known version of the emulator implements both savestates and secure value.
Overwriting sav.dat with 0xFF-bytes doesn't have any affect on the actual emulator. Doing that with most of the rsm*.dat data doesn't crash anything.

=SNES VC=
An emulator application + VC ROM in the NCCH [[RomFS]] (among other things in the RomFS).
SNES VC titles are New 3DS exclusive.

==RomFS==
* "rom:/ErrorMessage/" This directory contains text used by the emulator app.
* "rom:/shader/" This directory contains .shbin GPU shaders used by the emulator app.
* "rom:/VCM/" This directory contains text used by the emulator app.
* "rom:/caravel.bcsar" This file contains audio used by the emulator app.
* "rom:/ctrl_change.arc" This file contains graphics used by the emulator app.
* "rom:/data.bin" This file contains the ROM and other data. See below for documentation.
* "rom:/ErrorMessage.arc" This file contains graphics used by the emulator app.
* "rom:/KTR-XXXX.icn" Copy of the SMDH of the game.
* "rom:/shader.shbin" GPU shader.
* "rom:/nnfont_RectDrawerShader.shbin" GPU shader.
* "rom:/VCM.arc" This file contains graphics used by the emulator app.

===data.bin structure===
The file begins with a header (all values are little-endian):
{| class="wikitable" border="1"
|-
! START
! SIZE
! DESCRIPTION
|-
| 0x00
| 0x4
| Always 0x00000100
|-
| 0x04
| 0x4
| File size
|-
| 0x08
| 0x4
| Always 0x00000030
|-
| 0x0C
| 0x4
| Always 0x00000050
|-
| 0x10
| 0x4
| Start of the ROM (always 0x00000060 in official VC)
|-
| 0x14
| 0x4
| End of the ROM
|-
| 0x18
| 0x4
| Start of the footer region (presumably an index for the PCM audio samples). Matches end of file/file size if PCM data is missing
|-
| 0x1C
| 0x4
| Always 0
|-
| 0x20
| 0x4
| Start of decompressed SDD-1 graphics data region. Matches end of file/file size if no SDD-1 chip is present
|-
| 0x24
| 0x8
| Product ID (KTR-XXXX), determines filenames in savedata
|-
| 0x2C
| 0x4
| Always 0
|-
| 0x30
| 0x1
| Emulation speed in FPS (always 0x3C in official VC)
|-
| 0x31
| 0x3
| ROM size
|-
| 0x34
| 0x1
| Always 0
|-
| 0x35
| 0x3
| Size of the converted PCM audio samples region (starting after ROM). 0 if PCM data is missing
|-
| 0x38
| 0x1
| Always 0
|-
| 0x39
| 0x2
| Footer region size. 0 if PCM data is missing
|-
| 0x3B
| 0x2
| Always 0
|-
| 0x3D
| 0x2
| Preset ID (varies for each game). A full list of know Preset IDs (shared by WiiU/SNESC/Switch SNES emulators) can be found [https://docs.google.com/spreadsheets/d/1PbIPVA4NpFEXs1zk249aR3FSuBTY3r-ajpTq3dP3GnQ here]
|-
| 0x3F
| 0x1
| Always 0x2
|-
| 0x40
| 0x1
| Sound volume
|-
| 0x41
| 0x1
| ROM type (0x15 == HiROM/0x14 == LoROM)
|-
| 0x42
| 0xE
| Always 0
|-
| 0x50
| 0x4
| Always 0x00000003
|-
| 0x54
| 0x4
| Always 0x00000001
|-
| 0x58
| 0x8
| Always 0
|}

The 0x60 header is followed by the SNES ROM, often altered to replace audio samples with pointers to external PCM audio files converted from the game, presumably to speed up emulation (these pointers can be found by looking for "PCMF" in the ROM, as seen on [https://github.com/Plombo/vcromclaim/blob/master/snesrestore.py Wii VC]).
The ROM is then optionally followed by the PCM audio files, by the SDD-1 decompressed graphics data (the emulator doesn't properly emulate the chip, presumably because of hardware constraints) and by a footer which appears to be an index for the PCM audio data.
There are no separate setting fields for individual cart features, and it appears that the emulator has "game presets" stored in its own code, which determine the game-specific settings (such as the expansion chip, and presumably the presence of SRAM), selectable via the preset ID in the header. Each official VC release has [https://docs.google.com/spreadsheets/d/1PbIPVA4NpFEXs1zk249aR3FSuBTY3r-ajpTq3dP3GnQ/edit#gid=490971147 a different preset ID]. The supported SNES expansion chips are: DSP1, C4 and DSP2.

A similar structure can be found on the Wii U, SNES Classic and Switch Mini emulator [https://gist.github.com/anpage/c1085055db0242ea3c7558dab56712a5]

==Savedata==
The savedata contains:
* "KTR-XXXX.cfg": Appears to contain the "preset ID" and possibly more game/save information.
* "KTR-XXXX.vea": Current emulator save-state, for storing/loading state at VC-title launch/exit.
* "KTR-XXXX.ves": The actual savedata used by the emulated ROM.

Filenames are determined in the ROM header.

=GBA VC=
GBA VC is run by [[FIRM|AGB_FIRM]]. RomFS isn't used for GBA VC titles, but can be found empty within GBA VC titles. The NCCH [[ExeFS]] contains the same files as a normal application. The [[ExeFS]]:/.code contains the GBA VC ROM followed by a 0x360 byte long footer.

===Footer===
All values in the GBA VC footer and related structures are little-endian.
{| class="wikitable" border="1"
|-
! START
! SIZE
! DESCRIPTION
|-
| 0x00
| 0x4
| Magic '.CAA'
|-
| 0x04
| 0x4
| Must be 1
|-
| 0x08
| 0x4
| Offset to array of config descriptors
|-
| 0x0C
| 0x4
| Number of config descriptors << 4
|}

====Config descriptor====

{| class="wikitable" border="1"
|-
! START
! SIZE
! DESCRIPTION
|-
| 0x0
| 0x4
| Entry type. 0 is the ROM itself (without the CAA stuff) and offset must be 0 (otherwise fails w/ result 0xC900464F). 1 is ROM metadata, see below
|-
| 0x4
| 0x4
| Offset to entry data
|-
| 0x8
| 0x4
| Size of entry data (unused by the function that parses this, which hardcodes the config size (0x324) to memcpy for type 1)
|-
| 0xC
| 0x4
| Padding
|}

====AGB ROM metadata====

{| class="wikitable" border="1"
|-
! START
! SIZE
! DESCRIPTION
|-
| 0x000
| 0x4
| Padding
|-
| 0x004
| 0x4
| GBA ROM Filesize
|-
| 0x008
| 0x4
| Save type (see below for supported values and [[ARM7_Registers#ARM7_SAVE_MODE|here]] for details)
|-
| 0x00C
| 0x2
| Padding (set to FF FF usually?)
|-
| 0x00E
| 0x2
| Sleep mode button combo (utilizes the same bit masks as the [[HID_Registers#HID_PAD|HID_PAD register]], with flipped bits).<br/>If the GBA title supports a button-combo based sleep mode and it's set here, Agbbg spoofs this combo when closing the 3DS' lid to enter proper sleep mode.
|-
| 0x010
| 0x10
| Flash and EEPROM configuration (see the target registers [[ARM7_Registers|here]])
|-
| 0x020
| 0x4
| "Accumulated" interframe alpha blending (01-FF, lower values equal more "ghosting"). Uses previous *output* instead of previous input
|-
| 0x024
| 0x300
| Video LUT (black to full, rgbrgbrgb...)?,<br/>three different types of this data have been observed.
|}

Save types:
* 0x0: EEPROM 8k for < 256 Mbit titles
* 0x1: EEPROM 8k for 256 Mbit titles
* 0x2: EEPROM 64k for < 256 Mbit titles
* 0x3: EEPROM 64k for 256 Mbit titles
* 0x4: Flash 512k (Atmel, ID: 0x3D1F) + RTC
* 0x5: Flash 512k (Atmel, ID: 0x3D1F)
* 0x6: Flash 512k (SST, ID: 0xD4BF) + RTC
* 0x7: Flash 512k (SST, ID: 0xD4BF)
* 0x8: Flash 512k (Panasonic, ID: 0x1B32) + RTC
* 0x9: Flash 512k (Panasonic, ID: 0x1B32)
* 0xA: Flash 1Mbit (Macronix, ID: 0x09C2) + RTC
* 0xB: Flash 1Mbit (Macronix, ID: 0x09C2)
* 0xC: Flash 1Mbit (Sanyo, ID: 0x1362) + RTC
* 0xD: Flash 1Mbit (Sanyo, ID: 0x1362)
* 0xE: SRAM/FRAM 256k

Everything above 0xE results in no save chip and nothing being saved to NAND.

===NAND Savegame===
AGB_FIRM saves its active save memory to NAND on exit, this is then immediately picked up by NATIVE_FIRM on reboot by checking [[CONFIG_Registers#CFG_BOOTENV|CFG_BOOTENV]]. From there, this is verified and copied out to SD (also see below). The savegame format is as follows:
{| class="wikitable" border="1"
|-
! START
! SIZE
! DESCRIPTION
|-
| 0x0
| 0x4
| Magic ('.SAV')
|-
| 0x4
| 0xC
| Always 0xFF
|-
| 0x10
| 0x10
| AES-CMAC of the SHA256 hash of 0x30..0x200 + the entire save itself, keyslot 0x24, keyY from process9 .rodata
|-
| 0x20
| 0x10
| Always 0xFF
|-
|-
| 0x30
| 0x4
| Always 0x1
|-
| 0x34
| 0x4
| Number of times saved (unused?)
|-
| 0x38
| 0x8
| AGB TitleID
|-
| 0x40
| 0x10
| SD card CID from the console the save was made on (verified on load)
|-
| 0x50
| 0x4
| Save start addr (always 0x200)
|-
| 0x54
| 0x4
| Save size
|-
| 0x58
| 0x8
| Always 0xFF (?)
|-
| 0x60
| 0x4
| See [[ARM7_Registers|here]]
|-
| 0x64
| 0x4
| See [[ARM7_Registers|here]]
|-
| 0x68
| 0x198
| Always 0xFF
|}

===NAND Savegame on SD===
A NAND savegame copied to the SD by process9 is identical to its counterpart on the NAND partition, save for the CMAC. For SD copies on retail units, the CMAC is recalculated as the AES-CMAC of the (SHA256 hash of ("CTR-SIGN" + AGB TitleID (little endian) + SHA256 hash of ("CTR-SAV0" + SHA256 hash of (0x30..0x200 + the entire save itself)))), using keyslot 0x30 set up with the keyY from movable.sed. For SD copies on devkit units, the CMAC is recalculated using the SHA256 hash of 0x30..0x200 + the entire save itself, using a different key from process9 .rodata.

GSPGPU:ImportDisplayCaptureInfo

2025-01-02T18:00:22Z

TuxSH:

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00180000]
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00180240]
|-
| 1
| Result code
|-
| 2-5
| Capture info for the top screen
|-
| 6-9
| Capture info for the bottom screen
|}

=Capture info=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Left framebuffer VA
|-
| 1
| Right framebuffer VA (top screen only)
|-
| 2
| [[GPU/External_Registers#Framebuffer_format|Format]]
|-
| 3
| [[GPU/External_Registers#LCD_Source_Framebuffer_Setup|Stride]] (offset 0x90)
|}

=Description=
This returns the current framebuffer state. The returned framebuffer addresses are for the new framebuffers (the ones that will be displayed next frame, after VBlank) for the process with GPU rights.

GSPGPU:ImportDisplayCaptureInfo

2025-01-02T17:56:00Z

TuxSH:

GSPGPU:ImportDisplayCaptureInfo

2025-01-02T17:52:19Z

TuxSH:

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00180000]
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00180240]
|-
| 1
| Result code
|-
| 2-5
| Capture info for the top screen
|-
| 6-9
| Capture info for the bottom screen
|}

=Capture info=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Left framebuffer VA
|-
| 1
| Right framebuffer VA (top screen only)
|-
| 2
| [[GPU/External_Registers#Framebuffer_format|Format]]
|-
| 3
| [[GPU/External_Registers#LCD_Source_Framebuffer_Setup|Stride]] (offset 0x90)
|}

=Description=
This returns the current framebuffer state. The returned framebuffer addresses are for the currently active framebuffers (or the ones presented in FB info sharedmem if fb entry has bit0 set) for the process with GPU rights.

GSPGPU:SetAxiConfigQoSMode

2025-01-01T12:48:43Z

TuxSH:

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00100040]
|-
| 1
| Quality of service
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|}

=Quality of service=
{| class="wikitable" border="1"
|-
! Index Bit
! Description
|-
| 2-0
| [https://developer.arm.com/documentation/ddi0422/d/programmers-model/programmable-quality-of-service--progqos-/qos-tidemark-register Tidemark]
|-
| 15-8
| [https://developer.arm.com/documentation/ddi0422/d/programmers-model/programmable-quality-of-service--progqos-/qos-access-control-register Access control]
|}

=Description=

This is used to program the QoS (Quality of Service). Tidemark is the maximum allowed number of transactions initiated but not completed with FCRAM, after which next transactions will be limited to certain masters. Access control sets which masters have this privilege. For more info, see [https://developer.arm.com/documentation/ddi0422/d/introduction/about-the-high-performance-matrix CoreLink™ NIC-301 r1p2].

Old systems have a total of 7 masters (guesses are ARM11, ARM9, GPU, DSP, CDMA, CSND, AHB); new systems have 3 additional masters (likely NewCDMA and L2 controller, and N3DS-GPU (enabled by [[CONFIG11_Registers#CFG11_GPU_N3DS_CNT|CFG11_GPU_N3DS_CNT]])).

GSP limits the maximum value of tidemark to 7; meanwhile, the maximum value for access control is 2^N-1, 1 bit for each slave interface, where N = number of slave interfaces.

New GSP forces SI7 (corresponding to N3DS-GPU) to be always set.

GSP Services

2025-01-01T11:40:38Z

TuxSH:

__TOC__
{{Anchor|GSPGPU}}{{Anchor|gsp::Gpu}}
= GSP service "gsp::Gpu" =
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! GSP rights required
! Description
|-
| 0x00010082
|
| Yes
| [[GSPGPU:WriteHWRegs|WriteHWRegs]]
|-
| 0x00020084
|
| Yes
| [[GSPGPU:WriteHWRegsWithMask|WriteHWRegsWithMask]]
|-
| 0x00030082
|
| Yes
| [[GSPGPU:WriteHWRegRepeat|WriteHWRegRepeat]]
|-
| 0x00040080
|
| Yes
| [[GSPGPU:ReadHWRegs|ReadHWRegs]]
|-
| 0x00050200
|
| Yes
| [[GSPGPU:SetBufferSwap|SetBufferSwap]]
|-
| 0x00060082
|
| No
| SetCommandList (Stubbed)
|-
| 0x000700C2
|
| No
| RequestDma (Stubbed)
|-
| 0x00080082
|
| No
| [[GSPGPU:FlushDataCache|FlushDataCache]]
|-
| 0x00090082
|
| No
| [[GSPGPU:InvalidateDataCache|InvalidateDataCache]]
|-
| 0x000A0044
|
| No
| RegisterInterruptEvents (Stubbed)
|-
| 0x000B0040
|
| Usually not (see below)
| [[GSPGPU:SetLcdForceBlack|SetLcdForceBlack]]
|-
| 0x000C0000
|
| No
| [[GSPGPU:TriggerCmdReqQueue|TriggerCmdReqQueue]]
|-
| 0x000D0140
|
| No
| SetDisplayTransfer (Stubbed)
|-
| 0x000E0180
|
| No
| SetTextureCopy (Stubbed)
|-
| 0x000F0200
|
| No
| SetMemoryFill (Stubbed)
|-
| 0x00100040
|
| No
| [[GSPGPU:SetAxiConfigQoSMode|SetAxiConfigQoSMode]]
|-
| 0x00110040
|
| No
| [[GSPGPU:SetPerfLogMode|SetPerfLogMode]]
|-
| 0x00120000
|
| No
| [[GSPGPU:GetPerfLog|GetPerfLog]]
|-
| 0x00130042
|
| No
| [[GSPGPU:RegisterInterruptRelayQueue|RegisterInterruptRelayQueue]]
|-
| 0x00140000
|
| No
| [[GSPGPU:UnregisterInterruptRelayQueue|UnregisterInterruptRelayQueue]]
|-
| 0x00150002
|
| No
| [[GSPGPU:TryAcquireRight|TryAcquireRight]]
|-
| 0x00160042
|
| No
| [[GSPGPU:AcquireRight|AcquireRight]]
|-
| 0x00170000
|
| No
| [[GSPGPU:ReleaseRight|ReleaseRight]]
|-
| 0x00180000
|
| No
| [[GSPGPU:ImportDisplayCaptureInfo|ImportDisplayCaptureInfo]]
|-
| 0x00190000
|
| See below
| [[GSPGPU:SaveVramSysArea|SaveVramSysArea]]
|-
| 0x001A0000
|
| See below
| [[GSPGPU:RestoreVramSysArea|RestoreVramSysArea]]
|-
| 0x001B0000
|
| Yes
| [[GSPGPU:ResetGpuCore|ResetGpuCore]]
|-
| 0x001C0040
|
| No
| [[GSPGPU:SetLedForceOff|SetLedForceOff]]
|-
| 0x001D0040
|
| No
| SetTestCommand (Stubbed)
|-
| 0x001E0080
|
| No
| [[GSPGPU:SetInternalPriorities|SetInternalPriorities]]
|-
| 0x001F0082
| [[8.0.0-18]]
| No
| [[GSPGPU:StoreDataCache|StoreDataCache]]
|}

The GSP module starts a thread for handling commands for each service session, a maximum of 4 processes can use this service at once. Official applications have an optional code-path which [[GSPGPU:WriteHWRegs|writes]] to registers during initialization, this is normally not used however.

If a process has forcefully acquired rights (ErrDisp), attempting [[GSPGPU:SetLcdForceBlack|unset LCDs black-fill]] from another process will fail.
Saving/restoring VRAM requires bit0 of process [[GSPGPU:RegisterInterruptRelayQueue|flags]] to be set.

{{Anchor|GSPLCD}}{{Anchor|gsp::Lcd}}
= GSP service "gsp::Lcd" =
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x00010040
|
| [[GSPLCD:EnableABL|EnableABL]]
|-
| 0x00020040
|
| [[GSPLCD:DisableABL|DisableABL]]
|-
| 0x00030080
|
| [[GSPLCD:SetRSLut|SetRSLut]]
|-
| 0x000400C0
|
| [[GSPLCD:SetRSParams|SetRSParams]]
|-
| 0x00050140
|
| [[GSPLCD:SetABLArea|SetABLArea]]
|-
| 0x00060140
|
| ?
|-
| 0x00070080
|
| [[GSPLCD:SetInertia|SetInertia]]
|-
| 0x000800C0
|
| [[GSPLCD:SetDitherMode|SetDitherMode]]
|-
| 0x00090140
|
| [[GSPLCD:SetDitherParams|SetDitherParams]]
|-
| 0x000A0080
|
| [[GSPLCD:SetBrightnessRaw|SetBrightnessRaw]]
|-
| 0x000B0080
|
| [[GSPLCD:SetBrightness|SetBrightness]]
|-
| 0x000C0040
|
| [[GSPLCD:ReloadConfig|ReloadConfig]]
|-
| 0x000D0040
|
| [[GSPLCD:RestoreConfig|RestoreConfig]]
|-
| 0x000E0000
|
| [[GSPLCD:GetPowerState|GetPowerState]]
|-
| 0x000F0000
|
| [[GSPLCD:PowerOnAllBacklights|PowerOnAllBacklights]]
|-
| 0x00100000
|
| [[GSPLCD:PowerOffAllBacklights|PowerOffAllBacklights]]
|-
| 0x00110040
|
| [[GSPLCD:PowerOnBacklight|PowerOnBacklight]]
|-
| 0x00120040
|
| [[GSPLCD:PowerOffBacklight|PowerOffBacklight]]
|-
| 0x00130040
|
| [[GSPLCD:SetLedForceOff|SetLedForceOff]]
|-
| 0x00140000
| [[8.0.0-18]]
| [[GSPLCD:GetVendor|GetVendor]] New3DS-only, stubbed on Old3DS: This only returns an error. Uninitialized data(not set by this command itself) is also written to u8 cmdreply_word[2].
|-
| 0x00150040
| [[8.0.0-18]]
| [[GSPLCD:GetBrightness|GetBrightness]] New3DS-only, stubbed on Old3DS: This only returns an error. Uninitialized data(not set by this command itself) is also written to u32 cmdreply_word[2].
|}

Unlike gsp::Gpu, GSP module does not start a separate thread for handling these service commands.

= Version history =
{| class="wikitable" border="1"
|-
! Version
! Changes
|-
| [[8.0.0-18|v8196]]
| Support for the new LINEAR memory region was implemented(for cache commands and vaddr->physaddr conversion). Support for the new process-mem 0x1E800000 region(however the GPU can't actually access this memory) was added for vaddr->physaddr conversion. Originally GSP module ignored vaddr->physaddr conversion errors(like with vaddrs outside of the handled ranges) and just wrote physaddr value0 to the GPU registers, however now GSP module returns an error for that instead(see [[GSP_Shared_Memory#Command_Buffer_Header|here]] regarding errors being written to GSP shared-mem). New services commands were added too, see above.
|}

=New3DS=
There's separate GSP-module titles for Old3DS and New3DS. PTM CheckNew3DS is only used by the New3DS title, for copying that flag into a state field. Elsewhere that field is checked for running additional code only on New3DS, for processing various state / using [[QTM_Services|QTM]] commands.

[[Category:Services]]

GSPGPU:SetInternalPriorities

2024-12-31T23:43:38Z

TuxSH:

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x001E0080]
|-
| 1
| Session thread priority
|-
| 2
| Command queue priority for this session
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|}

=Description=
Sets the priority for the thread handling incoming GSPGPU commands, and the priority for the command queue reader thread when the current session has acquired GPU rights. Both values must be < 0x40.

QTM Services

2024-09-17T16:43:06Z

TuxSH: QTM documentation

[[Category:Services]]

QTM is the [[New_3DS]] system module in charge of handling head tracking. A maximum of three (only two until [[9.3.0-21]]) sessions for *all* QTM services combined.

Head tracking is not usable when any other process is using any of the cameras, QTM returns error 0xC8A18008 for this.

QTM only tracks the position of the user's two eyes, but does not track the area they are focusing at. Hence, "eye-tracking" is sometimes used to refer to this feature on 3DS, even though it means something else outside the 3DS hacking scene.

Refer to this libctru commit for more details: https://github.com/devkitPro/libctru/commit/8e55cdf05d1f2c07f350ec678d0f0d6a7a2df214

=QTM services=

= QTM user service "qtm:u" =
{| class="wikitable"
! Command ID !! Description
|-
| 0x00010080 || GetRawTrackingDataEx
|-
| 0x00020080 || GetTrackingDataEx
|-
| 0x00030000 || EnableManualIrLedControl
|-
| 0x00040000 || DisableManualIrLedControl
|-
| 0x00050040 || SetIrLedStatus
|-
| 0x00060000 || IsCurrentAppBlacklisted
|}

= QTM system service "qtm:s" =
"qtm:s" has access to all "qtm:u" commands and more:

{| class="wikitable"
! Command ID !! Description
|-
| 0x04010040 || SetCentralBarrierPosition
|-
| 0x04020000 || GetCameraLuminance
|-
| 0x04030000 || EnableAutoBarrierControl
|-
| 0x04040000 || DisableAutoBarrierControl
|-
| 0x04050040 || SetBarrierPosition
|-
| 0x04060000 || GetCurrentBarrierPosition
|-
| 0x04070040 || SetIrLedStatusOverride
|-
| 0x040801C0 || SetCalibrationData
|-
| 0x04090000 || GetQtmStatus
|-
| 0x040A0040 || SetQtmStatus
|}

= QTM service "qtm:sp" =
qtm:sp has access to all "qtm:u", "qtm:s" commands and more:

{| class="wikitable"
! Command ID !! Description
|-
| 0x08010040 || NotifyTopLcdModeChange
|-
| 0x08020000 || NotifyTopLcdPowerOn
|-
| 0x08030000 || IsExpanderInUse
|-
| 0x08040000 || NotifyTopLcdPowerOff
|}

GSP always keeps an handle to this service open. NS sometimes uses this service (to blacklist some internal test applications, see [[NS_CFA]]), but when it does it opens then immediately closes the session thereafter.

= QTM "hardware check" service "qtm:c" =
{| class="wikitable"
! Command ID !! Description
|-
| 0x00010000 || StartHardwareCheck
|-
| 0x00020000 || StopHardwareCheck
|-
| 0x00030040 || SetBarrierPattern
|-
| 0x00040000 || WaitAndCheckExpanderWorking
|-
| 0x00050040 || SetIrLedStatusOverride
|}

The commands for this service are separate from all the other services documented above.

FirmwareNews

2024-09-17T16:10:13Z

TuxSH:

As of this writing, the latest firmware is '''[[11.17.0-50]]'''.

See [[Homebrew Exploits|here]] regarding running homebrew.

----

Software-based full system control exploits are known and publicly available for system versions up to and including [[11.17.0-50]], while [[Bootloader#Non-NAND_FIRM_boot|ntrboothax]] allows for ARM9 arbitrary code execution on any 3DS-family console regardless of system firmware version (or even its presence at all).

NS CFA

2024-09-12T17:33:40Z

TuxSH: Parse kv and qtm blacklist

This pages describes the content of the [[NCCH#CFA|CFA]](titleID 0004001B00010702) RomFS used by NS.

==key.bin and value.bin==
Originally the filesize for key.bin was 12-bytes, with the [[6.0.0-11]] title-version this is now 48-bytes.

Originally the filesize for value.bin was 8-bytes, with the [[6.0.0-11]] title-version this is now 32-bytes.

The two files form a KV-store of compatibility parameters, as follows:

{| class="wikitable"
! TitleId !! Name !! Flags
|-
| 0004000000032800 || Ridge Racer 3D (JPN) || Card latency parameter 0x47E000, override level 0
|-
| 0004000000033400 || Zelda no Densetsu: Toki no Ocarina 3D (JPN) || Use only 4KB pages
|-
| 0004000000033500 || The Legend of Zelda: Ocarina of Time 3D (USA) || Use only 4KB pages
|-
| 0004000000033600 || The Legend of Zelda: Ocarina of Time 3D (EUR) || Use only 4KB pages
|-
| 0004000000033B00 || Ridge Racer 3D (EUR) || Card latency parameter 0x47E000, override level 0
|-
| 0004000000035800 || Ridge Racer 3D (USA) || Card latency parameter 0x47E000, override level 0
|-
| 000400000008F800 || The Legend of Zelda: Ocarina of Time 3D (KOR) || Use only 4KB pages
|-
| 000400000008F900 || The Legend of Zelda: Ocarina of Time 3D (CHN) || Use only 4KB pages
|}

Refer to https://gist.github.com/TuxSH/11da5baae53e80f466829bbab6be6373#file-parse_kv-py for more details.

==ctr_backup_black_list==
This file added with [[6.0.0-11]] contains the uniqueID blacklist for [[SD Savedata Backups]].

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Total entries, this is value 93 for the [[6.0.0-11]] title-version.
|-
| 0x4
| 0xC
| All-zero
|-
| 0x10
| Totalentries*4
| Entries, each entry is a word in the following format: <nowiki>0x100000 |</nowiki> [[Title_list|title_UniqueID]]
|}

==qtm_black_list==
This file was added with title version v4096, for [[9.0.0-20]]/[[8.1.0-0_New3DS]]. This is used when launching applications, on New3DS.

The applications in the "blacklist" seem to only be Nintendo-internal (?) test applications, going from the unique IDs (unique ID is (tid >> 8) & 0xFFFFF). Camera mode (unsure) corresponds to stubbed cam command id 0x00410040:

{| class="wikitable"
! UID !! Flags
|-
| 0xF8087 || QTM disabled, camera mode 0 [stubbed]
|-
| 0xF8088 || Camera mode 1 [stubbed]
|-
| 0xF8089 || QTM disabled (2), camera mode 1 [stubbed]
|-
| 0xF8090 || Camera mode 0 [stubbed], [[APT:GetApplicationRunningMode|report app mode as O3DS]]
|}

Refer to https://gist.github.com/TuxSH/11da5baae53e80f466829bbab6be6373#file-parse_qtm_blacklist-py for more details

QTM Services

2024-09-05T21:44:19Z

TuxSH:

[[Category:Services]]

QTM is the [[New_3DS]] system module in charge of handling head tracking. A maximum of three (only two until [[9.3.0-21]]) sessions can be opened for each QTM service.

Head tracking is not usable when any other process is using any of the cameras, QTM returns error 0xC8A18008 for this.

=QTM services=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010080
| [[QTM:GetHeadtrackingInfoRaw|GetHeadtrackingInfoRaw]]
|-
| 0x00020080
| [[QTM:GetHeadtrackingInfo|GetHeadtrackingInfo]]
|-
| 0x00030000
|
|-
| 0x00040000
|
|-
| 0x00050040
| (u8 input)
|-
| 0x00060000
| Writes an output u8 to cmdreply[2].
|}

The commands under this section are available for all QTM services except for "qtm:c".

= QTM user service "qtm:u" =
The commands available for this are exactly the same as the commands listed under the "QTM services" section.

= QTM system service "qtm:s" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x04010040
| (float input)
|-
| 0x04020000
| Writes float output to cmdreply[2].
|-
| 0x04030000
|
|-
| 0x04040000
|
|-
| 0x04050040
| (u8 input)
|-
| 0x04060000
| Writes an u8 to cmdreply[2].
|-
| 0x04070040
| (u8 input)
|-
| 0x040801C0
|
|-
| 0x04090000
| Writes an u8 to cmdreply[2].
|-
| 0x040A0040
| (u8 input)
|}

See also the "QTM services" section.

= QTM service "qtm:sp" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x08010040
| (u8 input) Internally compared with 2
|-
| 0x08020000
| Writes 1 to a flag
|-
| 0x08030040
| Returns a byte loaded from a flag
|-
| 0x08040000
| Writes 1 to a flag
|}

This service has all of the commands listed under the "QTM services" section and the "qtm:s" section, in addition to the above commands.

This service is used by [[NS]] and [[GSP_Services|GSP]]-module, hence no other processes can use this service until [[9.3.0-21]].

= QTM callibration service "qtm:c" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010000
| InitializeHardwareCheck (sets 0x1EB63410, 0x1EB6342B, 0x1EB6340A to 1)
|-
| 0x00020000
| ? (sets 0x1EB6342B, 0x1EB6340A to 0)
|-
| 0x00030040
|
|-
| 0x00040000
| Writes an output u8 to cmdreply[2].
|-
| 0x00050040
| SetIrLedCheck (u8 input)
|}

The commands for this service are separate from the commands under the "QTM services" section.

QTM Services

2024-09-05T21:42:33Z

TuxSH:

[[Category:Services]]

QTM is the [[New_3DS]] system module in charge of handling head tracking. A maximum of three (only two until [[9.3.0-21]]) sessions can be opened for each QTM service.

Head tracking is not usable when any other process is using any of the cameras, QTM returns error 0xC8A18008 for this.

=QTM services=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010080
| [[QTM:GetHeadtrackingInfoRaw|GetHeadtrackingInfoRaw]]
|-
| 0x00020080
| [[QTM:GetHeadtrackingInfo|GetHeadtrackingInfo]]
|-
| 0x00030000
|
|-
| 0x00040000
|
|-
| 0x00050040
| (u8 input)
|-
| 0x00060000
| Writes an output u8 to cmdreply[2].
|}

The commands under this section are available for all QTM services except for "qtm:c".

= QTM user service "qtm:u" =
The commands available for this are exactly the same as the commands listed under the "QTM services" section.

= QTM system service "qtm:s" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x04010040
| (float input)
|-
| 0x04020000
| Writes float output to cmdreply[2].
|-
| 0x04030000
|
|-
| 0x04040000
|
|-
| 0x04050040
| (u8 input)
|-
| 0x04060000
| Writes an u8 to cmdreply[2].
|-
| 0x04070040
| (u8 input)
|-
| 0x040801C0
|
|-
| 0x04090000
| Writes an u8 to cmdreply[2].
|-
| 0x040A0040
| (u8 input)
|}

See also the "QTM services" section.

= QTM service "qtm:sp" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x08010040
| (u8 input) Internally compared with 2
|-
| 0x08020000
| Writes 1 to a flag
|-
| 0x08030040
| Returns a byte loaded from a flag
|-
| 0x08040000
| Writes 1 to a flag
|}

This service has all of the commands listed under the "QTM services" section and the "qtm:s" section, in addition to the above commands.

This service is used by [[NS]] and [[GSP_Services|GSP]]-module, hence no other processes can use this service.

= QTM callibration service "qtm:c" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010000
| InitializeHardwareCheck (sets 0x1EB63410, 0x1EB6342B, 0x1EB6340A to 1)
|-
| 0x00020000
| ? (sets 0x1EB6342B, 0x1EB6340A to 0)
|-
| 0x00030040
|
|-
| 0x00040000
| Writes an output u8 to cmdreply[2].
|-
| 0x00050040
| SetIrLedCheck (u8 input)
|}

The commands for this service are separate from the commands under the "QTM services" section.

Legacy FIRM PXI

2024-06-21T20:24:38Z

TuxSH:

This page describes the PXI commands for TWL_FIRM/AGB_FIRM.

{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x0001....
| [[1.0.0-0]]
| Shuts down LgyP9, puts ARM9 into a <code>while(1) svcSleepThread(1*1000*1000);</code> loop at the end of <code>main()</code>
|-
| 0x00020080
| [[1.0.0-0]]
| PrepareArm9ForTwl(u64 application_titleID) This launches the specified TWL title.
|-
| 0x00030080
| [[1.0.0-0]]
| PrepareArm9ForAgb(u64 application_titleID) This launches the specified GBA VC title. On success, returns u64 GBA VC title exeFS .code length in cmdbuf[2].
|-
| 0x00040080 / 0x00040000
| [[1.0.0-0]]
| Process9 will eventually wait for the ARM11 to send this command after PrepareArm9ForTwl/PrepareArm9ForAgb is called, see [[FIRM|here]]. The input parameters should be 0 and 0x00040000 as this is a nested message of which the ITCM code consumes the first half. Returns 0 after going into AGB mode
|-
| 0x00050040
| [[1.0.0-0]]
| (u8 unk) Does some lowlevel sd/emmc register setting (different for unk=0 and unk=1). If unk=1, sets a flag, code ran during the pxi main-func loop detects this and calls <code>svcKernelSetState(2,0)</code>.
|-
| 0x0006....
| [[1.0.0-0]]
| (DateTime datetimetoset,u8 shouldRead) - Sets the P9 date/time (calling the same function used by cmd 0xA for this), then reads (if shouldRead is not 0) or writes (if shouldRead is 0) ARM7_RTC_LO/HI registers to or from agbsave_in_ram+0x60. AgbBg doesn't appear to use this command at all.
|-
| 0x0007....
| [[1.0.0-0]]
| Returns u8, IsSdCardInserted maybe?
|-
| 0x0008....
| [[1.0.0-0]]
| Stubbed, returns 0xE0C0EC03...
|-
| 0x0009....
| [[1.0.0-0]]
| Stubbed, returns 0xE0C0EC03...
|-
| 0x000A....
| [[1.0.0-0]]
| Sets Process9's internal date/time, see below.
|-
| 0x000B0240
| [[1.0.0-0]]
| This is used for TWL initialization, prior to using command 0x00020080. Arguments: u8 <2 if card, else 3>, u8 <bit 1 from firmlaunchparams+0x460>, u64 tid, u8 bannerHmac[0x14]
|-
| 0x000C0800
| [[1.0.0-0]]
| This writes the input 0x80-byte ASCII data to [[Flash_Filesystem|nand:/rw/sys/lgy.log]].
|}

This PXI service seems to be based on [[Development Services PXI]]. Commands 0x8 and 0x9 in both are stubbed with the same function (returns 0xE0C0EC03), commands that seem useless under NATIVE_FIRM have a purpose on legacy FIRMs (command 0xC does some "unnecessary copying to stack" on NATIVE_FIRM, but this same copy (0x80-bytes) is used to write to lgy.log on legacy FIRMs), and commands that are essential (and only useful) on legacy FIRMs (0x2 and 0x3) are stubbed completely on NATIVE_FIRM.

=Command 0x2=
This does the following:
* Waits for an u8 state field to become non-zero.
* Clears DSi memory, etc.
* Loads the DS(i) application specified by the command request titleID. If this fails, it immediately returns the error for this.
* Initializes the DSi memory at 0x02fe7000 and 0x02fffc00.
* Loads the TWL launcher located at physical address [[Memory_layout|0x27C00000]], which was written there by the TwlBg ARM11 process.
* Loads the TWL bootloader, see [[FIRM|here]].
* Initializes DSi memory/keys, [[IO_Registers|0x10018000]] registers, etc.
* Writes value 0x3 to [[CONFIG_Registers|REG_BOOTENV]], and value 0x1 to an u8 state field.
* Uses [[SVC|svcSignalEvent]], then returns.

=Command 0xA=
This takes 3 arguments, which are the following structure packed into 12 bytes (no padding):
s32 year;
s8 month;
s8 day;
s8 day_of_week; // Sunday = 0, up to Saturday = 6
s8 hour;
s8 minute;
s8 second;
s16 ms;
This should be the current date/time (AgbBg seems to get it from MCU); it's converted from this structure into milliseconds, and saved into .data. Another .data variable is set from svcGetSystemTick by this command, and another function in (LGY) P9 essentially does <code>return date_time_set_from_this_command + ticks_to_ms(svcGetSystemTick() - systemtick_from_this_command);</code> to get the current date&time.

I2C Registers

2024-06-13T15:17:54Z

TuxSH:

= Registers =
{| class="wikitable" border="1"
! Old3DS
! Name
! Address
! Width
! Used by
|-
| style="background: green" | Yes
| I2C1_DATA
| 0x10161000
| 1
| I2C bus 1 devices
|-
| style="background: green" | Yes
| [[#I2C_CNT|I2C1_CNT]]
| 0x10161001
| 1
| I2C bus 1 devices
|-
| style="background: green" | Yes
| I2C1_CNTEX
| 0x10161002
| 2
| I2C bus 1 devices
|-
| style="background: green" | Yes
| I2C1_SCL
| 0x10161004
| 2
| I2C bus 1 devices
|-
| style="background: green" | Yes
| I2C2_DATA
| 0x10144000
| 1
| I2C bus 2 devices
|-
| style="background: green" | Yes
| [[#I2C_CNT|I2C2_CNT]]
| 0x10144001
| 1
| I2C bus 2 devices
|-
| style="background: green" | Yes
| I2C2_CNTEX
| 0x10144002
| 2
| I2C bus 2 devices
|-
| style="background: green" | Yes
| I2C2_SCL
| 0x10144004
| 2
| I2C bus 2 devices
|-
| style="background: green" | Yes
| I2C3_DATA
| 0x10148000
| 1
| I2C bus 3 devices
|-
| style="background: green" | Yes
| [[#I2C_CNT|I2C3_CNT]]
| 0x10148001
| 1
| I2C bus 3 devices
|-
| style="background: green" | Yes
| I2C3_CNTEX
| 0x10148002
| 2
| I2C bus 3 devices
|-
| style="background: green" | Yes
| I2C3_SCL
| 0x10148004
| 2
| I2C bus 3 devices
|}

== I2C_CNT ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 0
| Stop (0=No, 1=Stop/last byte)
|-
| 1
| Start (0=No, 1=Start/first byte)
|-
| 2
| Pause (0=Transfer Data, 1=Pause after Error, used with/after Stop)
|-
| 4
| Ack Flag (0=Error, 1=Okay) (For DataRead: W, for DataWrite: R)
|-
| 5
| Data Direction (0=Write, 1=Read)
|-
| 6
| Interrupt Enable (0=Disable, 1=Enable)
|-
| 7
| Start/busy (0=Ready, 1=Start/busy)
|}

== I2C_CNTEX ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 0-1
| ? Set to 2 normally.
|}

== I2C_SCL ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 0-5
| ?
|-
| 8-12
| ? Set to 5 normally.
|}

= I2C Devices =
{| class="wikitable" border="1"
! [[I2C_Registers|Device id]]
! Device bus id
! Device Write Address
! Accessible via I2C [[I2C_Services|service]]
! Device description
|-
| 0
| 1
| 0x4a
| "i2c::MCU"
| Power management?(same device addr as the DSi power-management)
|-
| 1
| 1
| 0x7a
| "i2c::CAM"
| Camera0?(same dev-addr as DSi cam0)
|-
| 2
| 1
| 0x78
| "i2c::CAM"
| Camera1?(same dev-addr as DSi cam1)
|-
| 3
| 2
| 0x4a
| "i2c::MCU"
| MCU
|-
| 4
| 2
| 0x78
| "i2c::CAM"
| ?
|-
| 5
| 2
| 0x2c
| "i2c::LCD"
| ?
|-
| 6
| 2
| 0x2e
| "i2c::LCD"
| ?
|-
| 7
| 2
| 0x40
| "i2c::DEB"
| ?
|-
| 8
| 2
| 0x44
| "i2c::DEB"
| ?
|-
| 9
| 3
| 0xa6
| "i2c::HID"
| Gyroscope. The device table in I2C-module had the device address changed from 0xA6 to 0xD6 with [[8.0.0-18]].
|-
| 10
| 3
| 0xd0
| "i2c::HID"
| Gyroscope (old3DS)
|-
| 11
| 3
| 0xd2
| "i2c::HID"
| Gyroscope (2DS, new3DSXL, new2DSXL)
|-
| 12
| 3
| 0xa4
| "i2c::HID"
| DebugPad (slightly modified [https://wiibrew.org/wiki/Wiimote/Extension_Controllers/Classic_Controller_Pro Wii Classic Controller Pro])
|-
| 13
| 3
| 0x9a
| "i2c::IR"
| IR
|-
| 14
| 3
| 0xa0
| "i2c::EEP"
| HWCAL EEPROM ([[Hardware_calibration#Header|only present on dev units where SHA256 is used for HWCAL verification]])
|-
| 15
| 2
| 0xee
| "i2c::NFC"
| New3DS-only [[NFC_Services|NFC]]
|-
| 16
| 1
| 0x40
| "i2c::QTM"
| New3DS-only [[QTM_Services|QTM]]
|-
| 17
| 3
| 0x54
| "i2c::IR"
| Used by IR-module starting with [[8.0.0-18]], for New3DS-only HID via "ir:rst". This deviceid doesn't seem to be supported by i2c module on [[8.0.0-18]](actual support was later added in New3DS i2c module).
|}

'''Notice''': These device addresses are used for writing to the respective device, for reading bit0 must be set (see I2C protocol). Thus, the actual device address is >> 1.

== Device 3 ==
ro = read-only (writing is no-op)
rw = read-write
wo = write-only (reading will yield 00, FF, or unpredictable data)

d* = dynamic register (explaination below this table)
s* = shared register (explaination below this table)
ds = dynamic shared (explaination below this table)

Reading or writing multiple bytes from/to single-byte registers increments the register ID along with it. For example reading two bytes from reg 0x00 reads regs 0x00 and 0x01.

This is not the case for multibyte regs (0x29, 0x2D, 0x4F, 0x61 and 0x7F), plus reg 0x60.

{| class="wikitable" border="1"
! REGISTER
! WIDTH
! INFO
! DESCRIPTION
|-
| 0x00
| s
| ro
| Version high
|-
| 0x01
| s
| ro
| Version low
|-
| 0x02
| d
| rw
| For bit0 and 1 values, writing will mask away/"acknowledge" the event, set to 3 by mcuMainLoop on reset if reset source is Watchdog
bit0: RTC clock value got reset to defaults
bit1: Watchdog reset happened
bit5: TWL MCU reg: volume mode (0: 8-step, 1: 32-step)
bit6: TWL MCU reg: NTR (0) vs TWL mode (1)
bit7: TWL MCU reg: Uses NAND
|-
| 0x03
| ds
| rw
| Top screen Vcom
|-
| 0x04
| ds
| rw
| Bottom screen Vcom
|-
| 0x05
- 0x07
| s
| rw
| Danger zone - [[MCU_Services#MCU_firmware_versions|MCU unlock sequence]] is written here.
|-
| 0x08
| s
| ro
| Raw 3D slider position
|-
| 0x09
| s
| ro
| Volume slider state (0x00 - 0x3F)
This is the same value returned by [[MCUHWC:GetSoundVolume|MCUHWC:GetSoundVolume]]
|-
| 0x0A
| s
| ro
| Battery temperature (in Celcius?)
|-
| 0x0B
| s
| ro
| Battery percentage
|-
| 0x0C
| s
| ro
| Battery percentage, fractional part (seems to have a resolution of around 0.1% according to tests)
|-
| 0x0D
| s
| ro
| System voltage
|-
| 0x0E
| s
| ro
| ?
|-
| 0x0F
| s
| ro
| Flags: bit7-5 are read via [[MCU_Services|mcu::GPU]]. The rest of them are read via [[MCU_Services|mcu::RTC]].
bit1: ShellState
bit3: AdapterState
bit4: BatteryChargeState
bit5: Bottom screen backlight on
bit6: Top screen backlight on
bit7: LCD panel voltage on
|-
| 0x10
- 0x13
| s
| ro
| Received interrupt bitmask, see register 0x18 for possible values
If no interrupt was received this register is 0
|-
| 0x14
| s
| ro
| Unused and unwritable byte :(
|-
| 0x15
- 0x17
| s
| rw
| Unused and unreferenced free RAM! Good for userdata.
|-
| 0x18
- 0x1B
| s
| rw
| Interrupt mask for register 0x10 (0=enabled,1=disabled)
bit00: Power button press (for 27 "ticks")
bit01: Power button held (for 375 "ticks"; the 3DS turns off regardless after a fixed time)
bit02: HOME button press (for 5 "ticks")
bit03: HOME button release
bit04: WiFi switch button
bit05: Shell close
bit06: Shell open
bit07: Fatal hardware condition([[Services#Notifications|?]]) (sent when the MCU gets reset by the Watchdog timer)
bit08: Charger removed
bit09: Charger plugged in
bit10: RTC alarm (when some conditions are met it's sent when the current day and month and year matches the current RTC time)
bit11: Accelerometer I2C read/write done [https://github.com/profi200/libn3ds/blob/083c8ffa3f56a49802fa74b6afe45a96820f0439/include/arm11/drivers/mcu_regmap.h#L124]
bit12: HID update
bit13: Battery percentage status change (triggered at 10%, 5%, and 0% while discharging)
bit14: Battery stopped charging (independent of charger state)
bit15: Battery started charging
Nonmaskable(?) interrupts
bit16: ???
bit17: ??? (opposite even for bit16)
bit22: Volume slider position change
bit23: ??? Register 0x0E update
bit24: GPU off
bit25: GPU on
bit26: bottom backlight off
bit27: bottom backlight on
bit28: top backlight off
bit29: top backlight on
bit30: bit set by mcu sysmodule
bit31: bit set by mcu sysmodule
|-
| 0x1C
- 0x1F
| s
| rw
| Unused and unreferenced free RAM! Good for userdata.
|-
| 0x20
| d
| wo
| System power control:
bit0: power off
bit1: full reboot (unused). Discards things like [[CONFIG9_Registers#CFG9_BOOTENV|CFG9_BOOTENV]]
- Asserts RESET1 via PMIC command (?) (deasserts nRESET1). This could be the reset that controls some CFG9 registers
- Asserts RESET2 (P0.1 = 0, PM0.1 = 0 (output)) (deasserts nRESET2)
- Asserts FCRAM_RESET (P3.0 = 0) (deasserts nFCRAM_RESET)
bit2: normal reboot. Preserves [[CONFIG9_Registers#CFG9_BOOTENV|CFG9_BOOTENV]], etc.
- Asserts RESET2 (P0.1 = 0, PM0.1 = 0)
- If in NTR emulation mode (see reg 0x02), asserts FCRAM_RESET (P3.0 = 0)
- Resets TWL MCU i2c registers
bit3: FCRAM reset (present in by LgyBg. Unused because a system reboot does the same thing & a PDN reg also possibly implements this function)
- Asserts FCRAM_RESET (P3.0 = 0)
bit4: signal that sleep mode is about to be entered (used by PTM)
Bit 4 sets a bit at a RAM address which seems to control the watcdog timer state, then this bit is immediately unmasked. This field has a bitmask of 0x0F.

If any of the reset bits is set, the MCU waits for 5ms, then deasserts RESET1 (via PMIC), RESET2 (PM0.1 = 1 (input)) and FCRAM_RESET (P3.0 = 1), and reinitializes some other various registers after a 100ms delay.
|-
| 0x21
| d
| wo
| Used in legacy mode to signal events for TWL MCU "emulation" (written to REG[0x5D])? Software then asserts the TWL MCU IRQ pin via [[#LGY_GPIOEMU_MASK|Legacy I/O registers]].
bit0: Signal TWL POWER button click
bit1: Signal TWL reset
bit2: Signal TWL power off
bit3: Signal TWL battery low
bit4: Signal TWL battery empty
bit5: Signal TWL volume button click
|-
| 0x22
| d
| wo
| Used to turn on or turn off LCD-related boost circuits. Bits 5:2 can be read back so see whether backlight setting is in progress or not, however bits 1:0 get cleared as soon as the request gets acknowledged.
bit0: LCD panel voltage off
bit1: LCD panel voltage on
bit2: Bottom screen backlight off
bit3: Bottom screen backlight on
bit4: Top screen backlight off
bit5: Top screen backlight on

Bits 4 and 5 have no effect on a 2DS because the backlight source is the bottom screen.
The rest of the bits are masked away.
|-
| 0x23
| d
| wo
| Writing 0x72 ('r') resets the MCU, but this is stubbed on retail?
|-
| 0x24
| s
| rw
| Watchdog timer. This must be set *before* the timer is triggered, otherwise the old value is used. Value zero disables the watchdog.
|-
| 0x25
| s
| rw
| ?
|-
| 0x26
| s
| rw
| ?
|-
| 0x27
| sd
| rw
| Raw volume slider state
|-
| 0x28
| s
| rw
| Brightness of the WiFi/Power LED
|-
| 0x29
| sd(5)
| rw
| Power mode indicator state (read-write)
1 = forced default blue
2 = sleep mode animation
3 = "power off" mode
4 = disable blue power LED and turn on red power LED
5 = disable red power LED and turn on blue power LED
6 = animate blue power LED off and flash red power LED
anything else = automatic mode
The other 4 bytes (32bits) affect the pattern of the red power LED (write only)
|-
| 0x2A
| s
| rw
| WiFi LED state, non-0 value turns on the WiFi LED, 4 bits wide
|-
| 0x2B
| s
| rw
| Camera LED state, 4bits wide,
0, 3, 6-0xF = off
1 = slowly blinking
2 = constantly on
3 = "TWL" mode
4 = flash once
5 = delay before changing to 2
|-
| 0x2C
| s
| rw
| 3D LED state, 4 bits wide
|-
| 0x2D
| 0x64
| wo
| This is used for [[MCURTC:SetInfoLEDPattern|controlling]] the notification LED (see [[MCURTC:SetInfoLEDPatternHeader]] as well), when this register is written. It's possible to write data here with size less than 0x64, and only that portion of the pattern data will get overwritten. Reading from this register only returns zeroes, so it's considered write-only. Writing past the size of this register seems to do nothing.
|-
| 0x2E
| s
| ro
| This [[MCURTC:GetInfoLEDStatus|returns]] the notification LED status when read (1 means new cycle started)
|-
| 0x2F
| s
| wo?
| ??? The write function for this register is stubbed.
|-
| 0x30
- 0x36
| ds
| rw
| RTC time (system clock). 7 bytes are read from this. The upper nibble of each byte encodes 10s (BCD), so each byte is post-processed with (byte & 0xF) + (10 * (byte >> 4)).
byte 0: seconds
byte 1: minutes
byte 2: hours
byte 3: current week (unused)
byte 4: days
byte 5: months
byte 6: years
|-
| 0x37
| s
| rw
| RTC time byte 7: leap year counter / "watch error correction" register (unused in code)
|-
| 0x38
- 0x3C
| s
| rw
| RTC alarm registers
byte 0: minutes
byte 1: hours
byte 2: day
byte 3: month
byte 4: year
|-
| 0x3B
| s
| rw
| Could be used on extremely old MCU_FIRM versions to upload [[MCU_Services#MCU_firmware_versions|MCU firmware]] if reg 0xF == 0 and reg 0x10 == 1 (presumably major and minor version fields for mcufw 0.1 which largely predates factory firm).
|-
| 0x3D
0x3E
| ds
| ro
| RTC tick counter / "ITMC" (when resets to 0 the seconds increase)
Only reading 0x3D will update the in-RAM value
|-
| 0x3F
| d
| wo
| 2 bits
bit0: Asserts RESET1 (P0.0 = 0, PM0.0 = 0 (output)) but does NOT deassert it (wtf?). This seems to kill the entire SoC: is it because it doesn't deassert it, or does it not deassert it because the SoC hangs anyway? This is the pin that controls some security-critical regs like CFG9_BOOTENV!
bit1: turns on a prohibited bit in an RTC Control register and turns P12 into an output
|-
| 0x40
| s
| rw
| Tilt sensor sampling mode. Bits 0 and 1 control the mode. If bits 0 or 1 are set then the tilt sensor is enabled and sampled.
|-
| 0x41
| s
| rw
| Index selector for register 0x44
|-
| 0x42
| s
| rw
| Unused?
|-
| 0x43
| s
| rw
| Unused???, accelometer related
|-
| 0x44
| s
| rw
| ???, pedoometer related(?)
|-
| 0x45
- 0x4A
| s
| ro
| Tilt sensor 3D rotation from the 12bit ADC, left shifted 4 to fit in a 16bit signed short, relative to the 3DS bottom screen
{| class="wikitable" border="1"
! AXIS
! V=0x00
! V=0x40
! V=0xC0
|-
| X (left/right)
| held up vertically
| rotated left 90° like a steering wheel
| rotated right 90° like a steering wheel
|-
| Y (forwards/backwards)
| laid flat on the desk with the screen facing up
| held up vertically
| held up vertically with screen facing upside-down
|-
| Z (???)
| ???
| ???
| ???
|}
|-
| 0x4B
| s
| rw
| PedometerStepCount (for the current day)
|-
| 0x4C
0x4D
| ??
| ??
| ??
|-
| 0x4E
| d
| rw
| ??? this = (0xFFE9E & 1) ? 0x10 : 0
|-
| 0x4F
| d(6)
| ro
|
|-
| 0x50
| s
| rw
| ???
|-
| 0x51
| s
| rw
| ???
|-
| 0x52
- 0x57
| s
| rw
| ?
|-
| 0x58
| s
| rw
| Register-mapped ADC register
DSP volume slider 0% volume offset (setting this to 0xFF will esentially mute the DSP as it's the volume slider's maximum raw value)
|-
| 0x59
| s
| rw
| Register-mapped ADC register
DSP volume slider 100% volume offset (setting both this and the above to 0 will disable the volume slider with 100% volume, setting this to a lower value than the above will make the volume slider have only 2 states; on and off)
|-
| 0x5A
| s
| ro/rw
| Invalid, do not use! On newer MCU_FIRM versions this is unused, but on older MCU_FIRM versions this is a read-only counter.
|-
| 0x5B
- 0x5F
| s
| -
| These registers are out of bounds (0xFFC00 and up), they don't exist, writing is no-op, reading will yield FFs.
|-
| 0x60
| d
| rw
| Free register bank address (index) select
Selects the index to read from in the free register bank, up to 200. Used in conjunction with reg 0x61.

byte 0: bit0 = "WirelessDisabled", bit1 = "SoftwareClosed", bit2 = "PowerOffInitiated", bit3 = "LgyNativeResolution", bit4 = "LegacyJumpProhibited"
byte 1: Legacy LCD data
bytes 2 and 3: Local Friend Code counter
bytes 4 and 5: UUID clock sequence
bytes 6 and 7: Unused
bytes 8 to 175: Playtime data for legacy titles
bytes 176 to 188: Temporary playtime data in case console doesn't shut down gracefully, updated every 5 minutes
bytes 188 to 199: Unused
|-
| 0x61
| d(200)
| rw
| Free register bank, data is read from/written to here.

Accessing N bytes of this register increments the selected index by N.
|-
| 0x62 - 0x7E
| s
| -
| These registers don't exist, writing is no-op, reading will yield FFs.
|-
| 0x7F
| d(9-0x13)
| ro
| Various system state information (debug pointer table)
byte 0x00: Console type, see [[Configuration_Memory#MCU_HW_INFO|here]]
byte 0x01: PMIC vendor code
byte 0x02: Battery vendor code
byte 0x03: MGIC version (major?)
byte 0x04: MGIC version (minor?)
byte 0x05: RCOMP(?)
byte 0x06: battery related? (seems to decrease while charging and increase while discharging)
byte 0x09: system model (see [[Cfg:GetSystemModel#System_Model_Values|Cfg:GetSystemModel]] for values)
byte 0x0A: Red Power LED mode (0 = off, 1 = on)
byte 0x0B: Blue Power LED intensity (0x00 - 0xFF)
byte 0x0D: RGB LED red intensity
byte 0x0E: RGB LED green intensity
byte 0x0F: RGB LED blue intensity
byte 0x11: WiFi LED brightness
byte 0x12: raw button states?
bit0: unset while Power button is held
bit1: unset while HOME button is held
bit2: unset while WiFi slider is held
bit5: unset while the charging LED is active
bit6: unset while charger is plugged in

On MCU_FIRM major version 1 the size of this is 9, reading past the 9th byte will yield AA instead of FF.
|-
| 0x80
- 0xFF
| s
| -
| These registers don't exist, writing is no-op, reading will yield FFs.
|}

Shared register: the letter "s" means that the given register is in a "shared register pool", meaning the resgister is in the register pool in RAM at address <code>0xFFBA4 + registernumber</code>.

Dynamic register: these registers aren't in the shared pool, they just "pretend" to be there. These registers often don't retain their set value, change rapidly, or control various hardware.

Non-shared (dynamic) register: it's a register whose contents separate from the shared register pool. Messing with these registers will not affect the shared register pool at all.

On old versions of MCU_FIRM none of the invalid registers are masked away by the read handler function, but are still read-only. Newer MCU_FIRM versions return the hardcoded value FF instead.

== Device 5 & 6 ==
These are the chip-on-glass display controllers, also known as I2CLCD.

=== Shared registers ===
These registers are the same across all known I2CLCD controllers (except Controller ID 0x00).

{| class="wikitable" border="1"
! Register
! Name
! Valid bits
! Description
|-
| 0x01
| Display enable
| 0x11
| Values:

- 0x00 - screen off, slow burn-in
- 0x01 - screen off, fast burn-in
- 0x10 - screen on, color input used
- 0x11 - screen on, color input not used, High-Z (display turns black or white depending on interface config)
|-
| 0x40
| Read address
|
| Write to this register to set the read address.

Reading from I2CLCD is non-standard. When you read, it returns pairs of the currently read address, and then the data byte at that address. The read address auto-increments.
|-
| 0x54
| Checksum? trigger
| 0x01
| When transitioning bit0 from 0 to 1, it seems to trigger some sort of checksum calcuation. Broken on controller 0x01, where it's oneshot.
|-
| 0x55
| ???
| 0x03 (all) /
0x07 (2DS)
| Unknown. When toggling 0x54 bit0 from 0 to 1, this register gets changed to 0x01 (all) / 0x05 (2DS).

This register is sometimes seen with a value of 0x02 at initialization time on the top screen.
|-
| 0x56
| Checksum?
|
| Unknown. Read-writable with no effect (old3DS) / read-only (all).

A random value is written here when 0x54 bit0 is changed from 0 to 1. Constantly updates with a seemingly random value, except on Controller ID 0x01, where it's oneshot/bugged.
|-
| 0x60
| ???
| 0x01
| Unknown. 0x00 is written here during init. Seems to have no effect.
|-
| 0x61
| Register checksum
|
| Some - but not all - register values are combined using an unknown algorithm into this register.
It's unknown which registers influence this value, as some registers which influence this value are read-only.
|-
| 0x62
| ???
| 0x01
| Unknown, does nothing on known controllers. During init, gsp waits for this to become 0x01.
|-
| 0xFE
| ???
|
| Unknown, does nothing. 0xAA is written here during init.
|-
| 0xFF
| Controller ID
|
| Upper 4bits is manufacturer. Lower 4bits is unknown, most likely revision, possibly encoded as a Johnson counter. The fields are encoded this way, most likely for the register checksum feature.

Manufacturers:
- 0x0 - SHARP (LTPS(?) TN), old I2CLCD, found in old3DS (non-XL) only
- 0x1 - JDI (LTPS IPS), found in select new3DS and new3DSXL consoles
- 0xC - SHARP (LTPS(?) TN), new I2CLCD
- 0xE - SHARP (TFT), found in 2DS only

Known IDs:
- 0xC7 - new3DS, new3DSXL, new2DSXL, and some select newer old3DSXL
- 0xC3 - older old3DSXL
- 0xE1 - 2DS
- LQ050B1LW10B
- LQ = normal TFT
- 050 = panel 5 inches diagonal
- B = "other" display format
- 1 = transmissive (backlight-compatible)
- L = LVDS
- W = *unknown coating type*
- 10 = model number
- B = *unknown suffix*
- 0x10 - some select new3DS and new3DSXL with IPS screens
- 0x01 - old3DS
- LS035T7LE38P (top screen)
- LS = TFT (LTPS or SI-TFT ?)
- 035 = panel 3.5 inches diagonal
- T = "other 16:9" (even though the panel is 16:10 in physical size, or 32:10 in terms of pixel count)
- 7 = *unknown backing type*
- L = LVDS
- E = *unknown coating type*
- 38 = model number
- P = *unknow suffix*
- LS030Q7DW48P (bottom screen)
- LS = TFT (LTPS or SI-TFT ?)
- 030 = panel 3 inches diagonal
- Q = QVGA (320x240)
- 7 = *unknown backing type*
- D = parallel RGB (unspecified, but it's known to be RGB888 for this display)
- W = *unknown coating type*
- 48 = model number
- P = *unknow suffix*
- 0x00 - no controller, or dead (I2CLCD always ACKs reads, but returns 00 if dead)
|}

=== Custom registers for controller 0x00 ===
This Controller ID is fully unknown, and the only reason we know about its existance is due to gsp having special handling code for it.

{| class="wikitable" border="1"
! Register
! Name
! Valid bits
! Description
|-
| 0x11
| ???
|
| Unknown. Write 0x10 to initialize.
|-
| 0x50
| ???
|
| Unknown. Write 0x01 to initialize.
|}

=== Custom registers for controller 0x01 ===

{| class="wikitable" border="1"
! Register
! Name
! Valid bits
! Description
|-
| 0x10
| Interface config
| 0xF7
| Regonfigures the input pins and pin behavior of the controller.

bit0 - color value invert (D = ~D, or D = 255 - D)
bit1 - color format remap (D7:D2 <-- D5:D0, that is left shift color data by 2)
bit2 - ???
bit4 - ???
bit5 - ???
bit6 - ???
bit7 - DS-style undriven screen (it will be white instead of black, see shared register 0x01)
|-
| 0x11
| Image config
| 0x7F
| Image filters and pixel clock control.

bit0 - Horizontal Flip (scan from right to left)
bit1 - red-blue swap
bit2 - ???
bit3 - ???
bit4 - ???
bit5 - ???
bit6 - ???
|-
| 0x1D
| ???
| 0x0F
| Unknown, bit0 enables registers 0x12 to 0x19 to control some analog timing controls to the display panel itself.
|-
| 0x50
| ???
| 0x11
| Unknown. Has no effect on bottom screen. On the top screen, bit4 blanks out the display (LVDS disable?).
|-
| 0x53
| ???
| 0x73
| Unknown. While other bits seem to have no effect, bit0 kills the controller until a power cycle.
|}

=== Custom registers for controller 0xC3 ===
Basically the same as Controller ID 0xC7.

=== Custom registers for controller 0xC7 ===
This is the most common non-old3DS display controller. Quite overclockable.

Note: on the 0xC7 controller unlocking the factory controls at register 0x03 glitches out most of the standard controls (like registers 0x50 to 0x56), so use with caution.

{| class="wikitable" border="1"
! Register
! Name
! Valid bits
! Description
|-
| 0x03
| Factory key 2
|
| Write 0xAA here to unlock a second set of factory controls.
|-
| 0xAF
| Factory key
|
| Write 0xAA here to unlock factory controls.
|}

Factory mode registers for unlock register 0x03:
{| class="wikitable" border="1"
! Register
! Name
! Valid bits
! Description
|-
| 0x10
| Image control?
| 0xD7
| Most bits are unknown.

bit0 - color invert
bit1 - slight gamma increase
|-
| 0x11
| Image transform?
| 0x7F
| Mostly unknown.
bit0 - Invert horizontal scan direction (0 = left to right, 1 = right to left)
bit1 - red-blue swap
bit2 - Invert vertical scan direction (0 = top to bottom, 1 = bottom to top)
bit3 - Invert the order of each scanline pair (might be needed if bit2 is toggled)
bit4 - Enable interlaced signal (use bit3 to swap fields)
bit5 - ???
bit6 - ???
|-
| 0x70-0x83
| Color curve red
| rowspan=3 |
| rowspan=3 | These registers are used for fine-tuning the analog driving curve of the screen

Positive:
- byte 00 (0xFF) - ???
- byte 01 (0xFF) - ???
- byte 02 (0x3F) - ???
- byte 03 (0x3F) - ???
- byte 04 (0x3F) - ???
- byte 05 (0x3F) - ???
- byte 06 (0x3F) - ???
- byte 07 (0x3F) - ???
- byte 08 (0x3F) - ???
- byte 09 (0x3F) - ???

Negative:
- byte 10 (0xFF) - ???
- byte 11 (0xFF) - ???
- byte 12 (0x3F) - ???
- byte 13 (0x3F) - ???
- byte 14 (0x3F) - ???
- byte 15 (0x3F) - ???
- byte 16 (0x3F) - ???
- byte 17 (0x3F) - ???
- byte 18 (0x3F) - ???
- byte 19 (0x3F) - ???
|-
| 0x84-0x97
| Color curve green
|-
| 0x98-0xAB
| Color curve blue
|}

=== Custom registers for controller 0xE1 ===
This controller is designed to drive a split panel. As such, the factory controls have been slightly altered to accomodate this.

This is the only I2CLCD which responds on both I2CLCD addresses. The dominant screen is the bottom one.

Most registers are similar to controller 0xC7, but there are some differences due to the split shared panel nature.

{| class="wikitable" border="1"
! Register
! Name
! Valid bits
! Description
|-
| 0x03
| Factory key 2
|
| Write 0xAA here to unlock a 2nd set of factory controls.
|-
| 0xAF
| Factory key
|
| Write 0xAA here to unlock factory controls.
|}

Factory mode registers for unlock register 0x03:
{| class="wikitable" border="1"
! Register
! Name
! Valid bits
! Description
|-
| 0x10
| Image control?
| 0xD7
| Most bits are unknown. This applies to the whole display panel.

bit0 - color invert
bit1 - slight gamma increase
|-
| 0x11
| Image transform
| 0x33
|
bit0 - top half horizontal flip
bit1 - top half red-blue swap
bit4 - bottom half horizontal flip
bit5 - bottom half red-blue swap
|-
| 0x70-0x83
| Analog curve top
| rowspan=2 |
| rowspan=2 | Consists of two unknown curve values. Seems to be nonstandard.

Pair 1:
byte 00 (0xFF) - ???
byte 01 (0xFF) - ???
byte 02 (0xFF) - ???
byte 03 (0xFF) - ???
byte 04 (0x3F) - ???
byte 05 (0x3F) - ???
byte 06 (0x3F) - ???
byte 07 (0x3F) - ???
byte 08 (0x3F) - ???
byte 09 (0x3F) - ???

Part 2:
byte 10 (0xFF) - ???
byte 11 (0xFF) - ???
byte 12 (0xFF) - ???
byte 13 (0xFF) - ???
byte 14 (0x3F) - ???
byte 15 (0x3F) - ???
byte 16 (0x3F) - ???
byte 17 (0x3F) - ???
byte 18 (0x3F) - ???
byte 19 (0x3F) - ???
|-
| 0x84-0x97
| Analog curve bottom
|}

=== Custom registers for controller 0x10 ===
JDI IPS controller.

Warning: on the JDI controller, unlocking any of the factory mode registers overshadows some other registers, so don't write to "standard" locations (other than register 0x40) before locking factory mode back!

{| class="wikitable" border="1"
! Register
! Name
! Valid bits
! Description
|-
| 0x03
| Factory key 2
|
| Write 0xAA here to unlock advanced IPS curve controls.
|-
| 0xAF
| Factory key
|
| Write 0xAA here to unlock factory controls.
|}

Factory mode registers unlocked by register 0xAF:
* 0x41 - 0x4F
* 0x58 - 0x5F
* 0x67 - 0x6F
* 0xD0 - 0xEF
* unknown...

Factory mode registers unlocked by register 0x03:
* 0x04 - 0x0F
* unknown...
{| class="wikitable" border="1"
! Register
! Name
! Valid bits
! Description
|-
| 0x70-0x7F
| Driving curve 1-1
|
|
|-
| 0x80-0x8F
| Driving curve 1-2
|
|
|-
| 0x90-0x9F
| Driving curve 2-1
|
|
|-
| 0xA0-0xAF
| Driving curve 2-2
|
|
|-
| 0xB0-0xBF
| Driving curve 3-1
|
|
|-
| 0xC0-0xCF
| Driving curve 3-2
|
|
|}

== Device 10 ==
See the datasheet linked to on the [[Hardware]] page for reference.

== Device 11 ==
See the datasheet linked to on the [[Hardware]] page for reference.

== Device 12 ==
{| class="wikitable" border="1"
! REGISTER
! WIDTH
! DESCRIPTION
|-
| 0x0
| 21
| DebugPad state.
|}

This is a [https://wiibrew.org/wiki/Wiimote/Extension_Controllers/Classic_Controller_Pro Wii Classic Controller Pro] which was slightly modified to have an encrypted device type of 0xF0 [https://wiibrew.org/wiki/Wiimote/Extension_Controllers#The_New_Way instead of 0xFD].

See [[HID_Shared_Memory#Offset_0x238|here]] for the HID shared memory report format.

== Device 13 ==
{| class="wikitable" border="1"
! Raw I2C register address
! Internal register address
! Width
! Description
|-
| 0x0
| 0x0
| 0x40
| RHR / THR (data receive/send FIFO)
|-
| 0x8
| 0x1
| 0x1
| IER
|-
| 0x10
| 0x2
| 0x1
| FCR/IIR
|-
| 0x18
| 0x3
| 0x1
| LCR
|-
| 0x20
| 0x4
| 0x1
| MCR
|-
| 0x28
| 0x5
| 0x1
| LSR
|-
| 0x30
| 0x6
| 0x1
| MSR/TCR
|-
| 0x38
| 0x7
| 0x1
| SPR/TLR
|-
| 0x40
| 0x8
| 0x1
| TXLVL
|-
| 0x48
| 0x9
| 0x1
| RXLVL
|-
| 0x50
| 0xA
| 0x1
| IODir
|-
| 0x58
| 0xB
| 0x1
| IOState
|-
| 0x60
| 0xC
| 0x1
| IoIntEna
|-
| 0x68
| 0xD
| 0x1
| reserved
|-
| 0x70
| 0xE
| 0x1
| IOControl
|-
| 0x78
| 0xF
| 0x1
| EFCR
|}

See the [http://www.alldatasheet.net/datasheet-pdf/pdf/347838/NXP/SC16IS750IBS.html datasheet] linked to on the [[Hardware]] page for reference. From that datasheet, for the structure of the I2C register address u8: "Bit 0 is not used, bits 2:1 select the channel, bits 6:3 select one of the UART internal registers. Bit 7 is not used with the I2C-bus interface, but it is used by the SPI interface to indicate a read or a write operation."

== Device 14 ==

Used by [[Config_Services|Cfg]]-sysmodule via the i2c::EEP service. This is presumably EEPROM going by the service name.

The Cfg-module code which loads the [[Flash_Filesystem|CCAL]](nandro:/sys/{HWCAL0.dat/HWCAL1.dat}) file from NAND will load it from I2C instead, if a certain state flag is non-zero. Likewise for the function which writes CCAL to NAND. HMAC/hash verification after loading is skipped when the CCAL was loaded from I2C.

== Device 15 ==
This the New3DS [[NFC_Services|NFC]] controller "I2C" interface. This device is accessed via the WriteDeviceRaw/ReadDeviceRaw I2C service [[I2C_Services|commands]].

Since the *Raw commands are used with this, this device has no I2C registers. Instead, raw data is transfered after the I2C device is selected. Hence, WriteDeviceRaw is used for sending commands to the controller, while ReadDeviceRaw is for receiving responses from the controller. Certain commands may return multiple command responses.

Command request / response structure:
{| class="wikitable" border="1"
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Normally 0x10?
|-
| 0x1
| 0x1
| Command source / destination.
|-
| 0x2
| 0x1
| CmdID
|-
| 0x3
| 0x1
| Payload size.
|}

Following the above header is the payload data(when payload size is non-zero), with the size specified in the header. The command response payload is usually at least 1-byte, where that byte appears to be normally 0x0. For command requests the payload data is the command parameters.

For command requests sent to the NFC tag itself, Cmd[1]=0x0 and CmdID=0x0. The command request payload data here is the actual command request data for the NFC tag, starting with the CmdID u8 at payload+0.

During NFC module startup, a certain command is sent to the controller which eventually(after various cmd-reply headers etc) returns the following the payload after the first byte in the payload:
000000: 44 65 63 20 32 32 20 32 30 31 32 31 34 3a 35 33 Dec 22 201214:53
000010: 3a 35 30 01 05 0d 46 05 1b 79 20 07 32 30 37 39 :50...F..y .2079
000020: 31 42 35 1B5

Or that is: "Dec 22 201214:53:50<binary>20791B5". Therefore, this appears to return the part-number of the NFC controller(other command request(s) / response(s) use this part-number value too).

=== NFC controller commands ===
{| class="wikitable" border="1"
! CmdRequest[1]
! CmdID
! Payload data for parameters
! Description
|-
| 0x2E
| 0x2F
| Firmware image for this chunk, size varies.
| This is used during NFC module startup to upload the firmware image to the NFC controller. This is used repeatedly to upload multiple chunks of the image.
|}

== Device 17 ==

(Stub)

Used by New 3DS for ZL, ZR, C stick

This device do not use registers. After writing the address, read the next several bytes.

{| class="wikitable" border="1"
! Offset
! Description
|-
| 0x0
| Fixed 0x80
|-
| 0x1
| Buttons (ZL = 0x4, ZR = 0x2)
|}

I2C Registers

2024-06-12T17:31:16Z

TuxSH:

= Registers =
{| class="wikitable" border="1"
! Old3DS
! Name
! Address
! Width
! Used by
|-
| style="background: green" | Yes
| I2C1_DATA
| 0x10161000
| 1
| I2C bus 1 devices
|-
| style="background: green" | Yes
| [[#I2C_CNT|I2C1_CNT]]
| 0x10161001
| 1
| I2C bus 1 devices
|-
| style="background: green" | Yes
| I2C1_CNTEX
| 0x10161002
| 2
| I2C bus 1 devices
|-
| style="background: green" | Yes
| I2C1_SCL
| 0x10161004
| 2
| I2C bus 1 devices
|-
| style="background: green" | Yes
| I2C2_DATA
| 0x10144000
| 1
| I2C bus 2 devices
|-
| style="background: green" | Yes
| [[#I2C_CNT|I2C2_CNT]]
| 0x10144001
| 1
| I2C bus 2 devices
|-
| style="background: green" | Yes
| I2C2_CNTEX
| 0x10144002
| 2
| I2C bus 2 devices
|-
| style="background: green" | Yes
| I2C2_SCL
| 0x10144004
| 2
| I2C bus 2 devices
|-
| style="background: green" | Yes
| I2C3_DATA
| 0x10148000
| 1
| I2C bus 3 devices
|-
| style="background: green" | Yes
| [[#I2C_CNT|I2C3_CNT]]
| 0x10148001
| 1
| I2C bus 3 devices
|-
| style="background: green" | Yes
| I2C3_CNTEX
| 0x10148002
| 2
| I2C bus 3 devices
|-
| style="background: green" | Yes
| I2C3_SCL
| 0x10148004
| 2
| I2C bus 3 devices
|}

== I2C_CNT ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 0
| Stop (0=No, 1=Stop/last byte)
|-
| 1
| Start (0=No, 1=Start/first byte)
|-
| 2
| Pause (0=Transfer Data, 1=Pause after Error, used with/after Stop)
|-
| 4
| Ack Flag (0=Error, 1=Okay) (For DataRead: W, for DataWrite: R)
|-
| 5
| Data Direction (0=Write, 1=Read)
|-
| 6
| Interrupt Enable (0=Disable, 1=Enable)
|-
| 7
| Start/busy (0=Ready, 1=Start/busy)
|}

== I2C_CNTEX ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 0-1
| ? Set to 2 normally.
|}

== I2C_SCL ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 0-5
| ?
|-
| 8-12
| ? Set to 5 normally.
|}

= I2C Devices =
{| class="wikitable" border="1"
! [[I2C_Registers|Device id]]
! Device bus id
! Device Write Address
! Accessible via I2C [[I2C_Services|service]]
! Device description
|-
| 0
| 1
| 0x4a
| "i2c::MCU"
| Power management?(same device addr as the DSi power-management)
|-
| 1
| 1
| 0x7a
| "i2c::CAM"
| Camera0?(same dev-addr as DSi cam0)
|-
| 2
| 1
| 0x78
| "i2c::CAM"
| Camera1?(same dev-addr as DSi cam1)
|-
| 3
| 2
| 0x4a
| "i2c::MCU"
| MCU
|-
| 4
| 2
| 0x78
| "i2c::CAM"
| ?
|-
| 5
| 2
| 0x2c
| "i2c::LCD"
| ?
|-
| 6
| 2
| 0x2e
| "i2c::LCD"
| ?
|-
| 7
| 2
| 0x40
| "i2c::DEB"
| ?
|-
| 8
| 2
| 0x44
| "i2c::DEB"
| ?
|-
| 9
| 3
| 0xa6
| "i2c::HID"
| Gyroscope. The device table in I2C-module had the device address changed from 0xA6 to 0xD6 with [[8.0.0-18]].
|-
| 10
| 3
| 0xd0
| "i2c::HID"
| Gyroscope (old3DS)
|-
| 11
| 3
| 0xd2
| "i2c::HID"
| Gyroscope (2DS, new3DSXL, new2DSXL)
|-
| 12
| 3
| 0xa4
| "i2c::HID"
| DebugPad (slightly modified [https://wiibrew.org/wiki/Wiimote/Extension_Controllers/Classic_Controller_Pro Wii Classic Controller Pro])
|-
| 13
| 3
| 0x9a
| "i2c::IR"
| IR
|-
| 14
| 3
| 0xa0
| "i2c::EEP"
| HWCAL EEPROM ([[Hardware_calibration#Header|only present on dev units where SHA256 is used for HWCAL verification]])
|-
| 15
| 2
| 0xee
| "i2c::NFC"
| New3DS-only [[NFC_Services|NFC]]
|-
| 16
| 1
| 0x40
| "i2c::QTM"
| New3DS-only [[QTM_Services|QTM]]
|-
| 17
| 3
| 0x54
| "i2c::IR"
| Used by IR-module starting with [[8.0.0-18]], for New3DS-only HID via "ir:rst". This deviceid doesn't seem to be supported by i2c module on [[8.0.0-18]](actual support was later added in New3DS i2c module).
|}

'''Notice''': These device addresses are used for writing to the respective device, for reading bit0 must be set (see I2C protocol). Thus, the actual device address is >> 1.

== Device 3 ==
ro = read-only (writing is no-op)
rw = read-write
wo = write-only (reading will yield 00, FF, or unpredictable data)

d* = dynamic register (explaination below this table)
s* = shared register (explaination below this table)
ds = dynamic shared (explaination below this table)

Reading or writing multiple bytes from/to single-byte registers increments the register ID along with it. For example reading two bytes from reg 0x00 reads regs 0x00 and 0x01.

This is not the case for multibyte regs (0x29, 0x2D, 0x4F, 0x61 and 0x7F), plus reg 0x60.

{| class="wikitable" border="1"
! REGISTER
! WIDTH
! INFO
! DESCRIPTION
|-
| 0x00
| s
| ro
| Version high
|-
| 0x01
| s
| ro
| Version low
|-
| 0x02
| d
| rw
| For bit0 and 1 values, writing will mask away/"acknowledge" the event, set to 3 by mcuMainLoop on reset if reset source is Watchdog
bit0: RTC clock value got reset to defaults
bit1: Watchdog reset happened
bit5: TWL MCU reg: volume mode (0: 8-step, 1: 32-step)
bit6: TWL MCU reg: NTR (0) vs TWL mode (1)
bit7: TWL MCU reg: Uses NAND
|-
| 0x03
| ds
| rw
| Top screen Vcom
|-
| 0x04
| ds
| rw
| Bottom screen Vcom
|-
| 0x05
- 0x07
| s
| rw
| Danger zone - [[MCU_Services#MCU_firmware_versions|MCU unlock sequence]] is written here.
|-
| 0x08
| s
| ro
| Raw 3D slider position
|-
| 0x09
| s
| ro
| Volume slider state (0x00 - 0x3F)
This is the same value returned by [[MCUHWC:GetSoundVolume|MCUHWC:GetSoundVolume]]
|-
| 0x0A
| s
| ro
| Battery temperature (in Celcius?)
|-
| 0x0B
| s
| ro
| Battery percentage
|-
| 0x0C
| s
| ro
| Battery percentage, fractional part (seems to have a resolution of around 0.1% according to tests)
|-
| 0x0D
| s
| ro
| System voltage
|-
| 0x0E
| s
| ro
| ?
|-
| 0x0F
| s
| ro
| Flags: bit7-5 are read via [[MCU_Services|mcu::GPU]]. The rest of them are read via [[MCU_Services|mcu::RTC]].
bit1: ShellState
bit3: AdapterState
bit4: BatteryChargeState
bit5: Bottom screen backlight on
bit6: Top screen backlight on
bit7: LCD panel voltage on
|-
| 0x10
- 0x13
| s
| ro
| Received interrupt bitmask, see register 0x18 for possible values
If no interrupt was received this register is 0
|-
| 0x14
| s
| ro
| Unused and unwritable byte :(
|-
| 0x15
- 0x17
| s
| rw
| Unused and unreferenced free RAM! Good for userdata.
|-
| 0x18
- 0x1B
| s
| rw
| Interrupt mask for register 0x10 (0=enabled,1=disabled)
bit00: Power button press (for 27 "ticks")
bit01: Power button held (for 375 "ticks"; the 3DS turns off regardless after a fixed time)
bit02: HOME button press (for 5 "ticks")
bit03: HOME button release
bit04: WiFi switch button
bit05: Shell close
bit06: Shell open
bit07: Fatal hardware condition([[Services#Notifications|?]]) (sent when the MCU gets reset by the Watchdog timer)
bit08: Charger removed
bit09: Charger plugged in
bit10: RTC alarm (when some conditions are met it's sent when the current day and month and year matches the current RTC time)
bit11: Accelerometer I2C read/write done [https://github.com/profi200/libn3ds/blob/083c8ffa3f56a49802fa74b6afe45a96820f0439/include/arm11/drivers/mcu_regmap.h#L124]
bit12: HID update
bit13: Battery percentage status change (triggered at 10%, 5%, and 0% while discharging)
bit14: Battery stopped charging (independent of charger state)
bit15: Battery started charging
Nonmaskable(?) interrupts
bit16: ???
bit17: ??? (opposite even for bit16)
bit22: Volume slider position change
bit23: ??? Register 0x0E update
bit24: GPU off
bit25: GPU on
bit26: bottom backlight off
bit27: bottom backlight on
bit28: top backlight off
bit29: top backlight on
bit30: bit set by mcu sysmodule
bit31: bit set by mcu sysmodule
|-
| 0x1C
- 0x1F
| s
| rw
| Unused and unreferenced free RAM! Good for userdata.
|-
| 0x20
| d
| wo
| System power control:
bit0: power off
bit1: full reboot (unused). Discards things like [[CONFIG9_Registers#CFG9_BOOTENV|CFG9_BOOTENV]]
- Asserts RESET1 via PMIC command (?) (deasserts nRESET1). This could be the reset that controls some CFG9 registers
- Asserts RESET2 (P0.1 = 0, PM0.1 = 0 (output)) (deasserts nRESET2)
- Asserts FCRAM_RESET (P3.0 = 0) (deasserts nFCRAM_RESET)
bit2: normal reboot. Preserves [[CONFIG9_Registers#CFG9_BOOTENV|CFG9_BOOTENV]], etc.
- Asserts RESET2 (P0.1 = 0, PM0.1 = 0)
- If in NTR emulation mode (see reg 0x02), asserts FCRAM_RESET (P3.0 = 0)
- Resets TWL MCU i2c registers
bit3: FCRAM reset (present in by LgyBg. Unused because a system reboot does the same thing & a PDN reg also possibly implements this function)
- Asserts FCRAM_RESET (P3.0 = 0)
bit4: signal that sleep mode is about to be entered (used by PTM)
Bit 4 sets a bit at a RAM address which seems to control the watcdog timer state, then this bit is immediately unmasked. This field has a bitmask of 0x0F.

If any of the reset bits is set, the MCU waits for 5ms, then deasserts RESET1 (via PMIC), RESET2 (PM0.1 = 1 (input)) and FCRAM_RESET (P3.0 = 1), and reinitializes some other various registers after a 100ms delay.
|-
| 0x21
| d
| wo
| Used in legacy mode to signal events for TWL MCU "emulation" (written to REG[0x5D])? Software then asserts the TWL MCU IRQ pin via [[#LGY_GPIOEMU_MASK|Legacy I/O registers]].
bit0: Signal TWL POWER button click
bit1: Signal TWL reset
bit2: Signal TWL power off
bit3: Signal TWL battery low
bit4: Signal TWL battery empty
bit5: Signal TWL volume button click
|-
| 0x22
| d
| wo
| Used to turn on or turn off LCD-related boost circuits. Bits 5:2 can be read back so see whether backlight setting is in progress or not, however bits 1:0 get cleared as soon as the request gets acknowledged.
bit0: LCD panel voltage off
bit1: LCD panel voltage on
bit2: Bottom screen backlight off
bit3: Bottom screen backlight on
bit4: Top screen backlight off
bit5: Top screen backlight on

Bits 4 and 5 have no effect on a 2DS because the backlight source is the bottom screen.
The rest of the bits are masked away.
|-
| 0x23
| d
| wo
| Writing 0x72 ('r') resets the MCU, but this is stubbed on retail?
|-
| 0x24
| s
| rw
| Watchdog timer. This must be set *before* the timer is triggered, otherwise the old value is used. Value zero disables the watchdog.
|-
| 0x25
| s
| rw
| ?
|-
| 0x26
| s
| rw
| ?
|-
| 0x27
| sd
| rw
| Raw volume slider state
|-
| 0x28
| s
| rw
| Brightness of the WiFi/Power LED
|-
| 0x29
| sd(5)
| rw
| Power mode indicator state (read-write)
1 = forced default blue
2 = sleep mode animation
3 = "power off" mode
4 = disable blue power LED and turn on red power LED
5 = disable red power LED and turn on blue power LED
6 = animate blue power LED off and flash red power LED
anything else = automatic mode
The other 4 bytes (32bits) affect the pattern of the red power LED (write only)
|-
| 0x2A
| s
| rw
| WiFi LED state, non-0 value turns on the WiFi LED, 4 bits wide
|-
| 0x2B
| s
| rw
| Camera LED state, 4bits wide,
0, 3, 6-0xF = off
1 = slowly blinking
2 = constantly on
3 = "TWL" mode
4 = flash once
5 = delay before changing to 2
|-
| 0x2C
| s
| rw
| 3D LED state, 4 bits wide
|-
| 0x2D
| 0x64
| wo
| This is used for [[MCURTC:SetInfoLEDPattern|controlling]] the notification LED (see [[MCURTC:SetInfoLEDPatternHeader]] as well), when this register is written. It's possible to write data here with size less than 0x64, and only that portion of the pattern data will get overwritten. Reading from this register only returns zeroes, so it's considered write-only. Writing past the size of this register seems to do nothing.
|-
| 0x2E
| s
| ro
| This [[MCURTC:GetInfoLEDStatus|returns]] the notification LED status when read (1 means new cycle started)
|-
| 0x2F
| s
| wo?
| ??? The write function for this register is stubbed.
|-
| 0x30
- 0x36
| ds
| rw
| RTC time (system clock). 7 bytes are read from this. The upper nibble of each byte encodes 10s (BCD), so each byte is post-processed with (byte & 0xF) + (10 * (byte >> 4)).
byte 0: seconds
byte 1: minutes
byte 2: hours
byte 3: current week (unused)
byte 4: days
byte 5: months
byte 6: years
|-
| 0x37
| s
| rw
| RTC time byte 7: leap year counter / "watch error correction" register (unused in code)
|-
| 0x38
- 0x3C
| s
| rw
| RTC alarm registers
byte 0: minutes
byte 1: hours
byte 2: day
byte 3: month
byte 4: year
|-
| 0x3B
| s
| rw
| Could be used on extremely old MCU_FIRM versions to upload [[MCU_Services#MCU_firmware_versions|MCU firmware]] if reg 0xF == 0 and reg 0x10 == 1 (presumably major and minor version fields for mcufw 0.1 which largely predates factory firm).
|-
| 0x3D
0x3E
| ds
| ro
| RTC tick counter / "ITMC" (when resets to 0 the seconds increase)
Only reading 0x3D will update the in-RAM value
|-
| 0x3F
| d
| wo
| 2 bits
bit0: Asserts RESET1 (P0.0 = 0, PM0.0 = 0 (output)) but does NOT deassert it (wtf?). This seems to kill the entire SoC: is it because it doesn't deassert it, or does it not deassert it because the SoC hangs anyway? This is the pin that controls some security-critical regs like CFG9_BOOTENV!
bit1: turns on a prohibited bit in an RTC Control register and turns P12 into an output
|-
| 0x40
| s
| rw
| Tilt sensor sampling mode. Bits 0 and 1 control the mode. If bits 0 or 1 are set then the tilt sensor is enabled and sampled.
|-
| 0x41
| s
| rw
| Index selector for register 0x44
|-
| 0x42
| s
| rw
| Unused?
|-
| 0x43
| s
| rw
| Unused???, accelometer related
|-
| 0x44
| s
| rw
| ???, pedoometer related(?)
|-
| 0x45
- 0x4A
| s
| ro
| Tilt sensor 3D rotation from the 12bit ADC, left shifted 4 to fit in a 16bit signed short, relative to the 3DS bottom screen
{| class="wikitable" border="1"
! AXIS
! V=0x00
! V=0x40
! V=0xC0
|-
| X (left/right)
| held up vertically
| rotated left 90° like a steering wheel
| rotated right 90° like a steering wheel
|-
| Y (forwards/backwards)
| laid flat on the desk with the screen facing up
| held up vertically
| held up vertically with screen facing upside-down
|-
| Z (???)
| ???
| ???
| ???
|}
|-
| 0x4B
| s
| rw
| PedometerStepCount (for the current day)
|-
| 0x4C
0x4D
| ??
| ??
| ??
|-
| 0x4E
| d
| rw
| ??? this = (0xFFE9E & 1) ? 0x10 : 0
|-
| 0x4F
| d(6)
| ro
|
|-
| 0x50
| s
| rw
| ???
|-
| 0x51
| s
| rw
| ???
|-
| 0x52
- 0x57
| s
| rw
| ?
|-
| 0x58
| s
| rw
| Register-mapped ADC register
DSP volume slider 0% volume offset (setting this to 0xFF will esentially mute the DSP as it's the volume slider's maximum raw value)
|-
| 0x59
| s
| rw
| Register-mapped ADC register
DSP volume slider 100% volume offset (setting both this and the above to 0 will disable the volume slider with 100% volume, setting this to a lower value than the above will make the volume slider have only 2 states; on and off)
|-
| 0x5A
| s
| ro/rw
| Invalid, do not use! On newer MCU_FIRM versions this is unused, but on older MCU_FIRM versions this is a read-only counter.
|-
| 0x5B
- 0x5F
| s
| -
| These registers are out of bounds (0xFFC00 and up), they don't exist, writing is no-op, reading will yield FFs.
|-
| 0x60
| d
| rw
| Free register bank address (index) select
Selects the index to read from in the free register bank, up to 200. Used in conjunction with reg 0x61.

byte 0: bit0 = "WirelessDisabled", bit1 = "SoftwareClosed", bit2 = "PowerOffInitiated", bit3 = "LgyNativeResolution", bit4 = "LegacyJumpProhibited"
byte 1: Legacy LCD data
bytes 2 and 3: Local Friend Code counter
bytes 4 and 5: UUID clock sequence
bytes 6 and 7: Unused
bytes 8 to 175: Playtime data for legacy titles
bytes 176 to 188: Temporary playtime data in case console doesn't shut down gracefully, updated every 5 minutes
bytes 188 to 199: Unused
|-
| 0x61
| d(200)
| rw
| Free register bank, data is read from/written to here.

Accessing N bytes of this register increments the selected index by N.
|-
| 0x62 - 0x7E
| s
| -
| These registers don't exist, writing is no-op, reading will yield FFs.
|-
| 0x7F
| d(9-0x13)
| ro
| Various system state information (debug pointer table)
byte 0x00: Console type, see [[Configuration_Memory#MCU_HW_INFO|here]]
byte 0x01: PMIC vendor code
byte 0x02: Battery vendor code
byte 0x03: MGIC version (major?)
byte 0x04: MGIC version (minor?)
byte 0x05: RCOMP(?)
byte 0x06: battery related? (seems to decrease while charging and increase while discharging)
byte 0x09: system model (see [[Cfg:GetSystemModel#System_Model_Values|Cfg:GetSystemModel]] for values)
byte 0x0A: Red Power LED mode (0 = off, 1 = on)
byte 0x0B: Blue Power LED intensity (0x00 - 0xFF)
byte 0x0D: RGB LED red intensity
byte 0x0E: RGB LED green intensity
byte 0x0F: RGB LED blue intensity
byte 0x11: WiFi LED brightness
byte 0x12: always 0?

On MCU_FIRM major version 1 the size of this is 9, reading past the 9th byte will yield AA instead of FF.
|-
| 0x80
- 0xFF
| s
| -
| These registers don't exist, writing is no-op, reading will yield FFs.
|}

Shared register: the letter "s" means that the given register is in a "shared register pool", meaning the resgister is in the register pool in RAM at address <code>0xFFBA4 + registernumber</code>.

Dynamic register: these registers aren't in the shared pool, they just "pretend" to be there. These registers often don't retain their set value, change rapidly, or control various hardware.

Non-shared (dynamic) register: it's a register whose contents separate from the shared register pool. Messing with these registers will not affect the shared register pool at all.

On old versions of MCU_FIRM none of the invalid registers are masked away by the read handler function, but are still read-only. Newer MCU_FIRM versions return the hardcoded value FF instead.

== Device 5 & 6 ==
These are the chip-on-glass display controllers, also known as I2CLCD.

=== Shared registers ===
These registers are the same across all known I2CLCD controllers (except Controller ID 0x00).

{| class="wikitable" border="1"
! Register
! Name
! Valid bits
! Description
|-
| 0x01
| Display enable
| 0x11
| Values:

- 0x00 - screen off, slow burn-in
- 0x01 - screen off, fast burn-in
- 0x10 - screen on, color input used
- 0x11 - screen on, color input not used, High-Z (display turns black or white depending on interface config)
|-
| 0x40
| Read address
|
| Write to this register to set the read address.

Reading from I2CLCD is non-standard. When you read, it returns pairs of the currently read address, and then the data byte at that address. The read address auto-increments.
|-
| 0x54
| Checksum? trigger
| 0x01
| When transitioning bit0 from 0 to 1, it seems to trigger some sort of checksum calcuation. Broken on controller 0x01, where it's oneshot.
|-
| 0x55
| ???
| 0x03 (all) /
0x07 (2DS)
| Unknown. When toggling 0x54 bit0 from 0 to 1, this register gets changed to 0x01 (all) / 0x05 (2DS).

This register is sometimes seen with a value of 0x02 at initialization time on the top screen.
|-
| 0x56
| Checksum?
|
| Unknown. Read-writable with no effect (old3DS) / read-only (all).

A random value is written here when 0x54 bit0 is changed from 0 to 1. Constantly updates with a seemingly random value, except on Controller ID 0x01, where it's oneshot/bugged.
|-
| 0x60
| ???
| 0x01
| Unknown. 0x00 is written here during init. Seems to have no effect.
|-
| 0x61
| Register checksum
|
| Some - but not all - register values are combined using an unknown algorithm into this register.
It's unknown which registers influence this value, as some registers which influence this value are read-only.
|-
| 0x62
| ???
| 0x01
| Unknown, does nothing on known controllers. During init, gsp waits for this to become 0x01.
|-
| 0xFE
| ???
|
| Unknown, does nothing. 0xAA is written here during init.
|-
| 0xFF
| Controller ID
|
| Upper 4bits is manufacturer. Lower 4bits is unknown, most likely revision, possibly encoded as a Johnson counter. The fields are encoded this way, most likely for the register checksum feature.

Manufacturers:
- 0x0 - SHARP (LTPS(?) TN), old I2CLCD, found in old3DS (non-XL) only
- 0x1 - JDI (LTPS IPS), found in select new3DS and new3DSXL consoles
- 0xC - SHARP (LTPS(?) TN), new I2CLCD
- 0xE - SHARP (TFT), found in 2DS only

Known IDs:
- 0xC7 - new3DS, new3DSXL, new2DSXL, and some select newer old3DSXL
- 0xC3 - older old3DSXL
- 0xE1 - 2DS
- LQ050B1LW10B
- LQ = normal TFT
- 050 = panel 5 inches diagonal
- B = "other" display format
- 1 = transmissive (backlight-compatible)
- L = LVDS
- W = *unknown coating type*
- 10 = model number
- B = *unknown suffix*
- 0x10 - some select new3DS and new3DSXL with IPS screens
- 0x01 - old3DS
- LS035T7LE38P (top screen)
- LS = TFT (LTPS or SI-TFT ?)
- 035 = panel 3.5 inches diagonal
- T = "other 16:9" (even though the panel is 16:10 in physical size, or 32:10 in terms of pixel count)
- 7 = *unknown backing type*
- L = LVDS
- E = *unknown coating type*
- 38 = model number
- P = *unknow suffix*
- LS030Q7DW48P (bottom screen)
- LS = TFT (LTPS or SI-TFT ?)
- 030 = panel 3 inches diagonal
- Q = QVGA (320x240)
- 7 = *unknown backing type*
- D = parallel RGB (unspecified, but it's known to be RGB888 for this display)
- W = *unknown coating type*
- 48 = model number
- P = *unknow suffix*
- 0x00 - no controller, or dead (I2CLCD always ACKs reads, but returns 00 if dead)
|}

=== Custom registers for controller 0x00 ===
This Controller ID is fully unknown, and the only reason we know about its existance is due to gsp having special handling code for it.

{| class="wikitable" border="1"
! Register
! Name
! Valid bits
! Description
|-
| 0x11
| ???
|
| Unknown. Write 0x10 to initialize.
|-
| 0x50
| ???
|
| Unknown. Write 0x01 to initialize.
|}

=== Custom registers for controller 0x01 ===

{| class="wikitable" border="1"
! Register
! Name
! Valid bits
! Description
|-
| 0x10
| Interface config
| 0xF7
| Regonfigures the input pins and pin behavior of the controller.

bit0 - color value invert (D = ~D, or D = 255 - D)
bit1 - color format remap (D7:D2 <-- D5:D0, that is left shift color data by 2)
bit2 - ???
bit4 - ???
bit5 - ???
bit6 - ???
bit7 - DS-style undriven screen (it will be white instead of black, see shared register 0x01)
|-
| 0x11
| Image config
| 0x7F
| Image filters and pixel clock control.

bit0 - Horizontal Flip (scan from right to left)
bit1 - red-blue swap
bit2 - ???
bit3 - ???
bit4 - ???
bit5 - ???
bit6 - ???
|-
| 0x1D
| ???
| 0x0F
| Unknown, bit0 enables registers 0x12 to 0x19 to control some analog timing controls to the display panel itself.
|-
| 0x50
| ???
| 0x11
| Unknown. Has no effect on bottom screen. On the top screen, bit4 blanks out the display (LVDS disable?).
|-
| 0x53
| ???
| 0x73
| Unknown. While other bits seem to have no effect, bit0 kills the controller until a power cycle.
|}

=== Custom registers for controller 0xC3 ===
Basically the same as Controller ID 0xC7.

=== Custom registers for controller 0xC7 ===
This is the most common non-old3DS display controller. Quite overclockable.

Note: on the 0xC7 controller unlocking the factory controls at register 0x03 glitches out most of the standard controls (like registers 0x50 to 0x56), so use with caution.

{| class="wikitable" border="1"
! Register
! Name
! Valid bits
! Description
|-
| 0x03
| Factory key 2
|
| Write 0xAA here to unlock a second set of factory controls.
|-
| 0xAF
| Factory key
|
| Write 0xAA here to unlock factory controls.
|}

Factory mode registers for unlock register 0x03:
{| class="wikitable" border="1"
! Register
! Name
! Valid bits
! Description
|-
| 0x10
| Image control?
| 0xD7
| Most bits are unknown.

bit0 - color invert
bit1 - slight gamma increase
|-
| 0x11
| Image transform?
| 0x7F
| Mostly unknown.
bit0 - Invert horizontal scan direction (0 = left to right, 1 = right to left)
bit1 - red-blue swap
bit2 - Invert vertical scan direction (0 = top to bottom, 1 = bottom to top)
bit3 - Invert the order of each scanline pair (might be needed if bit2 is toggled)
bit4 - Enable interlaced signal (use bit3 to swap fields)
bit5 - ???
bit6 - ???
|-
| 0x70-0x83
| Color curve red
| rowspan=3 |
| rowspan=3 | These registers are used for fine-tuning the analog driving curve of the screen

Positive:
- byte 00 (0xFF) - ???
- byte 01 (0xFF) - ???
- byte 02 (0x3F) - ???
- byte 03 (0x3F) - ???
- byte 04 (0x3F) - ???
- byte 05 (0x3F) - ???
- byte 06 (0x3F) - ???
- byte 07 (0x3F) - ???
- byte 08 (0x3F) - ???
- byte 09 (0x3F) - ???

Negative:
- byte 10 (0xFF) - ???
- byte 11 (0xFF) - ???
- byte 12 (0x3F) - ???
- byte 13 (0x3F) - ???
- byte 14 (0x3F) - ???
- byte 15 (0x3F) - ???
- byte 16 (0x3F) - ???
- byte 17 (0x3F) - ???
- byte 18 (0x3F) - ???
- byte 19 (0x3F) - ???
|-
| 0x84-0x97
| Color curve green
|-
| 0x98-0xAB
| Color curve blue
|}

=== Custom registers for controller 0xE1 ===
This controller is designed to drive a split panel. As such, the factory controls have been slightly altered to accomodate this.

This is the only I2CLCD which responds on both I2CLCD addresses. The dominant screen is the bottom one.

Most registers are similar to controller 0xC7, but there are some differences due to the split shared panel nature.

{| class="wikitable" border="1"
! Register
! Name
! Valid bits
! Description
|-
| 0x03
| Factory key 2
|
| Write 0xAA here to unlock a 2nd set of factory controls.
|-
| 0xAF
| Factory key
|
| Write 0xAA here to unlock factory controls.
|}

Factory mode registers for unlock register 0x03:
{| class="wikitable" border="1"
! Register
! Name
! Valid bits
! Description
|-
| 0x10
| Image control?
| 0xD7
| Most bits are unknown. This applies to the whole display panel.

bit0 - color invert
bit1 - slight gamma increase
|-
| 0x11
| Image transform
| 0x33
|
bit0 - top half horizontal flip
bit1 - top half red-blue swap
bit4 - bottom half horizontal flip
bit5 - bottom half red-blue swap
|-
| 0x70-0x83
| Analog curve top
| rowspan=2 |
| rowspan=2 | Consists of two unknown curve values. Seems to be nonstandard.

Pair 1:
byte 00 (0xFF) - ???
byte 01 (0xFF) - ???
byte 02 (0xFF) - ???
byte 03 (0xFF) - ???
byte 04 (0x3F) - ???
byte 05 (0x3F) - ???
byte 06 (0x3F) - ???
byte 07 (0x3F) - ???
byte 08 (0x3F) - ???
byte 09 (0x3F) - ???

Part 2:
byte 10 (0xFF) - ???
byte 11 (0xFF) - ???
byte 12 (0xFF) - ???
byte 13 (0xFF) - ???
byte 14 (0x3F) - ???
byte 15 (0x3F) - ???
byte 16 (0x3F) - ???
byte 17 (0x3F) - ???
byte 18 (0x3F) - ???
byte 19 (0x3F) - ???
|-
| 0x84-0x97
| Analog curve bottom
|}

=== Custom registers for controller 0x10 ===
JDI IPS controller.

Warning: on the JDI controller, unlocking any of the factory mode registers overshadows some other registers, so don't write to "standard" locations (other than register 0x40) before locking factory mode back!

{| class="wikitable" border="1"
! Register
! Name
! Valid bits
! Description
|-
| 0x03
| Factory key 2
|
| Write 0xAA here to unlock advanced IPS curve controls.
|-
| 0xAF
| Factory key
|
| Write 0xAA here to unlock factory controls.
|}

Factory mode registers unlocked by register 0xAF:
* 0x41 - 0x4F
* 0x58 - 0x5F
* 0x67 - 0x6F
* 0xD0 - 0xEF
* unknown...

Factory mode registers unlocked by register 0x03:
* 0x04 - 0x0F
* unknown...
{| class="wikitable" border="1"
! Register
! Name
! Valid bits
! Description
|-
| 0x70-0x7F
| Driving curve 1-1
|
|
|-
| 0x80-0x8F
| Driving curve 1-2
|
|
|-
| 0x90-0x9F
| Driving curve 2-1
|
|
|-
| 0xA0-0xAF
| Driving curve 2-2
|
|
|-
| 0xB0-0xBF
| Driving curve 3-1
|
|
|-
| 0xC0-0xCF
| Driving curve 3-2
|
|
|}

== Device 10 ==
See the datasheet linked to on the [[Hardware]] page for reference.

== Device 11 ==
See the datasheet linked to on the [[Hardware]] page for reference.

== Device 12 ==
{| class="wikitable" border="1"
! REGISTER
! WIDTH
! DESCRIPTION
|-
| 0x0
| 21
| DebugPad state.
|}

This is a [https://wiibrew.org/wiki/Wiimote/Extension_Controllers/Classic_Controller_Pro Wii Classic Controller Pro] which was slightly modified to have an encrypted device type of 0xF0 [https://wiibrew.org/wiki/Wiimote/Extension_Controllers#The_New_Way instead of 0xFD].

See [[HID_Shared_Memory#Offset_0x238|here]] for the HID shared memory report format.

== Device 13 ==
{| class="wikitable" border="1"
! Raw I2C register address
! Internal register address
! Width
! Description
|-
| 0x0
| 0x0
| 0x40
| RHR / THR (data receive/send FIFO)
|-
| 0x8
| 0x1
| 0x1
| IER
|-
| 0x10
| 0x2
| 0x1
| FCR/IIR
|-
| 0x18
| 0x3
| 0x1
| LCR
|-
| 0x20
| 0x4
| 0x1
| MCR
|-
| 0x28
| 0x5
| 0x1
| LSR
|-
| 0x30
| 0x6
| 0x1
| MSR/TCR
|-
| 0x38
| 0x7
| 0x1
| SPR/TLR
|-
| 0x40
| 0x8
| 0x1
| TXLVL
|-
| 0x48
| 0x9
| 0x1
| RXLVL
|-
| 0x50
| 0xA
| 0x1
| IODir
|-
| 0x58
| 0xB
| 0x1
| IOState
|-
| 0x60
| 0xC
| 0x1
| IoIntEna
|-
| 0x68
| 0xD
| 0x1
| reserved
|-
| 0x70
| 0xE
| 0x1
| IOControl
|-
| 0x78
| 0xF
| 0x1
| EFCR
|}

See the [http://www.alldatasheet.net/datasheet-pdf/pdf/347838/NXP/SC16IS750IBS.html datasheet] linked to on the [[Hardware]] page for reference. From that datasheet, for the structure of the I2C register address u8: "Bit 0 is not used, bits 2:1 select the channel, bits 6:3 select one of the UART internal registers. Bit 7 is not used with the I2C-bus interface, but it is used by the SPI interface to indicate a read or a write operation."

== Device 14 ==

Used by [[Config_Services|Cfg]]-sysmodule via the i2c::EEP service. This is presumably EEPROM going by the service name.

The Cfg-module code which loads the [[Flash_Filesystem|CCAL]](nandro:/sys/{HWCAL0.dat/HWCAL1.dat}) file from NAND will load it from I2C instead, if a certain state flag is non-zero. Likewise for the function which writes CCAL to NAND. HMAC/hash verification after loading is skipped when the CCAL was loaded from I2C.

== Device 15 ==
This the New3DS [[NFC_Services|NFC]] controller "I2C" interface. This device is accessed via the WriteDeviceRaw/ReadDeviceRaw I2C service [[I2C_Services|commands]].

Since the *Raw commands are used with this, this device has no I2C registers. Instead, raw data is transfered after the I2C device is selected. Hence, WriteDeviceRaw is used for sending commands to the controller, while ReadDeviceRaw is for receiving responses from the controller. Certain commands may return multiple command responses.

Command request / response structure:
{| class="wikitable" border="1"
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Normally 0x10?
|-
| 0x1
| 0x1
| Command source / destination.
|-
| 0x2
| 0x1
| CmdID
|-
| 0x3
| 0x1
| Payload size.
|}

Following the above header is the payload data(when payload size is non-zero), with the size specified in the header. The command response payload is usually at least 1-byte, where that byte appears to be normally 0x0. For command requests the payload data is the command parameters.

For command requests sent to the NFC tag itself, Cmd[1]=0x0 and CmdID=0x0. The command request payload data here is the actual command request data for the NFC tag, starting with the CmdID u8 at payload+0.

During NFC module startup, a certain command is sent to the controller which eventually(after various cmd-reply headers etc) returns the following the payload after the first byte in the payload:
000000: 44 65 63 20 32 32 20 32 30 31 32 31 34 3a 35 33 Dec 22 201214:53
000010: 3a 35 30 01 05 0d 46 05 1b 79 20 07 32 30 37 39 :50...F..y .2079
000020: 31 42 35 1B5

Or that is: "Dec 22 201214:53:50<binary>20791B5". Therefore, this appears to return the part-number of the NFC controller(other command request(s) / response(s) use this part-number value too).

=== NFC controller commands ===
{| class="wikitable" border="1"
! CmdRequest[1]
! CmdID
! Payload data for parameters
! Description
|-
| 0x2E
| 0x2F
| Firmware image for this chunk, size varies.
| This is used during NFC module startup to upload the firmware image to the NFC controller. This is used repeatedly to upload multiple chunks of the image.
|}

== Device 17 ==

(Stub)

Used by New 3DS for ZL, ZR, C stick

This device do not use registers. After writing the address, read the next several bytes.

{| class="wikitable" border="1"
! Offset
! Description
|-
| 0x0
| Fixed 0x80
|-
| 0x1
| Buttons (ZL = 0x4, ZR = 0x2)
|}

Config Savegame

2024-06-04T21:27:55Z

TuxSH: /* Configuration blocks */

This page describes the format of the [[Config_Services|Cfg]] [[System_SaveData|NAND]] savegame. These blocks can be accessed with the Cfg service commands.

==Structure of save-file "/config"==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| Total entries
|-
| 0x2
| 0x2
| Data entries offset
|-
| 0x4
| 0x4558
| Block entries
|-
| 0x455C
|
| Data for the entries
|}

The filesize for this /config file is 0x8000-bytes.

==Configuration block entry ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| BlkID
|-
| 0x4
| 0x4
| Offset to the data for this block when size is >4, otherwise this word is the data for this block
|-
| 0x8
| 0x2
| Size
|-
| 0xA
| 0x2
| Access Flags
|}

===Access Flags===
{| class="wikitable" border="1"
|-
! Bit Mask
! Description
|-
| 0x2
| User Readable (cfg:u)
|-
| 0x4
| System Writable (cfg:s / cfg:i)
|-
| 0x8
| System Readable (cfg:s / cfg:i)
|}

Config blocks will typically either use 0xC for system readable/writable or 0xE for all 3.

==Configuration blocks==
{| class="wikitable" border="1"
|-
! BlkID
! Size
! Access Flags
! Description
|-
| 0x00000000
| 0x2
| 0xC
| Config savegame version?
|-
| 0x00010000
| 0x1
| 0xC
| [[Hardware_calibration#RTC|RTC compensation value]]
|-
| 0x00020000
| 0x134
| 0xC
| [[Hardware_calibration#CDC|Codec]]
|-
| 0x00030000
| 0x1
| 0xC
| Leap Year Counter (read By PTM)
|-
| 0x00030001
| 0x8
| 0xE
| User time offset (read by CECD): displayed timestamp - rtc timestamp
|-
| 0x00030002
| 0x8
| 0xC
| Settings time offset: newly set timestamp - rtc timestamp
|-
| 0x00040000
| 0x10
| 0xC
| [[Hardware_calibration#Touch|Touch calibration]] (read by HID)
|-
| 0x00040001
| 0x1C
| 0xC
| Analog Stick Calibration Param?(read by HID)
|-
| 0x00040002
| 0x12
| 0xC
| [[Hardware_calibration#Gyro|Gyroscope]] (read by HID)
|-
| 0x00040003
| 0xC
| 0xC
| [[Hardware_calibration#Accel|Accelerometer]] (read by HID)
|-
| 0x00040004
| 0x1C
| 0xC
| [[Hardware_calibration#CStick|CStick calibration data]]
|-
| 0x00050000
| 0x2
| 0xC
| [[Hardware_calibration#Screen_flicker|Screen flicker]]
|-
| 0x00050001
| 0x2
| 0xC
| Backlight controls (u8 ABL_powersave_enable, u8 brightness_level) (read by GSP)
|-
| 0x00050002
| 0x38
| 0xC
| [[Hardware_calibration#BLPWM|Backlight PWM]] (read by GSP)
|-
| 0x00050003
| 0x20
| 0xC
| [[Hardware_calibration#ABL|Power saving mode (ABL) calibration]] (read by GSP)
|-
| 0x00050004
| 0x20
| 0xC
| [[Hardware_calibration#ABL|Power saving mode (ABL) calibration]] (for legacy FIRM)
|-
| 0x00050005
| 0x20
| 0xE
| Stereo display settings (HWCAL block 0x470)
|-
| 0x00050006
| 0x2
| 0xC
| [[Hardware_calibration#ULCD_delay|3D switching delay]]
|-
| 0x00050007
| 0x4
| 0xC
| ?
|-
| 0x00050008
| 0x10C
| 0xC
| [[Hardware_calibration#ABL_extra|Power saving mode (ABL) extra config]]
|-
| 0x00050009
| 0x8
| 0xC
| new3DS only(?) backlight control (5th byte: auto-brightness enable)
|-
| 0x00060000
| 0x96
| 0xC
| ??? (HWCAL block 0x500)
|-
| 0x00070000
| 0x214
| 0xE
| [[Hardware_calibration#3D_filters|3D filters]]
|-
| 0x00070001
| 0x1
| 0xE
| Sound output mode (mono=0, stereo=1, surround=2)
|-
| 0x00070002
| 0x8
| 0xE
| [[Hardware_calibration#Microphone_echo_cancel|Microphone echo cancellation params]]
|-
| 0x00080000
| 0xC00
| 0xC
| WiFi configuration slot 0
|-
| 0x00080001
| 0xC00
| 0xC
| WiFi configuration slot 1
|-
| 0x00080002
| 0xC00
| 0xC
| WiFi configuration slot 2
|-
| 0x00090000
| 0x8
| 0xE
| This contains a u64 ID, used by processes using [[NWMUDS:InitializeWithVersion]]. The first word is the same as [[CfgS:GetLocalFriendCodeSeed|LocalFriendCodeSeed]], while the latter is a separate word.
|-
| 0x00090001
| 0x8
| 0xE
| Same content as 0x0009000? This console-unique u64 is used by [[Cfg:GenHashConsoleUnique|GenHashConsoleUnique]]. It is generated by <code>((0x3FFFFFFFF) & LocalFriendCodeSeed) | (random16 << 48))</code>, where random16 is generated by [[PSPXI:GenerateRandomBytes|GenerateRandomBytes]]
|-
| 0x00090002
| 0x4
| 0xE
| The first two bytes are the same random16 used in 0x00090001. The second two bytes are zeros.
|-
| 0x000A0000
| 0x1C
| 0xE
| [[#User Name Block 0x000A0000|User Name]]
|-
| 0x000A0001
| 0x2
| 0xE
| Birthday (u8 month, u8 day)
|-
| 0x000A0002
| 0x1
| 0xE
| Language
|-
| 0x000B0000
| 0x4
| 0xE
| CountryInfo
|-
| 0x000B0001
| 0x800
| 0xE
| Country name in UTF-16, every 0x80-bytes is an entry for each language, in the order of the Language table below (not all entries are set)
|-
| 0x000B0002
| 0x800
| 0xE
| State name in UTF-16, every 0x80-bytes is an entry for each language
|-
| 0x000B0003
| 0x4
| 0xE
| Coordinates. A pair of s16 represents latitude and longitude, respectively. One need to multiply both value by 180/32768 to get coordinates in degrees

|-
| 0x000C0000
| 0xC0
| 0xE
| [[#Parental Control Settings Block 0x000C0000|Parental Controls - Main data]]
|-
| 0x000C0001
| 0x14
| 0xE
| COPPACS restriction data
|-
| 0x000C0002
| 0x200
| 0xE
| [[#Parental Control Settings Block 0x000C0002|Parental Controls - Registered e-Mail address and custom secret question]]
|-
| 0x000D0000
| 0x4
| 0xE
| u16 at offset 0x0: [[SMDH#EULA_Version|EULA Version]] which was agreed to. u16 @ 0x02: latest version
|-
| 0x000E0000
| 0x1
| 0xE
| ? (related to SpotPass options in Internet Settings?)
|-
| 0x000F0000
| 0x10
| 0xC
| Debug configuration, read by [[NS]] on dev-units: on startup, NS does <code>svcKernelSetState(6, 1, (u64)debug_flags & 1);
svcKernelSetState(6, 2, (u64)debug_flags & 2);</code> (see [[SVC#KernelSetState|here]]) where <code>debug_flags</code> is the u32 located at offset 0xC in this struct. Then it compares the u32 from +8 in this config-block with the [[Configuration_Memory#APPMEMTYPE|APPMEMTYPE]]. When those don't match NS starts a FIRM-launch (with the same FIRM titleID as the currently running one) to boot into a FIRM with the APPMEMTYPE value from this config-block. The byte at offset 0x0 is related to the memtype as well.
|-
| 0x000F0001
| 0x8
| 0xC
| ?
|-
| 0x000F0003
| 0x1
| 0xC
| Home Menu button disable
|-
| 0x000F0004
| 0x4
| 0xC
| The first u8 is the System-Model [[Cfg:GetSystemModel|value]], the last 3-bytes are unknown
|-
| 0x000F0005
| 0x4
| 0xC
| The first u8 indicates whether network updates are enabled (however, NIM only checks this flag with developer [[Configuration_Memory#ENVINFO|ENVINFO]]).
|-
| 0x000F0006
| 0x28
| 0xC
| In NIM, taken as a (hopefully null terminated) string used for the "X-Device-Token" http header field for NPNS url.
|-
| 0x00100000
| 0x2
| 0xC
| TWL EULA info ({bool agreed; u8 agreedVersion})
|-
| 0x00100001
| 0x94
| 0xC
| Stores Parental Restrictions PIN/Secret Answer and other info for TWL mode
|-
| 0x00100002
| 0x1
| 0xC
| TWL country code
|-
| 0x00100003
| 0x10
| 0xC
| TWL movable unique ID, used for DSiWare exports
|-
| 0x00110000
| 0x4
| 0xC
| The low u16 indicates whether the system setup is required, such as when the system is booted for the first time or after doing a [[System Settings|System Format]]: 0 = setup required, non-zero = no setup required
|-
| 0x00110001
| 0x8
| 0xC
| TitleID of the menu to launch, used by [[NS]] on dev units (this block can be edited on dev units with [[3DS Development Unit Software#Config|Config]])
|-
| 0x00120000
| 0x8
| 0xC
| Volume Slider Bounds (Read by HID and PTM)
|-
| 0x00130000
| 0x4
| 0xE
| If response is 0x100 then debug mode is enabled.
|-
| 0x00150000
| 0x4
| 0xC
| Clock Sequence (u16) used for generating UUIDs in [[ACT_Services|ACT]].
|-
| 0x00150001
| 0x8
| 0xC
| ?
|-
| 0x00150002
| 0x4
| 0xE
| In NIM, taken as an u32, using the low u16, casted to a char, and turned lower case for the making of the url for NPNS.
|-
| 0x00160000
| 0x4
| 0xE
| Unknown, first byte is used by config service-cmd [[Config_Services|0x00070040]]. (Unknown whether the last 3-bytes are used)
|-
| 0x00170000
| 0x4
| 0xE
| Miiverse (OLV) access key
|-
| 0x00180000
| 0x4
| 0xC
| QTM Infrared LED related, can be 0 or 1
|-
| 0x00180001
| 0x18
| 0xC
| [[Hardware_calibration#QTM|QTM calibration data]]
|-
| 0x00190000
| 0x1
| 0xC
| Unknown. NFC-module checks for value1/non-value1.
|}

The developer unit TID block only exists on developer units.

===Stereo Display Settings===
All values are hard-coded in cfg module.
{| class="wikitable" border="1"
|-
! Offset
! Size
! Value
! Description
|-
| 0x0
| 4
| 62.0f
|assumed pupillary distance in mm?
|-
| 0x4
| 4
| 289.0f
|assumed distance in mm between player's eyes and upper screen?
|-
| 0x8
| 4
| 76.80f
|width in mm of (old) 3DS upper screen (doesn't vary for different models?)
|-
| 0xC
| 4
| 46.08f
|height in mm of (old) 3DS upper screen (doesn't vary for different models?)
|-
| 0x10
| 4
| 10.0f
|
|-
| 0x14
| 4
| 5.0f
|
|-
| 0x18
| 4
| 55.58f
|
|-
| 0x1C
| 4
| 21.57f
|
|}

===Languages===
{| class="wikitable" border="1"
|-
! ID
! Description
|-
| 0
| JP
|-
| 1
| EN
|-
| 2
| FR
|-
| 3
| DE
|-
| 4
| IT
|-
| 5
| ES
|-
| 6
| ZH
|-
| 7
| KO
|-
| 8
| NL
|-
| 9
| PT
|-
| 10
| RU
|-
| 11
| TW
|}

===CountryInfo===
{| class="wikitable" border="1"
|-
! Byte
! Description
|-
| 0
|?
|-
| 1
|?
|-
| 2
| State/Province code.
|-
| 3
| Country code, same as DSi/Wii country codes. Value 0xFF is invalid.
|}

===User Name Block 0x000A0000===
{| class="wikitable" border="1"
|-
! Byte
! Description
|-
| 0x00-0x15
| User name (UTF-16)
|-
| 0x16-0x17
| u16 NGWord flag to denote that the user name is inappropriate
|-
| 0x18-0x1B
| u32 NGWord version the username was last checked with. If this value is less than the u32 stored in the NGWord CFA "romfs:/version.dat", the system then checks the username string with the bad-word list CFA again, then updates this field with the value from the CFA
|}

While the user name is NULL-terminated, the terminator is not applied when the user name is 10 characters long, which leads to online access breaking (002-0109) and buffer overflows when the user name is retrieved, even in DS games.

===WiFi Slot Structure===

====Network structure====
This is used twice in the actual WiFi slot structure.
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Whether the network was set or not?
|-
| 0x1
| 0x1
| Whether to use this network strucutre to connect?
|-
| 0x2
| 0x1
| Whether this structure is the first (0) or the second (1) in the larger WiFi slot structure?
|-
| 0x3
| 0x1
| Padding ?
|-
| 0x4
| 0x20
| SSID of the network, without a trailing nullbyte.
|-
| 0x24
| 0x1
| Length of the SSID.
|-
| 0x25
| 0x1
| [[Nintendo_Zone#Beacon_payload_format|AP crypto key type]]
|-
| 0x26
| 0x2
| Padding ?
|-
| 0x28
| 0x40
| Plaintext of the passphrase of the network, without a trailing nullbyte.
|-
| 0x68
| 0x20
| PBKDF2 of the passphrase and SSID (http://jorisvr.nl/wpapsk.html).
|-
|}

====Actual structure====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| ?
|-
| 0x2
| 0x2
| [https://github.com/lammertb/libcrc/blob/v2.0/src/crc16.c#L43-L76 CRC-16 checksum] of the next 0x410 bytes.
|-
| 0x4
| 0x88
| First network structure. Only set if the network was set "normally", or was the last to be set using WPS during the session.
|-
| 0x8C
| 0x20
| Padding.
|-
| 0xAC
| 0x88
| Second network structure. Only set if the network was set using WPS, otherwise 0-filled.
|-
| 0x134
| 0x20C
| Padding.
|-
| 0x340
| 0x1
| Whether to automatically get the IP address (use DHCP) or not, defaults to 1.
|-
| 0x341
| 0x1
| Whether to automatically get the DNS or not, defaults to 1.
|-
| 0x342
| 0x2
| Padding ?
|-
| 0x344
| 0x4
| IP address, to use if 0x340 is false.
|-
| 0x348
| 0x4
| IP address of the gateway, to use if 0x340 is false.
|-
| 0x34C
| 0x4
| Subnetwork mask, to use if 0x340 is false.
|-
| 0x350
| 0x4
| IP address of the primary DNS , to use if 0x341 is false.
|-
| 0x354
| 0x4
| IP address of the secondary DNS, to use if 0x341 is false.
|-
| 0x358
| 0x4
| Always 0x01050000 ? Only set if the network was the last to be set during the session.
|-
| 0x35C
| 0x4
| IP address to use. Only set if the network was the last to be set during the session.
|-
| 0x360
| 0x6
| MAC address of the AP. Only set if the network was the last to be set during the session.
|-
| 0x366
| 0x1
| Channel. Only set if the network was the last to be set during the session.
|-
| 0x367
| 0x1
| Padding ? Only set if the network was the last to be set during the session.
|-
| 0x368
| 0x1
| Whether to use a proxy or not, defaults to 0.
|-
| 0x369
| 0x1
| Whether to use a basic authentication for the proxy, defaults to 0.
|-
| 0x36A
| 0x2
| Port to use for the proxy, defaults to 1.
|-
| 0x36C
| 0x30
| URL/address of the proxy, including a trailing nullbyte.
|-
| 0x39C
| 0x34
| Padding.
|-
| 0x3D0
| 0x20
| Username to use for basic authentication, including a trailing nullbyte.
|-
| 0x3F0
| 0x20
| Password to use for basic authentication, including a trailing nullbyte.
|-
| 0x410
| 0x2
| Padding ?
|-
| 0x412
| 0x2
| MTU value, defaults to 1400 and ranges between 576 and 1500, inclusive.
|-
| 0x414
| 0x7EC
| Padding.
|-
|}

===LCD display config===
There seems to be some sort of LCD display configuration stored in this cfg. When using the cfg-save from an Old3DS on a New3DS without formatting the cfg first, the bottom-screen display is somewhat off(which is fixed by formatting the cfg-save).

===Parental Control Settings Block 0x00100001===
{| class="wikitable" border="1"
|-
! Byte
! Size in bytes
! Description
|-
| 0x0
| 0xD
| Unknown.
|-
| 0xD
| 0x4
| PIN
|-
| 0x11
| 0x40
| Secret Answer (UTF-16)
|}

===Parental Control Settings Block 0x000C0000===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x00
| 0x04
| [[#Parental Control Restriction Bitmask|Parental Control Restriction Bitmask]]
|-
| 0x04
| 0x04
| Unknown
|-
| 0x08
| 0x01
| Rating system used for configuration
|-
| 0x09
| 0x01
| Maximum allowed age (20 = No restriction)
|-
| 0x0A
| 0x01
| Secret Question Type (0-5: Pre-defined, 6: Custom)
|-
| 0x0B
| 0x01
| Unknown
|-
| 0x0C
| 0x08
| Parental Controls PIN code (with NULL-termination, although restricted to 4 digits)
|-
| 0x14
| 0x44
| Secret Answer (UTF-16)
|}

====Parental Control Restriction Bitmask====
{| class="wikitable" border="1"
|-
! Bit
! Restriction name
|-
| 0
| Global Parental Controls Enable
|-
| 1
| Internet Browser
|-
| 2
| Display of 3D Images (disabled on 2DS)
|-
| 3
| Sharing Images/Audio/Video/Long Text Data
|-
| 4
| Online Interaction
|-
| 5
| StreetPass
|-
| 6
| Friend Registration
|-
| 7
| DS Download Play
|-
| 8
| Nintendo 3DS Shopping Services (eShop / EC Applet)
|-
| 9
| View Distributed Videos
|-
| 10
| Miiverse (View)
|-
| 11
| Miiverse (Post)
|-
| 31
| "Child Online Privacy Protection" (see [[Cfg:GetRegionCanadaUSA|CFG:IsCoppacsSupported]])
|}

===Parental Control Settings Block 0x000C0002===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0000
| 0x0001
| Boolean, whether an e-Mail has been registered
|-
| 0x0001
| 0x0101
| Registered e-Mail address (Plaintext)
|-
| 0x0102
| 0x0068
| Custom Secret Question (UTF-16)
|}

Multi-threading

2023-08-19T08:45:48Z

TuxSH:

This page documents all kernel functionality for managing multiple processes and threads as well as handling synchronization between them.

= Processes =

Each process is given an array of [[NCCH/Extended_Header#ARM11_Kernel_Capabilities|kernel capability descriptors]] upon creation (see CreateProcess). Official software forwards the descriptors specified in the [[NCCH#Extended_Header|NCCH exheader]].

Any process can only use SVCs which are enabled in its kernel capability descriptors. This is enforced by the ARM11 kernel SVC handler by checking the syscall access control mask stored on the SVC-mode stack. If the SVC isn't enabled, a kernelpanic() is triggered. Each process has a separate SVC-mode stack; this stack and the syscall access mask stored here are initialized when the process is started. Applications normally only have access to SVCs <=0x3D, however not all SVCs <=0x3D are accessible to the application. The majority of the SVCs accessible to applications are unused by the application.

Each process has a separate handle-table, the size of which is stored in the kernel capability descriptor. The handles in a handle-table can't be used in the context of other processes, since those handles don't exist in other handle-tables.

0xFFFF8001 is a handle alias for the current process.

Calling svcBreak on retail will only terminate the process which called this SVC.

== Usage ==

=== CreateCodeSet ===
(behavior unconfirmed)

Allocates memory for a process according to the given CodeSetInfo contents and copies the segment data from the given memory locations to the allocated memory.

=== CreateProcess ===
(behavior unconfirmed)

Sets up a process using the segments managed by the given CodeSet handle.

This system call furthermore processes the [[NCCH/Extended_Header#ARM11_Kernel_Capabilities|kernel capabilities]] from the [[NCCH/Extended_Header|ExHeader]], hence setting up virtual address mappings, CPU clock frequency/L2 cache configuration, and other things.

=== Run ===
(behavior unconfirmed)

Sets up the main process thread and appends it to the scheduler queue.

The argc, argv, and envp fields from the given StartupInfo structure are ignored.

== struct CodeSetInfo ==
All addresses are given virtual for the process to be created.
All sizes are given in 0x1000-pages.

{| class="wikitable" border="1"
! Type
! Field
|-
| u8[8]
| Codeset Name
|-
| u16
| Unknown, this is written to field 0x5A of KCodeSet
|-
| u16
| Unknown/padding
|-
| u32
| Unknown/padding
|-
| u32
| .text addr
|-
| u32
| .text size
|-
| u32
| .rodata start
|-
| u32
| .rodata size
|-
| u32
| RW addr (.data + .bss)
|-
| u32
| RW size (.data + .bss)
|-
| u32
| Total .text pages
|-
| u32
| Total .rodata pages
|-
| u32
| Total RW pages (.data + .bss)
|-
| u32
| Unknown/padding
|-
| u8[8]
| Program ID
|}

= Threads =

For Kernel implementation details, see [[KThread]].

Though it is possible to run multi-threaded programs, running those on different cores is not possible "as-is". One core is always dedicated to the OS, hence you will never get 100% of both cores.

Using CloseHandle() with a KThread handle will terminate the specified thread only if the reference count reaches 0.

Lower priority values give the thread higher priority. For userland apps, priorities between 0x18 and 0x3F are allowed. The priority of the app's main thread seems to be 0x30.

The [[Glossary#appcore|appcore]] thread scheduler, in typical real-time operating system fashion, implements a simple preemptive algorithm based around multiple thread priority levels. This algorithm guarantees that the currently executing thread is always the highest priority runnable thread (also known as SCHED_FIFO). In other words, a thread will be interrupted (preempted) if and only if a higher priority thread is woken up, by means of an event (i.e. svcSendSyncRequest) or similar. Contrary to typical desktop operating systems, no timeslice-based scheduling is performed, which means that if a thread uses up all available CPU time (for example if it enters an endless loop), all other threads with equal or lower priority that run on the same CPU core won't get a chance to run. Yielding to other threads is otherwise done by means of synchronization primitives (thread sleep, mutex, address arbiter, etc.). Address arbiters can be used to implement process-local synchronization primitives.

0xFFFF8000 is a handle alias for the currently active thread.

== Usage ==

=== CreateThread ===
'''svc''' : 0x08

'''Signature'''
Result CreateThread(Handle* thread, func entrypoint, u32 arg, u32 stacktop, s32 threadpriority, s32 processorid);

'''Configuration'''
R0=s32 threadpriority
R1=func entrypoint
R2=u32 arg
R3=u32 stacktop
R4=s32 processorid

Result result=R0
Handle* thread=R1

'''Details'''

Creates a new thread in the current process which will begin execution at the given entrypoint. The SP CPU register will be initialized to stacktop, while r0 will be initialized to the given arg.

The input address used for Entrypoint_Param and StackTop are normally the same, but they may be chosen arbitrarily. For the main thread (created in svcRun), the Entrypoint_Param is value 0.

The stacktop must be aligned to 0x8-bytes, otherwise when not aligned to 0x8-bytes the ARM11 kernel clears the low 3-bits of the stacktop address.

The processorid parameter specifies which processor the thread can run on. Non-negative values correspond to a specific CPU. (e.g. 0 for the Appcore and 1 for the Syscore on Old3DS. On New3DS, IDs 2 and 3 are also valid, referring to the 2 additional CPU cores) Special value -1 means all CPUs, and -2 means the default CPU for the process (Read from the [[NCCH/Extended Header|Exheader]], usually 0 for applications, 1 for system services). Games usually create threads using -2.

The thread priority value must be in the range 0x0..0x3F. Otherwise, error 0xE0E01BFD is returned.

With the Old3DS kernel, the s32 processorid must be <=2 (for the processorid validation check in the kernel). With the New3DS kernel, the processorid validation check requires processorid to be less than or equal to <total cores(MPCore "SCU Configuration Register" CPU number value + 1)>, and a number of additional constraints apply: When processorid==0x2 and the process is not a BASE mem-region process, exheader kernel-flags bitmask 0x2000 must be set (otherwise error 0xD9001BEA is returned). When processorid==0x3 and the process is not a BASE mem-region process, error 0xD9001BEA is returned. These are the only restriction checks done by the kernel for processorid.

=== ExitThread ===
'''svc''' : 0x09

'''Signature'''
void ExitThread(void);

'''Details'''

Makes the currently running thread exit. When a thread exits, all mutex objects it owns are released and made available to other threads.

=== SleepThread ===
'''svc''' : 0x0A

'''Signature'''
void SleepThread(s64 nanoseconds);

=== GetThreadPriority ===
'''svc''' : 0x0B

'''Signature'''
Result GetThreadPriority(s32* priority, Handle thread);

'''asm'''
.global svcGetThreadPriority
.type svcGetThreadPriority, %function
svcGetThreadPriority:
str r0, [sp, #-0x4]!
svc 0x0B
ldr r3, [sp], #4
str r1, [r3]
bx lr

=== SetThreadPriority ===
'''svc''' : 0x0C

'''Signature'''
Result SetThreadPriority(Handle thread, s32 priority);

=== OpenThread ===
'''svc''' : 0x34

'''Signature'''
Result OpenThread(Handle* thread, Handle process, u32 threadId);

=== GetProcessIdOfThread ===
'''svc''' : 0x36

'''Signature'''
Result GetProcessIdOfThread(u32* processId, Handle thread);

=== GetThreadId ===
'''svc''' : 0x37

'''Signature'''
Result GetThreadId(u32* threadId, Handle thread);

'''Details'''
It seems that only the thread itself or one of its parent can get the ID. Calling this on the handle of a sibling or parent seems to always yield the ID 0.

=== GetThreadInfo ===
'''svc''' : 0x2C

'''Signature'''
Result GetThreadInfo(s64* out, Handle thread, ThreadInfoType type);

''' Details '''
This requests always return an error when called, it only checks if the handle is a thread or not.
Hence, it will return 0xD8E007ED (BAD_ENUM) if the Handle is a Thread Handle, 0xD8E007F7 (BAD_HANDLE) if it isn't.

=== GetThreadContext ===
'''svc''' : 0x3B

'''Signature'''
Result GetThreadContext(ThreadContext* context, Handle thread);

'''Details'''
Stubbed?

== Core affinity ==

The cores are numbered from 0 to 1 for Old 3DS and 0 to 3 for the new 3DS.

=== GetThreadAffinityMask ===
'''svc''' : 0x0D

'''Signature'''
Result GetThreadAffinityMask(u8* affinitymask, Handle thread, s32 processorcount);

=== SetThreadAffinityMask ===
'''svc''' : 0x0E

'''Signature'''
Result SetThreadAffinityMask(Handle thread, u8* affinitymask, s32 processorcount);

=== GetThreadIdealProcessor ===
'''svc''' : 0x0F

'''Signature'''
Result GetThreadIdealProcessor(s32* processorid, Handle thread);

=== SetThreadIdealProcessor ===
'''svc''' : 0x10

=== APT:SetApplicationCpuTimeLimit ===

See [[APT:SetApplicationCpuTimeLimit]].

You are not able to use the system core (core1) by default. You have to first assign the amount of time dedicated to the system.
The value is in percent, the higher it is, the more the system will be available for your application.

For example if you set this value to 25%, it means that your application will be able to use 25% of the system core at most, even if you never issue system calls.

If you set the value to a non-zero value, you will not be able to set it back to 0%.
Keep in mind that if your application is heavily dependant on the system, setting a high value for your application might yield poorer performance than if you had set a low value.

=== APT:GetApplicationCpuTimeLimit ===

See [[APT:GetApplicationCpuTimeLimit]].

== Debug ==

=== GetThreadList ===

=== GetDebugThreadContext ===

=== SetDebugThreadContext ===

=== GetDebugThreadParam ===

= Synchronization =

Synchronization can be performed via WaitSynchronization on any handles deriving from [[KSynchronizationObject]]. The semantic meaning of the call depends on the particular object type referred to by the given handle:

* KClientPort: Wakes if max sessions not reached (free session available)
* KClientSession: Always false?
* KDebug: Waits until a debug event is signaled (the user should then use svcGetProcessDebugEvent to get the debug event info)
* KDmaObject: ???
* KEvent: Waits until the event is signaled
* KMutex: Acquires a lock on the mutex (blocks until this succeeds)
* KProcess: Waits until the process exits/is terminated
* KSemaphore: This consumes a value from the semaphore count, if possible, otherwise continues to wait
* KServerPort: Waits for a new client connection, upon which svcAcceptSession is ready to be called
* KServerSession: Waits for an IPC command to be submitted to the server process
* KThread: Waits until the thread terminates
* KTimer: Wakes when timer activates (this also clears the timer if it is oneshot)

Most synchronization systems seem to have both a "normal" and "light-weight" version

== Mutex ==

For Kernel implementation details, see [[KMutex]]

=== CreateMutex ===

/!\ It seems that the mutex will not be available once the thread that created it is destroyed

=== ReleaseMutex ===

== Semaphore ==

== Event ==

== Address Arbiters ==

Address arbiters are a low-level primitive to implement synchronization based on a counter stored at some user-specified virtual memory address. Address arbiters are used to put the current thread to sleep until the counter is signaled. Both of these tasks are implemented in ArbitrateAddress.

Address arbiters are implemented by [[KAddressArbiter]].

===CreateAddressArbiter===
Result CreateAddressArbiter(Handle* arbiter)

Creates an address arbiter handle for use with ArbitrateAddress.

=== ArbitrateAddress ===
Result ArbitrateAddress(Handle arbiter, u32 addr, ArbitrationType type, s32 value, s64 nanoseconds)

if <code>type</code> is SIGNAL, the ArbitrateAddress call will resume up to <code>value</code> of the threads waiting on <code>addr</code> using an arbiter, starting with the highest-priority threads. If <code>value</code> is negative, all of these threads are released. <code>nanoseconds</code> remains unused in this mode.

The other modes are used to (conditionally) put the current thread to sleep based on the memory word at virtual address <code>addr</code> until another thread signals that address using ArbitrateAddress with the <code>type</code> SIGNAL. WAIT_IF_LESS_THAN will put the current thread to sleep if that word is smaller than <code>value</code>. DECREMENT_AND_WAIT_IF_LESS_THAN will furthermore decrement the memory value before the comparison. WAIT_IF_LESS_THAN_TIMEOUT and DECREMENT_AND_WAIT_IF_LESS_THAN_TIMEOUT will do the same as their counterparts, but will have thread execution resume if <code>nanoseconds</code> nanoseconds pass without <code>addr</code> being signaled.

=== enum ArbitrationType ===
{| class="wikitable" border="1"
! Address arbitration type
! Value
|-
| SIGNAL
| 0
|-
| WAIT_IF_LESS_THAN
| 1
|-
| DECREMENT_AND_WAIT_IF_LESS_THAN
| 2
|-
| WAIT_IF_LESS_THAN_TIMEOUT
| 3
|-
| DECREMENT_AND_WAIT_IF_LESS_THAN_TIMEOUT
| 4
|}

NCCH/Extended Header

2023-08-09T16:09:12Z

TuxSH: /* ARM11 Kernel Capabilities */

This page documents the format of the '''NCCH Extended Header''', or '''exheader''' for short.

The exheader has two sections:

* The actual exheader data, containing System Control Info (SCI) and Access Control Info (ACI);
* A signed copy of NCCH HDR public key, and exheader ACI. This version of the ACI is used as limitation to the actual ACI.

== Main Structure ==
All values are little endian unless otherwise specified.

See also: [https://github.com/3DSGuy/Project_CTR/blob/20f708450b9c6e7f64eafa6c2a8eeb25a630c69a/ctrtool/exheader.h]

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| <code>0x0</code>
| <code>0x200</code>
| SCI
|-
| <code>0x200</code>
| <code>0x200</code>
| ACI
|-
| <code>0x400</code>
| <code>0x100</code>
| <code>AccessDesc</code> signature (RSA-2048-SHA256)
|-
| <code>0x500</code>
| <code>0x100</code>
| NCCH HDR RSA-2048 public key
|-
| <code>0x600</code>
| <code>0x200</code>
| ACI (for limitation of first ACI)
|}

The <code>AccessDesc</code> signature covers the NCCH HDR public key and second ACI. The <code>AccessDesc</code> public key is initialised by the boot ROM.

When loading the exheader, [[FIRM|Process9]] compares the exheader data with the data in the <code>AccessDesc</code> (note that not everything is compared here). When these don't match, an error is returned. The Process9 code handling this validation was updated with [[6.0.0-11|v6.0]]; the only change in this function seems to be the check for the "Ideal processor" field.

== System Control Info ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| <code>0x0</code>
| <code>0x8</code>
| Application title (default is "CtrApp")
|-
| <code>0x8</code>
| <code>0x5</code>
| Reserved
|-
| <code>0xD</code>
| <code>0x1</code>
| Flag (bit 0: <code>CompressExefsCode</code>, bit 1: <code>SDApplication</code>)
|-
| <code>0xE</code>
| <code>0x2</code>
| Remaster version
|-
| <code>0x10</code>
| <code>0xC</code>
| Text code set info
|-
| <code>0x1C</code>
| <code>0x4</code>
| Stack size
|-
| <code>0x20</code>
| <code>0xC</code>
| Read-only code set info
|-
| <code>0x2C</code>
| <code>0x4</code>
| Reserved
|-
| <code>0x30</code>
| <code>0xC</code>
| Data code set info
|-
| <code>0x3C</code>
| <code>0x4</code>
| BSS size
|-
| <code>0x40</code>
| <code>0x180</code> (<code>48*8</code>)
| Dependency [[Title list#00040130 - System Modules|module]] (program ID) list
|-
| <code>0x1C0</code>
| <code>0x40</code>
| <code>SystemInfo</code>
|}

Most of these fields are used in [[LOADER:LoadProcess]].

=== Code Set Info ===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| <code>0x0</code>
| <code>4</code>
| Address
|-
| <code>0x4</code>
| <code>4</code>
| Physical region size (in page-multiples)
|-
| <code>0x8</code>
| <code>4</code>
| Size (in bytes)
|}

=== System Info ===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| <code>0x0</code>
| <code>0x8</code>
| <code>SaveData</code> Size
|-
| <code>0x8</code>
| <code>0x8</code>
| Jump ID
|-
| <code>0x10</code>
| <code>0x30</code>
| Reserved
|}

== Access Control Info ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| <code>0x0</code>
| <code>0x170</code>
| [[#ARM11 Local System Capabilities|ARM11 local system capabilities]]
|-
| <code>0x170</code>
| <code>0x80</code>
| [[#ARM11 Kernel Capabilities|ARM11 kernel capabilities]]
|-
| <code>0x1F0</code>
| <code>0x10</code>
| [[#ARM9 Access Control|ARM9 access control]]
|}

=== ARM11 Local System Capabilities ===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| <code>0x0</code>
| <code>0x8</code>
| Program ID
|-
| <code>0x8</code>
| <code>0x4</code>
| Core version (The Title ID low of the required [[FIRM]])
|-
| <code>0xC</code>
| <code>0x2</code>
| [[#Flag1|Flag1]] and [[#Flag2|Flag2]] (both implemented starting from [[8.0.0-18]]).
|-
| <code>0xE</code>
| <code>0x1</code>
| [[#Flag0|Flag0]]
|-
| <code>0xF</code>
| <code>0x1</code>
| Priority
|-
| <code>0x10</code>
| <code>0x20</code> (<code>16*2</code>)
| Resource limit descriptors. The first byte here controls the maximum allowed [[PMApp:SetAppResourceLimit|<code>CpuTime</code>]].
|-
| <code>0x30</code>
| <code>0x20</code>
| [[#Storage Info|Storage info]]
|-
| <code>0x50</code>
| <code>0x100</code> (<code>32*8</code>)
| [[#Service Access Control|Service access control]]
|-
| <code>0x150</code>
| <code>0x10</code> (<code>2*8</code>)
| Extended service access control, support for this was implemented with [[9.3.0-21|9.3.0-X]].
|-
| <code>0x160</code>
| <code>0xF</code>
| Reserved
|-
| <code>0x16F</code>
| <code>0x1</code>
| Resource limit category. (0 = <code>APPLICATION</code>, 1 = <code>SYS_APPLET</code>, 2 = <code>LIB_APPLET</code>, 3 = <code>OTHER</code> (sysmodules running under the BASE memregion))
|}

==== Flag0 ====
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| <code>0-1</code>
| Ideal processor
|-
| <code>2-3</code>
| Affinity mask
|-
| <code>4-7</code>
| Old3DS system mode
|}

===== Old3DS System Mode =====
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| <code>0</code>
| <code>Prod</code> (64MB of usable application memory)
|-
| <code>1</code>
| <code>Undefined</code> (unusable)
|-
| <code>2</code>
| <code>Dev1</code> (96MB of usable application memory)
|-
| <code>3</code>
| <code>Dev2</code> (80MB of usable application memory)
|-
| <code>4</code>
| <code>Dev3</code> (72MB of usable application memory)
|-
| <code>5</code>
| <code>Dev4</code> (32MB of usable application memory)
|-
| <code>6-7</code>
| <code>Undefined</code> Same as <code>Prod</code>?
|}

In the exheader data, the ideal processor field is a bit-index, while in the <code>AccessDesc</code> the ideal processor field is a bitmask. When the bit specified by the exheader field is not set in the <code>AccessDesc</code> field, an error is returned.

<pre>if((1 << exheaderval) & accessdescval == 0) return error</pre>

During a FIRM-launch when a <code>TitleInfo</code> structure was specified, the field at offset [[FIRM#FIRM_Launch_Parameters|0x400]] in the FIRM-launch parameters is set to the SystemMode of the specified title, however in some cases other values are written there. With [[8.0.0-18]] NS will now check the output of [[PTM|PTMSYSM]] command <code>0x040A0000</code>, when the output is non-zero and a certain NS state field is value-zero, the following is executed otherwise this is skipped. With that check passed on [[8.0.0-18]], NS will then check (<code>Flag2 & 0xF</code>). When that is <code>value2</code>, the output value (used for the FIRM-launcher parameter field mentioned above) is set to <code>value7</code>. Otherwise, when that value is non-zero, the output value is set to 6.

==== Flag1 ====
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| <code>0</code>
| <code>EnableL2Cache</code> (Unknown what this actually does, New3DS-only presumably)
|-
| <code>1</code>
| <code>cpuspeed_804MHz</code> (Default "cpuspeed" when not set)
|-
| <code>2-7</code>
| Unused
|}

In order for the exheader to have any of the above new bits set, the <code>AccessDesc</code> must have the corresponding bit set, otherwise the invalid-exheader error is returned.

Homebrew which runs under a title which has the above <code>cpuspeed</code> flag set, runs much faster on New3DS. It's unknown how exactly the system handles these flags.

When launching titles / perhaps other things with [[APT]], [[NS]] uses [[PTMSYSM:ConfigureNew3DSCPU]] with data which originally came from these flags; NS does this regardless of what the running 3DS system is. However, due to a bug(?) in NS the value sent to that command is always either 0x0 or 0x3. When calculating that value, the code only ever uses the cpuspeed field, not the cache field: code to actually load and check the value of the cache field appears to be missing.

==== Flag2 ====
{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| <code>0-3</code>
| New3DS system mode
|-
| <code>4-7</code>
| Unused
|}

===== New3DS System Mode =====
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| <code>0</code>
| <code>Legacy</code> (use Old3DS system mode)
|-
| <code>1</code>
| <code>Prod</code> (124MB of usable application memory)
|-
| <code>2</code>
| <code>Dev1</code> (178MB of usable application memory)
|-
| <code>3</code>
| <code>Dev2</code> (124MB of usable application memory)
|-
| <code>4-7</code>
| <code>Undefined</code> Same as <code>Prod</code>?
|}

When in <code>Legacy</code> mode, the actual memory layout is the same as in <code>New3DS Prod</code>, except the available application memory as reported to the application is reduced to the Old3DS size.

The exheader value for the New3DS system mode value must be ≤ to the <code>AccessDesc</code> value, otherwise the invalid-exheader error is returned.

==== Storage Info ====
Used in [[FSReg:Register]].

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| <code>0x0</code>
| <code>8</code>
| Extdata ID
|-
| <code>0x8</code>
| <code>8</code>
| System savedata IDs
|-
| <code>0x10</code>
| <code>8</code>
| Storage accessible unique IDs
|-
| <code>0x18</code>
| <code>7</code>
| Filesystem access info
|-
| <code>0x1F</code>
| <code>1</code>
| Other attributes
|}

File System Access Info:
{| class="wikitable" border="1"
|-
! Bit and bitmask
! Description
|-
| <code>0</code>, <code>0x1</code>
| Category system application
|-
| <code>1</code>, <code>0x2</code>
| Category hardware check
|-
| <code>2</code>, <code>0x4</code>
| Category filesystem tool
|-
| <code>3</code>, <code>0x8</code>
| Debug
|-
| <code>4</code>, <code>0x10</code>
| TWL card backup
|-
| <code>5</code>, <code>0x20</code>
| TWL NAND data
|-
| <code>6</code>, <code>0x40</code>
| BOSS
|-
| <code>7</code>, <code>0x80</code>
| [[FS:OpenArchive|<code>sdmc:/</code>]]
|-
| <code>8</code>, <code>0x100</code>
| Core
|-
| <code>9</code>, <code>0x200</code>
| [[Flash Filesystem|<code>nand:/ro/</code>]] (Read Only)
|-
| <code>10</code>, <code>0x400</code>
| [[Flash Filesystem|<code>nand:/rw/</code>]]
|-
| <code>11</code>, <code>0x800</code>
| [[Flash Filesystem|<code>nand:/ro/</code>]] (Write Access)
|-
| <code>12</code>, <code>0x1000</code>
| Category system settings
|-
| <code>13</code>, <code>0x2000</code>
| Cardboard
|-
| <code>14</code>, <code>0x4000</code>
| Export/Import IVS
|-
| <code>15</code>, <code>0x8000</code>
| [[FS:OpenArchive|<code>sdmc:/</code>]] (Write-only)
|-
| <code>16</code>, <code>0x10000</code>
| Switch cleanup (Introduced in [[3.0.0-5|3.0.0]]?)
|-
| <code>17</code>, <code>0x20000</code>
| Savedata move (Introduced in [[5.0.0-11|5.0.0]])
|-
| <code>18</code>, <code>0x40000</code>
| Shop (Introduced in [[5.0.0-11|5.0.0]])
|-
| <code>19</code>, <code>0x80000</code>
| Shell (Introduced in [[5.0.0-11|5.0.0]])
|-
| <code>20</code>, <code>0x100000</code>
| Category home menu (Introduced in [[6.0.0-11|6.0.0]])
|-
| <code>21</code>, <code>0x200000</code>
| Seed DB. Introduced in [[9.6.0-24|9.6.0-X]] [[FIRM]]. [[Home Menu]] has this bit set starting with [[9.6.0-24|9.6.0-X]].
|}

====Other Attributes====

{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| <code>0</code>
| Not use ROMFS
|-
| <code>1</code>
| Use Extended savedata access.
|}

When Bit1 is set, the "Extdata ID" and "Storage Accessable Unique IDs" regions are used to store a total of 6 "Accessible Save IDs". Introduced in [[6.0.0-11|6.0.0]].

==== Service Access Control ====
This is the list of [[Services_API|services]] which the process is allowed to access, this is registered with the [[Services|services]] manager. Each service listed in the exheader must be listed in the <code>AccessDesc</code>, otherwise the invalid exheader error is returned. The order of the services for exheader/<code>AccessDesc</code> doesn't matter. The <code>AccessDesc</code> can list services which are not in the exheader, but normally the service-access-control data for exheader/<code>AccessDesc</code> are exactly the same.

This list is submitted to [[SRVPM:RegisterProcess]].

=== ARM11 Kernel Capabilities ===
The kernel capability descriptors are passed to [[SVC|svcCreateProcess]].

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| <code>0x0</code>
| <code>0x70</code> (<code>28*4</code>)
| Descriptors
|-
| <code>0x70</code>
| <code>0x10</code>
| Reserved
|}

There are different descriptor types, determined by the number of leading ones in the binary value representation of bits 20-31. The different types are laid out as follows:

{| class="wikitable" border="1"
|-
! Pattern of bits 20-31
! Type
! Fields
|-
| <code>0b1110xxxxxxxx</code>
| Interrupt info
|
|-
| <code>0b11110xxxxxxx</code>
| System call mask
| Bits 24-26: System call mask table index; Bits 0-23: mask
|-
| <code>0b1111110xxxxx</code>
| Kernel release version
| Bits 8-15: Major version; Bits 0-7: Minor version
|-
| <code>0b11111110xxxx</code>
| Handle table size
| Bits 0-18: size
|-
| <code>0b111111110xxx</code>
| [[#ARM11_Kernel_Flags|Kernel flags]]
| See below
|-
| <code>0b11111111100x</code>
| Map IO/static address range
| Describes a memory mapping like the 0b111111111110 descriptor, but an entire range rather than a single page is mapped. Another 0b11111111100x descriptor must follow this one to denote the (exclusive) end of the address range to map. Bit20 on the first descriptor: map read-only (otherwise RW), bit20 on the second descriptor: map static (cacheable, otherwise IO if the bit is not set)
|-
| <code>0b111111111110</code>
| Map IO memory page
| Bits 0-19: page index to map (virtual address >> 12; the physical address is determined per-page according to [[Memory layout]]); Bit 20: Map read-only (otherwise read-write)
|}

==== ARM11 Kernel Flags ====
{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| <code>0</code>
| Allow debug
|-
| <code>1</code>
| Force debug
|-
| <code>2</code>
| Allow non-alphanum
|-
| <code>3</code>
| Shared page writing
|-
| <code>4</code>
| Privilege priority
|-
| <code>5</code>
| Allow <code>main()</code> args
|-
| <code>6</code>
| Shared device memory
|-
| <code>7</code>
| Runnable on sleep
|-
| <code>8-11</code>
| Memory type (1: application, 2: system, 3: base)
|-
| <code>12</code>
| [[Memory_layout#NATIVE_FIRM.2FSAFE_MODE_FIRM_Userland_Memory|Special memory]]
|-
| <code>13</code>
| Process has access to CPU core 2 (New3DS only)
|}

=== ARM9 Access Control ===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| <code>0x0</code>
| <code>15</code>
| Descriptors
|-
| <code>0xF</code>
| <code>1</code>
| ARM9 Descriptor Version. Originally this value had to be ≥ 2. Starting with [[9.3.0-21|9.3.0-X]] this value has to be either value 2 or value 3.
|}

Descriptors:
{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| <code>0</code>
| Mount [[Flash Filesystem|<code>nand:/</code>]]
|-
| <code>1</code>
| Mount [[Flash Filesystem|<code>nand:/ro/</code>]] (Write Access)
|-
| <code>2</code>
| Mount [[Flash Filesystem|<code>twln:/</code>]]
|-
| <code>3</code>
| Mount [[Flash Filesystem|<code>wnand:/</code>]]
|-
| <code>4</code>
| Mount card SPI
|-
| <code>5</code>
| Use SDIF3
|-
| <code>6</code>
| Create seed
|-
| <code>7</code>
| Use card SPI
|-
| <code>8</code>
| SD application (Not checked)
|-
| <code>9</code>
| Mount [[SD Filesystem|sdmc:/]] (Write Access)
|}

ERR:SetUserString

2023-01-10T20:56:06Z

TuxSH: Data is actually copied to static buffer, I believe

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00020042]
|-
| 1
| Size
|-
| 2
| (Size << 14) <nowiki>|</nowiki> 2
|-
| 3
| char*, String
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|}

11.16.0-48

2022-08-30T14:06:49Z

TuxSH: rip smpwn

The Old3DS+New3DS 11.16.0-48 system update was released on August 30, 2022 (UTC). This Old3DS update was released for the following regions: USA, EUR, JPN, CHN, KOR, and TWN. This New3DS update was released for the following regions: USA, EUR, JPN, CHN, KOR, and TWN.

Security flaws fixed: <fill this in manually later, see the updatedetails page from the ninupdates-report page(s) once available for now>.

This update does NOT break Luma3DS.

==Change-log==
[https://en-americas-support.nintendo.com/app/answers/detail/a_id/231/~/system-menu-update-history Official] USA change-log:
*
* Further improvements to overall system stability and other minor adjustments have been made to enhance the user experience.
*
*

==System Titles==
The following was updated: NVer/CVer, eShop, friends-sysmodule, NATIVE_FIRM, mint, Web browser Data (title 0004001B00018002). EULA was also updated only for JPN.

The following changed in the RomFs for 0004001B00018002:
* "/js/cave.js differ" updated
* "/js/cave.min.js" updated
* "/json/": The "message_" files for localization were updated.
* "/version.txt" updated

===FIRM===
Besides the usual changes (version bumps / anti-downgrade list), the only other change was updating sm.

The changes in SM added bound checks to RegisterService and RegisterPort, thereby fixing smpwn (the only other change was removing an unused field in a structure).

==See Also==
System update report(s):
* [https://yls8.mtheall.com/ninupdates/reports.php?date=2022-08-30_00-00-33&sys=ctr]
* [https://yls8.mtheall.com/ninupdates/reports.php?date=2022-08-30_00-00-41&sys=ktr]

CONFIG9 Registers

2022-03-20T16:13:31Z

TuxSH: xdma config

= Registers =
{| class="wikitable" border="1"
! Old3DS
! Name
! Address
! Width
! Used by
|-
| style="background: green" | Yes
| [[#CFG9_SYSPROT9|CFG9_SYSPROT9]]
| 0x10000000
| 1
| Boot9
|-
| style="background: green" | Yes
| [[#CFG9_SYSPROT11|CFG9_SYSPROT11]]
| 0x10000001
| 1
| Boot9
|-
| style="background: green" | Yes
| [[#CFG9_RST11|CFG9_RST11]]
| 0x10000002
| 1
| Boot9
|-
| style="background: green" | Yes
| CFG9_DEBUGCTL
| 0x10000004
| 4
|
|-
| style="background: green" | Yes
| [[#CFG9_XDMA_CNT|CFG9_XDMA_CNT]]
| 0x10000008
| 1
| Boot9, Process9, TwlProcess9
|-
| style="background: green" | Yes
| [[#CFG9_CARDCTL|CFG9_CARDCTL]]
| 0x1000000C
| 2
| Process9
|-
| style="background: green" | Yes
| [[#CFG9_CARDSTATUS|CFG9_CARDSTATUS]]
| 0x10000010
| 1
| Process9
|-
| style="background: green" | Yes
| CFG9_CARDCYCLES0
| 0x10000012
| 2
| Boot9, Process9
|-
| style="background: green" | Yes
| CFG9_CARDCYCLES1
| 0x10000014
| 2
| Boot9, Process9
|-
| style="background: green" | Yes
| [[#CFG9_SDMMCCTL|CFG9_SDMMCCTL]]
| 0x10000020
| 2
| Process9
|-
| style="background: green" | Yes
| ?
| 0x10000100
| 2
|
|-
| style="background: red" | No
| [[#CFG9_EXTMEMCNT9|CFG9_EXTMEMCNT9]]
| 0x10000200
| 1
| NewKernel9
|-
| style="background: green" | Yes
| [[#CFG9_MPCORECFG|CFG9_MPCORECFG]]
| 0x10000FFC
| 4
|
|-
| style="background: green" | Yes
| [[#CFG9_BOOTENV|CFG9_BOOTENV]]
| 0x10010000
| 4
|
|-
| style="background: green" | Yes
| [[#CFG9_UNITINFO|CFG9_UNITINFO]]
| 0x10010010
| 1
| Process9
|-
| style="background: green" | Yes
| [[#CFG9_TWLUNITINFO|CFG9_TWLUNITINFO]]
| 0x10010014
| 1
| Process9
|}

== CFG9_SYSPROT9 ==
CFG9_SYSPROT9 is used to permanently disable certain security-sensitive ARM9 memory areas until the next hard reset.

{| class="wikitable" border="1"
! Bit
! Description
! Used by
|-
| 0
| Disables ARM9 [[Memory_layout|bootrom]](+0x8000) when set to 1, and enables access to [[Memory_layout|FCRAM]]. Cannot be cleared to 0 once set to 1.
| Boot9
|-
| 1
| Disables [[OTP_Registers|OTP area]] when set to 1. Cannot be cleared to 0 once set to 1.
| NewKernel9Loader, Process9
|-
| 31-2
| Not used
|
|}

On Old 3DS, NATIVE_FIRM reads CFG9_SYSPROT9 to know whether it has previously initialized the TWL console-unique keys using the OTP data. After setting the TWL console-unique keys, NATIVE_FIRM sets CFG9_SYSPROT9 bit 1 to disable the OTP area. In subsequent FIRM launches prior to the next reset, NATIVE_FIRM will see that the OTP area is disabled, and skip this step.

On New 3DS, the above is instead done by the [[FIRM#New_3DS_FIRM|Kernel9 loader]]. In addition to using the OTP data for initializing the TWL console-unique keys, the Kernel9 loader will generate the decryption key for NATIVE_FIRM. The final keyslot for NATIVE_FIRM is preserved, so that at a non-reset FIRM launch, the keyslot can be reused, since the OTP would then be inaccessible.

== CFG9_SYSPROT11 ==

{| class="wikitable" border="1"
! Bit
! Description
! Used by
|-
| 0
| Disables ARM11 [[Memory_layout|bootrom]](+0x8000) when set to 1, and enables access to [[Memory_layout|FCRAM]]. Cannot be cleared to 0 once set to 1.
| Boot9
|-
| 31-1
| Not used
|
|}

== CFG9_RST11 ==

{| class="wikitable" border="1"
! Bit
! Description
! Used by
|-
| 0
| Presumably takes ARM11 out of reset. Cannot be set to 1 once it has been cleared.
| Boot9
|-
| 31-1
| Not used
|
|}

== CFG9_XDMA_CNT ==

Write 1 to enable XDMA for the device, 0 to disable. Always enabled for CTRCARD (ids 0 and 1), NTRCARD (id 8), and SHA (id 6 for infifo and 7 for outfifo).

{| class="wikitable" border="1"
! Bit
! Description
! Used by
|-
| 0
| SDIO controller 1 (eMMC and usually SD card; XDMA device ID: 2)
|
|-
| 1
| SDIO controller 3 (SD card if configured so; ID: 3)
|
|-
| 2
| AES Input FIFO (ID: 4)
| Boot9, Process9, TwlProcess9
|-
| 3
| AES Output FIFO (ID: 5)
| Boot9, Process9, TwlProcess9
|-
| 31-4
| Reserved
|
|}

== CFG9_CARDCTL ==
{| class="wikitable" border="1"
! Bit
! Description
! Used by
|-
| 1-0
| Gamecard active controller select (0=NTRCARD, 1=?, 2=CTRCARD0, 3=CTRCARD1)
| Process9
|-
| 8
| 1 = Switch to [[SPICARD_Registers|SPICARD]] interface (savegames).
| Process9
|}

Depending on the gamecard controller that has been selected, one of the following gamecard registers will become active:
* Selecting NTRCARD will activate the register space at [[NTRCARD|0x10164000]].
* Selecting CTRCARD0 will activate the register space at [[CTRCARD|0x10004000]].
* Selecting CTRCARD1 will activate the register space at [[CTRCARD|0x10005000]].

== CFG9_CARDSTATUS ==
{| class="wikitable" border="1"
! Bit
! Description
! Used by
|-
| 0
| Cartridge-slot empty (0=inserted, 1=empty)
| Process9
|-
| 3-2
| ?
| Process9
|}

== CFG9_SDMMCCTL ==
This register controls power of multiple ports/controllers and allows to map controller 3 to ARM9 or ARM11. The SD card can be accessed on ARM11 by setting bit 8 and clearing bit 9.

{| class="wikitable" border="1"
! Bit
! Description
! Used by
|-
| 0
| Controller 1/3 port 0 power (SD card) (1=off)
| Process9
|-
| 1
| Controller 1 port 1 power (eMMC) (1=off)
| Process9
|-
| 2
| Controller 2 port 0 power (WiFi SDIO) (1=off)
| Process9
|-
| 3
| Controller 3 port 1 power? Set at cold boot.
| -
|-
| 4-5
| Unused.
| -
|-
| 6
| Wifi port related? Pull up? Set at cold boot.
| -
|-
| 8
| Controller 3 mapping (0=ARM9 0x10007000, 1=ARM11 0x10100000)
| Process9
|-
| 9
| SD card controller select (0=0x10007000/0x10100000, 1=0x10006000)
| Process9
|-
| 10-15
| Unused.
| -
|}

== CFG9_EXTMEMCNT9 ==
This register is New3DS-only.

{| class="wikitable" border="1"
! Bit
! Description
! Used by
|-
| 0
| Hide extended ARM9 memory (0=hidden, 1=shown)
| Kernel9 (New3DS)
|-
| 31-1
| Reserved
|
|}

== CFG9_MPCORECFG ==
Identical to [[PDN#PDN_MPCORE_CFG|PDN_MPCORE_CFG]].

== CFG9_BOOTENV ==
This register is used to determine what the previous running FIRM was. Its value is kept following an MCU reboot. Its initial value (on a cold boot) is 0. NATIVE_FIRM [[Development_Services_PXI|sets it to 1]] on shutdown/FIRM launch. [[Legacy_FIRM_PXI|LGY FIRM]] writes value 3 here when launching a TWL title, and writes value 7 when launching an AGB title.

NATIVE_FIRM will only launch titles if this is not value 0, and will only save the [[Flash_Filesystem|AGB_FIRM savegame]] to SD if this is value 7.

== CFG9_UNITINFO ==
This 8-bit register is value zero for retail, non-zero for dev/debug units.

== CFG9_TWLUNITINFO ==
In the console-unique TWL key-init/etc function the ARM9 copies the u8 value from REG_UNITINFO to this register.

This is also used by TWL_FIRM Process9.

NDMA Registers

2021-11-10T20:48:54Z

TuxSH: Add device to device modes

3DS NDMA has 8 channels. The first 0x100-bytes of this IO mem is mirrored at 0x10002100, repeated every 0x100-bytes until the end of the 0x1000-byte IO mem. NDMA can access the Arm9 bootrom, including the protected part before it is locked out.

= Registers =
{| class="wikitable" border="1"
! Old3DS
! Name
! Address
! Width
! Used by
|-
| style="background: green" | Yes
| [[#NDMA_GLOBAL_CNT|NDMA_GLOBAL_CNT]]
| 0x10002000
| 4
| Boot9, Kernel9
|-
| style="background: green" | Yes
| [[#NDMA_SRC_ADDR|NDMA_SRC_ADDR]](n)
| 0x10002004 + (n*0x1c)
| 4
| Boot9, Kernel9
|-
| style="background: green" | Yes
| [[#NDMA_DST_ADDR|NDMA_DST_ADDR]](n)
| 0x10002008 + (n*0x1c)
| 4
| Boot9, Kernel9
|-
| style="background: green" | Yes
| [[#NDMA_TRANSFER_CNT|NDMA_TRANSFER_CNT]](n)
| 0x1000200c + (n*0x1c)
| 4
| Boot9, Kernel9
|-
| style="background: green" | Yes
| [[#NDMA_WRITE_CNT|NDMA_WRITE_CNT]](n)
| 0x10002010 + (n*0x1c)
| 4
| Boot9, Kernel9
|-
| style="background: green" | Yes
| [[#NDMA_BLOCK_CNT|NDMA_BLOCK_CNT]](n)
| 0x10002014 + (n*0x1c)
| 4
| Boot9, Kernel9
|-
| style="background: green" | Yes
| [[#NDMA_FILL_DATA|NDMA_FILL_DATA]](n)
| 0x10002018 + (n*0x1c)
| 4
| Boot9, Kernel9
|-
| style="background: green" | Yes
| [[#NDMA_CNT|NDMA_CNT]](n)
| 0x1000201C + (n*0x1c)
| 4
| Boot9, Kernel9
|}

== NDMA_GLOBAL_CNT ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 0
| Global enable?
|-
| 19-16
| Cycle selection.
|-
| 31
| DMA arbitration method. 0=Fixed method, 1=Round robin
|}

== NDMA_SRC_ADDR ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 31-0
| Source data address. Must be multiple of 4.
|}
Like old DMA, NDMA_SRC_ADDR is copied to internal registers when written to.

== NDMA_DST_ADDR ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 31-0
| Destination data address. Must be multiple of 4.
|}
Like old DMA, NDMA_DST_ADDR is copied to internal registers when written to.

== NDMA_TRANSFER_CNT ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 27-0
| Total number of words transferred.
|}

== NDMA_WRITE_CNT ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 23-0
| Number of words to transfer.
|}

== NDMA_BLOCK_CNT ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 15-0
| Interval timer.
|-
| 17-16
| Prescaler. 0=System freq, 1=1/4th freq, 2=1/16th freq, 3=1/64th freq.
|}

== NDMA_FILL_DATA ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 31-0
| Fill data.
|}

== NDMA_CNT ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 4-0
| Device to device startup mode
|-
| 11-10
| Destination address update method. 0=Increment, 1=Decrement, 2=Fixed.
|-
| 12
| Destination address reload flag.
|-
| 14-13
| Source address update method. 0=Increment, 1=Decrement, 2=Fixed, 3=No address (for filling)
|-
| 15
| Source address reload flag.
|-
| 19-16
| Block transfer word count = (1<<x) words.
|-
| 27-24
| Startup mode.
|-
| 28
| Immediate mode.
|-
| 29
| Repeating mode.
|-
| 30
| IRQ enable
|-
| 31
| Enable/busy flag.
|}

== Startup modes (4-0) ==
{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| TIMER0
|-
| 1
| TIMER1
|-
| 2
| TIMER2
|-
| 3
| TIMER3
|-
| 4
| CTRCARD0
|-
| 5
| CTRCARD1
|-
| 6
| SDIO1
|-
| 7
| SDIO3
|-
| 8
| AES in ([[AES_Registers#AES_WRFIFO.2FAES_RDFIFO|WRFIFO]])
|-
| 9
| AES out ([[AES_Registers#AES_WRFIFO.2FAES_RDFIFO|RDFIFO]])
|-
| 10
| SHA in ([[SHA_Registers#SHA_FIFO|INFIFO]])
|-
| 11
| SHA out ([[SHA_Registers#SHA_FIFO|INFIFO]], source data readback mode)
|-
| 12
| NTRCARD
|-
| 13
| ?
|-
| 14
| ?
|-
| 15
| Device to device (subclassed by bits 4-0)
|}

== Device to device startup modes (4-0) ==
{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| CTRCARD0 -> AES
|-
| 1
| CTRCARD1 -> AES
|-
| 2
| AES -> CTRCARD0
|-
| 3
| AES -> CTRCARD1
|-
| 4
| CTRCARD0 -> SHA
|-
| 5
| CTRCARD1 -> SHA
|-
| 6
| SHA -> CTRCARD0
|-
| 7
| SHA -> CTRCARD1
|-
| 8
| SDIO1 -> AES
|-
| 9
| SDIO3 -> AES
|-
| 10
| AES -> SDIO1
|-
| 11
| AES -> SDIO3
|-
| 12
| SDIO1 -> SHA
|-
| 13
| SDIO3 -> SHA
|-
| 14
| SHA -> SDIO1
|-
| 15
| SHA -> SDIO3
|-
| 16
| AES -> SHA
|-
| 17
| SHA -> AES
|}

== Block transfers ==
First, a word is always 32 bits. Second, the block transfer specified in NDMA_CNT is the smallest atom of data that will be transferred in a burst. The bus is monopolized until this block is transferred, without splitting up.

The next block transfer will happen after the specified time in the NDMA_BLOCK_CNT interval timer, until done.

== Immediate mode ==
Transfers the words specified in NDMA_WRITE_CNT immediately following block transfer rules. NDMA_TRANSFER_CNT and repeating mode are ignored.

== Repeating mode ==
Transfers the words specified in NDMA_WRITE_CNT following the startup mode event. NDMA_TRANSFER_CNT is ignored.

== No immediate and no repeating mode ==
Transfers the words specified in NDMA_WRITE_CNT for each startup event, and gets disabled when the total number of words in NDMA_TRANSFER_CNT are transferred.

RSA Registers

2021-02-05T22:34:10Z

TuxSH: /* RSA_SLOTCNT */

= Overview =

The RSA module is essentially a hardware-accelerated modular exponentiation engine. It is specially optimized for RSA applications, so its behavior can be incoherent when RSA's invariants are broken.

=== Observed edge cases ===
* if 2 divides mod, output == 0

= Registers =
{| class="wikitable" border="1"
! Old3DS
! Name
! Address
! Width
! Used by
|-
| style="background: green" | Yes
| [[#RSA_CNT|RSA_CNT]]
| 0x1000B000
| 0x04
|
|-
| style="background: green" | Yes
| RSA_?
| 0x1000B0F0
| 0x04
|
|-
| style="background: green" | Yes
| [[#RSA_SLOT|RSA_SLOT]]0
| 0x1000B100
| 0x10
|
|-
| style="background: green" | Yes
| [[#RSA_SLOT|RSA_SLOT]]1
| 0x1000B110
| 0x10
|
|-
| style="background: green" | Yes
| [[#RSA_SLOT|RSA_SLOT]]2
| 0x1000B120
| 0x10
|
|-
| style="background: green" | Yes
| [[#RSA_SLOT|RSA_SLOT]]3
| 0x1000B130
| 0x10
|
|-
| style="background: green" | Yes
| [[#RSA_EXPFIFO|RSA_EXPFIFO]]
| 0x1000B200
| 0x100 (can handle u32 writes to any aligned position in the FIFO)
|
|-
| style="background: green" | Yes
| [[#RSA_MOD|RSA_MOD]]
| 0x1000B400
| 0x100
|
|-
| style="background: green" | Yes
| [[#RSA_TXT|RSA_TXT]]
| 0x1000B800
| 0x100
|
|}

== RSA_CNT ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 0
| Start (1=Enable/Busy, 0=Idle)
|-
| 1
| Interrupt enable (1=enable, 0=disable)
|-
| 4-7
| Keyslot (Bit6-7 don't actually affect the keyslot)
|-
| 8
| Endianness (1=Little endian, 0=Big endian). Affects RSA_EXPFIFO, RSA_MOD, and RSA_TXT.
|-
| 9
| Word order (1=Normal order, 0=Reversed order). Affects RSA_MOD and RSA_TXT.
|}

== RSA_SLOT ==
{| class="wikitable" border="1"
! Name
! Offset
! Width
|-
| [[#RSA_SLOTCNT|RSA_SLOTCNT]]
| 0x0
| 0x4
|-
| [[#RSA_SLOTSIZE|RSA_SLOTSIZE]]
| 0x4
| 0x4
|-
| ?
| 0x8
| 0x4
|-
| ?
| 0xC
| 0x4
|}

== RSA_SLOTCNT ==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Key status (1=Key has been set, 0=Key has not been set yet)
|-
| 1
| Key write-protect, this bit is RW. (0 = no protection, 1 = protected)
|-
| 2
| Key read-protect, this bit is RW. (0 = no protection, 1 = protected)
|-
| 30-3
| ?
|-
| 31
| Key slot protect. Makes all other bits in this reg read-only until reset
|}

Before writing RSA_EXPFIFO/RSA_MOD, bit0 here should be cleared when bit31 is already clear. Otherwise, the ARM9 will hang when attempting to write to RSA_EXPFIFO.

== RSA_SLOTSIZE ==
This contains the RSA size for this slot, in words. Normally this is 0x40 for RSA-2048.

== RSA_EXPFIFO ==
The 0x100-byte private or public exponent is written to this write-only FIFO.

== RSA_MOD ==
The RSA key modulus for the selected keyslot can be written here. When writing the RSA modulus, the modulus must align with the end of the register area.

Writing to RSA_MOD does not change the exponent written with RSA_EXPFIFO. An attack based on the [[wikipedia:Pohlig-Hellman algorithm|Pohlig-Hellman algorithm]] exists to "read" the contents of RSA_EXPFIFO as a result (see [[3DS System Flaws#Hardware|3DS System Flaws]]).

== RSA_TXT ==
The RSA signature can be written here, and the data read from here is the message. When writing the RSA signature, the signature must be prepended with zeroes until it is a multiple of 8 bytes, and the end of the signature must align with the end of the register area.

The PKCS message padding must be manually checked by software, as hardware will only do raw RSA operations.

== Keyslots usage ==
{| class="wikitable" border="1"
! Keyslot
! Description
|-
| 0
| Arbitrary
|-
| 1
| [[NCCH#CXI|CXI]] access desc (following the exheader)
|-
| 2-3
| Initialized by the ARM9 bootrom, but not used by any of the [[FIRM]]s. It's unknown what the ARM9 bootrom uses these for, if anything.
|}

IO Registers

2021-02-04T21:08:51Z

TuxSH:

= Overview =

{| class="wikitable" border="1"
! Old3DS
! A9/A11
! Category
! Physaddr
! Used by
! Comments
|-
| style="background: green" | Yes
| A9
| [[CONFIG9 Registers]]
| 0x10000000
| Boot9, Process9
|
|-
| style="background: green" | Yes
| A9
| [[IRQ Registers]]
| 0x10001000
| Boot9, Process9, Kernel9
| ARM9 Interrupt Masking
|-
| style="background: green" | Yes
| A9
| [[NDMA Registers]]
| 0x10002000
| Boot9, Process9
| AHB DMA Engine
|-
| style="background: green" | Yes
| A9
| [[TIMER Registers]]
| 0x10003000
| Boot9, Process9
|
|-
| style="background: green" | Yes
| A9
| [[CTRCARD Registers]]
| 0x10004000 / 0x10005000
| Process9
|
|-
| style="background: green" | Yes
| A9
| [[EMMC Registers]]
| 0x10006000 / 0x10007000
| Boot9, Process9, NewKernel9Loader
| SD(IO) controller 1 and 3. 3 is normally mapped to ARM11.
|-
| style="background: green" | Yes
| A9
| [[PXI Registers]]
| 0x10008000
| Boot9, Process9
|
|-
| style="background: green" | Yes
| A9
| [[AES Registers]]
| 0x10009000
| Boot9, Process9, NewKernel9Loader
|
|-
| style="background: green" | Yes
| A9
| [[SHA Registers]]
| 0x1000A000
| Boot9, Process9, NewKernel9Loader
|
|-
| style="background: green" | Yes
| A9
| [[RSA Registers]]
| 0x1000B000
| Boot9, Process9
|
|-
| style="background: green" | Yes
| A9
| [[Corelink DMA Engines|XDMA Registers]]
| 0x1000C000
| Boot9, Kernel9
| [http://infocenter.arm.com/help/topic/com.arm.doc.subset.primecell.system/index.html CoreLink™ DMA-330 r0p0] (AXI busmaster, two channels, uses 32-bit bus width instead of 64).
|-
| style="background: green" | Yes
| A9
| [[SPICARD Registers]]
| 0x1000D800
| Process9
|
|-style="border-top: double"
| style="background: green" | Yes
| A9
| [[CONFIG Registers]]
| 0x10010000
| Process9
|
|-
| style="background: green" | Yes
| A9
| PRNG Registers
| 0x10011000
| Boot9, Process9
| Used as entropy-source for seeding random number generators.
|-
| style="background: green" | Yes
| A9
| [[OTP Registers]]
| 0x10012000
| Boot9, Kernel9, NewKernel9Loader
| Top secret.
|-
| style="background: green" | Yes
| A9
| [[ARM7|ARM7 Registers]]
| 0x10018000
| TwlProcess9
| Used to setup the ARM7 core for AGB/TWL
|-style="border-top: double"
| style="background: green" | Yes
| A11/A9
| TMIO SD(IO) controller 3
| 0x10100000
|
| NWM references this controller but doesn't have access to it.
|-
| style="background: green" | Yes
| A11/A9
| [[HASH Registers]]
| 0x10101000
| [[Filesystem services]]
| These registers function the same as the [[SHA Registers]], with the exception of the FIFO being located at 0x10301000.
|-
| style="background: green" | Yes
| A11/A9
| [[Y2R Registers]]
| 0x10102000
| [[Camera Services]]
| y2r
|-
| style="background: green" | Yes
| A11/A9
| [[CSND Registers]]
| 0x10103000
| TwlBg, [[Codec Services]], [[CSND Services]], [[DSP Services]]
| Sound hardware.
|-style="border-top: double"
| style="background: green" | Yes
| A11/A9
| [[MTX_Registers|LgyFb bottom screen]]
| 0x10110000
| TwlBg
| IO registers used to access legacy output framebuffer, as well as configure the upscaling filter.
|-
| style="background: green" | Yes
| A11/A9
| [[MTX_Registers|LgyFb top screen]]
| 0x10111000
| TwlBg
| IO registers used to access legacy output framebuffer, as well as configure the upscaling filter.
|-style="border-top: double"
| style="background: green" | Yes
| A11/A9
| [[Camera Registers]]
| 0x10120000
| [[Camera Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[Camera Registers]]
| 0x10121000
| [[Camera Services]]
| Mirror of 0x10120000?
|-
| style="background: green" | Yes
| A11/A9
| [[WIFI Registers]]
| 0x10122000
| [[NWM Services]]
| WIFI SDIO bus registers
|-
| style="background: green" | Yes
| A11/A9
| ?
| 0x10123000
| [[NWM Services]]
| WIFI?
|-style="border-top: double"
| style="background: red" | No
| A11/A9
| [[MVD Registers]]
| 0x10130000
| [[MVD Services]]
|
|-
| style="background: red" | No
| A11/A9
| [[MVD Registers]]
| 0x10131000
| [[MVD Services]]
|
|-
| style="background: red" | No
| A11/A9
| [[MVD Registers]]
| 0x10132000
| [[MVD Services]]
|
|-style="border-top: double"
| style="background: green" | Yes
| A11/A9
| [[CONFIG11 Registers]]
| 0x10140000
| Process9, Boot11, Kernel11, TwlBg, [[DSP Services]], [[NWM Services]], [[SPI Services]]
| System configuration.
|-
| style="background: green" | Yes
| A11/A9
| [[PDN Registers]]
| 0x10141000
| Process9, Boot11, Kernel11, TwlBg, [[Codec Services]], [[NWM Services]], [[SPI Services]], [[PDN Services]]
| Power management
|-
| style="background: green" | Yes
| A11/A9
| [[SPI Registers]]
| 0x10142000
| TwlBg, [[SPI Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[SPI Registers]]
| 0x10143000
| TwlBg, dmnt Module
| Debugger related?
|-
| style="background: green" | Yes
| A11/A9
| [[I2C Registers]]
| 0x10144000
| Boot11, Kernel11, TwlBg, [[I2C Services]]
| 3DS I2C interface (MCU + Cameras + LCD)
|-
| style="background: green" | Yes
| A11/A9
| [[I2S Registers]]
| 0x10145000
| TwlBg, AgbBg, [[Codec Services]]
| Sound input/output lines
|-
| style="background: green" | Yes
| A11/A9
| [[HID Registers]]
| 0x10146000
| Boot9, Boot11, Kernel11, TwlBg, [[HID Services]], dlp Services
| See [[PAD]].
|-
| style="background: green" | Yes
| A11/A9
| [[GPIO Registers]]
| 0x10147000
| Boot11, TwlBg, [[GPIO Services]], [[DSP Services]](v0)
|
|-
| style="background: green" | Yes
| A11/A9
| [[I2C Registers]]
| 0x10148000
| TwlBg, [[I2C Services]]
| 3DS I2C interface (Gyro + IR)
|-style="border-top: double"
| style="background: green" | Yes
| A11/A9
| [[SPI Registers]]
| 0x10160000
| Boot9, TwlBg, [[SPI Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[I2C Registers]]
| 0x10161000
| Boot11, TwlBg, [[I2C Services]]
| TWL I2C interface (MCU + Cameras)
|-
| style="background: green" | Yes
| A11/A9
| [[MIC Registers]]
| 0x10162000
| [[MIC Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[PXI Registers]]
| 0x10163000
| Boot11, Kernel11, TwlBg, [[PXI Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[NTRCARD Registers]]
| 0x10164000
| Boot9, Process9
|
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10165000
| [[MP Services]]
|
|-style="border-top: double"
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10170000
| [[MP Services]]
| NTR WIFI Registers, see [http://problemkaputt.de/gbatek.htm#dswirelesscommunications GBATek].
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10171000
| [[MP Services]]
| NTR WIFI Registers (mirror)
|-
| style="background: green" | Yes
| A11/A9
|?
| 0x10172000
|?
| NTR WIFI Unused?
|-
| style="background: green" | Yes
| A11/A9
|?
| 0x10173000
|?
| NTR WIFI Unused?
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10174000
| [[MP Services]]
| NTR WIFI RAM
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10175000
|?
| NTR WIFI RAM
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10176000
|?
| NTR WIFI Registers (mirror)
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10177000
|?
| NTR WIFI Registers (mirror)
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10178000 - 0x10180000
| [[MP Services]]
| NTR WIFI WS1 Region
|-style="border-top: double"
| style="background: green" | Yes
| A11
| [[Corelink DMA Engines|CDMA]]
| 0x10200000
| Boot11, Kernel11
| [http://infocenter.arm.com/help/topic/com.arm.doc.subset.primecell.system/index.html CoreLink™ DMA-330 r0p0] (eight channels). Only used by bootrom on New3DS.
|-
| style="background: green" | Yes
| A11
| FCRAM configuration
| 0x10201000
| TwlBg, Kernel11 (dead code)
|
|-
| style="background: green" | Yes
| A11
| [[LCD Registers]]
| 0x10202000
| TwlBg, Kernel11, [[GSP Services]]
|
|-
| style="background: green" | Yes
| A11
| [[DSP Registers]]
| 0x10203000
| [[DSP Services]]
| see the "DSi XpertTeak" section in [http://problemkaputt.de/gba.htm no$gba] help.
|-style="border-top: double"
| style="background: red" | No
| A11
| ?
| 0x10204000
| ?
|
|-
| style="background: red" | No
| A11
| [[Corelink DMA Engines|CDMA]]
| 0x10206000
| NewKernel11
| [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0424d/index.html CoreLink™ DMA-330 r1p2] (eight channels). This is the DMA engine actually being used by the New3DS ARM11 kernel.
|-
| style="background: red" | No
| A11
| [[MVD Registers]]
| 0x10207000
| [[MVD Services]]
| New 3DS only?
|-style="border-top: double"
| style="background: green" | Yes
| A11
| AXI
| 0x1020F000
| TwlBg, [[GSP Services]]
| [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0422a/CHDGHIID.html CoreLink™ NIC-301 r1p0].
|-style="border-top: double"
| style="background: green" | Yes
| A11
| AHB (or AXI?) FIFOs region
| 0x10300000-0x10340000
|
| Pages present in this region correspond to the same respective devices in the 0x10100000-0x10140000 region but don't hold the same registers. They hold the FIFOs instead: the HASH FIFO register is located at 0x10301000. The LgyFb scaler data FIFO are located at 0x10310000 (top) and 0x10311000 (bot), etc. Needed for DMA.
|-style="border-top: double"
| style="background: green" | Yes
| A11
| [[GPU/External_Registers|GPU Registers]]
| 0x10400000
| Boot11, Kernel11, [[GSP Services]]
||
|}

IO registers starting at physical address 0x10200000 are not accessible from the ARM9 (which includes all LCD/GPU registers). It seems IO registers below physical address 0x10100000 are not accessible from the ARM11 bus.

ARM11 kernel virtual address mappings for these registers varies for different builds. For ARM11 user mode applications you have:
physaddr = virtaddr - 0x1EC00000 + 0x10100000

ARM11 Interrupts

2021-02-04T20:38:53Z

TuxSH: /* Private Interrupts */

== Interrupts ==

Interrupt priority is 0-0xF. A priority of 0xF means that the interrupt is disabled.

= Private Interrupts =

Each CPU core has 32 software interrupts that are private and belong to that core. These interrupts are numbers 0-0x1F for each core. The hardware interrupts are not core-specific and start at interrupt ID 0x20.

{| class="wikitable" border="1"
! IRQ
! Listener
! Description
|-
| 0
|
| MPCore software-interrupt. Used by Kernel11 to sync cores in crt0.
|-
| 0x1-0x3
|
| MPCore software-interrupt. Used by Boot11 and Kernel11 to kickstart Core1/2/3, and by Kernel11 to sync cores in crt0.
|-
| 0x4
| Kernel
| MPCore software-interrupt. Used to manage the performance counter. Also used by Kernel11 during crt0 to sync up.
|-
| 0x5
| Kernel
| MPCore software-interrupt. Does apparently nothing.
|-
| 0x6
| Kernel
| MPCore software-interrupt. Extensively used by [[SVC|KernelSetState]] (and contains most of the actual code of the latter).
|-
| 0x7
| Kernel
| MPCore software-interrupt. See [[KCacheMaintenanceInterruptEvent]]
|-
| 0x8
| Kernel
| MPCore software-interrupt. Used for scheduling.
|-
| 0x9
| Kernel
| MPCore software-interrupt. Used when handling exceptions that require termination of a thread or a process, and in some cases by svcSetDebugThreadContext, to store VFP registers in the thread's register storage.
|-
| 0xA
| Kernel
| TLB operations interrupt, see [[KTLBOperationsInterruptEvent]]
|-
| 0xB-0xE
|
| MPCore software-interrupt. Not configured.
|-
| 0xF
| dmnt/debugger
| MPCore software-interrupt. Used to abstract FIQ (debug). This interrupt is never sent to core2 nor core3 on N3DS.
|-
| 0x1D
| Kernel
| MPCore timer.
|-
| 0x1E
| Kernel
| MPCore watchdog - set when the watchdog counter reaches 0 in timer mode, causes interrupt 30 to set as pending. Only set on core 1 as core 1's timer is used for everything.
|}

= Hardware Interrupts =

There are 0x60 hardware interrupts starting at 0x20 and continuing up to 0x7F. These are not private and are accessible from any core.

{| class="wikitable" border="1"
! IRQ
! Listener
! Description
|-
| 0x24
| ?
| SPI bus 2 interrupt status update
|-
| 0x28
| gsp, TwlBg
| PSC0
|-
| 0x29
| gsp, TwlBg
| PSC1
|-
| 0x2A
| gsp, TwlBg
| PDC0 (VBlank0)
|-
| 0x2B
| gsp, TwlBg
| PDC1 (VBlank1)
|-
| 0x2C
| gsp, TwlBg
| PPF
|-
| 0x2D
| gsp, TwlBg
| P3D
|-
| 0x30-0x38
| Kernel
| Old CDMA Event 0..8 (9 separate IRQ lines)
|-
| 0x39
| Kernel
| Old CDMA Faulting (eg. CCR=0, or event>15)
|-
| 0x3A
| Kernel
| New CDMA Event 0..31 (shared IRQ line)
|-
| 0x3B
| Kernel
| New CDMA Faulting (eg. CCR=0)
|-
| 0x40
| nwm
| WIFI SDIO Controller @ 0x10122000
|-
| 0x41
| nwm
| WIFI SDIO Controller IRQ pin @ 0x10122000
|-
| 0x42
| nwm_dev?
| Debug WIFI SDIO Controller @ 0x10100000 ?
|-
| 0x43
| nwm_dev?
| Debug WIFI SDIO Controller @ 0x10100000 ?
|-
| 0x44
| ?
| NTRCARD (maybe?)
|-
| 0x45
| mvd (New3DS)
| L2B_0 (First RGB-to-RGBA Converter)
|-
| 0x46
| mvd (New3DS)
| L2B_1 (Second RGB-to-RGBA Converter)
|-
| 0x48
| camera
| Camera Bus 0 (DSi cameras)
|-
| 0x49
| camera
| Camera Bus 1 (left-eye)
|-
| 0x4A
| dsp
| General interrupt from DSP, including semaphore and command/reply registers status change
|-
| 0x4B
| camera
| Y2R Conversion Finished
|-
| 0x4C
| TwlBg
| LGYFB_0 Legacy GBA/NDS Video
|-
| 0x4D
| TwlBg
| LGYFB_1 Legacy GBA/NDS Video
|-
| 0x4E
| mvd (New3DS)
| Y2R2 End Event
|-
| 0x4F
| mvd (New3DS)
| MVD general interrupt?
|-
| 0x50
| pxi, TwlBg
| Sync (bit 29 from Arm9's PXI_SYNC)
|-
| 0x51
| pxi, TwlBg
| Sync 2 (bit 30 from Arm9's PXI_SYNC)
|-
| 0x52
| pxi, TwlBg
| Send Fifo Empty
|-
| 0x53
| pxi, TwlBg
| Receive Fifo Not Empty
|-
| 0x54
| i2c, TwlBg
| I2C Bus0 work done
|-
| 0x55
| i2c, TwlBg
| I2C Bus1 work done
|-
| 0x56
| spi, TwlBg
| SPI bus 3 interrupt status update
|-
| 0x57
| spi, TwlBg
| SPI bus 1 interrupt status update
|-
| 0x58
| Kernel
| PDN (wake event or SoC mode changed)
|-
| 0x59
| TwlBg
| PDN Legacy Sleep
|-
| 0x5A
| mic
| General microphone interrupt (?)
|-
| 0x5B
| -
| [[HID_Registers#HID_PAD_CNT|HID_PAD_CNT]]
|-
| 0x5C
| i2c, TwlBg
| I2C Bus2 work done
|-
| 0x5F
| mp
| DS WiFi registers
|-
| 0x60
| gpio, TwlBg
| Shell opened (GPIO1_2 falling edge)
|-
| 0x62
| gpio, TwlBg
| Shell closed (GPIO1_2 rising edge)
|-
| 0x63
| gpio, TwlBg
| Touch Screen pressed (GPIO1_1 falling edge)
|-
| 0x64
| gpio, TwlBg
| Headphones inserted (GPIO2_0)
|-
| 0x66
| gpio, TwlBg
| TWL depop circuit (GPIO2_1)
|-
| 0x68
| gpio, TwlBg
| C-stick interrupt (GPIO3_0)
|-
| 0x69
| gpio, TwlBg
| IrDA interrupt (active-low) (GPIO3_1)
|-
| 0x6A
| gpio, TwlBg
| Gyro interrupt (GPIO3_2)
|-
| 0x6B
| gpio, TwlBg
| C-stick "stop" (output) (GPIO3_3)
|-
| 0x6C
| gpio, TwlBg
| IrDA TX-RC (output) (GPIO3_4)
|-
| 0x6D
| gpio, TwlBg
| IrDA RXD (GPIO3_5)
|-
| 0x6E
| gpio, TwlBg
| NFC output1 (?) (GPIO3_6)
|-
| 0x6F
| gpio, TwlBg
| NFC output2 (?) (GPIO3_7)
|-
| 0x70
| gpio, TwlBg
| Headphones button/half-inserted (active-low) (GPIO3_8)
|-
| 0x71
| gpio, TwlBg
| MCU interrupt (GPIO3_9)
|-
| 0x72
| gpio, TwlBg
| NFC interrupt (?) (GPIO3_10)
|-
| 0x73
| TwlBg
| QTM output (?) (GPIO3_11)
|-
| 0x74
| ?
| Gamecard related
|-
| 0x75
| ?
| Gamecard inserted
|-
| 0x76
| -
| L2C
|-
| 0x78 to 0x7B
| Kernel
| Core 0-3 Performance monitor counter (any) overflow
|-
| 0x7A to 0x82 (PDN_MPCORE_CFG bit2 set) or
0x7C to 0x84 (bit2 clear)
| Kernel
| Other PMU interrupts (line may not exist at all)
|}
(interrupts from 0x80 and up can't be mapped in available builds of the kernel)

There are 2 tables in the Arm11 kernel: the first has 32 * 2(or 32 * 4) 8-byte entries. This table is for the private interrupts that belong to each core. The data for each interrupt can be found by doing table_base + (core_num * 0x100) + (intr_num * 8). The second table is for public hardware interrupts and the data for each interrupt can be retrieved by doing table_base + (intr_num * 8).

The Arm11 kernel configures interrupts the following way (it seems the GPIO IRQ layout doesn't match released 3DS models):

<nowiki>Interrupts 0x00 to 0x1F: edge-triggered, N-N
Interrupt 0x20: level-sensitive, 1-N
Interrupt 0x21: level-sensitive, 1-N
Interrupt 0x22: level-sensitive, 1-N
Interrupt 0x23: level-sensitive, 1-N
Interrupt 0x24: edge-triggered, 1-N
Interrupt 0x25: level-sensitive, 1-N
Interrupt 0x28: level-sensitive, 1-N
Interrupt 0x29: level-sensitive, 1-N
Interrupt 0x2a: level-sensitive, 1-N
Interrupt 0x2b: level-sensitive, 1-N
Interrupt 0x2c: level-sensitive, 1-N
Interrupt 0x2d: level-sensitive, 1-N
Interrupt 0x30: level-sensitive, 1-N
Interrupt 0x31: level-sensitive, 1-N
Interrupt 0x32: level-sensitive, 1-N
Interrupt 0x33: level-sensitive, 1-N
Interrupt 0x34: level-sensitive, 1-N
Interrupt 0x35: level-sensitive, 1-N
Interrupt 0x36: level-sensitive, 1-N
Interrupt 0x37: level-sensitive, 1-N
Interrupt 0x38: level-sensitive, 1-N
Interrupt 0x39: level-sensitive, 1-N
Interrupt 0x3a: level-sensitive, 1-N
Interrupt 0x3b: level-sensitive, 1-N
Interrupt 0x40: edge-triggered, 1-N
Interrupt 0x41: edge-triggered, 1-N
Interrupt 0x42: edge-triggered, 1-N
Interrupt 0x43: edge-triggered, 1-N
Interrupt 0x44: edge-triggered, 1-N
Interrupt 0x45: edge-triggered, 1-N
Interrupt 0x46: edge-triggered, 1-N
Interrupt 0x48: edge-triggered, 1-N
Interrupt 0x49: edge-triggered, 1-N
Interrupt 0x4a: edge-triggered, 1-N
Interrupt 0x4b: edge-triggered, 1-N
Interrupt 0x4c: edge-triggered, 1-N
Interrupt 0x4d: edge-triggered, 1-N
Interrupt 0x4e: edge-triggered, 1-N
Interrupt 0x4f: level-sensitive, 1-N
Interrupt 0x50: edge-triggered, 1-N
Interrupt 0x51: edge-triggered, 1-N
Interrupt 0x52: edge-triggered, 1-N
Interrupt 0x53: edge-triggered, 1-N
Interrupt 0x54: edge-triggered, 1-N
Interrupt 0x55: edge-triggered, 1-N
Interrupt 0x56: edge-triggered, 1-N
Interrupt 0x57: edge-triggered, 1-N
Interrupt 0x58: level-sensitive, 1-N
Interrupt 0x59: edge-triggered, 1-N
Interrupt 0x5a: edge-triggered, 1-N
Interrupt 0x5b: edge-triggered, 1-N
Interrupt 0x5f: edge-triggered, 1-N
Interrupt 0x60: edge-triggered, 1-N
Interrupt 0x61: edge-triggered, 1-N
Interrupt 0x64: edge-triggered, 1-N
Interrupt 0x65: edge-triggered, 1-N
Interrupt 0x66: edge-triggered, 1-N
Interrupt 0x68: edge-triggered, 1-N
Interrupt 0x69: edge-triggered, 1-N
Interrupt 0x6a: edge-triggered, 1-N
Interrupt 0x6b: edge-triggered, 1-N
Interrupt 0x6c: edge-triggered, 1-N
Interrupt 0x6d: edge-triggered, 1-N
Interrupt 0x6e: edge-triggered, 1-N
Interrupt 0x6f: edge-triggered, 1-N
Interrupt 0x70: edge-triggered, 1-N
Interrupt 0x71: edge-triggered, 1-N
Interrupt 0x72: edge-triggered, 1-N
Interrupt 0x73: edge-triggered, 1-N
Interrupt 0x74: edge-triggered, 1-N
Interrupt 0x75: edge-triggered, 1-N
Interrupt 0x76: level-sensitive, 1-N
Interrupt 0x77: level-sensitive, 1-N
Interrupt 0x78: edge-triggered, 1-N
Interrupt 0x79: level-sensitive, 1-N
Interrupt 0x7a: level-sensitive, 1-N
Interrupt 0x7b: level-sensitive, 1-N
Interrupt 0x7c: level-sensitive, 1-N
Interrupt 0x7d: level-sensitive, 1-N</nowiki>

= InterruptData =
{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| [[KBaseInterruptEvent]] *
| Pointer to the KBaseInterruptEvent object for this interrupt
|-
| 0x4
| u8
| Interrupt will be disabled by the IRQ handler as soon as it is acknowledged.
Ignored for FIQ: the FIQ handler always sets bit2 of [[PDN_Registers#PDN_FIQ_CNT|PDN_FIQ_CNT]]
|-
| 0x5
| u8
| Interrupt is disabled
|-
| 0x6
| u8
| Interrupt priority
|-
| 0x7
| u8
| Unused, alignment
|}

= Interrupt Table (New3DS) =
(0xFFF318F4 in 10.3)

{| class="wikitable" border="1"
! Offset
! Type
! Description
|-
| 0x0
| InterruptData[224]
| Data for all hardware and software interrupts
|-
| 0x700
| [[KObjectMutex]]
| Mutex
|}

ARM11 Interrupts

2021-02-04T19:52:04Z

TuxSH:

== Interrupts ==

Interrupt priority is 0-0xF. A priority of 0xF means that the interrupt is disabled.

= Private Interrupts =

Each CPU core has 32 software interrupts that are private and belong to that core. These interrupts are numbers 0-0x1F for each core. The hardware interrupts are not core-specific and start at interrupt ID 0x20.

{| class="wikitable" border="1"
! IRQ
! Listener
! Description
|-
| 0
|
| MPCore software-interrupt. Used by Kernel11 to sync cores in crt0.
|-
| 0x1-0x3
|
| MPCore software-interrupt. Used by Boot11 and Kernel11 to kickstart Core1/2/3.
|-
| 0x4
| Kernel
| MPCore software-interrupt. Used to manage the performance counter.
|-
| 0x5
| Kernel
| MPCore software-interrupt. Does apparently nothing.
|-
| 0x6
| Kernel
| MPCore software-interrupt. Extensively used by [[SVC|KernelSetState]] (and contains most of the actual code of the latter).
|-
| 0x7
| Kernel
| MPCore software-interrupt. See [[KCacheMaintenanceInterruptEvent]]
|-
| 0x8
| Kernel
| MPCore software-interrupt. Used for scheduling.
|-
| 0x9
| Kernel
| MPCore software-interrupt. Used when handling exceptions that require termination of a thread or a process, and in some cases by svcSetDebugThreadContext, to store VFP registers in the thread's register storage.
|-
| 0xA
| Kernel
| TLB operations interrupt, see [[KTLBOperationsInterruptEvent]]
|-
| 0xB-0xE
|
| MPCore software-interrupt. Not configured.
|-
| 0xF
| dmnt/debugger
| MPCore software-interrupt. Used to abstract FIQ (debug). This interrupt is never sent to core2 nor core3 on N3DS.
|-
| 0x1D
| Kernel
| MPCore timer.
|-
| 0x1E
| Kernel
| MPCore watchdog - set when the watchdog counter reaches 0 in timer mode, causes interrupt 30 to set as pending. Only set on core 1 as core 1's timer is used for everything.
|}

= Hardware Interrupts =

There are 0x60 hardware interrupts starting at 0x20 and continuing up to 0x7F. These are not private and are accessible from any core.

{| class="wikitable" border="1"
! IRQ
! Listener
! Description
|-
| 0x24
| ?
| SPI bus 2 interrupt status update
|-
| 0x28
| gsp, TwlBg
| PSC0
|-
| 0x29
| gsp, TwlBg
| PSC1
|-
| 0x2A
| gsp, TwlBg
| PDC0 (VBlank0)
|-
| 0x2B
| gsp, TwlBg
| PDC1 (VBlank1)
|-
| 0x2C
| gsp, TwlBg
| PPF
|-
| 0x2D
| gsp, TwlBg
| P3D
|-
| 0x30-0x38
| Kernel
| Old CDMA Event 0..8 (9 separate IRQ lines)
|-
| 0x39
| Kernel
| Old CDMA Faulting (eg. CCR=0, or event>15)
|-
| 0x3A
| Kernel
| New CDMA Event 0..31 (shared IRQ line)
|-
| 0x3B
| Kernel
| New CDMA Faulting (eg. CCR=0)
|-
| 0x40
| nwm
| WIFI SDIO Controller @ 0x10122000
|-
| 0x41
| nwm
| WIFI SDIO Controller IRQ pin @ 0x10122000
|-
| 0x42
| nwm_dev?
| Debug WIFI SDIO Controller @ 0x10100000 ?
|-
| 0x43
| nwm_dev?
| Debug WIFI SDIO Controller @ 0x10100000 ?
|-
| 0x44
| ?
| NTRCARD (maybe?)
|-
| 0x45
| mvd (New3DS)
| L2B_0 (First RGB-to-RGBA Converter)
|-
| 0x46
| mvd (New3DS)
| L2B_1 (Second RGB-to-RGBA Converter)
|-
| 0x48
| camera
| Camera Bus 0 (DSi cameras)
|-
| 0x49
| camera
| Camera Bus 1 (left-eye)
|-
| 0x4A
| dsp
| General interrupt from DSP, including semaphore and command/reply registers status change
|-
| 0x4B
| camera
| Y2R Conversion Finished
|-
| 0x4C
| TwlBg
| LGYFB_0 Legacy GBA/NDS Video
|-
| 0x4D
| TwlBg
| LGYFB_1 Legacy GBA/NDS Video
|-
| 0x4E
| mvd (New3DS)
| Y2R2 End Event
|-
| 0x4F
| mvd (New3DS)
| MVD general interrupt?
|-
| 0x50
| pxi, TwlBg
| Sync (bit 29 from Arm9's PXI_SYNC)
|-
| 0x51
| pxi, TwlBg
| Sync 2 (bit 30 from Arm9's PXI_SYNC)
|-
| 0x52
| pxi, TwlBg
| Send Fifo Empty
|-
| 0x53
| pxi, TwlBg
| Receive Fifo Not Empty
|-
| 0x54
| i2c, TwlBg
| I2C Bus0 work done
|-
| 0x55
| i2c, TwlBg
| I2C Bus1 work done
|-
| 0x56
| spi, TwlBg
| SPI bus 3 interrupt status update
|-
| 0x57
| spi, TwlBg
| SPI bus 1 interrupt status update
|-
| 0x58
| Kernel
| PDN (wake event or SoC mode changed)
|-
| 0x59
| TwlBg
| PDN Legacy Sleep
|-
| 0x5A
| mic
| General microphone interrupt (?)
|-
| 0x5B
| -
| [[HID_Registers#HID_PAD_CNT|HID_PAD_CNT]]
|-
| 0x5C
| i2c, TwlBg
| I2C Bus2 work done
|-
| 0x5F
| mp
| DS WiFi registers
|-
| 0x60
| gpio, TwlBg
| Shell opened (GPIO1_2 falling edge)
|-
| 0x62
| gpio, TwlBg
| Shell closed (GPIO1_2 rising edge)
|-
| 0x63
| gpio, TwlBg
| Touch Screen pressed (GPIO1_1 falling edge)
|-
| 0x64
| gpio, TwlBg
| Headphones inserted (GPIO2_0)
|-
| 0x66
| gpio, TwlBg
| TWL depop circuit (GPIO2_1)
|-
| 0x68
| gpio, TwlBg
| C-stick interrupt (GPIO3_0)
|-
| 0x69
| gpio, TwlBg
| IrDA interrupt (active-low) (GPIO3_1)
|-
| 0x6A
| gpio, TwlBg
| Gyro interrupt (GPIO3_2)
|-
| 0x6B
| gpio, TwlBg
| C-stick "stop" (output) (GPIO3_3)
|-
| 0x6C
| gpio, TwlBg
| IrDA TX-RC (output) (GPIO3_4)
|-
| 0x6D
| gpio, TwlBg
| IrDA RXD (GPIO3_5)
|-
| 0x6E
| gpio, TwlBg
| NFC output1 (?) (GPIO3_6)
|-
| 0x6F
| gpio, TwlBg
| NFC output2 (?) (GPIO3_7)
|-
| 0x70
| gpio, TwlBg
| Headphones button/half-inserted (active-low) (GPIO3_8)
|-
| 0x71
| gpio, TwlBg
| MCU interrupt (GPIO3_9)
|-
| 0x72
| gpio, TwlBg
| NFC interrupt (?) (GPIO3_10)
|-
| 0x73
| TwlBg
| QTM output (?) (GPIO3_11)
|-
| 0x74
| ?
| Gamecard related
|-
| 0x75
| ?
| Gamecard inserted
|-
| 0x76
| -
| L2C
|-
| 0x78 to 0x7B
| Kernel
| Core 0-3 Performance monitor counter (any) overflow
|-
| 0x7A to 0x82 (PDN_MPCORE_CFG bit2 set) or
0x7C to 0x84 (bit2 clear)
| Kernel
| Other PMU interrupts (line may not exist at all)
|}
(interrupts from 0x80 and up can't be mapped in available builds of the kernel)

There are 2 tables in the Arm11 kernel: the first has 32 * 2(or 32 * 4) 8-byte entries. This table is for the private interrupts that belong to each core. The data for each interrupt can be found by doing table_base + (core_num * 0x100) + (intr_num * 8). The second table is for public hardware interrupts and the data for each interrupt can be retrieved by doing table_base + (intr_num * 8).

The Arm11 kernel configures interrupts the following way (it seems the GPIO IRQ layout doesn't match released 3DS models):

<nowiki>Interrupts 0x00 to 0x1F: edge-triggered, N-N
Interrupt 0x20: level-sensitive, 1-N
Interrupt 0x21: level-sensitive, 1-N
Interrupt 0x22: level-sensitive, 1-N
Interrupt 0x23: level-sensitive, 1-N
Interrupt 0x24: edge-triggered, 1-N
Interrupt 0x25: level-sensitive, 1-N
Interrupt 0x28: level-sensitive, 1-N
Interrupt 0x29: level-sensitive, 1-N
Interrupt 0x2a: level-sensitive, 1-N
Interrupt 0x2b: level-sensitive, 1-N
Interrupt 0x2c: level-sensitive, 1-N
Interrupt 0x2d: level-sensitive, 1-N
Interrupt 0x30: level-sensitive, 1-N
Interrupt 0x31: level-sensitive, 1-N
Interrupt 0x32: level-sensitive, 1-N
Interrupt 0x33: level-sensitive, 1-N
Interrupt 0x34: level-sensitive, 1-N
Interrupt 0x35: level-sensitive, 1-N
Interrupt 0x36: level-sensitive, 1-N
Interrupt 0x37: level-sensitive, 1-N
Interrupt 0x38: level-sensitive, 1-N
Interrupt 0x39: level-sensitive, 1-N
Interrupt 0x3a: level-sensitive, 1-N
Interrupt 0x3b: level-sensitive, 1-N
Interrupt 0x40: edge-triggered, 1-N
Interrupt 0x41: edge-triggered, 1-N
Interrupt 0x42: edge-triggered, 1-N
Interrupt 0x43: edge-triggered, 1-N
Interrupt 0x44: edge-triggered, 1-N
Interrupt 0x45: edge-triggered, 1-N
Interrupt 0x46: edge-triggered, 1-N
Interrupt 0x48: edge-triggered, 1-N
Interrupt 0x49: edge-triggered, 1-N
Interrupt 0x4a: edge-triggered, 1-N
Interrupt 0x4b: edge-triggered, 1-N
Interrupt 0x4c: edge-triggered, 1-N
Interrupt 0x4d: edge-triggered, 1-N
Interrupt 0x4e: edge-triggered, 1-N
Interrupt 0x4f: level-sensitive, 1-N
Interrupt 0x50: edge-triggered, 1-N
Interrupt 0x51: edge-triggered, 1-N
Interrupt 0x52: edge-triggered, 1-N
Interrupt 0x53: edge-triggered, 1-N
Interrupt 0x54: edge-triggered, 1-N
Interrupt 0x55: edge-triggered, 1-N
Interrupt 0x56: edge-triggered, 1-N
Interrupt 0x57: edge-triggered, 1-N
Interrupt 0x58: level-sensitive, 1-N
Interrupt 0x59: edge-triggered, 1-N
Interrupt 0x5a: edge-triggered, 1-N
Interrupt 0x5b: edge-triggered, 1-N
Interrupt 0x5f: edge-triggered, 1-N
Interrupt 0x60: edge-triggered, 1-N
Interrupt 0x61: edge-triggered, 1-N
Interrupt 0x64: edge-triggered, 1-N
Interrupt 0x65: edge-triggered, 1-N
Interrupt 0x66: edge-triggered, 1-N
Interrupt 0x68: edge-triggered, 1-N
Interrupt 0x69: edge-triggered, 1-N
Interrupt 0x6a: edge-triggered, 1-N
Interrupt 0x6b: edge-triggered, 1-N
Interrupt 0x6c: edge-triggered, 1-N
Interrupt 0x6d: edge-triggered, 1-N
Interrupt 0x6e: edge-triggered, 1-N
Interrupt 0x6f: edge-triggered, 1-N
Interrupt 0x70: edge-triggered, 1-N
Interrupt 0x71: edge-triggered, 1-N
Interrupt 0x72: edge-triggered, 1-N
Interrupt 0x73: edge-triggered, 1-N
Interrupt 0x74: edge-triggered, 1-N
Interrupt 0x75: edge-triggered, 1-N
Interrupt 0x76: level-sensitive, 1-N
Interrupt 0x77: level-sensitive, 1-N
Interrupt 0x78: edge-triggered, 1-N
Interrupt 0x79: level-sensitive, 1-N
Interrupt 0x7a: level-sensitive, 1-N
Interrupt 0x7b: level-sensitive, 1-N
Interrupt 0x7c: level-sensitive, 1-N
Interrupt 0x7d: level-sensitive, 1-N</nowiki>

= InterruptData =
{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| [[KBaseInterruptEvent]] *
| Pointer to the KBaseInterruptEvent object for this interrupt
|-
| 0x4
| u8
| Interrupt will be disabled by the IRQ handler as soon as it is acknowledged.
Ignored for FIQ: the FIQ handler always sets bit2 of [[PDN_Registers#PDN_FIQ_CNT|PDN_FIQ_CNT]]
|-
| 0x5
| u8
| Interrupt is disabled
|-
| 0x6
| u8
| Interrupt priority
|-
| 0x7
| u8
| Unused, alignment
|}

= Interrupt Table (New3DS) =
(0xFFF318F4 in 10.3)

{| class="wikitable" border="1"
! Offset
! Type
! Description
|-
| 0x0
| InterruptData[224]
| Data for all hardware and software interrupts
|-
| 0x700
| [[KObjectMutex]]
| Mutex
|}

IO Registers

2021-01-30T15:14:13Z

TuxSH:

= Overview =

{| class="wikitable" border="1"
! Old3DS
! A9/A11
! Category
! Physaddr
! Used by
! Comments
|-
| style="background: green" | Yes
| A9
| [[CONFIG9 Registers]]
| 0x10000000
| Boot9, Process9
|
|-
| style="background: green" | Yes
| A9
| [[IRQ Registers]]
| 0x10001000
| Boot9, Process9, Kernel9
| ARM9 Interrupt Masking
|-
| style="background: green" | Yes
| A9
| [[NDMA Registers]]
| 0x10002000
| Boot9, Process9
| AHB DMA Engine
|-
| style="background: green" | Yes
| A9
| [[TIMER Registers]]
| 0x10003000
| Boot9, Process9
|
|-
| style="background: green" | Yes
| A9
| [[CTRCARD Registers]]
| 0x10004000 / 0x10005000
| Process9
|
|-
| style="background: green" | Yes
| A9
| [[EMMC Registers]]
| 0x10006000 / 0x10007000
| Boot9, Process9, NewKernel9Loader
| SD(IO) controller 1 and 3. 3 is normally mapped to ARM11.
|-
| style="background: green" | Yes
| A9
| [[PXI Registers]]
| 0x10008000
| Boot9, Process9
|
|-
| style="background: green" | Yes
| A9
| [[AES Registers]]
| 0x10009000
| Boot9, Process9, NewKernel9Loader
|
|-
| style="background: green" | Yes
| A9
| [[SHA Registers]]
| 0x1000A000
| Boot9, Process9, NewKernel9Loader
|
|-
| style="background: green" | Yes
| A9
| [[RSA Registers]]
| 0x1000B000
| Boot9, Process9
|
|-
| style="background: green" | Yes
| A9
| [[Corelink DMA Engines|XDMA Registers]]
| 0x1000C000
| Boot9, Kernel9
| [http://infocenter.arm.com/help/topic/com.arm.doc.subset.primecell.system/index.html CoreLink™ DMA-330 r0p0] (AXI busmaster, two channels, uses 32-bit bus width instead of 64).
|-
| style="background: green" | Yes
| A9
| [[SPICARD Registers]]
| 0x1000D800
| Process9
|
|-style="border-top: double"
| style="background: green" | Yes
| A9
| [[CONFIG Registers]]
| 0x10010000
| Process9
|
|-
| style="background: green" | Yes
| A9
| PRNG Registers
| 0x10011000
| Boot9, Process9
| Used as entropy-source for seeding random number generators.
|-
| style="background: green" | Yes
| A9
| [[OTP Registers]]
| 0x10012000
| Boot9, Kernel9, NewKernel9Loader
| Top secret.
|-
| style="background: green" | Yes
| A9
| [[ARM7|ARM7 Registers]]
| 0x10018000
| TwlProcess9
| Used to setup the ARM7 core for AGB/TWL
|-style="border-top: double"
| style="background: green" | Yes
| A11/A9
| TMIO SD(IO) controller 3
| 0x10100000
|
| NWM references this controller but doesn't have access to it.
|-
| style="background: green" | Yes
| A11/A9
| [[HASH Registers]]
| 0x10101000
| [[Filesystem services]]
| These registers function the same as the [[SHA Registers]], with the exception of the FIFO being located at 0x10301000.
|-
| style="background: green" | Yes
| A11/A9
| [[Y2R Registers]]
| 0x10102000
| [[Camera Services]]
| y2r
|-
| style="background: green" | Yes
| A11/A9
| [[CSND Registers]]
| 0x10103000
| TwlBg, [[Codec Services]], [[CSND Services]], [[DSP Services]]
| Sound hardware.
|-style="border-top: double"
| style="background: green" | Yes
| A11/A9
| [[MTX_Registers|LgyFb bottom screen]]
| 0x10110000
| TwlBg
| IO registers used to access legacy output framebuffer, as well as configure the upscaling filter.
|-
| style="background: green" | Yes
| A11/A9
| [[MTX_Registers|LgyFb top screen]]
| 0x10111000
| TwlBg
| IO registers used to access legacy output framebuffer, as well as configure the upscaling filter.
|-style="border-top: double"
| style="background: green" | Yes
| A11/A9
| [[Camera Registers]]
| 0x10120000
| [[Camera Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[Camera Registers]]
| 0x10121000
| [[Camera Services]]
| Mirror of 0x10120000?
|-
| style="background: green" | Yes
| A11/A9
| [[WIFI Registers]]
| 0x10122000
| [[NWM Services]]
| WIFI SDIO bus registers
|-
| style="background: green" | Yes
| A11/A9
| ?
| 0x10123000
| [[NWM Services]]
| WIFI?
|-style="border-top: double"
| style="background: red" | No
| A11/A9
| [[MVD Registers]]
| 0x10130000
| [[MVD Services]]
|
|-
| style="background: red" | No
| A11/A9
| [[MVD Registers]]
| 0x10131000
| [[MVD Services]]
|
|-
| style="background: red" | No
| A11/A9
| [[MVD Registers]]
| 0x10132000
| [[MVD Services]]
|
|-style="border-top: double"
| style="background: green" | Yes
| A11/A9
| [[CONFIG11 Registers]]
| 0x10140000
| Process9, Boot11, Kernel11, TwlBg, [[DSP Services]], [[NWM Services]], [[SPI Services]]
| System configuration.
|-
| style="background: green" | Yes
| A11/A9
| [[PDN Registers]]
| 0x10141000
| Process9, Boot11, Kernel11, TwlBg, [[Codec Services]], [[NWM Services]], [[SPI Services]], [[PDN Services]]
| Power management
|-
| style="background: green" | Yes
| A11/A9
| [[SPI Registers]]
| 0x10142000
| TwlBg, [[SPI Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[SPI Registers]]
| 0x10143000
| TwlBg, dmnt Module
| Debugger related?
|-
| style="background: green" | Yes
| A11/A9
| [[I2C Registers]]
| 0x10144000
| Boot11, Kernel11, TwlBg, [[I2C Services]]
| 3DS I2C interface (MCU + Cameras + LCD)
|-
| style="background: green" | Yes
| A11/A9
| [[I2S Registers]]
| 0x10145000
| TwlBg, AgbBg, [[Codec Services]]
| Sound input/output lines
|-
| style="background: green" | Yes
| A11/A9
| [[HID Registers]]
| 0x10146000
| Boot9, Boot11, Kernel11, TwlBg, [[HID Services]], dlp Services
| See [[PAD]].
|-
| style="background: green" | Yes
| A11/A9
| [[GPIO Registers]]
| 0x10147000
| Boot11, TwlBg, [[GPIO Services]], [[DSP Services]](v0)
|
|-
| style="background: green" | Yes
| A11/A9
| [[I2C Registers]]
| 0x10148000
| TwlBg, [[I2C Services]]
| 3DS I2C interface (Gyro + IR)
|-style="border-top: double"
| style="background: green" | Yes
| A11/A9
| [[SPI Registers]]
| 0x10160000
| Boot9, TwlBg, [[SPI Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[I2C Registers]]
| 0x10161000
| Boot11, TwlBg, [[I2C Services]]
| TWL I2C interface (MCU + Cameras)
|-
| style="background: green" | Yes
| A11/A9
| [[MIC Registers]]
| 0x10162000
| [[MIC Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[PXI Registers]]
| 0x10163000
| Boot11, Kernel11, TwlBg, [[PXI Services]]
|
|-
| style="background: green" | Yes
| A11/A9
| [[NTRCARD Registers]]
| 0x10164000
| Boot9, Process9
|
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10165000
| [[MP Services]]
|
|-style="border-top: double"
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10170000
| [[MP Services]]
| NTR WIFI Registers, see [http://problemkaputt.de/gbatek.htm#dswirelesscommunications GBATek].
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10171000
| [[MP Services]]
| NTR WIFI Registers (mirror)
|-
| style="background: green" | Yes
| A11/A9
|?
| 0x10172000
|?
| NTR WIFI Unused?
|-
| style="background: green" | Yes
| A11/A9
|?
| 0x10173000
|?
| NTR WIFI Unused?
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10174000
| [[MP Services]]
| NTR WIFI RAM
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10175000
|?
| NTR WIFI RAM
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10176000
|?
| NTR WIFI Registers (mirror)
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10177000
|?
| NTR WIFI Registers (mirror)
|-
| style="background: green" | Yes
| A11/A9
| [[MP Registers]]
| 0x10178000 - 0x10180000
| [[MP Services]]
| NTR WIFI WS1 Region
|-style="border-top: double"
| style="background: green" | Yes
| A11
| [[Corelink DMA Engines|CDMA]]
| 0x10200000
| Boot11, Kernel11
| [http://infocenter.arm.com/help/topic/com.arm.doc.subset.primecell.system/index.html CoreLink™ DMA-330 r0p0] (eight channels). Only used by bootrom on New3DS.
|-
| style="background: green" | Yes
| A11
| FCRAM configuration
| 0x10201000
| TwlBg, Kernel11 (dead code)
|
|-
| style="background: green" | Yes
| A11
| [[LCD Registers]]
| 0x10202000
| TwlBg, Kernel11, [[GSP Services]]
|
|-
| style="background: green" | Yes
| A11
| [[DSP Registers]]
| 0x10203000
| [[DSP Services]]
| see the "DSi XpertTeak" section in [http://problemkaputt.de/gba.htm no$gba] help.
|-style="border-top: double"
| style="background: red" | No
| A11
| ?
| 0x10204000
| ?
|
|-
| style="background: red" | No
| A11
| [[Corelink DMA Engines|CDMA]]
| 0x10206000
| NewKernel11
| [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0424d/index.html CoreLink™ DMA-330 r1p2] (eight channels). This is the DMA engine actually being used by the New3DS ARM11 kernel.
|-
| style="background: red" | No
| A11
| [[MVD Registers]]
| 0x10207000
| [[MVD Services]]
| New 3DS only?
|-style="border-top: double"
| style="background: green" | Yes
| A11
| AXI
| 0x1020F000
| TwlBg, [[GSP Services]]
| [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0422a/CHDGHIID.html CoreLink™ NIC-301 r1p0].
|-style="border-top: double"
| style="background: green" | Yes
| A11
| DMA region
| 0x10300000-0x10400000
|
| CDMA wants these addresses. Most pages in this region correspond to the same respective pages in the 0x10100000-0x10200000 region. The HASH FIFO register is located at 0x10301000 only. The LgyFb scaler data FIFO are located at 0x10310000 (top) and 0x10311000 (bot) only.
|-style="border-top: double"
| style="background: green" | Yes
| A11
| [[GPU/External_Registers|GPU Registers]]
| 0x10400000
| Boot11, Kernel11, [[GSP Services]]
||
|}

IO registers starting at physical address 0x10200000 are not accessible from the ARM9 (which includes all LCD/GPU registers). It seems IO registers below physical address 0x10100000 are not accessible from the ARM11 bus.

ARM11 kernel virtual address mappings for these registers varies for different builds. For ARM11 user mode applications you have:
physaddr = virtaddr - 0x1EC00000 + 0x10100000

IRQ Registers

2021-01-29T15:20:20Z

TuxSH: /* IRQ_IF */

= Registers =
{| class="wikitable" border="1"
! Old3DS
! Name
! Address
! Width
! Used by
|-
| style="background: green" | Yes
| [[#IRQ_IE|IRQ_IE]]
| 0x10001000
| 4
| Boot9, Kernel9
|-
| style="background: green" | Yes
| [[#IRQ_IF|IRQ_IF]]
| 0x10001004
| 4
| Boot9, Kernel9
|}

==IRQ_IE==
Bitfield with enabled interrupts. See below for the IRQ<->bit mapping.

==IRQ_IF==
Bitfield with pending interrupts. See below for the IRQ<->bit mapping.

Returns the pending interrupt bits on read, clears them on write (writing 0-bits has no effect).

== Interrupts ==
{| class="wikitable" border="1"
! IRQ bit
! Description
|-
| 0
| DMAC_1_0
|-
| 1
| DMAC_1_1
|-
| 2
| DMAC_1_2
|-
| 3
| DMAC_1_3
|-
| 4
| DMAC_1_4
|-
| 5
| DMAC_1_5
|-
| 6
| DMAC_1_6
|-
| 7
| DMAC_1_7
|-
| 8
| TIMER_0
|-
| 9
| TIMER_1
|-
| 10
| TIMER_2
|-
| 11
| TIMER_3
|-
| 12
| PXI_SYNC
|-
| 13
| PXI_NOT_FULL
|-
| 14
| PXI_NOT_EMPTY
|-
| 15
| AES
|-
| 16
| SDIO_1
|-
| 17
| SDIO_1_ASYNC
|-
| 18
| SDIO_3
|-
| 19
| SDIO_3_ASYNC
|-
| 20
| DEBUG_RECV
|-
| 21
| DEBUG_SEND
|-
| 22
| [[RSA]]
|-
| 23
| CTR_CARD_1
|-
| 24
| CTR_CARD_2
|-
| 25
| CGC
|-
| 26
| CGC_DET
|-
| 27
| DS_CARD
|-
| 28
| DMAC_2
|-
| 29
| DMAC_2_ABORT
|}

Memory layout

2021-01-27T21:04:52Z

TuxSH: /* ARM11 */

= Physical Memory =

== ARM11 ==
{| class="wikitable" border="1"
|-
! Old 3DS
! Address
! Size
! Description
|-
| style="background: green" | Yes
| 0x00000000
| 0x00010000
| Bootrom (super secret code/data @ 0x8000)
|-
| style="background: green" | Yes
| 0x00010000
| 0x00010000
| Bootrom mirror
|-
| style="background: green" | Yes
| 0x10000000
|?
| [[IO]] memory
|-
| style="background: green" | Yes
| 0x17E00000
| 0x00002000
| MPCore private memory region

|-
| style="background: red" | No
| 0x17E10000
| 0x00001000
| L2C-310 r3p3 Level 2 Cache Controller (2MB)
|-
| style="background: green" | Yes
| 0x18000000
| 0x00600000
| VRAM (divided in two areas VRAM A and B, four banks in total)
|-
| style="background: red" | No
| 0x1F000000
| 0x00400000
| [[New_3DS]] additional memory
|-
| style="background: green" | Yes
| 0x1FF00000
| 0x00080000
| DSP memory
|-
| style="background: green" | Yes
| 0x1FF80000
| 0x00080000
| AXI WRAM
|-
| style="background: green" | Yes
| 0x20000000
| 0x08000000
| FCRAM
|-
| style="background: red" | No
| 0x28000000
| 0x08000000
| [[New_3DS]] FCRAM extension
|-
| style="background: green" | Yes
| 0xFFFF0000
| 0x00010000
| Bootrom mirror
|}

===0x17E10000===
The 32-bit register at <code>0x17E10000</code>+<code>0x100</code> only has bit 0 set when, on New 3DS, [[PTMSYSM:ConfigureNew3DSCPU]] was used with bit 1 set for the input value (the L2 cache flag). All other bits in this register are normally all-zero. Therefore, bit 0 set = new cache hardware enabled, bit 0 clear = new cache hardware disabled. This bit is how the ARM11 kernel checks whether the additional cache hardware is enabled).

To enable the additional cache hardware, the following is used by the ARM11 kernel:
* Sets bit 0 in 32-bit register <code>0x17E10000</code>+<code>0x100</code>.

To disable the additional cache hardware, the following is used by the ARM11 kernel:
* Writes value <code>0xFFFF</code> to 32-bit register <code>0x17E10000</code>+<code>0x77C</code>.
* Waits for bit 0 in 32-bit register <code>0x17E10000</code>+<code>0x730</code> to become clear.
* Writes value <code>0x0</code> to 32-bit register <code>0x17E10000</code>+<code>0x0</code>.
* Clears bit 0 in 32-bit register <code>0x17E10000</code>+<code>0x100</code>.

=== <code>0x1F000000</code> ([[New 3DS]] only) ===
This area is used by [[QTM Services]] and Kernel11,starting at offset <code>0x200000</code>, size <code>0x180000</code>. This area is not accessible to the GPU on the old 3DS. The old 3DS and New 3DS GSP module has <code>vaddr->physaddr</code> conversion code for this entire region. On the New 3DS, only the first <code>0x200000</code> bytes (half of this memory) are accessible to the GPU.

== ARM9 ==
{| class="wikitable" border="1"
|-
! Old 3DS
! Address
! Size
! Description
|-
| style="background: green" | Yes
| 0x00000000
| 0x08000000
| Instruction TCM, repeating each 0x8000 bytes.
|-
| style="background: green" | Yes
| 0x01FF8000
| 0x00008000
| Instruction TCM (Accessed by the kernel and process by this address)
|-
| style="background: green" | Yes
| 0x07FF8000
| 0x00008000
| Instruction TCM (Accessed by bootrom by this address)
|-
| style="background: green" | Yes
| 0x08000000
| 0x00100000
| ARM9-only internal memory (ARM7's internal regions are mapped here as well)
|-
| style="background: red" | No
| 0x08100000
| 0x00080000
| [[New_3DS]] ARM9-only extension, only enabled when a certain [[CONFIG_Registers|CONFIG]] register is set.
|-
| style="background: green" | Yes
| 0x10000000
| 0x08000000
| [[IO]] memory
|-
| style="background: green" | Yes
| 0x18000000
| 0x00600000
| VRAM (divided in two banks, VRAM and VRAMB)
|-
| style="background: green" | Yes
| 0x1FF00000
| 0x00080000
| DSP memory
|-
| style="background: green" | Yes
| 0x1FF80000
| 0x00080000
| AXI WRAM
|-
| style="background: green" | Yes
| 0x20000000
| 0x08000000
| FCRAM
|-
| style="background: red" | No
| 0x28000000
| 0x08000000
| [[New_3DS]] FCRAM extension
|-
| style="background: green" | Yes
| 0xFFF00000
| 0x00004000
| Data TCM (Mapped during bootrom). Enabled at the time Boot9 jumps to FIRM, however Kernel9+arm9loader disables it.
|-
| style="background: green" | Yes
| 0xFFFF0000
| 0x00010000
| Bootrom, the main region is at +0x8000, which is disabled during system boot.
|}

==ARM9 MPU Regions==
For the below instruction permissions: RO = memory is executable, while None = not-executable.

===NATIVE_FIRM/SAFE_MODE_FIRM ARM9 kernel===
{| class="wikitable" border="1"
|-
! Region
! Address
! Size
! Privileged-mode data permissions
! User-mode data permissions
! Privileged-mode instruction permissions
! User-mode instruction permissions
|-
| 0
| 0xFFFF0000
| 32KB/0x8000
| RO
| None
| RO
| None
|-
| 1
| 0x01FF8000
| 32KB/0x8000
| RW
| RW
| RO
| RO
|-
| 2
| 0x08000000
| 1MB/0x100000. >=[[8.0.0-18|8.0.0-X]]: 2MB/0x200000.
| RW
| RW
| RO
| RO
|-
| 3
| 0x10000000
| 128KB/0x20000
| RW
| RW
| None
| None
|-
| 4
| 0x10100000
| 512KB/0x80000
| RW
| RW
| None
| None
|-
| 5
| 0x20000000
| 128MB/0x8000000. >=[[8.0.0-18|8.0.0-X]]: 256MB/0x10000000.
| RW
| RW
| None
| None
|-
| 6
| 0x08000000
| 128KB/0x20000
| RW
| None
| RO
| None
|-
| 7
| 0x08020000
| <[[3.0.0-5]]: 64KB/0x10000. >=[[3.0.0-5]]: 32KB/0x8000.
| RW
| None
| RO
| None
|}

The above is the MPU region settings setup by the ARM9-kernel in the crt0.

The New3DS ARM9-kernel MPU region settings are the same as the Old3DS MPU region settings for >=[[8.0.0-18|8.0.0-X]].

At the start of the Process9 function executed in kernel-mode via svc7b during firm-launching, it changes some MPU region settings. At the end of that function, before it uses the ARM9/ARM11 entrypoint fields, it disables MPU.

===New3DS [[FIRM|ARM9-loader]]===
{| class="wikitable" border="1"
|-
! Region
! Address
! Size
! Privileged-mode data permissions
! User-mode data permissions
! Privileged-mode instruction permissions
! User-mode instruction permissions
|-
| 0
| 0xFFFF0000
| 32KB/0x8000
| RO
| None
| RO
| None
|-
| 1
| 0x01FF8000
| 32KB/0x8000
| RW
| None
| RO
| None
|-
| 2
| 0x08000000
| 2MB/0x200000
| RW
| None
| RO
| None
|-
| 3
| 0x10000000
| 128KB/0x20000
| RW
| None
| None
| None
|}

MPU regions 4-7 are disabled. Note that the entire ARM9-loader runs in SVC-mode.

===TWL_FIRM/AGB_FIRM ARM9 kernel===
{| class="wikitable" border="1"
|-
! Region
! Address
! Size
! Privileged-mode data permissions
! User-mode data permissions
! Privileged-mode instruction permissions
! User-mode instruction permissions
|-
| 0
| 0xFFFF0000
| 32KB/0x8000
| RO
| None
| RO
| None
|-
| 1
| 0x01FF8000
| 32KB/0x8000
| RW
| RW
| RO
| RO
|-
| 2
| 0x08000000
| 1MB/0x100000. New3DS: 2MB/0x200000.
| RW
| RW
| RO
| RO
|-
| 3
| 0x10000000
| 2MB/0x200000.
| RW
| RW
| None
| None
|-
| 4
| 0x1FF00000
| 512KB/0x80000
| RW
| RW
| None
| None
|-
| 5
| 0x20000000
| 128MB/0x8000000. New3DS: 256MB/0x10000000.
| RW
| RW
| None
| None
|-
| 6
| 0x08000000
| <[[3.0.0-5|3.0.0-X]]: 256KB/0x40000. >=[[3.0.0-5|3.0.0-X]]: 128KB/0x20000
| RW
| None
| RO
| None
|-
| 7
| 0x08080000
| 128KB/0x20000
| RW
| RW
| RO
| RO
|}

===[[Bootloader|Boot9]]===
{| class="wikitable" border="1"
|-
! Region
! Address
! Size
! Privileged-mode data permissions
! User-mode data permissions
! Privileged-mode instruction permissions
! User-mode instruction permissions
|-
| 0
| 0x20000000
| 0x08000000
| None
| None
| None
| None
|-
| 1
| 0x10000000
| 0x10000000
| RW
| RW
| None
| None
|-
| 2
| 0x08000000
| 0x00100000
| RW
| RW
| None
| None
|-
| 3
| 0x08000000
| 0x00000400
| RW
| RW
| RO
| RO
|-
| 4
| 0xFFF00000
| 0x00004000
| RW
| RW
| None
| None
|-
| 5
| 0x07FF8000
| 0x00008000
| RW
| RW
| RO
| RO
|-
| 6
| 0xFFFF0000
| 0x00010000
| RO
| RO
| RO
| RO
|-
| 7
| 0x1FFFE000
| 0x00000800
| RW
| RW
| None
| None
|}

* Instruction cachable bits = 0x40(only enabled for region6).
* Data cachable bits = 0x44(only enabled for region2 and region6).
* Data bufferable bits = 0x44(only enabled for region2 and region6).

These are the same for both Old3DS/New3DS.

==ARM9 ITCM==
{| class="wikitable" border="1"
|-
! ITCM mirror address
! ITCM bootrom mirror address
! Offset
! Size
! Description
|-
| 0x01FF8000
|
| 0x0
| 0x3700
| Uninitialized memory.
|-
| 0x01FFB700
| 0x07FFB700
| 0x3700
| 0x100
| The unprotected ARM9-bootrom code copies code from unprotected bootrom to 0x07FFB700(ITCM mirror) size 0x100, then calls the code at 0x07FFB700. The code located here is the code used for disabling access to the bootroms.
|-
| 0x01FFB800
|
| 0x3800
| 0x100
| This is the first 0x90 bytes of [[OTP_Registers#Plaintext_OTP|plaintext OTP]] when OTP hash verification is successful. The remaining 0x70 bytes are cleared.
|-
| 0x01FFB880
|
| 0x3890
| 0x70
| This is all zeros; boot ROM does not reveal the console-specific keys or the OTP hash in ITCM.
|-
| 0x01FFB900
|
| 0x3900
| 0x200
| This is the 0x200-bytes from NAND sector0.
|-
| 0x01FFBB00
|
| 0x3B00
| 0x200
| This is the 0x200-bytes from the plaintext FIRM header for the FIRM which was loaded by [[Bootloader|Boot9]]. This is the only location Boot9 uses for storing the loaded FIRM headers internally, it's not stored anywhere else.
|-
| 0x01FFBD00
|
| 0x3D00
| 0x100
| This is the RSA-2048 modulus for [[RSA_Registers|RSA]]-engine slot0 set by bootrom.
|-
| 0x01FFBE00
|
| 0x3E00
| 0x100
| This is the RSA-2048 modulus for RSA-engine slot1 set by bootrom.
|-
| 0x01FFBF00
|
| 0x3F00
| 0x100
| This is the RSA-2048 modulus for RSA-engine slot2.
|-
| 0x01FFC000
|
| 0x4000
| 0x100
| This is the RSA-2048 modulus for RSA-engine slot3.
|-
| 0x01FFC100
|
| 0x4100
| 0x800
| These are RSA-2048 keys: 4 slots, each slot is 0x200-bytes. Slot+0 is the modulus, slot+0x100 is the private exponent. This can be confirmed by RSA-decrypting a message into a signature, then RSA-encrypting the signature back into a message, and comparing the original message with the output from the last operation.

[[FIRM]] doesn't seem to ever use these. None of these are related to RSA-keyslot0 used for v6.0/v7.0 key generation. These moduli are separate from all other moduli used elsewhere.
|-
| 0x01FFC900
| 0x07FFC900
| 0x4900
| 0x400
| The unprotected ARM9-bootrom copies data to 0x07FFC900(mirror of 0x01FFC900) size 0x400. This data is copied from AXI WRAM, initialized by ARM11-bootrom(the addr used for the src is determined by [[CONFIG_Registers|REG_UNITINFO]]). These are RSA moduli: retailsrcptr = 0x1FFFD000, devsrvptr = 0x1FFFD400.
* The first 0x100-bytes here is the RSA-2048 modulus for the CFA NCCH header, and for the gamecard NCSD header.
* 0x01FFCA00 is the RSA-2048 modulus for the CXI accessdesc signature, written to rsaengine keyslot1 by NATIVE_FIRM.
* 0x01FFCB00 size 0x200 is unknown, probably RSA related, these aren't used by [[FIRM]](these are not console-unique).
|-
| 0x01FFCD00
|
| 0x4D00
| 0x80
| Unknown, not used by [[FIRM]]. This isn't console-unique.
The first 0x10-bytes are checked by the v6.0/v7.0 NATIVE_FIRM keyinit function, when non-zero it clears this block and continues to do the key generation. Otherwise when this block was already all-zero, it immediately returns. This memclear was probably an attempt at destroying the RSA slot0 modulus, that missed (exactly 0x1000-bytes away). Even though they "failed" here, one would still need to derive the private exponent, which would require obtaining a ciphertext and plaintext.
|-
| 0x01FFCD80
|
| 0x4D80
| 0x64
| 0x01FFCD84 size 0x10-bytes is the NAND CID(the 0x64-byte region at 0x01FFCD80 is initialized by Process9 + ARM9-bootrom). The u32 at 0x01FFCDC4 is the total number of NAND sectors, read from a MMC command.
|-
| 0x01FFCDE4
|
| 0x4DE4
| 0x21C
| Uninitialized memory.
|-
| 0x01FFD000
| 0x07FFD000
| 0x5000
| 0x2470
| The unprotected ARM9-bootrom copies 0x1FFFA000(AXIWRAM mem initialized by ARM11-bootrom) size 0x2470 to 0x07FFD000(mirror of 0x01FFD000). This block contains DSi keys.
* 0x01FFD000 is the RSA-1024 modulus for the retail System Menu
* 0x01FFD080 is the RSA-1024 modulus for DSi Wifi firmware and DSi Sound
* 0x01FFD100 is the RSA-1024 modulus for base DSi apps (Settings, Shop, etc.)
* 0x01FFD180 is the RSA-1024 modulus for DSiWare and RSA-signed cartridge headers
* 0x01FFD210 is the keyY for per-console-encrypted ES blocks
* 0x01FFD220 is the keyY for fixed-keyX ES blocks
* 0x01FFD300 is the DSi common (normal)key
* 0x01FFD350 is a normalkey set on keyslot 0x02, and is likely only used during boot
* 0x01FFD380 is the keyslot 0x00 keyX and the first half of the retail keyX for modcrypt crypto "Nintendo"
* 0x01FFD398 is the keyX used for 'Tad' crypto, usually in keyslot 0x02 "Nintendo DS", ..
* 0x01FFD3A8 is set as the middle two words of keyslot 0x03's keyX, before being overwritten "NINTENDO"
* 0x01FFD3BC is the keyY for keyslot 0x01, see below
* 0x01FFD3C8 is the fixed keyY used for eMMC partition crypto on retail DSi, see below (keyslot 0x03)
* 0x01FFD3E0 is the 0x1048-byte Blowfish data for DSi cart crypto
* 0x01FFE428 is the 0x1048-byte Blowfish data for DS cart crypto
On the 3DS, keyslots 0x01 and 0x03 have the last word set as 0xE1A00005 instead of the next word in ITCM. This is consistent with retail DSis.
|-
| 0x01FFF470
|
| 0x7470
| 0xB90
| Uninitialized memory.
|-
| 0x01FFFC00
|
| 0x7C00
| 0x100
| Starting with [[9.5.0-22|9.5.0-X]] is the FIRM header used during FIRM-launching.
|}

=Memory map by firmware=
* [[Virtual address mapping FW0B]]
* [[Virtual address mapping FW1F]]
* [[Virtual address mapping FW25]]
* [[Virtual address mapping FW2E]]
* [[Virtual address mapping FW37]]
* [[Virtual address mapping FW38‎]]
* [[Virtual address mapping FW3F]]
* FW49([[9.6.0-24|9.6.0-X]]) and [[10.0.0-27|10.0.0-X]] ARM11-kernel vmem mapping is identical to FW40([[9.5.0-22|9.5.0-X]]).

* [[Virtual address mapping TWLFIRM04]]

* [[Virtual address mapping New3DS v8.1]]
* [[Virtual address mapping New3DS v9.0]]
* [[Virtual address mapping New3DS v9.2]]
* [[Virtual address mapping New3DS v11.1]]

=ARM11 Detailed physical memory map=
18000000 - 18600000: VRAM

1FF80000 - 1FFAB000: Kernel code
1FFAB000 - 1FFF0000: SlabHeap [temporarily contains boot processes]
1FFF0000 - 1FFF1000: ?
1FFF1000 - 1FFF2000: ?
1FFF2000 - 1FFF3000: ?
1FFF3000 - 1FFF4000: ?
1FFF4000 - 1FFF5000: Exception vectors
1FFF5000 - 1FFF5800: Unused?
1FFF5800 - 1FFF5C00: 256-entry L2 MMU table for VA FF4xx000
1FFF5C00 - 1FFF6000: 256-entry L2 MMU table for VA FF5xx000
1FFF6000 - 1FFF6400: 256-entry L2 MMU table for VA FF6xx000
1FFF6400 - 1FFF6800: 256-entry L2 MMU table for VA FF7xx000
1FFF6800 - 1FFF6C00: 256-entry L2 MMU table for VA FF8xx000
1FFF6C00 - 1FFF7000: 256-entry L2 MMU table for VA FF9xx000
1FFF7000 - 1FFF7400: 256-entry L2 MMU table for VA FFAxx000
1FFF7400 - 1FFF7800: 256-entry L2 MMU table for VA FFBxx000
1FFF7800 - 1FFF7C00: MMU table but unused?
1FFF7C00 - 1FFF8000: 256-entry L2 MMU table for VA FFFxx000
1FFF8000 - 1FFFC000: 4096-entry L1 MMU table for VA xxx00000 (CPU 0)
1FFFC000 - 20000000: 4096-entry L1 MMU table for VA xxx00000 (CPU 1)
20000000 - 28000000: Main memory

The entire FCRAM is cleared during NATIVE_FIRM boot. This is done by the ARM11 kernel in order by region as it initializes after loading [[FIRM]] launch parameters from FCRAM.

== FCRAM memory-regions layout ==
FCRAM is partitioned into three regions of memory (APPLICATION, SYSTEM, and BASE). Most applications can only allocate memory from one of these regions (which is encoded in the [[NCCH/Extended_Header#ARM11_Kernel_Flags|process kernel flags]]). There is a fixed set of possible size of each memory region, determined by the APPMEMTYPE value in [[Configuration_Memory#APPMEMTYPE|configuration memory]] (which in turn is set up according to the [[FIRM#FIRM_Launch_Parameters|firmware launch parameters]]).

Support for APPMEMTYPEs 6 and 7 (and 8?) was implemented in [[NS]] with [[8.0.0-18]]. These configurations are only supported in the [[New_3DS]] ARM11-kernel, and are in fact the only ones supported there at all. Applications only get access to the larger memory regions when this is specified in their [[NCCH/Extended Header#New3DS System Mode|extended header]].

{| class="wikitable" border="1"
! APPMEMTYPE
! APPLICATION starting address (relative to FCRAM)
! APPLICATION region size
! SYSTEM starting address (relative to FCRAM)
! SYSTEM region size
! BASE starting address (relative to FCRAM)
! BASE region size
|-
| 0 (default with regular 3DS kernel, used when the type is not 2-5)
| 0x0
| 0x04000000(64MB)
| 0x04000000
| 0x02C00000
| 0x06C00000
| 0x01400000
|-
| 2
| 0x0
| 0x06000000(96MB)
| 0x06000000
| 0x00C00000
| 0x06C00000
| 0x01400000
|-
| 3
| 0x0
| 0x05000000(80MB)
| 0x05000000
| 0x01C00000
| 0x06C00000
| 0x01400000
|-
| 4
| 0x0
| 0x04800000(72MB)
| 0x04800000
| 0x02400000
| 0x06C00000
| 0x01400000
|-
| 5
| 0x0
| 0x02000000(32MB)
| 0x02000000
| 0x04C00000
| 0x06C00000
| 0x01400000
|-
| 6 and 8 (6 is the default on New3DS. With [[New_3DS]] kernel this is the type used when the value is neither 7 nor 8)
| 0x0
| 0x07C00000(124MB)
| 0x07C00000
| 0x06400000
| 0x0E000000
| 0x02000000
|-
| 7
| 0x0
| 0x0B200000(178MB)
| 0x0B200000
| 0x02E00000
| 0x0E000000
| 0x02000000
|}

The SYSTEM mem-region size is calculated with: size = FCRAMTOTALSIZE - (APPLICATION_MEMREGIONSIZE + BASE_MEMREGIONSIZE).

All memory allocated by the kernel itself for kernel use is located under BASE. Most system-modules run under the BASE memregion too.

Free/used memory on [[4.5.0-10]] with Home Menu / Internet Browser, with the default APPMEMTYPE on retail:
{| class="wikitable" border="1"
! Region
! Base address relative to FCRAM+0
! Region size
! Used memory once [[Home Menu]] finishes loading for system boot, on [[4.5.0-10]]
! Used memory with [[Internet Browser]] running instead of [[Home Menu]], on [[4.5.0-10]]
! Free memory once [[Home Menu]] finishes loading for system boot, on [[4.5.0-10]]
! Free memory with [[Internet Browser]] running instead of [[Home Menu]], on [[4.5.0-10]]
|-
| APPLICATION
| 0x0
| 0x04000000
| 0x0
|
| 0x04000000
|
|-
| SYSTEM
| 0x04000000
| 0x02C00000
| 0x01488000
| 0x02A50000
| 0x01778000
| 0x001B0000
|-
| BASE
| 0x06C00000
| 0x01400000
| 0x01202000
| 0x01236000
| 0x001FE000
| 0x001CA000
|}

=ARM11 Detailed virtual memory map=
(valid only for FW0B, see [[#Memory map by firmware|Memory map by firmware]] for subsequent versions)

E8000000 - E8600000: mapped VRAM (18000000 - 18600000)

EFF00000 - F0000000: mapped Internal memory (1FF00000 - 20000000)
F0000000 - F8000000: mapped Main memory

FF401000 - FF402000: mapped ? (27FC7000 - 27FC8000)

FF403000 - FF404000: mapped ? (27FC2000 - 27FC3000)

FF405000 - FF406000: mapped ? (27FBB000 - 27FBC000)

FF407000 - FF408000: mapped ? (27FB3000 - 27FB4000)

FF409000 - FF40A000: mapped ? (27F8E000 - 27F8F000)

FFF00000 - FFF45000: mapped SlabHeap

FFF60000 - FFF8B000: mapped Kernel code

FFFCC000 - FFFCD000: mapped IO [[I2C|I2C]] second bus (10144000 - 10145000)

FFFCE000 - FFFCF000: mapped IO PDC([[LCD]]) (10400000 - 10401000)

FFFD0000 - FFFD1000: mapped IO PDN (10141000 - 10142000)

FFFD2000 - FFFD3000: mapped IO PXI (10163000 - 10164000)

FFFD4000 - FFFD5000: mapped IO PAD (10146000 - 10147000)

FFFD6000 - FFFD7000: mapped IO LCD (10202000 - 10203000)

FFFD8000 - FFFD9000: mapped IO DSP (10140000 - 10141000)

FFFDA000 - FFFDB000: mapped IO XDMA (10200000 - 10201000)

FFFDC000 - FFFE0000: mapped ? (1FFF8000 - 1FFFC000)

FFFE1000 - FFFE2000: mapped ? (1FFF0000 - 1FFF1000)

FFFE3000 - FFFE4000: mapped ? (1FFF2000 - 1FFF3000)

FFFE5000 - FFFE9000: mapped L1 MMU table for VA xxx00000

FFFEA000 - FFFEB000: mapped ? (1FFF1000 - 1FFF2000)

FFFEC000 - FFFED000: mapped ? (1FFF3000 - 1FFF4000)

FFFEE000 - FFFF0000: mapped IO IRQ (17E00000 - 17E02000)

FFFF0000 - FFFF1000: mapped Exception vectors

FFFF2000 - FFFF6000: mapped L1 MMU table for VA xxx00000

FFFF7000 - FFFF8000: mapped ? (1FFF1000 - 1FFF2000)

FFFF9000 - FFFFA000: mapped ? (1FFF3000 - 1FFF4000)

FFFFB000 - FFFFE000: mapped L2 MMU tables (1FFF5000 - 1FFF8000)

==0xFF4XX000==
Each [[KThread|thread]] is allocated a 0x1000-byte page in this region for the [[KThreadContext|thread context]]: the first page at 0xFF401000 is for the first created thread, 0xFF403000 for the second thread. This region is used to store the SVC-mode stack for the thread, and thread context data used for context switching. When the IRQ handler, prefetch/data abort handlers, and undefined instruction handler are entered where the SPSR-mode=user, these handlers then store LR+SPSR for the current mode on the SVC-mode stack, then these handlers switch to SVC-mode.

This page does not contain a dedicated block for storing R0-PC(etc). For user-mode, the user-mode regs are instead saved on the SVC-mode stack when IRQs such as timers for context switching are triggered.

For NATIVE_FIRM the memory pages for this region are located in FCRAM, however for TWL_FIRM these are located in AXI WRAM. For TWL_FIRM v6704 the first thread's page for this region is located at physical address 0x1FF93000, the next one at 0x1FF92000, etc.

== IO Process virtual addressing equivalence ==
It seems an IO register's process virtual address can be calculated by adding 0xEB00000 to its physical address. However for kernel mappings there is no fixed address equivalence.

=ARM11 User-land memory regions=
==NATIVE_FIRM/SAFE_MODE_FIRM Userland Memory==
{| class="wikitable" border="1"
|-
! Virtual Address Base
! Physical Address Base
! Region Max Size
! Address-range available for svcMapMemoryBlock
! Description
|-
| 0x00100000 / 0x14000000
|
| 0x03F00000
| No
| The [[ExeFS]]:/.code is loaded here, executables must be loaded to the 0x00100000 region when the exheader "special memory" flag is clear. The 0x03F00000-byte size restriction only applies when this flag is clear. Executables are usually loaded to 0x14000000 when the exheader "special memory" flag is set, however this address can be arbitrary.
|-
| 0x04000000
| ?
| ?
| No
| Used for mapping buffers during IPC, see [[IPC Command Structure]].
|-
| 0x08000000
| Main stack physaddr - <heap size for the allocated vaddr 0x08000000 memory>
| 0x08000000
| Yes
| Heap mapped by [[SVC|ControlMemory]]
|-
| 0x10000000-StackSize
| .bss physical address - total stack pages
| StackSize from process exheader
|
| Stack for the main-thread, initialized by the ARM11 kernel. The StackSize from the exheader is usually 0x4000, therefore the stack-bottom is usually 0x0FFFC000. The stack for the other threads is normally located in the process .data section however this can be arbitrary.
|-
| 0x10000000
|
| 0x04000000
| Yes
| [[SVC|Shared]] memory
|-
| 0x14000000
| FCRAM+0
| 0x08000000
| No
| Can be mapped by [[SVC|ControlMemory]], this is used for processes' [[SVC|LINEAR]]/GSP heap.
|-
| 0x1E800000
| 0x1F000000
| 0x00400000
| No
| [[New_3DS]] additional memory, access to this is specified by the exheader. Added with [[8.0.0-18]], see above section regarding this memory.
|-
| 0x1EC00000
| 0x10100000
| 0x00400000
| No
| [[IO]] registers, the mapped IO pages which each process can access is specified in the [[NCCH/Extended_Header|exheader]]. (Applications normally don't have access to registers in this range)
|-
| 0x1F000000
| 0x18000000
| 0x00600000
| No
| VRAM, access to this is specified by the exheader.
|-
| 0x1FF00000
| 0x1FF00000
| 0x00080000
| No
| DSP memory, access to this is specified by the exheader.
|-
| 0x1FF80000
| FCRAM memory page allocated by the ARM11 kernel.
| 0x1000
| No
| [[Configuration Memory]], all processes have read-only access to this.
|-
| 0x1FF81000
| FCRAM memory page allocated by the ARM11 kernel.
| 0x1000
| No
| [[Configuration Memory|Shared]] page, all processes have read-access to this. Write access to this is specified by the exheader "Shared page writing" kernel flag.
|-
| 0x1FF82000
| Dynamically taken from the BASE region of FCRAM
| Number of threads * 0x1000 / 8
| No
| [[Thread Local Storage]]
|-
| 0x30000000
| FCRAM+0
| 0x08000000(Old3DS) / 0x10000000([[New_3DS]])
| No
| This LINEAR memory mapping was added with [[8.0.0-18]], see [[SVC#enum_MemoryOperation|here]]. This replaces the original 0x14000000 mapping, for system(memory-region=BASE)/newer titles. The Old3DS kernel uses size 0x08000000 for LINEAR-memory address range checks, while the New3DS kernel uses size 0x10000000 for those range checks. Old3DS/New3DS system-module code doing vaddr->phys-addr conversion uses size 0x10000000.
|-
| 0x20000000 / 0x40000000
|
|
|
| This is the end-address of userland memory, memory under this address is process-unique. Memory starting at this address is only accessible in privileged-mode. This address was changed from 0x20000000 to 0x40000000 with [[8.0.0-18]].
|}

All executable pages are read-only, and data pages have the execute-never permission set. Normally .text from the loaded ExeFS:/.code is the only mapped executable memory. Executable [[RO Services|CROs]] can be loaded into memory, once loaded the CRO .text section memory page permissions are changed via [[SVC|ControlProcessMemory]] from RW- to R-X. The address and size of each ExeFS:/.code section is stored in the exheader, the permissions for each section is: .text R-X, .rodata R--, .data RW-, and .bss RW-. The loaded .code is mapped to the addresses specified in the exheader by the ARM11 kernel. The stack permissions is initialized by the ARM11 kernel: RW-. The heap permissions is normally RW-.

All userland memory is mapped with RW permissions for privileged-mode. However, normally the ARM11 kernel only uses userland read/write instructions(or checks that the memory can be written from userland first) for accessing memory specified by [[SVC|SVCs]].

Processes can't directly access memory for other processes. When service [[Services API|commands]] are used, the kernel maps memory in the destination process for input/output buffers, where the addresses in the command received by the process is replaced by this mapped memory. When this is an input buffer, the buffer data is copied to the mapped memory. When this is an output buffer, the data stored in the mapped memory is copied to the destination buffer specified in the command.

The physical address which memory for the application memory-type is mapped to begins at FCRAM+0, the total memory allocated for this memory-type is stored in [[Configuration_Memory]]. Applications' .text + .rodata + .data under the application memory-type is mapped at FCRAM + APPMEMALLOC - (aligned page-size for .text + .rodata + .data). The application .bss is mapped at CODEADDR - .bss size aligned down to the page size.

==TWL_FIRM Userland Memory==
{| class="wikitable" border="1"
|-
! Virtual Address Base
! Physical Address Base
! Size
! Description
|-
| 0x00100000
| 0x1FFAB000 (with newer TWL_FIRM such as v6704 this is located at 0x1FFAC000)
| 0x00055000
| Code + .(ro)data copied from the process 0x00300000 region is located here(.bss is located here as well).
|-
| 0x00155000
| 0x18555000
| 0x000AB000
|
|-
| 0x00200000
| 0x18500000
| 0x00100000
|
|-
| 0x00300000
| 0x24000000
| 0x04000000
| The beginning of the ARM11 process .text is located here.
|-
| 0x08000000
| 0x20000000
| 0x07E00000
|
|-
| 0x1EC00000
| 0x10100000
| 0x00400000
| [[IO]]
|-
| 0x1F000000
| 0x18000000
| 0x00600000
| VRAM
|-
| 0x1FF00000
| 0x1FF00000
| 0x00080000
| This is mapped to the DSP memory.
|}

The above regions are mapped by the ARM11 kernel. Later when the ARM11 process uses [[SVC|svcKernelSetState]] with type4, the kernel unmaps(?) the following regions: 0x00300000..0x04300000, 0x08000000..0x0FE00000, and 0x10000000..0xF8000000.

=== Detailed TWL_FIRM ARM11 Memory ===
{| class="wikitable" border="1"
|-
! Process Virtual Address
! Physical Address
! Size
! Description
|-
| 0x08000000
| 0x20000000
| 0x01000000*4
| DS(i) 0x02000000 RAM. Vaddr = (DSRAMOffset*4) + 0x08000000, where DSRAMOffset is DSRAMAddr-0x02000000.
|-
| 0x0FC00000
| 0x27C00000
|
| Loaded SRL binary, initially the dev DSi launcher SRL is located here(copied here by the ARM11 process).
|-
| 0x0FD00000
| 0x27D00000
|
| The data located here is copied to here by the ARM11 process. The data located here is a TWL NAND [http://dsibrew.org/wiki/Bootloader bootloader] image, using the same format+encryption/verification methods as the DSi NAND bootloader(stage2). The keyX for this bootloader keyslot is initially set to the retail DSi key-data, however when TWL_FIRM is launched this keyX key-data is replaced with a separate keyX. TWL_FIRM can use either the retail DSi bootloader RSA-1024 modulus, or a seperate modulus: normally only the latter is used(the former is only used when loading the image from FS instead of FCRAM). When using the image from FCRAM(default code-path), TWL_FIRM will not calculate+check the hashes for the bootloader code binaries(this is done when loading from FS however).
|-
| 0x0FDF7000
| 0x27DF7000
| 0x1000
| SRL header
|}

= System memory details =
0xFFFF9000 Pointer to the current KThread instance
0xFFFF9004 Pointer to the current KProcess instance
0xFFFF9008 Pointer to the current KScheduler instance
0xFFFF900C Pointer to the current KSchedulableInterruptEventLinkedList instance
0xFFFF9010 Pointer to the last KThread to encounter an exception

0x8000040 Pointer to the current KThread instance on the ARM9
0x8000044 Pointer to the current KProcess instance on the ARM9
0x8000048 Pointer to the current KScheduler instance on the ARM9

= VRAM Map While Running System Applets =
*0x1E6000-0x22C500 -- top screen 3D left framebuffer 0(240x400x3) (The "3D right first-framebuf" addr stored in the LCD register is set to this, when the 3D is set to "off")
*0x22C800-0x272D00 -- top screen 3D right framebuffer 0(240x400x3)
*0x273000-0x2B9500 -- top screen 3D left framebuffer 1(240x400x3)
*0x2B9800-0x2FFD00 -- top screen 3D right framebuffer 1(240x400x3)
*0x48F000-0x4C7400 -- bottom screen framebuffer 0(240x320x3)
*0x4C7800-0x4FF800 -- bottom screen framebuffer 1(240x320x3)

These LCD framebuffer addresses are not changed by the system when launching regular applications, the application itself handles that if needed. These VRAM framebuffers are cleared when launching regular applications.

PDN Registers

2021-01-26T23:32:28Z

TuxSH: /* PDN_LGR_CPU_CNT */

=Register table=
{| class="wikitable" border="1"
! Old3DS
! Name
! Address
! Width
! Used by
|-
| style="background: green" | Yes
| [[#PDN_SLEEP_CNT|PDN_SLEEP_CNT]]
| 0x10141000
| 2
| Kernel11
|-
| style="background: green" | Yes
| [[#PDN_WAKE_ENABLE|PDN_WAKE_ENABLE]]
| 0x10141008
| 4
| [[PTM Services]], [[PDN Services]]
|-
| style="background: green" | Yes
| [[#PDN_WAKE_REASON|PDN_WAKE_REASON]]
| 0x1014100C
| 4
| [[PTM Services]], TwlBg, [[PDN Services]]
|-style="border-top: double"
| style="background: green" | Yes
| [[#LGY_MODE|LGY_MODE]]
| 0x10141100
| 2
| TwlProcess9, TwlBg
|-
| style="background: green" | Yes
| [[#LGY_SLEEP_CNT|LGY_SLEEP_CNT]]
| 0x10141104
| 2
| TwlBg
|-
| style="background: green" | Yes
| [[#LGY_IRQ_ENABLE|LGY_IRQ_ENABLE]]
| 0x10141108
| 2
| TwlBg
|-
| style="background: green" | Yes
| [[#LGY_PAD_CNT|LGY_PAD_CNT]]
| 0x1014110A
| 2
| TwlBg
|-
| style="background: green" | Yes
| [[#LGY_HIDEMU_MASK|LGY_HIDEMU_MASK]]
| 0x10141110
| 2
| TwlBg
|-
| style="background: green" | Yes
| [[#LGY_HIDEMU_PAD|LGY_HIDEMU_PAD]]
| 0x10141112
| 2
| TwlBg
|-
| style="background: green" | Yes
| [[#LGY_GPIOEMU_MASK|LGY_GPIOEMU_MASK]]
| 0x10141114
| 2
| [[Codec Services]], TwlBg
|-
| style="background: green" | Yes
| [[#LGY_GPIOEMU_DATA|LGY_GPIOEMU_DATA]]
| 0x10141116
| 2
| [[Codec Services]], TwlBg
|-
| style="background: green" | Yes
| [[#LGY_CARDDETECTEMU_MASK|LGY_CARDDETECTEMU_MASK]]
| 0x10141118
| 1
| TwlBg
|-
| style="background: green" | Yes
| [[#LGY_CARDDETECTEMU_DATA|LGY_CARDDETECTEMU_DATA]]
| 0x10141119
| 1
| TwlBg
|-
| style="background: green" | Yes
| LGY_?
| 0x10141120
| 1
| TwlBg
|-
|-style="border-top: double"
| style="background: green" | Yes
| [[#PDN_GPU_CNT|PDN_GPU_CNT]]
| 0x10141200
| 4
| Boot11, Kernel11, [[PDN Services]], TwlBg
|-
| style="background: green" | Yes
| [[#PDN_VRAM_CNT|PDN_VRAM_CNT]]
| 0x10141204
| 1
| Boot11, Kernel11, TwlBg
|-
| style="background: green" | Yes
| [[#PDN_LCD_CNT|PDN_LCD_CNT]]
| 0x10141208
| 1
| Boot11
|-
| style="background: green" | Yes
| [[#PDN_FCRAM_CNT|PDN_FCRAM_CNT]]
| 0x10141210
| 2
| Kernel11, TwlBg
|-
| style="background: green" | Yes
| [[#PDN_I2S_CNT|PDN_I2S_CNT]]
| 0x10141220
| 1
| Boot11, TwlBg, [[PDN Services]]
|-
| style="background: green" | Yes
| [[#PDN_CAMERA_CNT|PDN_CAMERA_CNT]]
| 0x10141224
| 1
| [[PDN Services]]
|-
| style="background: green" | Yes
| [[#PDN_DSP_CNT|PDN_DSP_CNT]]
| 0x10141230
| 1
| Process9, [[PDN Services]]
|-
| style="background: red" | No
| [[#PDN_MVD_CNT|PDN_MVD_CNT]]
| 0x10141240
| 1
|
|-style="border-top: double"
| style="background: red" | No
| [[#PDN_LGR_SOCMODE|PDN_LGR_SOCMODE]]
| 0x10141300
| 2
| NewKernel11
|-
| style="background: red" | No
| [[#PDN_LGR_CNT|PDN_LGR_CNT]]
| 0x10141304
| 2
| NewKernel11
|-
| style="background: red" | No
| [[#PDN_LGR_CPU_CNT<0-3>|PDN_LGR_CPU_CNT]]<0-3>
| 0x10141310
| 1*4
| NewKernel11
|}

=Sleep registers=
==PDN_SLEEP_CNT==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| 1 = Enter sleep mode
|-
| 2-14
| Unused.
|-
| 15
| 1 = VRAM is powered down
|}

Kernel11 powers down VRAM (it's unclear whether bit15 is power-down or self-refresh mode) by first disabling the 8 banks using [[GPU/External_Registers#Map|GX register 0x10400030]], then by disabling the GPU clock using [[#PDN_GPU_CNT|PDN_GPU_CNT]] bit 16 and finally writes to and polls this register.

==PDN_WAKE_ENABLE==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| [[HID_Registers#HID_PAD_CNT|HID_PAD_CNT]]
|-
| 3
| Shell opened
|-
| 4
| Headphones not plugged in
|-
| 8
| WiFi (?)
|-
| 19
| Shell GPIO (?)
|-
| 26
| [[I2C_Registers#Device_3|MCU interrupt]]
|-
| 30
| Touch screen pressed
|-
| 31
| CTR gamecard inserted/removed
|-
|}
List in progress.

This is a OR list of wake triggers that will wake up the console from sleep and raise IRQ 0x58.

==PDN_WAKE_REASON==
Same layout as [[#PDN_WAKE_ENABLE|PDN_WAKE_ENABLE]].

This is a OR list of the wake triggers that actually woke up the console.

For each bit, write 1 to acknowledge, and 0 to clear (?).

=Legacy registers=
==LGY_MODE==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| Read only legacy mode set on reg 0x10018000.
|-
| 2-14
| Unused.
|-
| 15
| 1 = enable legacy mode.
|}
To boot into DSi or GBA mode first set register 0x10018000 to the desired mode and setup LgyFb. Then disable FCRAM by clearing bit 0 in reg 0x10201000, writing 0 to PDN_FCRAM_CNT followed by 1 and waiting for bit 2 to clear.

The very last 3DS-mode register poke the [[FIRM|TWL_FIRM]] Process9 does before it gets switched into TWL-mode, is writing 0x8000 to this register. Before writing this register, TWL Process9 waits for ARM7 to change the value of this register. The Process9 code for this runs from ITCM, since switching into TWL-mode includes remapping all ARM9 physical memory.

==LGY_SLEEP_CNT==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Write 1 to wakeup GBA mode.
|-
| 1
| Sleep state/ack. 1 when GBA mode entered sleep. Write 1 to ack.
|-
| 2
| ?
|-
| 3-14
| Unused.
|-
| 15
| 1 = IRQ enable (IRQ 0x59)
|}
When a GBA game enters sleep mode and bit 15 is 1, IRQ 0x59 fires and bit 1 is set. Bit 1 must be acknowledged/written together with bit 0 otherwise GBA mode wakes up from sleep early sometimes.

==LGY_IRQ_ENABLE==
[[ARM11_Interrupts|Arm11 interrupt]] enable bits for legacy interrupts, same bit layout as the GPIOEMU regs below.

==LGY_PAD_CNT==
Also named "KEYCNT" on certain other DS(i)/GBA documentations.
The value of this register is copied to [[HID_Registers|HID_PAD_CNT]] when GBA mode enters sleep.

==LGY_HIDEMU_MASK==
Set bits will use the corresponding values from [[#LGY_HIDEMU_PAD|LGY_HIDEMU_PAD]] instead of allowing the hardware to read it from [[HID_Registers#HID_PAD|HID_PAD]].

This is set to 0x1FFF (all buttons and the debug key) and [[#LGY_HIDEMU_PAD|LGY_HIDEMU_PAD]] is set to 0 when the "Close this software and return to HOME Menu?" dialog is shown to prevent the button presses from propagating to the DS/GBA CPU.

==LGY_HIDEMU_PAD==
Works the same way as [[HID_Registers#HID_PAD|HID_PAD]], but the values set here are only replaced in the HID_PAD seen by the DS/GBA CPU when the corresponding bits in [[#LGY_HIDEMU_MASK|LGY_HIDEMU_MASK]] are set.

==LGY_GPIOEMU_MASK==
Set bits will read bits from [[#LGY_GPIOEMU_DATA|LGY_GPIOEMU_DATA]] (override).

This is used to trigger things like the TWL MCU interrupt in TWL mode.

==LGY_GPIOEMU_DATA==
See above

==LGY_CARDDETECTEMU_MASK==
Set bits will read bits from [[#LGY_CARDDETECTEMU_DATA|LGY_CARDDETECTEMU_DATA]] (override).

Bit0 signals cartridge removal.

==LGY_CARDDETECTEMU_DATA==
See above

=Clock and reset registers=
==PDN_GPU_CNT==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| GPU main block + VRAM + LCD reset. 0 = reset.
|-
| 1
| PSC block reset? 0 = reset.
|-
| 2
| Geoshader block reset? 0 = reset.
|-
| 3
| Rasterization block reset? 0 = reset.
|-
| 4
| PPF block reset. 0 = reset.
|-
| 5
| PDC block reset? 0 = reset.
|-
| 6
| PDC related reset. 0 = reset.
|-
| 7-15
| Unused.
|-
| 16
| Clock enable for all blocks, VRAM and LCD. 1 = enable.
|}

PDN uses a 12 ARM11 cycle delay to deassert reset.

==PDN_VRAM_CNT==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Clock. 1 = enable, 0 = disable
|}

This register seems to be unimplemented in released models: while it is used in tandem with PDN_GPU_CNT.bit16 in Boot11 screeninit code, Kernel11 only uses PDN_GPU_CNT.bit16 to power-off VRAM before going to sleep.

==PDN_LCD_CNT==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Clock. 1 = enable, 0 = disable
|}

This register seems to be unimplemented in released models, only to be used in Boot11, as PDN_GPU_CNT.bit16 also drives the LCD clock.

==PDN_FCRAM_CNT==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Reset. 0 = reset.
|-
| 1
| Clock. 1 = enable, 0 = disable
|-
| 2
| Acknowledge clock request. Gets set or unset when toggling bit 1.
|}
Twl-/AgbBg use this to disable FCRAM for the GBA rom in GBA mode or DSi main RAM in DSi mode. AgbBg clears bit 0 in reg 0x10201000 before touching this reg.

Kernel11 uses it to put the FCRAM in self-refresh mode (clock disable) before going to sleep.

==PDN_I2S_CNT==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| I2S1 Clock (maybe?) 1 = enable, 0 = disable
|-
| 1
| I2S2 Clock. 1 = enable, 0 = disable
|}

I2S1 clock enable bit seems to be unimplemented. Maybe it's because DSP clock enable drives it?

==PDN_CAMERA_CNT==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Clock. 1 = enable, 0 = disable
|}

==PDN_DSP_CNT==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Reset. 0 = reset.
|-
| 1
| Clock. 1 = enable, 0 = disable
|}

PDN services holds reset for 0x30 Arm11 cycles.

==PDN_MVD_CNT==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Reset. 0 = reset
|}

This doesn't seem to be used by anything, but does have a clear effect on the hardware.

The reset value for this register is 1 (out-of-reset at boot).

=N3DS SoC (LGR) registers=
== PDN_LGR_SOCMODE ==
This is used for configuring the New3DS ARM11 CPU clock-rate. This register is New3DS-only: reading from here on Old3DS always returns all-zeros even when one tried writing data here prior to the read.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-2
| SoC mode.
Possible values:
0=CTR+256MHz
1=LGR2+256MHz, 5=LGR2+804MHz
2=LGR1+256MHz, 3=LGR1+536MHz

N3DS modes (LGR1/LGR2) enable the New 3DS FCRAM extension and are needed to access N3DS-only devices.

* CTR: O3DS
* LGR1: N3DS prototype, 4 cores (originally 2), no L2C
* LGR2: retail N3DS, 4 cores, has L2C
|-
| 15
| Interrupt status (read) / clear (write)
|}

'''All currently powered-on cores must be (and remain) in WFI state to trigger the SoC mode switch.'''

Kernel code suggests that devices that support LGR1 but not LGR2 only had 2 cores. All cores (the number of which can be read from MPCORE SCU registers) are usable in LGR1 mode.

On firmlaunch, the kernel sets the mode to O3DS.

[[SVC#KernelSetState|svcKernelSetState]] type10, only implemented on New3DS, uses this register. This piece of code choses the mode matching the input Param0 bit0 state (1 for higher clock), using the state of [[CONFIG11 Registers#CFG11_SOCINFO|CFG11_SOCINFO]] to determine which mode is the best (which is always LGR2 on all released New 3DS units).

== PDN_LGR_CNT ==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Enables the N3DS extramem block
|-
| 8
| Enables the L2C block (LGR2 only)
|}

Kernel11 sets this to 0x101 when bit 2 in [[CONFIG11 Registers#CFG11_SOCINFO|CFG11_SOCINFO]] (LGR2 supported) is set otherwise 1.

== PDN_LGR_CPU_CNT<0-3> ==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Power request: 0 = power off, 1 = power on
|-
| 1
| Handshake bit
Needs to be set before powering on the core. It is meant to be cleared by software on the powered-on core, to signal itself.
|-
| 4
| Power status: 0 = off, 1 = on
|-
| 5
| Core present?
|}

Only usable for core2 and core3. Core 0 and 1 have a fixed, read-only value of 0x30 for this register.

* On power-on, software should switch the affected core to Normal Mode on the SCU
* On power-off, software '''must''' switch the affected core to Powered Off mode on the SCU (otherwise the core won't go off)

The normal Arm11 bootrom checks cpuid and hangs if cpuid >= 2. This is a problem when booting the 2 additional New3DS Arm11 MPCores. NewKernel11 solves this by using a hardware feature to overlay the bootrom with a configurable branch to a kernel function. This overlay feature was added with the New3DS.

The overlay should be enabled by setting bit0 in [[CONFIG11_Registers#CFG11_BOOTROM_OVERLAY_CNT|CFG11_BOOTROM_OVERLAY_CNT]] and configured by setting the entrypoint address to [[CONFIG11_Registers#CFG11_BOOTROM_OVERLAY_VAL|CFG11_BOOTROM_OVERLAY_VAL]].

The overlay overrides all ''instruction'' reads from phyiscal addresses 0xFFFF0000-0xFFFF1000 and 0x10000-0x11000 to the following (figured out by using low exception vectors and configuring the b11 veeners accordingly):
ldr pc, [pc, #(0x20 - 8)]

and all ''data'' reads from the same ranges to [[CONFIG11_Registers#CFG11_BOOTROM_OVERLAY_VAL|CFG11_BOOTROM_OVERLAY_VAL]].

PDN Registers

2021-01-26T23:31:14Z

TuxSH: Credits: nocash for figuring out the instruction overlay /* PDN_LGR_CPU_CNT */

=Register table=
{| class="wikitable" border="1"
! Old3DS
! Name
! Address
! Width
! Used by
|-
| style="background: green" | Yes
| [[#PDN_SLEEP_CNT|PDN_SLEEP_CNT]]
| 0x10141000
| 2
| Kernel11
|-
| style="background: green" | Yes
| [[#PDN_WAKE_ENABLE|PDN_WAKE_ENABLE]]
| 0x10141008
| 4
| [[PTM Services]], [[PDN Services]]
|-
| style="background: green" | Yes
| [[#PDN_WAKE_REASON|PDN_WAKE_REASON]]
| 0x1014100C
| 4
| [[PTM Services]], TwlBg, [[PDN Services]]
|-style="border-top: double"
| style="background: green" | Yes
| [[#LGY_MODE|LGY_MODE]]
| 0x10141100
| 2
| TwlProcess9, TwlBg
|-
| style="background: green" | Yes
| [[#LGY_SLEEP_CNT|LGY_SLEEP_CNT]]
| 0x10141104
| 2
| TwlBg
|-
| style="background: green" | Yes
| [[#LGY_IRQ_ENABLE|LGY_IRQ_ENABLE]]
| 0x10141108
| 2
| TwlBg
|-
| style="background: green" | Yes
| [[#LGY_PAD_CNT|LGY_PAD_CNT]]
| 0x1014110A
| 2
| TwlBg
|-
| style="background: green" | Yes
| [[#LGY_HIDEMU_MASK|LGY_HIDEMU_MASK]]
| 0x10141110
| 2
| TwlBg
|-
| style="background: green" | Yes
| [[#LGY_HIDEMU_PAD|LGY_HIDEMU_PAD]]
| 0x10141112
| 2
| TwlBg
|-
| style="background: green" | Yes
| [[#LGY_GPIOEMU_MASK|LGY_GPIOEMU_MASK]]
| 0x10141114
| 2
| [[Codec Services]], TwlBg
|-
| style="background: green" | Yes
| [[#LGY_GPIOEMU_DATA|LGY_GPIOEMU_DATA]]
| 0x10141116
| 2
| [[Codec Services]], TwlBg
|-
| style="background: green" | Yes
| [[#LGY_CARDDETECTEMU_MASK|LGY_CARDDETECTEMU_MASK]]
| 0x10141118
| 1
| TwlBg
|-
| style="background: green" | Yes
| [[#LGY_CARDDETECTEMU_DATA|LGY_CARDDETECTEMU_DATA]]
| 0x10141119
| 1
| TwlBg
|-
| style="background: green" | Yes
| LGY_?
| 0x10141120
| 1
| TwlBg
|-
|-style="border-top: double"
| style="background: green" | Yes
| [[#PDN_GPU_CNT|PDN_GPU_CNT]]
| 0x10141200
| 4
| Boot11, Kernel11, [[PDN Services]], TwlBg
|-
| style="background: green" | Yes
| [[#PDN_VRAM_CNT|PDN_VRAM_CNT]]
| 0x10141204
| 1
| Boot11, Kernel11, TwlBg
|-
| style="background: green" | Yes
| [[#PDN_LCD_CNT|PDN_LCD_CNT]]
| 0x10141208
| 1
| Boot11
|-
| style="background: green" | Yes
| [[#PDN_FCRAM_CNT|PDN_FCRAM_CNT]]
| 0x10141210
| 2
| Kernel11, TwlBg
|-
| style="background: green" | Yes
| [[#PDN_I2S_CNT|PDN_I2S_CNT]]
| 0x10141220
| 1
| Boot11, TwlBg, [[PDN Services]]
|-
| style="background: green" | Yes
| [[#PDN_CAMERA_CNT|PDN_CAMERA_CNT]]
| 0x10141224
| 1
| [[PDN Services]]
|-
| style="background: green" | Yes
| [[#PDN_DSP_CNT|PDN_DSP_CNT]]
| 0x10141230
| 1
| Process9, [[PDN Services]]
|-
| style="background: red" | No
| [[#PDN_MVD_CNT|PDN_MVD_CNT]]
| 0x10141240
| 1
|
|-style="border-top: double"
| style="background: red" | No
| [[#PDN_LGR_SOCMODE|PDN_LGR_SOCMODE]]
| 0x10141300
| 2
| NewKernel11
|-
| style="background: red" | No
| [[#PDN_LGR_CNT|PDN_LGR_CNT]]
| 0x10141304
| 2
| NewKernel11
|-
| style="background: red" | No
| [[#PDN_LGR_CPU_CNT<0-3>|PDN_LGR_CPU_CNT]]<0-3>
| 0x10141310
| 1*4
| NewKernel11
|}

=Sleep registers=
==PDN_SLEEP_CNT==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| 1 = Enter sleep mode
|-
| 2-14
| Unused.
|-
| 15
| 1 = VRAM is powered down
|}

Kernel11 powers down VRAM (it's unclear whether bit15 is power-down or self-refresh mode) by first disabling the 8 banks using [[GPU/External_Registers#Map|GX register 0x10400030]], then by disabling the GPU clock using [[#PDN_GPU_CNT|PDN_GPU_CNT]] bit 16 and finally writes to and polls this register.

==PDN_WAKE_ENABLE==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| [[HID_Registers#HID_PAD_CNT|HID_PAD_CNT]]
|-
| 3
| Shell opened
|-
| 4
| Headphones not plugged in
|-
| 8
| WiFi (?)
|-
| 19
| Shell GPIO (?)
|-
| 26
| [[I2C_Registers#Device_3|MCU interrupt]]
|-
| 30
| Touch screen pressed
|-
| 31
| CTR gamecard inserted/removed
|-
|}
List in progress.

This is a OR list of wake triggers that will wake up the console from sleep and raise IRQ 0x58.

==PDN_WAKE_REASON==
Same layout as [[#PDN_WAKE_ENABLE|PDN_WAKE_ENABLE]].

This is a OR list of the wake triggers that actually woke up the console.

For each bit, write 1 to acknowledge, and 0 to clear (?).

=Legacy registers=
==LGY_MODE==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| Read only legacy mode set on reg 0x10018000.
|-
| 2-14
| Unused.
|-
| 15
| 1 = enable legacy mode.
|}
To boot into DSi or GBA mode first set register 0x10018000 to the desired mode and setup LgyFb. Then disable FCRAM by clearing bit 0 in reg 0x10201000, writing 0 to PDN_FCRAM_CNT followed by 1 and waiting for bit 2 to clear.

The very last 3DS-mode register poke the [[FIRM|TWL_FIRM]] Process9 does before it gets switched into TWL-mode, is writing 0x8000 to this register. Before writing this register, TWL Process9 waits for ARM7 to change the value of this register. The Process9 code for this runs from ITCM, since switching into TWL-mode includes remapping all ARM9 physical memory.

==LGY_SLEEP_CNT==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Write 1 to wakeup GBA mode.
|-
| 1
| Sleep state/ack. 1 when GBA mode entered sleep. Write 1 to ack.
|-
| 2
| ?
|-
| 3-14
| Unused.
|-
| 15
| 1 = IRQ enable (IRQ 0x59)
|}
When a GBA game enters sleep mode and bit 15 is 1, IRQ 0x59 fires and bit 1 is set. Bit 1 must be acknowledged/written together with bit 0 otherwise GBA mode wakes up from sleep early sometimes.

==LGY_IRQ_ENABLE==
[[ARM11_Interrupts|Arm11 interrupt]] enable bits for legacy interrupts, same bit layout as the GPIOEMU regs below.

==LGY_PAD_CNT==
Also named "KEYCNT" on certain other DS(i)/GBA documentations.
The value of this register is copied to [[HID_Registers|HID_PAD_CNT]] when GBA mode enters sleep.

==LGY_HIDEMU_MASK==
Set bits will use the corresponding values from [[#LGY_HIDEMU_PAD|LGY_HIDEMU_PAD]] instead of allowing the hardware to read it from [[HID_Registers#HID_PAD|HID_PAD]].

This is set to 0x1FFF (all buttons and the debug key) and [[#LGY_HIDEMU_PAD|LGY_HIDEMU_PAD]] is set to 0 when the "Close this software and return to HOME Menu?" dialog is shown to prevent the button presses from propagating to the DS/GBA CPU.

==LGY_HIDEMU_PAD==
Works the same way as [[HID_Registers#HID_PAD|HID_PAD]], but the values set here are only replaced in the HID_PAD seen by the DS/GBA CPU when the corresponding bits in [[#LGY_HIDEMU_MASK|LGY_HIDEMU_MASK]] are set.

==LGY_GPIOEMU_MASK==
Set bits will read bits from [[#LGY_GPIOEMU_DATA|LGY_GPIOEMU_DATA]] (override).

This is used to trigger things like the TWL MCU interrupt in TWL mode.

==LGY_GPIOEMU_DATA==
See above

==LGY_CARDDETECTEMU_MASK==
Set bits will read bits from [[#LGY_CARDDETECTEMU_DATA|LGY_CARDDETECTEMU_DATA]] (override).

Bit0 signals cartridge removal.

==LGY_CARDDETECTEMU_DATA==
See above

=Clock and reset registers=
==PDN_GPU_CNT==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| GPU main block + VRAM + LCD reset. 0 = reset.
|-
| 1
| PSC block reset? 0 = reset.
|-
| 2
| Geoshader block reset? 0 = reset.
|-
| 3
| Rasterization block reset? 0 = reset.
|-
| 4
| PPF block reset. 0 = reset.
|-
| 5
| PDC block reset? 0 = reset.
|-
| 6
| PDC related reset. 0 = reset.
|-
| 7-15
| Unused.
|-
| 16
| Clock enable for all blocks, VRAM and LCD. 1 = enable.
|}

PDN uses a 12 ARM11 cycle delay to deassert reset.

==PDN_VRAM_CNT==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Clock. 1 = enable, 0 = disable
|}

This register seems to be unimplemented in released models: while it is used in tandem with PDN_GPU_CNT.bit16 in Boot11 screeninit code, Kernel11 only uses PDN_GPU_CNT.bit16 to power-off VRAM before going to sleep.

==PDN_LCD_CNT==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Clock. 1 = enable, 0 = disable
|}

This register seems to be unimplemented in released models, only to be used in Boot11, as PDN_GPU_CNT.bit16 also drives the LCD clock.

==PDN_FCRAM_CNT==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Reset. 0 = reset.
|-
| 1
| Clock. 1 = enable, 0 = disable
|-
| 2
| Acknowledge clock request. Gets set or unset when toggling bit 1.
|}
Twl-/AgbBg use this to disable FCRAM for the GBA rom in GBA mode or DSi main RAM in DSi mode. AgbBg clears bit 0 in reg 0x10201000 before touching this reg.

Kernel11 uses it to put the FCRAM in self-refresh mode (clock disable) before going to sleep.

==PDN_I2S_CNT==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| I2S1 Clock (maybe?) 1 = enable, 0 = disable
|-
| 1
| I2S2 Clock. 1 = enable, 0 = disable
|}

I2S1 clock enable bit seems to be unimplemented. Maybe it's because DSP clock enable drives it?

==PDN_CAMERA_CNT==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Clock. 1 = enable, 0 = disable
|}

==PDN_DSP_CNT==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Reset. 0 = reset.
|-
| 1
| Clock. 1 = enable, 0 = disable
|}

PDN services holds reset for 0x30 Arm11 cycles.

==PDN_MVD_CNT==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Reset. 0 = reset
|}

This doesn't seem to be used by anything, but does have a clear effect on the hardware.

The reset value for this register is 1 (out-of-reset at boot).

=N3DS SoC (LGR) registers=
== PDN_LGR_SOCMODE ==
This is used for configuring the New3DS ARM11 CPU clock-rate. This register is New3DS-only: reading from here on Old3DS always returns all-zeros even when one tried writing data here prior to the read.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-2
| SoC mode.
Possible values:
0=CTR+256MHz
1=LGR2+256MHz, 5=LGR2+804MHz
2=LGR1+256MHz, 3=LGR1+536MHz

N3DS modes (LGR1/LGR2) enable the New 3DS FCRAM extension and are needed to access N3DS-only devices.

* CTR: O3DS
* LGR1: N3DS prototype, 4 cores (originally 2), no L2C
* LGR2: retail N3DS, 4 cores, has L2C
|-
| 15
| Interrupt status (read) / clear (write)
|}

'''All currently powered-on cores must be (and remain) in WFI state to trigger the SoC mode switch.'''

Kernel code suggests that devices that support LGR1 but not LGR2 only had 2 cores. All cores (the number of which can be read from MPCORE SCU registers) are usable in LGR1 mode.

On firmlaunch, the kernel sets the mode to O3DS.

[[SVC#KernelSetState|svcKernelSetState]] type10, only implemented on New3DS, uses this register. This piece of code choses the mode matching the input Param0 bit0 state (1 for higher clock), using the state of [[CONFIG11 Registers#CFG11_SOCINFO|CFG11_SOCINFO]] to determine which mode is the best (which is always LGR2 on all released New 3DS units).

== PDN_LGR_CNT ==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Enables the N3DS extramem block
|-
| 8
| Enables the L2C block (LGR2 only)
|}

Kernel11 sets this to 0x101 when bit 2 in [[CONFIG11 Registers#CFG11_SOCINFO|CFG11_SOCINFO]] (LGR2 supported) is set otherwise 1.

== PDN_LGR_CPU_CNT<0-3> ==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Power request: 0 = power off, 1 = power on
|-
| 1
| Handshake bit
Needs to be set before powering on the core. It is meant to be cleared by software on the powered-on core, to signal itself.
|-
| 4
| Power status: 0 = off, 1 = on
|-
| 5
| Core present?
|}

Only usable for core2 and core3. Core 0 and 1 have a fixed, read-only value of 0x30 for this register.

* On power-on, software should switch the affected core to Normal Mode on the SCU
* On power-off, software '''must''' switch the affected core to Powered Off mode on the SCU (otherwise the core won't go off)

The normal Arm11 bootrom checks cpuid and hangs if cpuid >= 2. This is a problem when booting the 2 additional New3DS Arm11 MPCores. NewKernel11 solves this by using a hardware feature to overlay the bootrom with a configurable branch to a kernel function. This overlay feature was added with the New3DS.

The overlay should be enabled by setting bit0 in [[CONFIG11_Registers#CFG11_BOOTROM_OVERLAY_CNT|CFG11_BOOTROM_OVERLAY_CNT]] and configured by setting the entrypoint address to [[CONFIG11_Registers#CFG11_BOOTROM_OVERLAY_VAL|CFG11_BOOTROM_OVERLAY_VAL]].

The overlays overrides all ''instruction'' reads from phyiscal addresses 0xFFFF0000-0xFFFF1000 and 0x10000-0x11000 to the following (figured out by using low exception vectors and configuring the b11 veeners accordingly):
ldr pc, [pc, #(0x20 - 8)]

and all ''data'' reads from the same ranges to [[CONFIG11_Registers#CFG11_BOOTROM_OVERLAY_VAL|CFG11_BOOTROM_OVERLAY_VAL]].

PDN Registers

2021-01-26T23:02:16Z

TuxSH: /* PDN_LGR_SOCMODE */

=Register table=
{| class="wikitable" border="1"
! Old3DS
! Name
! Address
! Width
! Used by
|-
| style="background: green" | Yes
| [[#PDN_SLEEP_CNT|PDN_SLEEP_CNT]]
| 0x10141000
| 2
| Kernel11
|-
| style="background: green" | Yes
| [[#PDN_WAKE_ENABLE|PDN_WAKE_ENABLE]]
| 0x10141008
| 4
| [[PTM Services]], [[PDN Services]]
|-
| style="background: green" | Yes
| [[#PDN_WAKE_REASON|PDN_WAKE_REASON]]
| 0x1014100C
| 4
| [[PTM Services]], TwlBg, [[PDN Services]]
|-style="border-top: double"
| style="background: green" | Yes
| [[#LGY_MODE|LGY_MODE]]
| 0x10141100
| 2
| TwlProcess9, TwlBg
|-
| style="background: green" | Yes
| [[#LGY_SLEEP_CNT|LGY_SLEEP_CNT]]
| 0x10141104
| 2
| TwlBg
|-
| style="background: green" | Yes
| [[#LGY_IRQ_ENABLE|LGY_IRQ_ENABLE]]
| 0x10141108
| 2
| TwlBg
|-
| style="background: green" | Yes
| [[#LGY_PAD_CNT|LGY_PAD_CNT]]
| 0x1014110A
| 2
| TwlBg
|-
| style="background: green" | Yes
| [[#LGY_HIDEMU_MASK|LGY_HIDEMU_MASK]]
| 0x10141110
| 2
| TwlBg
|-
| style="background: green" | Yes
| [[#LGY_HIDEMU_PAD|LGY_HIDEMU_PAD]]
| 0x10141112
| 2
| TwlBg
|-
| style="background: green" | Yes
| [[#LGY_GPIOEMU_MASK|LGY_GPIOEMU_MASK]]
| 0x10141114
| 2
| [[Codec Services]], TwlBg
|-
| style="background: green" | Yes
| [[#LGY_GPIOEMU_DATA|LGY_GPIOEMU_DATA]]
| 0x10141116
| 2
| [[Codec Services]], TwlBg
|-
| style="background: green" | Yes
| [[#LGY_CARDDETECTEMU_MASK|LGY_CARDDETECTEMU_MASK]]
| 0x10141118
| 1
| TwlBg
|-
| style="background: green" | Yes
| [[#LGY_CARDDETECTEMU_DATA|LGY_CARDDETECTEMU_DATA]]
| 0x10141119
| 1
| TwlBg
|-
| style="background: green" | Yes
| LGY_?
| 0x10141120
| 1
| TwlBg
|-
|-style="border-top: double"
| style="background: green" | Yes
| [[#PDN_GPU_CNT|PDN_GPU_CNT]]
| 0x10141200
| 4
| Boot11, Kernel11, [[PDN Services]], TwlBg
|-
| style="background: green" | Yes
| [[#PDN_VRAM_CNT|PDN_VRAM_CNT]]
| 0x10141204
| 1
| Boot11, Kernel11, TwlBg
|-
| style="background: green" | Yes
| [[#PDN_LCD_CNT|PDN_LCD_CNT]]
| 0x10141208
| 1
| Boot11
|-
| style="background: green" | Yes
| [[#PDN_FCRAM_CNT|PDN_FCRAM_CNT]]
| 0x10141210
| 2
| Kernel11, TwlBg
|-
| style="background: green" | Yes
| [[#PDN_I2S_CNT|PDN_I2S_CNT]]
| 0x10141220
| 1
| Boot11, TwlBg, [[PDN Services]]
|-
| style="background: green" | Yes
| [[#PDN_CAMERA_CNT|PDN_CAMERA_CNT]]
| 0x10141224
| 1
| [[PDN Services]]
|-
| style="background: green" | Yes
| [[#PDN_DSP_CNT|PDN_DSP_CNT]]
| 0x10141230
| 1
| Process9, [[PDN Services]]
|-
| style="background: red" | No
| [[#PDN_MVD_CNT|PDN_MVD_CNT]]
| 0x10141240
| 1
|
|-style="border-top: double"
| style="background: red" | No
| [[#PDN_LGR_SOCMODE|PDN_LGR_SOCMODE]]
| 0x10141300
| 2
| NewKernel11
|-
| style="background: red" | No
| [[#PDN_LGR_CNT|PDN_LGR_CNT]]
| 0x10141304
| 2
| NewKernel11
|-
| style="background: red" | No
| [[#PDN_LGR_CPU_CNT<0-3>|PDN_LGR_CPU_CNT]]<0-3>
| 0x10141310
| 1*4
| NewKernel11
|}

=Sleep registers=
==PDN_SLEEP_CNT==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| 1 = Enter sleep mode
|-
| 2-14
| Unused.
|-
| 15
| 1 = VRAM is powered down
|}

Kernel11 powers down VRAM (it's unclear whether bit15 is power-down or self-refresh mode) by first disabling the 8 banks using [[GPU/External_Registers#Map|GX register 0x10400030]], then by disabling the GPU clock using [[#PDN_GPU_CNT|PDN_GPU_CNT]] bit 16 and finally writes to and polls this register.

==PDN_WAKE_ENABLE==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| [[HID_Registers#HID_PAD_CNT|HID_PAD_CNT]]
|-
| 3
| Shell opened
|-
| 4
| Headphones not plugged in
|-
| 8
| WiFi (?)
|-
| 19
| Shell GPIO (?)
|-
| 26
| [[I2C_Registers#Device_3|MCU interrupt]]
|-
| 30
| Touch screen pressed
|-
| 31
| CTR gamecard inserted/removed
|-
|}
List in progress.

This is a OR list of wake triggers that will wake up the console from sleep and raise IRQ 0x58.

==PDN_WAKE_REASON==
Same layout as [[#PDN_WAKE_ENABLE|PDN_WAKE_ENABLE]].

This is a OR list of the wake triggers that actually woke up the console.

For each bit, write 1 to acknowledge, and 0 to clear (?).

=Legacy registers=
==LGY_MODE==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| Read only legacy mode set on reg 0x10018000.
|-
| 2-14
| Unused.
|-
| 15
| 1 = enable legacy mode.
|}
To boot into DSi or GBA mode first set register 0x10018000 to the desired mode and setup LgyFb. Then disable FCRAM by clearing bit 0 in reg 0x10201000, writing 0 to PDN_FCRAM_CNT followed by 1 and waiting for bit 2 to clear.

The very last 3DS-mode register poke the [[FIRM|TWL_FIRM]] Process9 does before it gets switched into TWL-mode, is writing 0x8000 to this register. Before writing this register, TWL Process9 waits for ARM7 to change the value of this register. The Process9 code for this runs from ITCM, since switching into TWL-mode includes remapping all ARM9 physical memory.

==LGY_SLEEP_CNT==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Write 1 to wakeup GBA mode.
|-
| 1
| Sleep state/ack. 1 when GBA mode entered sleep. Write 1 to ack.
|-
| 2
| ?
|-
| 3-14
| Unused.
|-
| 15
| 1 = IRQ enable (IRQ 0x59)
|}
When a GBA game enters sleep mode and bit 15 is 1, IRQ 0x59 fires and bit 1 is set. Bit 1 must be acknowledged/written together with bit 0 otherwise GBA mode wakes up from sleep early sometimes.

==LGY_IRQ_ENABLE==
[[ARM11_Interrupts|Arm11 interrupt]] enable bits for legacy interrupts, same bit layout as the GPIOEMU regs below.

==LGY_PAD_CNT==
Also named "KEYCNT" on certain other DS(i)/GBA documentations.
The value of this register is copied to [[HID_Registers|HID_PAD_CNT]] when GBA mode enters sleep.

==LGY_HIDEMU_MASK==
Set bits will use the corresponding values from [[#LGY_HIDEMU_PAD|LGY_HIDEMU_PAD]] instead of allowing the hardware to read it from [[HID_Registers#HID_PAD|HID_PAD]].

This is set to 0x1FFF (all buttons and the debug key) and [[#LGY_HIDEMU_PAD|LGY_HIDEMU_PAD]] is set to 0 when the "Close this software and return to HOME Menu?" dialog is shown to prevent the button presses from propagating to the DS/GBA CPU.

==LGY_HIDEMU_PAD==
Works the same way as [[HID_Registers#HID_PAD|HID_PAD]], but the values set here are only replaced in the HID_PAD seen by the DS/GBA CPU when the corresponding bits in [[#LGY_HIDEMU_MASK|LGY_HIDEMU_MASK]] are set.

==LGY_GPIOEMU_MASK==
Set bits will read bits from [[#LGY_GPIOEMU_DATA|LGY_GPIOEMU_DATA]] (override).

This is used to trigger things like the TWL MCU interrupt in TWL mode.

==LGY_GPIOEMU_DATA==
See above

==LGY_CARDDETECTEMU_MASK==
Set bits will read bits from [[#LGY_CARDDETECTEMU_DATA|LGY_CARDDETECTEMU_DATA]] (override).

Bit0 signals cartridge removal.

==LGY_CARDDETECTEMU_DATA==
See above

=Clock and reset registers=
==PDN_GPU_CNT==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| GPU main block + VRAM + LCD reset. 0 = reset.
|-
| 1
| PSC block reset? 0 = reset.
|-
| 2
| Geoshader block reset? 0 = reset.
|-
| 3
| Rasterization block reset? 0 = reset.
|-
| 4
| PPF block reset. 0 = reset.
|-
| 5
| PDC block reset? 0 = reset.
|-
| 6
| PDC related reset. 0 = reset.
|-
| 7-15
| Unused.
|-
| 16
| Clock enable for all blocks, VRAM and LCD. 1 = enable.
|}

PDN uses a 12 ARM11 cycle delay to deassert reset.

==PDN_VRAM_CNT==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Clock. 1 = enable, 0 = disable
|}

This register seems to be unimplemented in released models: while it is used in tandem with PDN_GPU_CNT.bit16 in Boot11 screeninit code, Kernel11 only uses PDN_GPU_CNT.bit16 to power-off VRAM before going to sleep.

==PDN_LCD_CNT==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Clock. 1 = enable, 0 = disable
|}

This register seems to be unimplemented in released models, only to be used in Boot11, as PDN_GPU_CNT.bit16 also drives the LCD clock.

==PDN_FCRAM_CNT==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Reset. 0 = reset.
|-
| 1
| Clock. 1 = enable, 0 = disable
|-
| 2
| Acknowledge clock request. Gets set or unset when toggling bit 1.
|}
Twl-/AgbBg use this to disable FCRAM for the GBA rom in GBA mode or DSi main RAM in DSi mode. AgbBg clears bit 0 in reg 0x10201000 before touching this reg.

Kernel11 uses it to put the FCRAM in self-refresh mode (clock disable) before going to sleep.

==PDN_I2S_CNT==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| I2S1 Clock (maybe?) 1 = enable, 0 = disable
|-
| 1
| I2S2 Clock. 1 = enable, 0 = disable
|}

I2S1 clock enable bit seems to be unimplemented. Maybe it's because DSP clock enable drives it?

==PDN_CAMERA_CNT==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Clock. 1 = enable, 0 = disable
|}

==PDN_DSP_CNT==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Reset. 0 = reset.
|-
| 1
| Clock. 1 = enable, 0 = disable
|}

PDN services holds reset for 0x30 Arm11 cycles.

==PDN_MVD_CNT==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Reset. 0 = reset
|}

This doesn't seem to be used by anything, but does have a clear effect on the hardware.

The reset value for this register is 1 (out-of-reset at boot).

=N3DS SoC (LGR) registers=
== PDN_LGR_SOCMODE ==
This is used for configuring the New3DS ARM11 CPU clock-rate. This register is New3DS-only: reading from here on Old3DS always returns all-zeros even when one tried writing data here prior to the read.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-2
| SoC mode.
Possible values:
0=CTR+256MHz
1=LGR2+256MHz, 5=LGR2+804MHz
2=LGR1+256MHz, 3=LGR1+536MHz

N3DS modes (LGR1/LGR2) enable the New 3DS FCRAM extension and are needed to access N3DS-only devices.

* CTR: O3DS
* LGR1: N3DS prototype, 4 cores (originally 2), no L2C
* LGR2: retail N3DS, 4 cores, has L2C
|-
| 15
| Interrupt status (read) / clear (write)
|}

'''All currently powered-on cores must be (and remain) in WFI state to trigger the SoC mode switch.'''

Kernel code suggests that devices that support LGR1 but not LGR2 only had 2 cores. All cores (the number of which can be read from MPCORE SCU registers) are usable in LGR1 mode.

On firmlaunch, the kernel sets the mode to O3DS.

[[SVC#KernelSetState|svcKernelSetState]] type10, only implemented on New3DS, uses this register. This piece of code choses the mode matching the input Param0 bit0 state (1 for higher clock), using the state of [[CONFIG11 Registers#CFG11_SOCINFO|CFG11_SOCINFO]] to determine which mode is the best (which is always LGR2 on all released New 3DS units).

== PDN_LGR_CNT ==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Enables the N3DS extramem block
|-
| 8
| Enables the L2C block (LGR2 only)
|}

Kernel11 sets this to 0x101 when bit 2 in [[CONFIG11 Registers#CFG11_SOCINFO|CFG11_SOCINFO]] (LGR2 supported) is set otherwise 1.

== PDN_LGR_CPU_CNT<0-3> ==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| nRESET, 0 = reset. Also enable the bootrom instruction overlay.
|-
| 1
| Enable bootrom data overlay
|-
| 4
| Reset operation in progress
|-
| 5
| Always 1?
|}

Only usable for core2 and core3.

The normal Arm11 bootrom checks cpuid and hangs if cpuid >= 2. This is a problem when booting the 2 additional New3DS Arm11 MPCores. NewKernel11 solves this by using a hardware feature to overlay the bootrom with a configurable branch to a kernel function. This overlay feature was added with the New3DS.

Bit1 in register above enables a bootrom data-override for physical addresses 0xFFFF0000-0xFFFF1000 and 0x10000-0x11000. All _data reads_ made to those regions now read the 32-bit value provided in [[CONFIG11 Registers #CFG11_BOOTROM_OVERLAY_VAL|CFG11_BOOTROM_OVERLAY_VAL]].

Bit0 sets the core out of reset and enables a bootrom instruction-overlay which means that _instruction reads_ made to the bootrom region are overridden. We have not been able to dump what instructions are actually placed at bootrom by this switch (because reading the area only yields data-reads). Jumping randomly into the 0xFFFF0000-0xFFFF1000 region works fine and jumps to the value provided by the data overlay [[CONFIG11 Registers #CFG11_BOOTROM_OVERLAY_VAL|CFG11_BOOTROM_OVERLAY_VAL]]. Thus we may predict that the entire bootrom region is filled by:
ldr pc, [pc]

Or equivalent. However, jumping to some high addresses such as 0xFFFF0FF0+ will crash the core. This may be explained by prefetching in the Arm pipeline, and might help us identify what instructions are placed by the instruction-overlay.

CONFIG11 Registers

2021-01-26T22:56:42Z

TuxSH: /* CFG11_SOCINFO */

= Registers =
{| class="wikitable" border="1"
! Old3DS
! Name
! Address
! Width
! Used by
|-
| style="background: green" | Yes
| [[#CFG11_SHAREDWRAM_32K_CODE|CFG11_SHAREDWRAM_32K_CODE]]<0-7>
| 0x10140000
| 1*8
| Boot11, Process9, [[DSP Services]]
|-
| style="background: green" | Yes
| [[#CFG11_SHAREDWRAM_32K_DATA|CFG11_SHAREDWRAM_32K_DATA]]<0-7>
| 0x10140008
| 1*8
| Boot11, Process9, [[DSP Services]]
|-style="border-top: double"
| style="background: green" | Yes
| [[#CFG11_NULLPAGE_CNT|CFG11_NULLPAGE_CNT]]
| 0x10140100
| 4
|
|-
| style="background: green" | Yes
| [[#CFG11_FIQ_MASK|CFG11_FIQ_MASK]]
| 0x10140104
| 1
| Kernel11.
|-
| style="background: green" | Yes
| Debug related bitfield?
Observed: 0b1100(N3DS)/0b0000(O3DS)
| 0x10140105
| 1
|
|-
| style="background: green" | Yes
| [[#CFG11_CDMA_CNT|CFG_CDMA_CNT]]
| 0x1014010C
| 2
| TwlBg
|-
| style="background: green" | Yes
| [[#CFG11_GPUPROT|CFG11_GPUPROT]]
| 0x10140140
| 4
| Kernel11
|-
| style="background: green" | Yes
| [[#CFG11_WIFICNT|CFG11_WIFICNT]]
| 0x10140180
| 1
| TwlBg, [[NWM Services]]
|-
| style="background: green" | Yes
| [[#CFG11_SPI_CNT|CFG11_SPI_CNT]]
| 0x101401C0
| 2
| [[SPI Services]], TwlBg
|-style="border-top: double"
| style="background: green" | Yes
| ?
| 0x10140200
| 4
|
|-style="border-top: double"
| style="background: red" | No
| [[#CFG11_GPU_N3DS_CNT|CFG11_GPU_N3DS_CNT]]
| 0x10140400
| 1
| NewKernel11
|-
| style="background: red" | No
| [[#CFG11_CDMA_PERIPHERALS|CFG11_CDMA_PERIPHERALS]]
| 0x10140410
| 4
| NewKernel11
|-
| style="background: red" | No
| [[#CFG11_BOOTROM_OVERLAY_CNT|CFG11_BOOTROM_OVERLAY_CNT]]
| 0x10140420
| 1
| NewKernel11
|-
| style="background: red" | No
| [[#CFG11_BOOTROM_OVERLAY_VAL|CFG11_BOOTROM_OVERLAY_VAL]]
| 0x10140424
| 4
| NewKernel11
|-
| style="background: red" | No
| ?
| 0x10140428
| 4
|
|-style="border-top: double"
| style="background: green" | Yes
| [[#CFG11_SOCINFO|CFG11_SOCINFO]]
| 0x10140FFC
| 2
| Boot11, Kernel11
|}

== CFG11_SHAREDWRAM_32K_CODE ==
Used for mapping 32K chunks of shared WRAM for DSP data.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| Master (0=ARM9?, 1=ARM11?, 2 or 3=DSP/code)
|-
| 2-4
| Offset (0..7) (slot 0..7) (LSB of address in 32Kbyte units)
|-
| 5-6
| Not used (0)
|-
| 7
| Enable (0=Disable, 1=Enable)
|}

== CFG11_SHAREDWRAM_32K_DATA ==
Used for mapping 32K chunks of shared WRAM for DSP data.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| Master (0=ARM9?, 1=ARM11?, 2 or 3=DSP/data)
|-
| 2-4
| Offset (0..7) (slot 0..7) (LSB of address in 32Kbyte units)
|-
| 5-6
| Not used (0)
|-
| 7
| Enable (0=Disable, 1=Enable)
|}

== CFG11_NULLPAGE_CNT ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 0
| Trap all ''data'' accesses to physmem addresses 0x0000 to 0x1000
|-
| 16
| Unknown
|}

The reset value of this register is 0x10000.

== CFG11_FIQ_MASK ==
Write bit N to mask FIQ interrutps on core N? (judging from what Kernel11 does -- it only ever configures FIQ for core1)

Reset value: 0xF

== CFG11_CDMA_CNT ==
Write 1 to enable, to disable.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Enable Microphone DMA (CDMA 0x00)
|-
| 1
| Enable NTRCARD DMA on Arm11 side (CDMA 0x01)
|-
| 2-4
| ?
|-
| 5
| WiFi. Enabled during kernel init since 11.4.
|}

== CFG11_SPI_CNT ==
When the corresponding bit is 0, the bus has to be accessed using the DS SPI registers. Otherwise it has to be accessed using the 3DS SPI registers.
{| class="wikitable" border="1"
! Bit
! Description
|-
| 0
| Enable [[SPI Registers]] 0x10160800.
|-
| 1
| Enable [[SPI Registers]] 0x10142800.
|-
| 2
| Enable [[SPI Registers]] 0x10143800.
|}

== CFG11_GPU_N3DS_CNT ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 0
| Enable N3DS mode? (enables access to the extra N3DS FCRAM banks, etc.)
|-
| 1
| Texture related? (observing texture glitches when disabling this bit)
|}

== CFG11_CDMA_PERIPHERALS ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 0-17
| CDMA Peripheral 0x00-0x11 data request target (0=Old CDMA, 1=New CDMA)
|-
| 18-31
| Unused
|}

== CFG11_BOOTROM_OVERLAY_CNT ==
Bit0: Enable bootrom overlay functionality.

== CFG11_BOOTROM_OVERLAY_VAL ==
The 32-bit value to overlay data-reads to bootrom with. See [[PDN Registers#PDN_LGR_CPU_CNT<0-3>|PDN_LGR_CPU_CNT]]<0-3>.

== CFG11_SOCINFO ==
Read-only register. Identifies the maximum mode-switching capabilities of the SoC.

* CTR: O3DS
* LGR1: N3DS prototype, 4 cores (orginally 2), up to 535MHz, no L2C (see below)
* LGR2: retail N3DS, 4 cores, up to 804MHz, has L2C

Kernel code suggests that devices that support LGR1 but not LGR2 only had 2 cores. All cores (the number of which can be read from MPCORE SCU registers) are usable in LGR1 mode.

{| class="wikitable" border="1"
! Bits
! Description
! Used by
|-
| 0
| CTR mode (1 on all 3DSes)
| Boot11
|-
| 1
| LGR1 (1 on all N3DSes, orginally 2 cores, and 2x clockrate)
| Kernel11
|-
| 2
| LGR2 (1 on all released N3DSes, 4 cores and 3x clockrate)
| Kernel11
|}

==CFG11_GPUPROT==
{| class="wikitable" border="1"
! Old3DS
! Bits
! Description
|-
| style="background: green" | Yes
| 3-0
| Old FCRAM DMA cutoff size, 0 = no protection.
|-
| style="background: red" | No
| 7-4
| New FCRAM DMA cutoff size, 0 = no protection.
|-
| style="background: green" | Yes
| 8
| AXIWRAM protection, 0 = accessible.
|-
| style="background: red" | No
| 10-9
| QTM DMA cutoff size
|-
| style="background: green" | Yes
| 31-11
| Zeroes
|}

For the old FCRAM DMA cutoff, it protects starting from 0x28000000-(0x800000*x) until end of FCRAM. There is no way to protect the first 0x800000-bytes.

For the new FCRAM DMA cutoff, it protects starting from 0x30000000-(0x800000*x) until end of FCRAM. When the old FCRAM cutoff is set to non-zero, the first 0x800000-bytes bytes of new FCRAM are protected.

On New3DS the old+new FCRAM cutoff can be used at the same time, however this isn't done officially.

For the QTM DMA cutoff, it protects starting from 0x1F400000-(0x100000*x) until end of QTM mem.

On cold boot this reg is set to 0.

When this register is set to value 0, the GPU can access the entire FCRAM, AXIWRAM, and on New3DS all QTM-mem.

[[SVC|Initialized]] during kernel boot, and used with [[SVC]] 0x59 which was implemented with [[11.3.0-36|v11.3]].

==CFG11_WIFICNT==
{| class="wikitable" border="1"
! Old3DS
! Bits
! Description
|-
| style="background: green" | Yes
| 0
| Enable wifi subsystem
|}

GPIO Registers

2021-01-24T22:36:28Z

TuxSH: /* GPIO pins */

= Registers =

== GPIO ==

{| class="wikitable" border="1"
! Old3DS
! Name
! Address
! Width
|-
| style="background: green" | Yes
| [[#GPIOn_DATA|GPIO1_DATA]]
| 0x10147000
| 1
|-
| style="background: green" | Yes
| [[#GPIOn_DATA|GPIO2_DATA]]
| 0x10147010
| 1
|-
| style="background: green" | Yes
| [[#GPIOn_DIR|GPIO2_DIR]]
| 0x10147011
| 1
|-
| style="background: green" | Yes
| [[#GPIOn_INTCFG|GPIO2_INTCFG]]
| 0x10147012
| 1
|-
| style="background: green" | Yes
| [[#GPIOn_INTEN|GPIO2_INTEN]]
| 0x10147013
| 1
|-
| style="background: green" | Yes
| [[#GPIOn_DATA2|GPIO2_DATA2]]
| 0x10147014
| 2
|-
| style="background: green" | Yes
| [[#GPIOn_DATA|GPIO3_DATA]]
| 0x10147020
| 2
|-
| style="background: green" | Yes
| [[#GPIOn_DIR|GPIO3_DIR]]
| 0x10147022
| 2
|-
| style="background: green" | Yes
| [[#GPIOn_INTCFG|GPIO3_INTCFG]]
| 0x10147024
| 2
|-
| style="background: green" | Yes
| [[#GPIOn_INTEN|GPIO3_INTEN]]
| 0x10147026
| 2
|-
| style="background: green" | Yes
| [[#GPIOn_DATA2|GPIO3_DATA2]]
| 0x10147028
| 2
|-
|}

== Legacy RTC ==
{| class="wikitable" border="1"
! Name
! Address
! Width
! Description
|-
| [[#RTC_CNT_(0x10147100)|RTC_CNT]]
| 0x10147100
| 2
| Control register
|-
| RTC_REG_STAT1
| 0x10147110
| 1
| Rtc status register 1 (command 0). Bitswapped
|-
| RTC_REG_STAT2
| 0x10147111
| 1
| Rtc status register 2 (command 1). Bitswapped
|-
| RTC_REG_CLKADJ
| 0x10147112
| 1
| Rtc clock adjustment register (command 6). Bitswapped
|-
| RTC_REG_FREE
| 0x10147113
| 1
| The free general purpose rtc register (command 7). Bitswapped
|-
| RTC_REG_TIME1
| 0x10147120
| 4
| Byte-wise bit-swapped (bit7 is bit0, etc.) BCD RTC (byte0 = seconds, byte1 = minutes, byte2 = hours, byte3 = day of week)
|-
| RTC_REG_TIME2
| 0x10147124
| 4 (3?)
| Day, month and year all byte-wise bit-swapped
|-
| RTC_REG_ALRMTIM1
| 0x10147130
| 4 (3?)
| Rtc alarm time register 1 (command 4). Byte-wise bit-swapped
|-
| RTC_REG_ALRMTIM2
| 0x10147134
| 4 (3?)
| Rtc alarm time register 2 (command 5). Byte-wise bit-swapped
|-
| RTC_REG_COUNT
| 0x10147140
| 4 (3?)
| Rtc dsi counter register (ex command 0). Byte-wise bit-swapped
|-
| RTC_REG_FOUT1
| 0x10147150
| 1
| Rtc dsi fout register 1 (ex command 1). Bitswapped
|-
| RTC_REG_FOUT2
| 0x10147151
| 1
| Rtc dsi fout register 2 (ex command 2). Bitswapped
|-
| RTC_REG_ALRMDAT1
| 0x10147160
| 4 (3?)
| Rtc dsi alarm date register 1 (ex command 4). Byte-wise bit-swapped
|-
| RTC_REG_ALRMDAT2
| 0x10147164
| 4 (3?)
| Rtc dsi alarm date register 2 (ex command 5). Byte-wise bit-swapped
|-
|}

= Descriptions =

== GPIO ==
=== GPIO pins ===

Only GPIO2 and GPIO3 pins have their interrupts configurable. Active low pins should be configured as "falling edge", and output ports shouldn't have interrupts enabled at all.

[[GPIO Services]] bitmasks use this table, in that order:

{| class="wikitable" border="1"
! Bit
! IRQ ID
! Description
|-
| 0
| ?
| Debug button (?) (active-low)
|-
| 1
| 0x63 (falling edge)
| Touch Screen (active low, 0 = screen pressed)
|-
| 2
| 0x60 (falling edge)
0x62 (rising edge)
| Shell closed
|-style="border-top: double"
| 0
| 0x64
| Headphones inserted
|-
| 1
| 0x66
| TWL depop circuit (?) (active-low)
|-style="border-top: double"
| DATA2.0
| -
| WiFi mode/freq. select (0 = CTR, 1 = MP (DS WiFi))
|-style="border-top: double"
| 0
| 0x68
| C-stick interrupt
|-
| 1
| 0x69
| IrDA interrupt (active-low)
|-
| 2
| 0x6A
| Gyro interrupt
|-
| 3
| 0x6B
| C-stick "stop" (output)
|-
| 4
| 0x6C
| IrDA TX-RC (output)
|-
| 5
| 0x6D
| IrDA RXD (active-low)
|-
| 6
| 0x6E
| NFC output1 (?)
|-
| 7
| 0x6F
| NFC output2 (?)
|-
| 8
| 0x70
| Headphones button/half-inserted (active-low)
|-
| 9
| 0x71
| MCU interrupt
|-
| 10
| 0x72
| NFC interrupt (?)
|-
| 11
| 0x73
| QTM output (?)
|-
|-style="border-top: double"
| DATA2.0
| -
| WiFi enable
|}

=== GPIOn_DATA ===
Pin values, one bit per pin.

=== GPIOn_DIR ===
Pin directions for GPIO2 and GPIO3, one bit per pin.

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Input
|-
| 1
| Output
|}

=== GPIOn_INTCFG ===
Interrupt configuration for GPIO2 and GPIO3 pins (not the extra ones), one bit per pin.

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Falling edge
|-
| 1
| Rising edge
|}

=== GPIOn_INTEN ===
Interrupt enable bits for GPIO2 and GPIO3 pins (not the extra ones), one bit per pin.

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Interrupt disabled
|-
| 1
| Interrupt enabled
|}

=== GPIOn_DATA2 ===
Extra pins for GPIO2 and GPIO3 (one bit each). These two pins, in total, are not bound to any IRQ and are not configurable.

=== Default values ===
After bootrom initialization, these are the values of the registers:

{| class="wikitable" border="1"
! Address
! Value
|-
| 0x10147000
| 0x0003
|-
| 0x10147010
| 0x00000002
|-
| 0x10147014
| 0x0000
|-
| 0x10147020
| 0x00000DFB
|-
| 0x10147024
| 0x00000000
|-
| 0x10147028
| 0x0000
|}

== Legacy RTC ==
=== RTC_CNT (0x10147100) ===
{| class="wikitable" border="1"
! Bit
! Description
|-
| 0
| Latch STAT1
|-
| 1
| Latch STAT2
|-
| 2
| Latch CLKADJ
|-
| 3
| Latch FREE
|-
| 4
| Latch TIME
|-
| 5
| Latch ALRMTIM1
|-
| 6
| Latch ALRMTIM2
|-
| 7
| Latch COUNT
|-
| 8
| Latch FOUT1
|-
| 9
| Latch FOUT2
|-
| 10
| Latch ALRMDAT1
|-
| 11
| Latch ALRMDAT2
|-
| 12
| ARM7 Busy? This may be chipselect
|-
| 13
| ARM7 write command received? (writing 1 clears it seems)
|-
| 14
| ARM7 read command recieved? (writing 1 clears it seems)
|-
| 15
| DS SIO SI pin (rtc irq pin)
|}

GPIO Registers

2021-01-24T22:35:08Z

TuxSH: /* GPIO */

= Registers =

== GPIO ==

{| class="wikitable" border="1"
! Old3DS
! Name
! Address
! Width
|-
| style="background: green" | Yes
| [[#GPIOn_DATA|GPIO1_DATA]]
| 0x10147000
| 1
|-
| style="background: green" | Yes
| [[#GPIOn_DATA|GPIO2_DATA]]
| 0x10147010
| 1
|-
| style="background: green" | Yes
| [[#GPIOn_DIR|GPIO2_DIR]]
| 0x10147011
| 1
|-
| style="background: green" | Yes
| [[#GPIOn_INTCFG|GPIO2_INTCFG]]
| 0x10147012
| 1
|-
| style="background: green" | Yes
| [[#GPIOn_INTEN|GPIO2_INTEN]]
| 0x10147013
| 1
|-
| style="background: green" | Yes
| [[#GPIOn_DATA2|GPIO2_DATA2]]
| 0x10147014
| 2
|-
| style="background: green" | Yes
| [[#GPIOn_DATA|GPIO3_DATA]]
| 0x10147020
| 2
|-
| style="background: green" | Yes
| [[#GPIOn_DIR|GPIO3_DIR]]
| 0x10147022
| 2
|-
| style="background: green" | Yes
| [[#GPIOn_INTCFG|GPIO3_INTCFG]]
| 0x10147024
| 2
|-
| style="background: green" | Yes
| [[#GPIOn_INTEN|GPIO3_INTEN]]
| 0x10147026
| 2
|-
| style="background: green" | Yes
| [[#GPIOn_DATA2|GPIO3_DATA2]]
| 0x10147028
| 2
|-
|}

== Legacy RTC ==
{| class="wikitable" border="1"
! Name
! Address
! Width
! Description
|-
| [[#RTC_CNT_(0x10147100)|RTC_CNT]]
| 0x10147100
| 2
| Control register
|-
| RTC_REG_STAT1
| 0x10147110
| 1
| Rtc status register 1 (command 0). Bitswapped
|-
| RTC_REG_STAT2
| 0x10147111
| 1
| Rtc status register 2 (command 1). Bitswapped
|-
| RTC_REG_CLKADJ
| 0x10147112
| 1
| Rtc clock adjustment register (command 6). Bitswapped
|-
| RTC_REG_FREE
| 0x10147113
| 1
| The free general purpose rtc register (command 7). Bitswapped
|-
| RTC_REG_TIME1
| 0x10147120
| 4
| Byte-wise bit-swapped (bit7 is bit0, etc.) BCD RTC (byte0 = seconds, byte1 = minutes, byte2 = hours, byte3 = day of week)
|-
| RTC_REG_TIME2
| 0x10147124
| 4 (3?)
| Day, month and year all byte-wise bit-swapped
|-
| RTC_REG_ALRMTIM1
| 0x10147130
| 4 (3?)
| Rtc alarm time register 1 (command 4). Byte-wise bit-swapped
|-
| RTC_REG_ALRMTIM2
| 0x10147134
| 4 (3?)
| Rtc alarm time register 2 (command 5). Byte-wise bit-swapped
|-
| RTC_REG_COUNT
| 0x10147140
| 4 (3?)
| Rtc dsi counter register (ex command 0). Byte-wise bit-swapped
|-
| RTC_REG_FOUT1
| 0x10147150
| 1
| Rtc dsi fout register 1 (ex command 1). Bitswapped
|-
| RTC_REG_FOUT2
| 0x10147151
| 1
| Rtc dsi fout register 2 (ex command 2). Bitswapped
|-
| RTC_REG_ALRMDAT1
| 0x10147160
| 4 (3?)
| Rtc dsi alarm date register 1 (ex command 4). Byte-wise bit-swapped
|-
| RTC_REG_ALRMDAT2
| 0x10147164
| 4 (3?)
| Rtc dsi alarm date register 2 (ex command 5). Byte-wise bit-swapped
|-
|}

= Descriptions =

== GPIO ==
=== GPIO pins ===

Only GPIO2 and GPIO3 pins have their interrupts configurable. Active low pins should be configured as "falling edge", and output ports shouldn't have interrupts enabled at all.

[[GPIO Services]] bitmasks use this table, in that order:

{| class="wikitable" border="1"
! Bit
! IRQ ID
! Description
|-
| 0
| ?
| Debug button (?) (active-low)
|-
| 1
| 0x63 (falling edge)
| Touch Screen (active low, 0 = screen pressed)
|-
| 2
| 0x60 (falling edge)
0x62 (rising edge)
| Shell closed
|-style="border-top: double"
| 0
| 0x64
| Headphones inserted
|-
| 1
| 0x66
| TWL depop circuit (?) (active-low)
|-style="border-top: double"
| DATA2.0
| -
| GPIO2_DATA2_0 (wifi related?)
|-style="border-top: double"
| 0
| 0x68
| C-stick interrupt
|-
| 1
| 0x69
| IrDA interrupt (active-low)
|-
| 2
| 0x6A
| Gyro interrupt
|-
| 3
| 0x6B
| C-stick "stop" (output)
|-
| 4
| 0x6C
| IrDA TX-RC (output)
|-
| 5
| 0x6D
| IrDA RXD (active-low)
|-
| 6
| 0x6E
| NFC output1 (?)
|-
| 7
| 0x6F
| NFC output2 (?)
|-
| 8
| 0x70
| Headphones button/half-inserted (active-low)
|-
| 9
| 0x71
| MCU interrupt
|-
| 10
| 0x72
| NFC interrupt (?)
|-
| 11
| 0x73
| QTM output (?)
|-
|-style="border-top: double"
| DATA2.0
| -
| GPIO3_DATA2_0 (wifi related?)
|}

=== GPIOn_DATA ===
Pin values, one bit per pin.

=== GPIOn_DIR ===
Pin directions for GPIO2 and GPIO3, one bit per pin.

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Input
|-
| 1
| Output
|}

=== GPIOn_INTCFG ===
Interrupt configuration for GPIO2 and GPIO3 pins (not the extra ones), one bit per pin.

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Falling edge
|-
| 1
| Rising edge
|}

=== GPIOn_INTEN ===
Interrupt enable bits for GPIO2 and GPIO3 pins (not the extra ones), one bit per pin.

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Interrupt disabled
|-
| 1
| Interrupt enabled
|}

=== GPIOn_DATA2 ===
Extra pins for GPIO2 and GPIO3 (one bit each). These two pins, in total, are not bound to any IRQ and are not configurable.

=== Default values ===
After bootrom initialization, these are the values of the registers:

{| class="wikitable" border="1"
! Address
! Value
|-
| 0x10147000
| 0x0003
|-
| 0x10147010
| 0x00000002
|-
| 0x10147014
| 0x0000
|-
| 0x10147020
| 0x00000DFB
|-
| 0x10147024
| 0x00000000
|-
| 0x10147028
| 0x0000
|}

== Legacy RTC ==
=== RTC_CNT (0x10147100) ===
{| class="wikitable" border="1"
! Bit
! Description
|-
| 0
| Latch STAT1
|-
| 1
| Latch STAT2
|-
| 2
| Latch CLKADJ
|-
| 3
| Latch FREE
|-
| 4
| Latch TIME
|-
| 5
| Latch ALRMTIM1
|-
| 6
| Latch ALRMTIM2
|-
| 7
| Latch COUNT
|-
| 8
| Latch FOUT1
|-
| 9
| Latch FOUT2
|-
| 10
| Latch ALRMDAT1
|-
| 11
| Latch ALRMDAT2
|-
| 12
| ARM7 Busy? This may be chipselect
|-
| 13
| ARM7 write command received? (writing 1 clears it seems)
|-
| 14
| ARM7 read command recieved? (writing 1 clears it seems)
|-
| 15
| DS SIO SI pin (rtc irq pin)
|}

ARM11 Interrupts

2021-01-24T21:20:32Z

TuxSH: /* Hardware Interrupts */

== Interrupts ==

Interrupt priority is 0-0xF. A priority of 0xF means that the interrupt is disabled.

= Private Interrupts =

Each CPU core has 32 software interrupts that are private and belong to that core. These interrupts are numbers 0-0x1F for each core. The hardware interrupts are not core-specific and start at interrupt ID 0x20.

{| class="wikitable" border="1"
! IRQ
! Listener
! Description
|-
| 0
|
| MPCore software-interrupt. Not configured.
|-
| 0x1-0x3
|
| MPCore software-interrupt. Used by Boot11 and Kernel11 to kickstart Core1/2/3.
|-
| 0x4
| Kernel
| MPCore software-interrupt. Used to manage the performance counter.
|-
| 0x5
| Kernel
| MPCore software-interrupt. Does apparently nothing.
|-
| 0x6
| Kernel
| MPCore software-interrupt. Extensively used by [[SVC|KernelSetState]] (and contains most of the actual code of the latter).
|-
| 0x7
| Kernel
| MPCore software-interrupt. See [[KCacheMaintenanceInterruptEvent]]
|-
| 0x8
| Kernel
| MPCore software-interrupt. Used for scheduling.
|-
| 0x9
| Kernel
| MPCore software-interrupt. Used when handling exceptions that require termination of a thread or a process, and in some cases by svcSetDebugThreadContext, to store VFP registers in the thread's register storage.
|-
| 0xA
| Kernel
| TLB operations interrupt, see [[KTLBOperationsInterruptEvent]]
|-
| 0xB-0xE
|
| MPCore software-interrupt. Not configured.
|-
| 0xF
| dmnt/debugger
| MPCore software-interrupt. Used to abstract FIQ (debug). This interrupt is never sent to core2 nor core3 on N3DS.
|-
| 0x1D
| Kernel
| MPCore timer.
|-
| 0x1E
| Kernel
| MPCore watchdog - set when the watchdog counter reaches 0 in timer mode, causes interrupt 30 to set as pending. Only set on core 1 as core 1's timer is used for everything.
|}

= Hardware Interrupts =

There are 0x60 hardware interrupts starting at 0x20 and continuing up to 0x7F. These are not private and are accessible from any core.

{| class="wikitable" border="1"
! IRQ
! Listener
! Description
|-
| 0x24
| ?
| SPI bus 2 interrupt status update
|-
| 0x28
| gsp, TwlBg
| PSC0
|-
| 0x29
| gsp, TwlBg
| PSC1
|-
| 0x2A
| gsp, TwlBg
| PDC0 (VBlank0)
|-
| 0x2B
| gsp, TwlBg
| PDC1 (VBlank1)
|-
| 0x2C
| gsp, TwlBg
| PPF
|-
| 0x2D
| gsp, TwlBg
| P3D
|-
| 0x30-0x38
| Kernel
| Old CDMA Event 0..8 (9 separate IRQ lines)
|-
| 0x39
| Kernel
| Old CDMA Faulting (eg. CCR=0, or event>15)
|-
| 0x3A
| Kernel
| New CDMA Event 0..31 (shared IRQ line)
|-
| 0x3B
| Kernel
| New CDMA Faulting (eg. CCR=0)
|-
| 0x40
| nwm
| WIFI SDIO Controller @ 0x10122000
|-
| 0x41
| nwm
| WIFI SDIO Controller IRQ pin @ 0x10122000
|-
| 0x42
| nwm_dev?
| Debug WIFI SDIO Controller @ 0x10100000 ?
|-
| 0x43
| nwm_dev?
| Debug WIFI SDIO Controller @ 0x10100000 ?
|-
| 0x44
| ?
| NTRCARD (maybe?)
|-
| 0x45
| mvd (New3DS)
| L2B_0 (First RGB-to-RGBA Converter)
|-
| 0x46
| mvd (New3DS)
| L2B_1 (Second RGB-to-RGBA Converter)
|-
| 0x48
| camera
| Camera Bus 0 (DSi cameras)
|-
| 0x49
| camera
| Camera Bus 1 (left-eye)
|-
| 0x4A
| dsp
| General interrupt from DSP, including semaphore and command/reply registers status change
|-
| 0x4B
| camera
| Y2R Conversion Finished
|-
| 0x4C
| TwlBg
| LGYFB_0 Legacy GBA/NDS Video
|-
| 0x4D
| TwlBg
| LGYFB_1 Legacy GBA/NDS Video
|-
| 0x4E
| mvd (New3DS)
| Y2R2 End Event
|-
| 0x4F
| mvd (New3DS)
| MVD general interrupt?
|-
| 0x50
| pxi, TwlBg
| Sync (bit 29 from Arm9's PXI_SYNC)
|-
| 0x51
| pxi, TwlBg
| Sync 2 (bit 30 from Arm9's PXI_SYNC)
|-
| 0x52
| pxi, TwlBg
| Send Fifo Empty
|-
| 0x53
| pxi, TwlBg
| Receive Fifo Not Empty
|-
| 0x54
| i2c, TwlBg
| I2C Bus0 work done
|-
| 0x55
| i2c, TwlBg
| I2C Bus1 work done
|-
| 0x56
| spi, TwlBg
| SPI bus 3 interrupt status update
|-
| 0x57
| spi, TwlBg
| SPI bus 1 interrupt status update
|-
| 0x58
| Kernel
| PDN (wake event or SoC mode changed)
|-
| 0x59
| TwlBg
| PDN Legacy Sleep
|-
| 0x5A
| mic
| General microphone interrupt (?)
|-
| 0x5B
| -
| [[HID_Registers#HID_PAD_CNT|HID_PAD_CNT]]
|-
| 0x5C
| i2c, TwlBg
| I2C Bus2 work done
|-
| 0x5F
| mp
| DS WiFi registers
|-
| 0x60
| gpio, TwlBg
| Shell opened (GPIO1_2 falling edge)
|-
| 0x62
| gpio, TwlBg
| Shell closed (GPIO1_2 rising edge)
|-
| 0x63
| gpio, TwlBg
| Touch Screen pressed (GPIO1_1 falling edge)
|-
| 0x64
| gpio, TwlBg
| Headphones inserted (GPIO2_0)
|-
| 0x66
| gpio, TwlBg
| TWL depop circuit (GPIO2_1)
|-
| 0x68
| gpio, TwlBg
| C-stick interrupt (GPIO3_0)
|-
| 0x69
| gpio, TwlBg
| IrDA interrupt (active-low) (GPIO3_1)
|-
| 0x6A
| gpio, TwlBg
| Gyro interrupt (GPIO3_2)
|-
| 0x6B
| gpio, TwlBg
| C-stick "stop" (output) (GPIO3_3)
|-
| 0x6C
| gpio, TwlBg
| IrDA TX-RC (output) (GPIO3_4)
|-
| 0x6D
| gpio, TwlBg
| IrDA RXD (GPIO3_5)
|-
| 0x6E
| gpio, TwlBg
| NFC output1 (?) (GPIO3_6)
|-
| 0x6F
| gpio, TwlBg
| NFC output2 (?) (GPIO3_7)
|-
| 0x70
| gpio, TwlBg
| Headphones button/half-inserted (active-low) (GPIO3_8)
|-
| 0x71
| gpio, TwlBg
| MCU interrupt (GPIO3_9)
|-
| 0x72
| gpio, TwlBg
| NFC interrupt (?) (GPIO3_10)
|-
| 0x73
| TwlBg
| QTM output (?) (GPIO3_11)
|-
| 0x74
| ?
| Gamecard related
|-
| 0x75
| ?
| Gamecard inserted
|-
| 0x76
| -
| L2C
|-
| 0x78 to 0x7B
| Kernel
| Core 0-3 Performance monitor counter (any) overflow
|-
| 0x7A to 0x82 (PDN_MPCORE_CFG bit2 set) or
0x7C to 0x84 (bit2 clear)
| Kernel
| Other PMU interrupts (line may not exist at all)
|}
(interrupts from 0x80 and up can't be mapped in available builds of the kernel)

There are 2 tables in the Arm11 kernel: the first has 32 * 2(or 32 * 4) 8-byte entries. This table is for the private interrupts that belong to each core. The data for each interrupt can be found by doing table_base + (core_num * 0x100) + (intr_num * 8). The second table is for public hardware interrupts and the data for each interrupt can be retrieved by doing table_base + (intr_num * 8).

The Arm11 kernel configures interrupts the following way (it seems the GPIO IRQ layout doesn't match released 3DS models):

<nowiki>Interrupts 0x00 to 0x1F: edge-triggered, N-N
Interrupt 0x20: level-sensitive, 1-N
Interrupt 0x21: level-sensitive, 1-N
Interrupt 0x22: level-sensitive, 1-N
Interrupt 0x23: level-sensitive, 1-N
Interrupt 0x24: edge-triggered, 1-N
Interrupt 0x25: level-sensitive, 1-N
Interrupt 0x28: level-sensitive, 1-N
Interrupt 0x29: level-sensitive, 1-N
Interrupt 0x2a: level-sensitive, 1-N
Interrupt 0x2b: level-sensitive, 1-N
Interrupt 0x2c: level-sensitive, 1-N
Interrupt 0x2d: level-sensitive, 1-N
Interrupt 0x30: level-sensitive, 1-N
Interrupt 0x31: level-sensitive, 1-N
Interrupt 0x32: level-sensitive, 1-N
Interrupt 0x33: level-sensitive, 1-N
Interrupt 0x34: level-sensitive, 1-N
Interrupt 0x35: level-sensitive, 1-N
Interrupt 0x36: level-sensitive, 1-N
Interrupt 0x37: level-sensitive, 1-N
Interrupt 0x38: level-sensitive, 1-N
Interrupt 0x39: level-sensitive, 1-N
Interrupt 0x3a: level-sensitive, 1-N
Interrupt 0x3b: level-sensitive, 1-N
Interrupt 0x40: edge-triggered, 1-N
Interrupt 0x41: edge-triggered, 1-N
Interrupt 0x42: edge-triggered, 1-N
Interrupt 0x43: edge-triggered, 1-N
Interrupt 0x44: edge-triggered, 1-N
Interrupt 0x45: edge-triggered, 1-N
Interrupt 0x46: edge-triggered, 1-N
Interrupt 0x48: edge-triggered, 1-N
Interrupt 0x49: edge-triggered, 1-N
Interrupt 0x4a: edge-triggered, 1-N
Interrupt 0x4b: edge-triggered, 1-N
Interrupt 0x4c: edge-triggered, 1-N
Interrupt 0x4d: edge-triggered, 1-N
Interrupt 0x4e: edge-triggered, 1-N
Interrupt 0x4f: level-sensitive, 1-N
Interrupt 0x50: edge-triggered, 1-N
Interrupt 0x51: edge-triggered, 1-N
Interrupt 0x52: edge-triggered, 1-N
Interrupt 0x53: edge-triggered, 1-N
Interrupt 0x54: edge-triggered, 1-N
Interrupt 0x55: edge-triggered, 1-N
Interrupt 0x56: edge-triggered, 1-N
Interrupt 0x57: edge-triggered, 1-N
Interrupt 0x58: level-sensitive, 1-N
Interrupt 0x59: edge-triggered, 1-N
Interrupt 0x5a: edge-triggered, 1-N
Interrupt 0x5b: edge-triggered, 1-N
Interrupt 0x5f: edge-triggered, 1-N
Interrupt 0x60: edge-triggered, 1-N
Interrupt 0x61: edge-triggered, 1-N
Interrupt 0x64: edge-triggered, 1-N
Interrupt 0x65: edge-triggered, 1-N
Interrupt 0x66: edge-triggered, 1-N
Interrupt 0x68: edge-triggered, 1-N
Interrupt 0x69: edge-triggered, 1-N
Interrupt 0x6a: edge-triggered, 1-N
Interrupt 0x6b: edge-triggered, 1-N
Interrupt 0x6c: edge-triggered, 1-N
Interrupt 0x6d: edge-triggered, 1-N
Interrupt 0x6e: edge-triggered, 1-N
Interrupt 0x6f: edge-triggered, 1-N
Interrupt 0x70: edge-triggered, 1-N
Interrupt 0x71: edge-triggered, 1-N
Interrupt 0x72: edge-triggered, 1-N
Interrupt 0x73: edge-triggered, 1-N
Interrupt 0x74: edge-triggered, 1-N
Interrupt 0x75: edge-triggered, 1-N
Interrupt 0x76: level-sensitive, 1-N
Interrupt 0x77: level-sensitive, 1-N
Interrupt 0x78: edge-triggered, 1-N
Interrupt 0x79: level-sensitive, 1-N
Interrupt 0x7a: level-sensitive, 1-N
Interrupt 0x7b: level-sensitive, 1-N
Interrupt 0x7c: level-sensitive, 1-N
Interrupt 0x7d: level-sensitive, 1-N</nowiki>

= InterruptData =
{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| [[KBaseInterruptEvent]] *
| Pointer to the KBaseInterruptEvent object for this interrupt
|-
| 0x4
| u8
| Interrupt will be disabled by the IRQ handler as soon as it is acknowledged.
Ignored for FIQ: the FIQ handler always sets bit2 of [[PDN_Registers#PDN_FIQ_CNT|PDN_FIQ_CNT]]
|-
| 0x5
| u8
| Interrupt is disabled
|-
| 0x6
| u8
| Interrupt priority
|-
| 0x7
| u8
| Unused, alignment
|}

= Interrupt Table (New3DS) =
(0xFFF318F4 in 10.3)

{| class="wikitable" border="1"
! Offset
! Type
! Description
|-
| 0x0
| InterruptData[224]
| Data for all hardware and software interrupts
|-
| 0x700
| [[KObjectMutex]]
| Mutex
|}

GPIO Registers

2021-01-24T21:19:12Z

TuxSH: /* GPIO pins */

= Registers =

== GPIO ==

{| class="wikitable" border="1"
! Old3DS
! Name
! Address
! Width
|-
| style="background: green" | Yes
| [[#GPIOn_DATA|GPIO1_DATA]]
| 0x10147000
| 1
|-
| style="background: green" | Yes
| [[#GPIOn_DATA|GPIO2_DATA]]
| 0x10147010
| 1
|-
| style="background: green" | Yes
| [[#GPIOn_DIR|GPIO2_DIR]]
| 0x10147011
| 1
|-
| style="background: green" | Yes
| [[#GPIOn_INTCFG|GPIO2_INTCFG]]
| 0x10147012
| 1
|-
| style="background: green" | Yes
| [[#GPIOn_INTEN|GPIO2_INTEN]]
| 0x10147013
| 1
|-
| style="background: green" | Yes
| [[#GPIOn_DATA2|GPIO2_DATA2]]
| 0x10147014
| 2
|-
| style="background: green" | Yes
| [[#GPIOn_DATA|GPIO3_DATA]]
| 0x10147020
| 2
|-
| style="background: green" | Yes
| [[#GPIOn_DIR|GPIO3_DIR]]
| 0x10147022
| 2
|-
| style="background: green" | Yes
| [[#GPIOn_INTCFG|GPIO3_INTCFG]]
| 0x10147024
| 2
|-
| style="background: green" | Yes
| [[#GPIOn_INTEN|GPIO3_INTEN]]
| 0x10147026
| 2
|-
| style="background: green" | Yes
| [[#GPIOn_DATA2|GPIO2_DATA2]]
| 0x10147028
| 2
|-
|}

== Legacy RTC ==
{| class="wikitable" border="1"
! Name
! Address
! Width
! Description
|-
| [[#RTC_CNT_(0x10147100)|RTC_CNT]]
| 0x10147100
| 2
| Control register
|-
| RTC_REG_STAT1
| 0x10147110
| 1
| Rtc status register 1 (command 0). Bitswapped
|-
| RTC_REG_STAT2
| 0x10147111
| 1
| Rtc status register 2 (command 1). Bitswapped
|-
| RTC_REG_CLKADJ
| 0x10147112
| 1
| Rtc clock adjustment register (command 6). Bitswapped
|-
| RTC_REG_FREE
| 0x10147113
| 1
| The free general purpose rtc register (command 7). Bitswapped
|-
| RTC_REG_TIME1
| 0x10147120
| 4
| Byte-wise bit-swapped (bit7 is bit0, etc.) BCD RTC (byte0 = seconds, byte1 = minutes, byte2 = hours, byte3 = day of week)
|-
| RTC_REG_TIME2
| 0x10147124
| 4 (3?)
| Day, month and year all byte-wise bit-swapped
|-
| RTC_REG_ALRMTIM1
| 0x10147130
| 4 (3?)
| Rtc alarm time register 1 (command 4). Byte-wise bit-swapped
|-
| RTC_REG_ALRMTIM2
| 0x10147134
| 4 (3?)
| Rtc alarm time register 2 (command 5). Byte-wise bit-swapped
|-
| RTC_REG_COUNT
| 0x10147140
| 4 (3?)
| Rtc dsi counter register (ex command 0). Byte-wise bit-swapped
|-
| RTC_REG_FOUT1
| 0x10147150
| 1
| Rtc dsi fout register 1 (ex command 1). Bitswapped
|-
| RTC_REG_FOUT2
| 0x10147151
| 1
| Rtc dsi fout register 2 (ex command 2). Bitswapped
|-
| RTC_REG_ALRMDAT1
| 0x10147160
| 4 (3?)
| Rtc dsi alarm date register 1 (ex command 4). Byte-wise bit-swapped
|-
| RTC_REG_ALRMDAT2
| 0x10147164
| 4 (3?)
| Rtc dsi alarm date register 2 (ex command 5). Byte-wise bit-swapped
|-
|}

= Descriptions =

== GPIO ==
=== GPIO pins ===

Only GPIO2 and GPIO3 pins have their interrupts configurable. Active low pins should be configured as "falling edge", and output ports shouldn't have interrupts enabled at all.

[[GPIO Services]] bitmasks use this table, in that order:

{| class="wikitable" border="1"
! Bit
! IRQ ID
! Description
|-
| 0
| ?
| Debug button (?) (active-low)
|-
| 1
| 0x63 (falling edge)
| Touch Screen (active low, 0 = screen pressed)
|-
| 2
| 0x60 (falling edge)
0x62 (rising edge)
| Shell closed
|-style="border-top: double"
| 0
| 0x64
| Headphones inserted
|-
| 1
| 0x66
| TWL depop circuit (?) (active-low)
|-style="border-top: double"
| DATA2.0
| -
| GPIO2_DATA2_0 (wifi related?)
|-style="border-top: double"
| 0
| 0x68
| C-stick interrupt
|-
| 1
| 0x69
| IrDA interrupt (active-low)
|-
| 2
| 0x6A
| Gyro interrupt
|-
| 3
| 0x6B
| C-stick "stop" (output)
|-
| 4
| 0x6C
| IrDA TX-RC (output)
|-
| 5
| 0x6D
| IrDA RXD (active-low)
|-
| 6
| 0x6E
| NFC output1 (?)
|-
| 7
| 0x6F
| NFC output2 (?)
|-
| 8
| 0x70
| Headphones button/half-inserted (active-low)
|-
| 9
| 0x71
| MCU interrupt
|-
| 10
| 0x72
| NFC interrupt (?)
|-
| 11
| 0x73
| QTM output (?)
|-
|-style="border-top: double"
| DATA2.0
| -
| GPIO3_DATA2_0 (wifi related?)
|}

=== GPIOn_DATA ===
Pin values, one bit per pin.

=== GPIOn_DIR ===
Pin directions for GPIO2 and GPIO3, one bit per pin.

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Input
|-
| 1
| Output
|}

=== GPIOn_INTCFG ===
Interrupt configuration for GPIO2 and GPIO3 pins (not the extra ones), one bit per pin.

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Falling edge
|-
| 1
| Rising edge
|}

=== GPIOn_INTEN ===
Interrupt enable bits for GPIO2 and GPIO3 pins (not the extra ones), one bit per pin.

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Interrupt disabled
|-
| 1
| Interrupt enabled
|}

=== GPIOn_DATA2 ===
Extra pins for GPIO2 and GPIO3 (one bit each). These two pins, in total, are not bound to any IRQ and are not configurable.

=== Default values ===
After bootrom initialization, these are the values of the registers:

{| class="wikitable" border="1"
! Address
! Value
|-
| 0x10147000
| 0x0003
|-
| 0x10147010
| 0x00000002
|-
| 0x10147014
| 0x0000
|-
| 0x10147020
| 0x00000DFB
|-
| 0x10147024
| 0x00000000
|-
| 0x10147028
| 0x0000
|}

== Legacy RTC ==
=== RTC_CNT (0x10147100) ===
{| class="wikitable" border="1"
! Bit
! Description
|-
| 0
| Latch STAT1
|-
| 1
| Latch STAT2
|-
| 2
| Latch CLKADJ
|-
| 3
| Latch FREE
|-
| 4
| Latch TIME
|-
| 5
| Latch ALRMTIM1
|-
| 6
| Latch ALRMTIM2
|-
| 7
| Latch COUNT
|-
| 8
| Latch FOUT1
|-
| 9
| Latch FOUT2
|-
| 10
| Latch ALRMDAT1
|-
| 11
| Latch ALRMDAT2
|-
| 12
| ARM7 Busy? This may be chipselect
|-
| 13
| ARM7 write command received? (writing 1 clears it seems)
|-
| 14
| ARM7 read command recieved? (writing 1 clears it seems)
|-
| 15
| DS SIO SI pin (rtc irq pin)
|}

ARM11 Interrupts

2021-01-24T21:14:40Z

TuxSH: More GPIOs /* Hardware Interrupts */

== Interrupts ==

Interrupt priority is 0-0xF. A priority of 0xF means that the interrupt is disabled.

= Private Interrupts =

Each CPU core has 32 software interrupts that are private and belong to that core. These interrupts are numbers 0-0x1F for each core. The hardware interrupts are not core-specific and start at interrupt ID 0x20.

{| class="wikitable" border="1"
! IRQ
! Listener
! Description
|-
| 0
|
| MPCore software-interrupt. Not configured.
|-
| 0x1-0x3
|
| MPCore software-interrupt. Used by Boot11 and Kernel11 to kickstart Core1/2/3.
|-
| 0x4
| Kernel
| MPCore software-interrupt. Used to manage the performance counter.
|-
| 0x5
| Kernel
| MPCore software-interrupt. Does apparently nothing.
|-
| 0x6
| Kernel
| MPCore software-interrupt. Extensively used by [[SVC|KernelSetState]] (and contains most of the actual code of the latter).
|-
| 0x7
| Kernel
| MPCore software-interrupt. See [[KCacheMaintenanceInterruptEvent]]
|-
| 0x8
| Kernel
| MPCore software-interrupt. Used for scheduling.
|-
| 0x9
| Kernel
| MPCore software-interrupt. Used when handling exceptions that require termination of a thread or a process, and in some cases by svcSetDebugThreadContext, to store VFP registers in the thread's register storage.
|-
| 0xA
| Kernel
| TLB operations interrupt, see [[KTLBOperationsInterruptEvent]]
|-
| 0xB-0xE
|
| MPCore software-interrupt. Not configured.
|-
| 0xF
| dmnt/debugger
| MPCore software-interrupt. Used to abstract FIQ (debug). This interrupt is never sent to core2 nor core3 on N3DS.
|-
| 0x1D
| Kernel
| MPCore timer.
|-
| 0x1E
| Kernel
| MPCore watchdog - set when the watchdog counter reaches 0 in timer mode, causes interrupt 30 to set as pending. Only set on core 1 as core 1's timer is used for everything.
|}

= Hardware Interrupts =

There are 0x60 hardware interrupts starting at 0x20 and continuing up to 0x7F. These are not private and are accessible from any core.

{| class="wikitable" border="1"
! IRQ
! Listener
! Description
|-
| 0x24
| ?
| SPI bus 2 interrupt status update
|-
| 0x28
| gsp, TwlBg
| PSC0
|-
| 0x29
| gsp, TwlBg
| PSC1
|-
| 0x2A
| gsp, TwlBg
| PDC0 (VBlank0)
|-
| 0x2B
| gsp, TwlBg
| PDC1 (VBlank1)
|-
| 0x2C
| gsp, TwlBg
| PPF
|-
| 0x2D
| gsp, TwlBg
| P3D
|-
| 0x30-0x38
| Kernel
| Old CDMA Event 0..8 (9 separate IRQ lines)
|-
| 0x39
| Kernel
| Old CDMA Faulting (eg. CCR=0, or event>15)
|-
| 0x3A
| Kernel
| New CDMA Event 0..31 (shared IRQ line)
|-
| 0x3B
| Kernel
| New CDMA Faulting (eg. CCR=0)
|-
| 0x40
| nwm
| WIFI SDIO Controller @ 0x10122000
|-
| 0x41
| nwm
| WIFI SDIO Controller IRQ pin @ 0x10122000
|-
| 0x42
| nwm_dev?
| Debug WIFI SDIO Controller @ 0x10100000 ?
|-
| 0x43
| nwm_dev?
| Debug WIFI SDIO Controller @ 0x10100000 ?
|-
| 0x44
| ?
| NTRCARD (maybe?)
|-
| 0x45
| mvd (New3DS)
| L2B_0 (First RGB-to-RGBA Converter)
|-
| 0x46
| mvd (New3DS)
| L2B_1 (Second RGB-to-RGBA Converter)
|-
| 0x48
| camera
| Camera Bus 0 (DSi cameras)
|-
| 0x49
| camera
| Camera Bus 1 (left-eye)
|-
| 0x4A
| dsp
| General interrupt from DSP, including semaphore and command/reply registers status change
|-
| 0x4B
| camera
| Y2R Conversion Finished
|-
| 0x4C
| TwlBg
| LGYFB_0 Legacy GBA/NDS Video
|-
| 0x4D
| TwlBg
| LGYFB_1 Legacy GBA/NDS Video
|-
| 0x4E
| mvd (New3DS)
| Y2R2 End Event
|-
| 0x4F
| mvd (New3DS)
| MVD general interrupt?
|-
| 0x50
| pxi, TwlBg
| Sync (bit 29 from Arm9's PXI_SYNC)
|-
| 0x51
| pxi, TwlBg
| Sync 2 (bit 30 from Arm9's PXI_SYNC)
|-
| 0x52
| pxi, TwlBg
| Send Fifo Empty
|-
| 0x53
| pxi, TwlBg
| Receive Fifo Not Empty
|-
| 0x54
| i2c, TwlBg
| I2C Bus0 work done
|-
| 0x55
| i2c, TwlBg
| I2C Bus1 work done
|-
| 0x56
| spi, TwlBg
| SPI bus 3 interrupt status update
|-
| 0x57
| spi, TwlBg
| SPI bus 1 interrupt status update
|-
| 0x58
| Kernel
| PDN (wake event or SoC mode changed)
|-
| 0x59
| TwlBg
| PDN Legacy Sleep
|-
| 0x5A
| mic
| General microphone interrupt (?)
|-
| 0x5B
| -
| [[HID_Registers#HID_PAD_CNT|HID_PAD_CNT]]
|-
| 0x5C
| i2c, TwlBg
| I2C Bus2 work done
|-
| 0x5F
| mp
| DS WiFi registers
|-
| 0x60
| gpio, TwlBg
| Shell opened (GPIO1_2 falling edge)
|-
| 0x62
| gpio, TwlBg
| Shell closed (GPIO1_2 rising edge)
|-
| 0x63
| gpio, TwlBg
| Touch Pen Down (GPIO1_1 falling edge)
|-
| 0x64
| gpio, TwlBg
| Headphones inserted (GPIO2_0)
|-
| 0x66
| gpio, TwlBg
| TWL depop circuit (GPIO2_1)
|-
| 0x68
| gpio, TwlBg
| C-stick interrupt (GPIO3_0)
|-
| 0x69
| gpio, TwlBg
| IrDA interrupt (active-low) (GPIO3_1)
|-
| 0x6A
| gpio, TwlBg
| Gyro interrupt (GPIO3_2)
|-
| 0x6B
| gpio, TwlBg
| C-stick "stop" (output) (GPIO3_3)
|-
| 0x6C
| gpio, TwlBg
| IrDA TX-RC (output) (GPIO3_4)
|-
| 0x6D
| gpio, TwlBg
| IrDA RXD (GPIO3_5)
|-
| 0x6E
| gpio, TwlBg
| NFC output1 (?) (GPIO3_6)
|-
| 0x6F
| gpio, TwlBg
| NFC output2 (?) (GPIO3_7)
|-
| 0x70
| gpio, TwlBg
| Headphones button/half-inserted (active-low) (GPIO3_8)
|-
| 0x71
| gpio, TwlBg
| MCU interrupt (GPIO3_9)
|-
| 0x72
| gpio, TwlBg
| NFC interrupt (?) (GPIO3_10)
|-
| 0x73
| TwlBg
| QTM output (?) (GPIO3_11)
|-
| 0x74
| ?
| Gamecard related
|-
| 0x75
| ?
| Gamecard inserted
|-
| 0x76
| -
| L2C
|-
| 0x78 to 0x7B
| Kernel
| Core 0-3 Performance monitor counter (any) overflow
|-
| 0x7A to 0x82 (PDN_MPCORE_CFG bit2 set) or
0x7C to 0x84 (bit2 clear)
| Kernel
| Other PMU interrupts (line may not exist at all)
|}
(interrupts from 0x80 and up can't be mapped in available builds of the kernel)

There are 2 tables in the Arm11 kernel: the first has 32 * 2(or 32 * 4) 8-byte entries. This table is for the private interrupts that belong to each core. The data for each interrupt can be found by doing table_base + (core_num * 0x100) + (intr_num * 8). The second table is for public hardware interrupts and the data for each interrupt can be retrieved by doing table_base + (intr_num * 8).

The Arm11 kernel configures interrupts the following way (it seems the GPIO IRQ layout doesn't match released 3DS models):

<nowiki>Interrupts 0x00 to 0x1F: edge-triggered, N-N
Interrupt 0x20: level-sensitive, 1-N
Interrupt 0x21: level-sensitive, 1-N
Interrupt 0x22: level-sensitive, 1-N
Interrupt 0x23: level-sensitive, 1-N
Interrupt 0x24: edge-triggered, 1-N
Interrupt 0x25: level-sensitive, 1-N
Interrupt 0x28: level-sensitive, 1-N
Interrupt 0x29: level-sensitive, 1-N
Interrupt 0x2a: level-sensitive, 1-N
Interrupt 0x2b: level-sensitive, 1-N
Interrupt 0x2c: level-sensitive, 1-N
Interrupt 0x2d: level-sensitive, 1-N
Interrupt 0x30: level-sensitive, 1-N
Interrupt 0x31: level-sensitive, 1-N
Interrupt 0x32: level-sensitive, 1-N
Interrupt 0x33: level-sensitive, 1-N
Interrupt 0x34: level-sensitive, 1-N
Interrupt 0x35: level-sensitive, 1-N
Interrupt 0x36: level-sensitive, 1-N
Interrupt 0x37: level-sensitive, 1-N
Interrupt 0x38: level-sensitive, 1-N
Interrupt 0x39: level-sensitive, 1-N
Interrupt 0x3a: level-sensitive, 1-N
Interrupt 0x3b: level-sensitive, 1-N
Interrupt 0x40: edge-triggered, 1-N
Interrupt 0x41: edge-triggered, 1-N
Interrupt 0x42: edge-triggered, 1-N
Interrupt 0x43: edge-triggered, 1-N
Interrupt 0x44: edge-triggered, 1-N
Interrupt 0x45: edge-triggered, 1-N
Interrupt 0x46: edge-triggered, 1-N
Interrupt 0x48: edge-triggered, 1-N
Interrupt 0x49: edge-triggered, 1-N
Interrupt 0x4a: edge-triggered, 1-N
Interrupt 0x4b: edge-triggered, 1-N
Interrupt 0x4c: edge-triggered, 1-N
Interrupt 0x4d: edge-triggered, 1-N
Interrupt 0x4e: edge-triggered, 1-N
Interrupt 0x4f: level-sensitive, 1-N
Interrupt 0x50: edge-triggered, 1-N
Interrupt 0x51: edge-triggered, 1-N
Interrupt 0x52: edge-triggered, 1-N
Interrupt 0x53: edge-triggered, 1-N
Interrupt 0x54: edge-triggered, 1-N
Interrupt 0x55: edge-triggered, 1-N
Interrupt 0x56: edge-triggered, 1-N
Interrupt 0x57: edge-triggered, 1-N
Interrupt 0x58: level-sensitive, 1-N
Interrupt 0x59: edge-triggered, 1-N
Interrupt 0x5a: edge-triggered, 1-N
Interrupt 0x5b: edge-triggered, 1-N
Interrupt 0x5f: edge-triggered, 1-N
Interrupt 0x60: edge-triggered, 1-N
Interrupt 0x61: edge-triggered, 1-N
Interrupt 0x64: edge-triggered, 1-N
Interrupt 0x65: edge-triggered, 1-N
Interrupt 0x66: edge-triggered, 1-N
Interrupt 0x68: edge-triggered, 1-N
Interrupt 0x69: edge-triggered, 1-N
Interrupt 0x6a: edge-triggered, 1-N
Interrupt 0x6b: edge-triggered, 1-N
Interrupt 0x6c: edge-triggered, 1-N
Interrupt 0x6d: edge-triggered, 1-N
Interrupt 0x6e: edge-triggered, 1-N
Interrupt 0x6f: edge-triggered, 1-N
Interrupt 0x70: edge-triggered, 1-N
Interrupt 0x71: edge-triggered, 1-N
Interrupt 0x72: edge-triggered, 1-N
Interrupt 0x73: edge-triggered, 1-N
Interrupt 0x74: edge-triggered, 1-N
Interrupt 0x75: edge-triggered, 1-N
Interrupt 0x76: level-sensitive, 1-N
Interrupt 0x77: level-sensitive, 1-N
Interrupt 0x78: edge-triggered, 1-N
Interrupt 0x79: level-sensitive, 1-N
Interrupt 0x7a: level-sensitive, 1-N
Interrupt 0x7b: level-sensitive, 1-N
Interrupt 0x7c: level-sensitive, 1-N
Interrupt 0x7d: level-sensitive, 1-N</nowiki>

= InterruptData =
{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| [[KBaseInterruptEvent]] *
| Pointer to the KBaseInterruptEvent object for this interrupt
|-
| 0x4
| u8
| Interrupt will be disabled by the IRQ handler as soon as it is acknowledged.
Ignored for FIQ: the FIQ handler always sets bit2 of [[PDN_Registers#PDN_FIQ_CNT|PDN_FIQ_CNT]]
|-
| 0x5
| u8
| Interrupt is disabled
|-
| 0x6
| u8
| Interrupt priority
|-
| 0x7
| u8
| Unused, alignment
|}

= Interrupt Table (New3DS) =
(0xFFF318F4 in 10.3)

{| class="wikitable" border="1"
! Offset
! Type
! Description
|-
| 0x0
| InterruptData[224]
| Data for all hardware and software interrupts
|-
| 0x700
| [[KObjectMutex]]
| Mutex
|}

GPIO Registers

2021-01-24T21:09:55Z

TuxSH: /* GPIO pins */

= Registers =

== GPIO ==

{| class="wikitable" border="1"
! Old3DS
! Name
! Address
! Width
|-
| style="background: green" | Yes
| [[#GPIOn_DATA|GPIO1_DATA]]
| 0x10147000
| 1
|-
| style="background: green" | Yes
| [[#GPIOn_DATA|GPIO2_DATA]]
| 0x10147010
| 1
|-
| style="background: green" | Yes
| [[#GPIOn_DIR|GPIO2_DIR]]
| 0x10147011
| 1
|-
| style="background: green" | Yes
| [[#GPIOn_INTCFG|GPIO2_INTCFG]]
| 0x10147012
| 1
|-
| style="background: green" | Yes
| [[#GPIOn_INTEN|GPIO2_INTEN]]
| 0x10147013
| 1
|-
| style="background: green" | Yes
| [[#GPIOn_DATA2|GPIO2_DATA2]]
| 0x10147014
| 2
|-
| style="background: green" | Yes
| [[#GPIOn_DATA|GPIO3_DATA]]
| 0x10147020
| 2
|-
| style="background: green" | Yes
| [[#GPIOn_DIR|GPIO3_DIR]]
| 0x10147022
| 2
|-
| style="background: green" | Yes
| [[#GPIOn_INTCFG|GPIO3_INTCFG]]
| 0x10147024
| 2
|-
| style="background: green" | Yes
| [[#GPIOn_INTEN|GPIO3_INTEN]]
| 0x10147026
| 2
|-
| style="background: green" | Yes
| [[#GPIOn_DATA2|GPIO2_DATA2]]
| 0x10147028
| 2
|-
|}

== Legacy RTC ==
{| class="wikitable" border="1"
! Name
! Address
! Width
! Description
|-
| [[#RTC_CNT_(0x10147100)|RTC_CNT]]
| 0x10147100
| 2
| Control register
|-
| RTC_REG_STAT1
| 0x10147110
| 1
| Rtc status register 1 (command 0). Bitswapped
|-
| RTC_REG_STAT2
| 0x10147111
| 1
| Rtc status register 2 (command 1). Bitswapped
|-
| RTC_REG_CLKADJ
| 0x10147112
| 1
| Rtc clock adjustment register (command 6). Bitswapped
|-
| RTC_REG_FREE
| 0x10147113
| 1
| The free general purpose rtc register (command 7). Bitswapped
|-
| RTC_REG_TIME1
| 0x10147120
| 4
| Byte-wise bit-swapped (bit7 is bit0, etc.) BCD RTC (byte0 = seconds, byte1 = minutes, byte2 = hours, byte3 = day of week)
|-
| RTC_REG_TIME2
| 0x10147124
| 4 (3?)
| Day, month and year all byte-wise bit-swapped
|-
| RTC_REG_ALRMTIM1
| 0x10147130
| 4 (3?)
| Rtc alarm time register 1 (command 4). Byte-wise bit-swapped
|-
| RTC_REG_ALRMTIM2
| 0x10147134
| 4 (3?)
| Rtc alarm time register 2 (command 5). Byte-wise bit-swapped
|-
| RTC_REG_COUNT
| 0x10147140
| 4 (3?)
| Rtc dsi counter register (ex command 0). Byte-wise bit-swapped
|-
| RTC_REG_FOUT1
| 0x10147150
| 1
| Rtc dsi fout register 1 (ex command 1). Bitswapped
|-
| RTC_REG_FOUT2
| 0x10147151
| 1
| Rtc dsi fout register 2 (ex command 2). Bitswapped
|-
| RTC_REG_ALRMDAT1
| 0x10147160
| 4 (3?)
| Rtc dsi alarm date register 1 (ex command 4). Byte-wise bit-swapped
|-
| RTC_REG_ALRMDAT2
| 0x10147164
| 4 (3?)
| Rtc dsi alarm date register 2 (ex command 5). Byte-wise bit-swapped
|-
|}

= Descriptions =

== GPIO ==
=== GPIO pins ===

Only GPIO2 and GPIO3 pins have their interrupts configurable. Active low pins should be configured as "falling edge", and output ports shouldn't have interrupts enabled at all.

[[GPIO Services]] bitmasks use this table, in that order:

{| class="wikitable" border="1"
! Bit
! IRQ ID
! Description
|-
| 0
| ?
| Debug button (?) (active-low)
|-
| 1
| 0x63 (falling edge)
| Touch Pen down (active low, 0 = screen pressed)
|-
| 2
| 0x60 (falling edge)
0x62 (rising edge)
| Shell closed
|-style="border-top: double"
| 0
| 0x64
| Headphones inserted
|-
| 1
| 0x66
| TWL depop circuit (?) (active-low)
|-style="border-top: double"
| DATA2.0
| -
| GPIO2_DATA2_0 (wifi related?)
|-style="border-top: double"
| 0
| 0x68
| C-stick interrupt
|-
| 1
| 0x69
| IrDA interrupt (active-low)
|-
| 2
| 0x6A
| Gyro interrupt
|-
| 3
| 0x6B
| C-stick "stop" (output)
|-
| 4
| 0x6C
| IrDA TX-RC (output)
|-
| 5
| 0x6D
| IrDA RXD (active-low)
|-
| 6
| 0x6E
| NFC output1 (?)
|-
| 7
| 0x6F
| NFC output2 (?)
|-
| 8
| 0x70
| Headphones button/half-inserted (active-low)
|-
| 9
| 0x71
| MCU interrupt
|-
| 10
| 0x72
| NFC interrupt (?)
|-
| 11
| 0x73
| QTM output (?)
|-
|-style="border-top: double"
| DATA2.0
| -
| GPIO3_DATA2_0 (wifi related?)
|}

=== GPIOn_DATA ===
Pin values, one bit per pin.

=== GPIOn_DIR ===
Pin directions for GPIO2 and GPIO3, one bit per pin.

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Input
|-
| 1
| Output
|}

=== GPIOn_INTCFG ===
Interrupt configuration for GPIO2 and GPIO3 pins (not the extra ones), one bit per pin.

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Falling edge
|-
| 1
| Rising edge
|}

=== GPIOn_INTEN ===
Interrupt enable bits for GPIO2 and GPIO3 pins (not the extra ones), one bit per pin.

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Interrupt disabled
|-
| 1
| Interrupt enabled
|}

=== GPIOn_DATA2 ===
Extra pins for GPIO2 and GPIO3 (one bit each). These two pins, in total, are not bound to any IRQ and are not configurable.

=== Default values ===
After bootrom initialization, these are the values of the registers:

{| class="wikitable" border="1"
! Address
! Value
|-
| 0x10147000
| 0x0003
|-
| 0x10147010
| 0x00000002
|-
| 0x10147014
| 0x0000
|-
| 0x10147020
| 0x00000DFB
|-
| 0x10147024
| 0x00000000
|-
| 0x10147028
| 0x0000
|}

== Legacy RTC ==
=== RTC_CNT (0x10147100) ===
{| class="wikitable" border="1"
! Bit
! Description
|-
| 0
| Latch STAT1
|-
| 1
| Latch STAT2
|-
| 2
| Latch CLKADJ
|-
| 3
| Latch FREE
|-
| 4
| Latch TIME
|-
| 5
| Latch ALRMTIM1
|-
| 6
| Latch ALRMTIM2
|-
| 7
| Latch COUNT
|-
| 8
| Latch FOUT1
|-
| 9
| Latch FOUT2
|-
| 10
| Latch ALRMDAT1
|-
| 11
| Latch ALRMDAT2
|-
| 12
| ARM7 Busy? This may be chipselect
|-
| 13
| ARM7 write command received? (writing 1 clears it seems)
|-
| 14
| ARM7 read command recieved? (writing 1 clears it seems)
|-
| 15
| DS SIO SI pin (rtc irq pin)
|}

GPIO Registers

2021-01-24T18:32:10Z

TuxSH: /* GPIO pins */

= Registers =

== GPIO ==

{| class="wikitable" border="1"
! Old3DS
! Name
! Address
! Width
|-
| style="background: green" | Yes
| [[#GPIOn_DATA|GPIO1_DATA]]
| 0x10147000
| 1
|-
| style="background: green" | Yes
| [[#GPIOn_DATA|GPIO2_DATA]]
| 0x10147010
| 1
|-
| style="background: green" | Yes
| [[#GPIOn_DIR|GPIO2_DIR]]
| 0x10147011
| 1
|-
| style="background: green" | Yes
| [[#GPIOn_INTCFG|GPIO2_INTCFG]]
| 0x10147012
| 1
|-
| style="background: green" | Yes
| [[#GPIOn_INTEN|GPIO2_INTEN]]
| 0x10147013
| 1
|-
| style="background: green" | Yes
| [[#GPIOn_DATA2|GPIO2_DATA2]]
| 0x10147014
| 2
|-
| style="background: green" | Yes
| [[#GPIOn_DATA|GPIO3_DATA]]
| 0x10147020
| 2
|-
| style="background: green" | Yes
| [[#GPIOn_DIR|GPIO3_DIR]]
| 0x10147022
| 2
|-
| style="background: green" | Yes
| [[#GPIOn_INTCFG|GPIO3_INTCFG]]
| 0x10147024
| 2
|-
| style="background: green" | Yes
| [[#GPIOn_INTEN|GPIO3_INTEN]]
| 0x10147026
| 2
|-
| style="background: green" | Yes
| [[#GPIOn_DATA2|GPIO2_DATA2]]
| 0x10147028
| 2
|-
|}

== Legacy RTC ==
{| class="wikitable" border="1"
! Name
! Address
! Width
! Description
|-
| [[#RTC_CNT_(0x10147100)|RTC_CNT]]
| 0x10147100
| 2
| Control register
|-
| RTC_REG_STAT1
| 0x10147110
| 1
| Rtc status register 1 (command 0). Bitswapped
|-
| RTC_REG_STAT2
| 0x10147111
| 1
| Rtc status register 2 (command 1). Bitswapped
|-
| RTC_REG_CLKADJ
| 0x10147112
| 1
| Rtc clock adjustment register (command 6). Bitswapped
|-
| RTC_REG_FREE
| 0x10147113
| 1
| The free general purpose rtc register (command 7). Bitswapped
|-
| RTC_REG_TIME1
| 0x10147120
| 4
| Byte-wise bit-swapped (bit7 is bit0, etc.) BCD RTC (byte0 = seconds, byte1 = minutes, byte2 = hours, byte3 = day of week)
|-
| RTC_REG_TIME2
| 0x10147124
| 4 (3?)
| Day, month and year all byte-wise bit-swapped
|-
| RTC_REG_ALRMTIM1
| 0x10147130
| 4 (3?)
| Rtc alarm time register 1 (command 4). Byte-wise bit-swapped
|-
| RTC_REG_ALRMTIM2
| 0x10147134
| 4 (3?)
| Rtc alarm time register 2 (command 5). Byte-wise bit-swapped
|-
| RTC_REG_COUNT
| 0x10147140
| 4 (3?)
| Rtc dsi counter register (ex command 0). Byte-wise bit-swapped
|-
| RTC_REG_FOUT1
| 0x10147150
| 1
| Rtc dsi fout register 1 (ex command 1). Bitswapped
|-
| RTC_REG_FOUT2
| 0x10147151
| 1
| Rtc dsi fout register 2 (ex command 2). Bitswapped
|-
| RTC_REG_ALRMDAT1
| 0x10147160
| 4 (3?)
| Rtc dsi alarm date register 1 (ex command 4). Byte-wise bit-swapped
|-
| RTC_REG_ALRMDAT2
| 0x10147164
| 4 (3?)
| Rtc dsi alarm date register 2 (ex command 5). Byte-wise bit-swapped
|-
|}

= Descriptions =

== GPIO ==
=== GPIO pins ===

Only GPIO2 and GPIO3 pins have their interrupts configurable. Active low pins should be configured as "falling edge", and output ports shouldn't have interrupts enabled at all.

[[GPIO Services]] bitmasks use this table, in that order:

{| class="wikitable" border="1"
! Bit
! IRQ ID
! Description
|-
| 0
| ?
| Debug button (?) (active-low)
|-
| 1
| 0x63 (falling edge)
| Touch Pen down (active low, 0 = screen pressed)
|-
| 2
| 0x60 (falling edge)
0x62 (rising edge)
| Shell closed
|-style="border-top: double"
| 0
| 0x64
| Headphones detected (CODEC)
|-
| 1
| 0x66
| TWL depop circuit (?) (CODEC, active-low)
|-style="border-top: double"
| DATA2.0
| -
| GPIO2_DATA2_0 (wifi related?)
|-style="border-top: double"
| 0
| 0x68
| C-stick interrupt
|-
| 1
| 0x69
| IrDA interrupt (active-low)
|-
| 2
| 0x6A
| Gyro interrupt
|-
| 3
| 0x6B
| C-stick "stop" (output)
|-
| 4
| 0x6C
| IrDA TX-RC (output)
|-
| 5
| 0x6D
| IrDA RXD (active-low)
|-
| 6
| 0x6E
| NFC output1 (?)
|-
| 7
| 0x6F
| NFC output2 (?)
|-
| 8
| 0x70
| Headphones inserted (active-low)
|-
| 9
| 0x71
| MCU interrupt
|-
| 10
| 0x72
| NFC interrupt (?)
|-
| 11
| 0x73
| QTM output (?)
|-
|-style="border-top: double"
| DATA2.0
| -
| GPIO3_DATA2_0 (wifi related?)
|}

=== GPIOn_DATA ===
Pin values, one bit per pin.

=== GPIOn_DIR ===
Pin directions for GPIO2 and GPIO3, one bit per pin.

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Input
|-
| 1
| Output
|}

=== GPIOn_INTCFG ===
Interrupt configuration for GPIO2 and GPIO3 pins (not the extra ones), one bit per pin.

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Falling edge
|-
| 1
| Rising edge
|}

=== GPIOn_INTEN ===
Interrupt enable bits for GPIO2 and GPIO3 pins (not the extra ones), one bit per pin.

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Interrupt disabled
|-
| 1
| Interrupt enabled
|}

=== GPIOn_DATA2 ===
Extra pins for GPIO2 and GPIO3 (one bit each). These two pins, in total, are not bound to any IRQ and are not configurable.

=== Default values ===
After bootrom initialization, these are the values of the registers:

{| class="wikitable" border="1"
! Address
! Value
|-
| 0x10147000
| 0x0003
|-
| 0x10147010
| 0x00000002
|-
| 0x10147014
| 0x0000
|-
| 0x10147020
| 0x00000DFB
|-
| 0x10147024
| 0x00000000
|-
| 0x10147028
| 0x0000
|}

== Legacy RTC ==
=== RTC_CNT (0x10147100) ===
{| class="wikitable" border="1"
! Bit
! Description
|-
| 0
| Latch STAT1
|-
| 1
| Latch STAT2
|-
| 2
| Latch CLKADJ
|-
| 3
| Latch FREE
|-
| 4
| Latch TIME
|-
| 5
| Latch ALRMTIM1
|-
| 6
| Latch ALRMTIM2
|-
| 7
| Latch COUNT
|-
| 8
| Latch FOUT1
|-
| 9
| Latch FOUT2
|-
| 10
| Latch ALRMDAT1
|-
| 11
| Latch ALRMDAT2
|-
| 12
| ARM7 Busy? This may be chipselect
|-
| 13
| ARM7 write command received? (writing 1 clears it seems)
|-
| 14
| ARM7 read command recieved? (writing 1 clears it seems)
|-
| 15
| DS SIO SI pin (rtc irq pin)
|}

GPIO Registers

2021-01-24T15:47:13Z

TuxSH: /* GPIO pins */

= Registers =

== GPIO ==

{| class="wikitable" border="1"
! Old3DS
! Name
! Address
! Width
|-
| style="background: green" | Yes
| [[#GPIOn_DATA|GPIO1_DATA]]
| 0x10147000
| 1
|-
| style="background: green" | Yes
| [[#GPIOn_DATA|GPIO2_DATA]]
| 0x10147010
| 1
|-
| style="background: green" | Yes
| [[#GPIOn_DIR|GPIO2_DIR]]
| 0x10147011
| 1
|-
| style="background: green" | Yes
| [[#GPIOn_INTCFG|GPIO2_INTCFG]]
| 0x10147012
| 1
|-
| style="background: green" | Yes
| [[#GPIOn_INTEN|GPIO2_INTEN]]
| 0x10147013
| 1
|-
| style="background: green" | Yes
| [[#GPIOn_DATA2|GPIO2_DATA2]]
| 0x10147014
| 2
|-
| style="background: green" | Yes
| [[#GPIOn_DATA|GPIO3_DATA]]
| 0x10147020
| 2
|-
| style="background: green" | Yes
| [[#GPIOn_DIR|GPIO3_DIR]]
| 0x10147022
| 2
|-
| style="background: green" | Yes
| [[#GPIOn_INTCFG|GPIO3_INTCFG]]
| 0x10147024
| 2
|-
| style="background: green" | Yes
| [[#GPIOn_INTEN|GPIO3_INTEN]]
| 0x10147026
| 2
|-
| style="background: green" | Yes
| [[#GPIOn_DATA2|GPIO2_DATA2]]
| 0x10147028
| 2
|-
|}

== Legacy RTC ==
{| class="wikitable" border="1"
! Name
! Address
! Width
! Description
|-
| [[#RTC_CNT_(0x10147100)|RTC_CNT]]
| 0x10147100
| 2
| Control register
|-
| RTC_REG_STAT1
| 0x10147110
| 1
| Rtc status register 1 (command 0). Bitswapped
|-
| RTC_REG_STAT2
| 0x10147111
| 1
| Rtc status register 2 (command 1). Bitswapped
|-
| RTC_REG_CLKADJ
| 0x10147112
| 1
| Rtc clock adjustment register (command 6). Bitswapped
|-
| RTC_REG_FREE
| 0x10147113
| 1
| The free general purpose rtc register (command 7). Bitswapped
|-
| RTC_REG_TIME1
| 0x10147120
| 4
| Byte-wise bit-swapped (bit7 is bit0, etc.) BCD RTC (byte0 = seconds, byte1 = minutes, byte2 = hours, byte3 = day of week)
|-
| RTC_REG_TIME2
| 0x10147124
| 4 (3?)
| Day, month and year all byte-wise bit-swapped
|-
| RTC_REG_ALRMTIM1
| 0x10147130
| 4 (3?)
| Rtc alarm time register 1 (command 4). Byte-wise bit-swapped
|-
| RTC_REG_ALRMTIM2
| 0x10147134
| 4 (3?)
| Rtc alarm time register 2 (command 5). Byte-wise bit-swapped
|-
| RTC_REG_COUNT
| 0x10147140
| 4 (3?)
| Rtc dsi counter register (ex command 0). Byte-wise bit-swapped
|-
| RTC_REG_FOUT1
| 0x10147150
| 1
| Rtc dsi fout register 1 (ex command 1). Bitswapped
|-
| RTC_REG_FOUT2
| 0x10147151
| 1
| Rtc dsi fout register 2 (ex command 2). Bitswapped
|-
| RTC_REG_ALRMDAT1
| 0x10147160
| 4 (3?)
| Rtc dsi alarm date register 1 (ex command 4). Byte-wise bit-swapped
|-
| RTC_REG_ALRMDAT2
| 0x10147164
| 4 (3?)
| Rtc dsi alarm date register 2 (ex command 5). Byte-wise bit-swapped
|-
|}

= Descriptions =

== GPIO ==
=== GPIO pins ===

[[GPIO Services]] bitmasks use this table, in that order:

{| class="wikitable" border="1"
! Bit
! IRQ ID
! Description
|-
| 0
| ?
| GPIO1_0 (?)
|-
| 1
| 0x63 (falling edge)
| Touch Pen up
|-
| 2
| 0x60 (falling edge)
0x62 (rising edge)
| Shell closed
|-style="border-top: double"
| 0
| 0x64
| Headphones inserted
|-
| 1
| 0x66
| GPIO2_1 (?)
|-style="border-top: double"
| DATA2.0
| -
| GPIO2_DATA2_0 (wifi related?)
|-style="border-top: double"
| 0
| 0x68
| C-stick
|-
| 1
| 0x69
| IrDA
|-
| 2
| 0x6A
| Gyro
|-
| 3
| 0x6B
| GPIO3_3 (?)
|-
| 4
| 0x6C
| GPIO3_4 (?)
|-
| 5
| 0x6D
| GPIO3_5 (?)
|-
| 6
| 0x6E
| GPIO3_6 (?)
|-
| 7
| 0x6F
| GPIO3_7 (?)
|-
| 8
| 0x70
| GPIO3_8 (?)
|-
| 9
| 0x71
| MCU
|-
| 10
| 0x72
| NFC
|-
| 11
| 0x73
| GPIO3_11 (?)
|-
|-style="border-top: double"
| DATA2.0
| -
| GPIO3_DATA2_0 (wifi related?)
|}

=== GPIOn_DATA ===
Pin values, one bit per pin.

=== GPIOn_DIR ===
Pin directions for GPIO2 and GPIO3, one bit per pin.

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Input
|-
| 1
| Output
|}

=== GPIOn_INTCFG ===
Interrupt configuration for GPIO2 and GPIO3 pins (not the extra ones), one bit per pin.

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Falling edge
|-
| 1
| Rising edge
|}

=== GPIOn_INTEN ===
Interrupt enable bits for GPIO2 and GPIO3 pins (not the extra ones), one bit per pin.

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Interrupt disabled
|-
| 1
| Interrupt enabled
|}

=== GPIOn_DATA2 ===
Extra pins for GPIO2 and GPIO3 (one bit each). These two pins, in total, are not bound to any IRQ and are not configurable.

=== Default values ===
After bootrom initialization, these are the values of the registers:

{| class="wikitable" border="1"
! Address
! Value
|-
| 0x10147000
| 0x0003
|-
| 0x10147010
| 0x00000002
|-
| 0x10147014
| 0x0000
|-
| 0x10147020
| 0x00000DFB
|-
| 0x10147024
| 0x00000000
|-
| 0x10147028
| 0x0000
|}

== Legacy RTC ==
=== RTC_CNT (0x10147100) ===
{| class="wikitable" border="1"
! Bit
! Description
|-
| 0
| Latch STAT1
|-
| 1
| Latch STAT2
|-
| 2
| Latch CLKADJ
|-
| 3
| Latch FREE
|-
| 4
| Latch TIME
|-
| 5
| Latch ALRMTIM1
|-
| 6
| Latch ALRMTIM2
|-
| 7
| Latch COUNT
|-
| 8
| Latch FOUT1
|-
| 9
| Latch FOUT2
|-
| 10
| Latch ALRMDAT1
|-
| 11
| Latch ALRMDAT2
|-
| 12
| ARM7 Busy? This may be chipselect
|-
| 13
| ARM7 write command received? (writing 1 clears it seems)
|-
| 14
| ARM7 read command recieved? (writing 1 clears it seems)
|-
| 15
| DS SIO SI pin (rtc irq pin)
|}

ARM11 Interrupts

2021-01-24T15:45:28Z

TuxSH: /* Hardware Interrupts */

== Interrupts ==

Interrupt priority is 0-0xF. A priority of 0xF means that the interrupt is disabled.

= Private Interrupts =

Each CPU core has 32 software interrupts that are private and belong to that core. These interrupts are numbers 0-0x1F for each core. The hardware interrupts are not core-specific and start at interrupt ID 0x20.

{| class="wikitable" border="1"
! IRQ
! Listener
! Description
|-
| 0
|
| MPCore software-interrupt. Not configured.
|-
| 0x1-0x3
|
| MPCore software-interrupt. Used by Boot11 and Kernel11 to kickstart Core1/2/3.
|-
| 0x4
| Kernel
| MPCore software-interrupt. Used to manage the performance counter.
|-
| 0x5
| Kernel
| MPCore software-interrupt. Does apparently nothing.
|-
| 0x6
| Kernel
| MPCore software-interrupt. Extensively used by [[SVC|KernelSetState]] (and contains most of the actual code of the latter).
|-
| 0x7
| Kernel
| MPCore software-interrupt. See [[KCacheMaintenanceInterruptEvent]]
|-
| 0x8
| Kernel
| MPCore software-interrupt. Used for scheduling.
|-
| 0x9
| Kernel
| MPCore software-interrupt. Used when handling exceptions that require termination of a thread or a process, and in some cases by svcSetDebugThreadContext, to store VFP registers in the thread's register storage.
|-
| 0xA
| Kernel
| TLB operations interrupt, see [[KTLBOperationsInterruptEvent]]
|-
| 0xB-0xE
|
| MPCore software-interrupt. Not configured.
|-
| 0xF
| dmnt/debugger
| MPCore software-interrupt. Used to abstract FIQ (debug). This interrupt is never sent to core2 nor core3 on N3DS.
|-
| 0x1D
| Kernel
| MPCore timer.
|-
| 0x1E
| Kernel
| MPCore watchdog - set when the watchdog counter reaches 0 in timer mode, causes interrupt 30 to set as pending. Only set on core 1 as core 1's timer is used for everything.
|}

= Hardware Interrupts =

There are 0x60 hardware interrupts starting at 0x20 and continuing up to 0x7F. These are not private and are accessible from any core.

{| class="wikitable" border="1"
! IRQ
! Listener
! Description
|-
| 0x24
| ?
| SPI bus 2 interrupt status update
|-
| 0x28
| gsp, TwlBg
| PSC0
|-
| 0x29
| gsp, TwlBg
| PSC1
|-
| 0x2A
| gsp, TwlBg
| PDC0 (VBlank0)
|-
| 0x2B
| gsp, TwlBg
| PDC1 (VBlank1)
|-
| 0x2C
| gsp, TwlBg
| PPF
|-
| 0x2D
| gsp, TwlBg
| P3D
|-
| 0x30-0x38
| Kernel
| Old CDMA Event 0..8 (9 separate IRQ lines)
|-
| 0x39
| Kernel
| Old CDMA Faulting (eg. CCR=0, or event>15)
|-
| 0x3A
| Kernel
| New CDMA Event 0..31 (shared IRQ line)
|-
| 0x3B
| Kernel
| New CDMA Faulting (eg. CCR=0)
|-
| 0x40
| nwm
| WIFI SDIO Controller @ 0x10122000
|-
| 0x41
| nwm
| WIFI SDIO Controller IRQ pin @ 0x10122000
|-
| 0x42
| nwm_dev?
| Debug WIFI SDIO Controller @ 0x10100000 ?
|-
| 0x43
| nwm_dev?
| Debug WIFI SDIO Controller @ 0x10100000 ?
|-
| 0x44
| ?
| NTRCARD (maybe?)
|-
| 0x45
| mvd (New3DS)
| L2B_0 (First RGB-to-RGBA Converter)
|-
| 0x46
| mvd (New3DS)
| L2B_1 (Second RGB-to-RGBA Converter)
|-
| 0x48
| camera
| Camera Bus 0 (DSi cameras)
|-
| 0x49
| camera
| Camera Bus 1 (left-eye)
|-
| 0x4A
| dsp
| General interrupt from DSP, including semaphore and command/reply registers status change
|-
| 0x4B
| camera
| Y2R Conversion Finished
|-
| 0x4C
| TwlBg
| LGYFB_0 Legacy GBA/NDS Video
|-
| 0x4D
| TwlBg
| LGYFB_1 Legacy GBA/NDS Video
|-
| 0x4E
| mvd (New3DS)
| Y2R2 End Event
|-
| 0x4F
| mvd (New3DS)
| MVD general interrupt?
|-
| 0x50
| pxi, TwlBg
| Sync (bit 29 from Arm9's PXI_SYNC)
|-
| 0x51
| pxi, TwlBg
| Sync 2 (bit 30 from Arm9's PXI_SYNC)
|-
| 0x52
| pxi, TwlBg
| Send Fifo Empty
|-
| 0x53
| pxi, TwlBg
| Receive Fifo Not Empty
|-
| 0x54
| i2c, TwlBg
| I2C Bus0 work done
|-
| 0x55
| i2c, TwlBg
| I2C Bus1 work done
|-
| 0x56
| spi, TwlBg
| SPI bus 3 interrupt status update
|-
| 0x57
| spi, TwlBg
| SPI bus 1 interrupt status update
|-
| 0x58
| Kernel
| PDN (wake event or SoC mode changed)
|-
| 0x59
| TwlBg
| PDN Legacy Sleep
|-
| 0x5A
| mic
| General microphone interrupt (?)
|-
| 0x5B
| -
| [[HID_Registers#HID_PAD_CNT|HID_PAD_CNT]]
|-
| 0x5C
| i2c, TwlBg
| I2C Bus2 work done
|-
| 0x5F
| mp
| DS WiFi registers
|-
| 0x60
| gpio, TwlBg
| Shell opened (GPIO1_2 falling edge)
|-
| 0x62
| gpio, TwlBg
| Shell closed (GPIO1_2 rising edge)
|-
| 0x63
| gpio, TwlBg
| Touch Pen Down (GPIO1_1 falling edge)
|-
| 0x64
| gpio, TwlBg
| Headphone jack plugged in/out
|-
| 0x66
| gpio, TwlBg
| GPIO2_1
|-
| 0x68
| gpio, TwlBg
| C-stick Interrupt
|-
| 0x69
| gpio, TwlBg
| IrDA Interrupt
|-
| 0x6A
| gpio, TwlBg
| Gyro Interrupt
|-
| 0x6B
| gpio, TwlBg
| GPIO3_3
|-
| 0x6C
| gpio, TwlBg
| GPIO3_4
|-
| 0x6D
| gpio, TwlBg
| GPIO3_5
|-
| 0x6E
| gpio, TwlBg
| GPIO3_6
|-
| 0x6F
| gpio, TwlBg
| GPIO3_7
|-
| 0x70
| gpio, TwlBg
| GPIO3_8
|-
| 0x71
| gpio, TwlBg
| MCU (HOME/POWER pressed/released or WiFi switch pressed, etc.)
|-
| 0x72
| gpio, TwlBg
| NFC
|-
| 0x73
| TwlBg
| GPIO3_11
|-
| 0x74
| ?
| Gamecard related
|-
| 0x75
| ?
| Gamecard inserted
|-
| 0x76
| -
| L2C
|-
| 0x78 to 0x7B
| Kernel
| Core 0-3 Performance monitor counter (any) overflow
|-
| 0x7A to 0x82 (PDN_MPCORE_CFG bit2 set) or
0x7C to 0x84 (bit2 clear)
| Kernel
| Other PMU interrupts (line may not exist at all)
|}
(interrupts from 0x80 and up can't be mapped in available builds of the kernel)

There are 2 tables in the Arm11 kernel: the first has 32 * 2(or 32 * 4) 8-byte entries. This table is for the private interrupts that belong to each core. The data for each interrupt can be found by doing table_base + (core_num * 0x100) + (intr_num * 8). The second table is for public hardware interrupts and the data for each interrupt can be retrieved by doing table_base + (intr_num * 8).

The Arm11 kernel configures interrupts the following way (it seems the GPIO IRQ layout doesn't match released 3DS models):

<nowiki>Interrupts 0x00 to 0x1F: edge-triggered, N-N
Interrupt 0x20: level-sensitive, 1-N
Interrupt 0x21: level-sensitive, 1-N
Interrupt 0x22: level-sensitive, 1-N
Interrupt 0x23: level-sensitive, 1-N
Interrupt 0x24: edge-triggered, 1-N
Interrupt 0x25: level-sensitive, 1-N
Interrupt 0x28: level-sensitive, 1-N
Interrupt 0x29: level-sensitive, 1-N
Interrupt 0x2a: level-sensitive, 1-N
Interrupt 0x2b: level-sensitive, 1-N
Interrupt 0x2c: level-sensitive, 1-N
Interrupt 0x2d: level-sensitive, 1-N
Interrupt 0x30: level-sensitive, 1-N
Interrupt 0x31: level-sensitive, 1-N
Interrupt 0x32: level-sensitive, 1-N
Interrupt 0x33: level-sensitive, 1-N
Interrupt 0x34: level-sensitive, 1-N
Interrupt 0x35: level-sensitive, 1-N
Interrupt 0x36: level-sensitive, 1-N
Interrupt 0x37: level-sensitive, 1-N
Interrupt 0x38: level-sensitive, 1-N
Interrupt 0x39: level-sensitive, 1-N
Interrupt 0x3a: level-sensitive, 1-N
Interrupt 0x3b: level-sensitive, 1-N
Interrupt 0x40: edge-triggered, 1-N
Interrupt 0x41: edge-triggered, 1-N
Interrupt 0x42: edge-triggered, 1-N
Interrupt 0x43: edge-triggered, 1-N
Interrupt 0x44: edge-triggered, 1-N
Interrupt 0x45: edge-triggered, 1-N
Interrupt 0x46: edge-triggered, 1-N
Interrupt 0x48: edge-triggered, 1-N
Interrupt 0x49: edge-triggered, 1-N
Interrupt 0x4a: edge-triggered, 1-N
Interrupt 0x4b: edge-triggered, 1-N
Interrupt 0x4c: edge-triggered, 1-N
Interrupt 0x4d: edge-triggered, 1-N
Interrupt 0x4e: edge-triggered, 1-N
Interrupt 0x4f: level-sensitive, 1-N
Interrupt 0x50: edge-triggered, 1-N
Interrupt 0x51: edge-triggered, 1-N
Interrupt 0x52: edge-triggered, 1-N
Interrupt 0x53: edge-triggered, 1-N
Interrupt 0x54: edge-triggered, 1-N
Interrupt 0x55: edge-triggered, 1-N
Interrupt 0x56: edge-triggered, 1-N
Interrupt 0x57: edge-triggered, 1-N
Interrupt 0x58: level-sensitive, 1-N
Interrupt 0x59: edge-triggered, 1-N
Interrupt 0x5a: edge-triggered, 1-N
Interrupt 0x5b: edge-triggered, 1-N
Interrupt 0x5f: edge-triggered, 1-N
Interrupt 0x60: edge-triggered, 1-N
Interrupt 0x61: edge-triggered, 1-N
Interrupt 0x64: edge-triggered, 1-N
Interrupt 0x65: edge-triggered, 1-N
Interrupt 0x66: edge-triggered, 1-N
Interrupt 0x68: edge-triggered, 1-N
Interrupt 0x69: edge-triggered, 1-N
Interrupt 0x6a: edge-triggered, 1-N
Interrupt 0x6b: edge-triggered, 1-N
Interrupt 0x6c: edge-triggered, 1-N
Interrupt 0x6d: edge-triggered, 1-N
Interrupt 0x6e: edge-triggered, 1-N
Interrupt 0x6f: edge-triggered, 1-N
Interrupt 0x70: edge-triggered, 1-N
Interrupt 0x71: edge-triggered, 1-N
Interrupt 0x72: edge-triggered, 1-N
Interrupt 0x73: edge-triggered, 1-N
Interrupt 0x74: edge-triggered, 1-N
Interrupt 0x75: edge-triggered, 1-N
Interrupt 0x76: level-sensitive, 1-N
Interrupt 0x77: level-sensitive, 1-N
Interrupt 0x78: edge-triggered, 1-N
Interrupt 0x79: level-sensitive, 1-N
Interrupt 0x7a: level-sensitive, 1-N
Interrupt 0x7b: level-sensitive, 1-N
Interrupt 0x7c: level-sensitive, 1-N
Interrupt 0x7d: level-sensitive, 1-N</nowiki>

= InterruptData =
{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| [[KBaseInterruptEvent]] *
| Pointer to the KBaseInterruptEvent object for this interrupt
|-
| 0x4
| u8
| Interrupt will be disabled by the IRQ handler as soon as it is acknowledged.
Ignored for FIQ: the FIQ handler always sets bit2 of [[PDN_Registers#PDN_FIQ_CNT|PDN_FIQ_CNT]]
|-
| 0x5
| u8
| Interrupt is disabled
|-
| 0x6
| u8
| Interrupt priority
|-
| 0x7
| u8
| Unused, alignment
|}

= Interrupt Table (New3DS) =
(0xFFF318F4 in 10.3)

{| class="wikitable" border="1"
! Offset
! Type
! Description
|-
| 0x0
| InterruptData[224]
| Data for all hardware and software interrupts
|-
| 0x700
| [[KObjectMutex]]
| Mutex
|}

CONFIG11 Registers

2021-01-23T16:09:00Z

TuxSH: nullpage_cnt

= Registers =
{| class="wikitable" border="1"
! Old3DS
! Name
! Address
! Width
! Used by
|-
| style="background: green" | Yes
| [[#CFG11_SHAREDWRAM_32K_CODE|CFG11_SHAREDWRAM_32K_CODE]]<0-7>
| 0x10140000
| 1*8
| Boot11, Process9, [[DSP Services]]
|-
| style="background: green" | Yes
| [[#CFG11_SHAREDWRAM_32K_DATA|CFG11_SHAREDWRAM_32K_DATA]]<0-7>
| 0x10140008
| 1*8
| Boot11, Process9, [[DSP Services]]
|-style="border-top: double"
| style="background: green" | Yes
| [[#CFG11_NULLPAGE_CNT|CFG11_NULLPAGE_CNT]]
| 0x10140100
| 4
|
|-
| style="background: green" | Yes
| [[#CFG11_FIQ_MASK|CFG11_FIQ_MASK]]
| 0x10140104
| 1
| Kernel11.
|-
| style="background: green" | Yes
| Debug related bitfield?
Observed: 0b1100(N3DS)/0b0000(O3DS)
| 0x10140105
| 1
|
|-
| style="background: green" | Yes
| [[#CFG11_CDMA_CNT|CFG_CDMA_CNT]]
| 0x1014010C
| 2
| TwlBg
|-
| style="background: green" | Yes
| [[#CFG11_GPUPROT|CFG11_GPUPROT]]
| 0x10140140
| 4
| Kernel11
|-
| style="background: green" | Yes
| [[#CFG11_WIFICNT|CFG11_WIFICNT]]
| 0x10140180
| 1
| TwlBg, [[NWM Services]]
|-
| style="background: green" | Yes
| [[#CFG11_SPI_CNT|CFG11_SPI_CNT]]
| 0x101401C0
| 2
| [[SPI Services]], TwlBg
|-style="border-top: double"
| style="background: green" | Yes
| ?
| 0x10140200
| 4
|
|-style="border-top: double"
| style="background: red" | No
| [[#CFG11_GPU_N3DS_CNT|CFG11_GPU_N3DS_CNT]]
| 0x10140400
| 1
| NewKernel11
|-
| style="background: red" | No
| [[#CFG11_CDMA_PERIPHERALS|CFG11_CDMA_PERIPHERALS]]
| 0x10140410
| 4
| NewKernel11
|-
| style="background: red" | No
| [[#CFG11_BOOTROM_OVERLAY_CNT|CFG11_BOOTROM_OVERLAY_CNT]]
| 0x10140420
| 1
| NewKernel11
|-
| style="background: red" | No
| [[#CFG11_BOOTROM_OVERLAY_VAL|CFG11_BOOTROM_OVERLAY_VAL]]
| 0x10140424
| 4
| NewKernel11
|-
| style="background: red" | No
| ?
| 0x10140428
| 4
|
|-style="border-top: double"
| style="background: green" | Yes
| [[#CFG11_SOCINFO|CFG11_SOCINFO]]
| 0x10140FFC
| 2
| Boot11, Kernel11
|}

== CFG11_SHAREDWRAM_32K_CODE ==
Used for mapping 32K chunks of shared WRAM for DSP data.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| Master (0=ARM9?, 1=ARM11?, 2 or 3=DSP/code)
|-
| 2-4
| Offset (0..7) (slot 0..7) (LSB of address in 32Kbyte units)
|-
| 5-6
| Not used (0)
|-
| 7
| Enable (0=Disable, 1=Enable)
|}

== CFG11_SHAREDWRAM_32K_DATA ==
Used for mapping 32K chunks of shared WRAM for DSP data.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| Master (0=ARM9?, 1=ARM11?, 2 or 3=DSP/data)
|-
| 2-4
| Offset (0..7) (slot 0..7) (LSB of address in 32Kbyte units)
|-
| 5-6
| Not used (0)
|-
| 7
| Enable (0=Disable, 1=Enable)
|}

== CFG11_NULLPAGE_CNT ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 0
| Trap all ''data'' accesses to physmem addresses 0x0000 to 0x1000
|-
| 16
| Unknown
|}

The reset value of this register is 0x10000.

== CFG11_FIQ_MASK ==
Write bit N to mask FIQ interrutps on core N? (judging from what Kernel11 does -- it only ever configures FIQ for core1)

Reset value: 0xF

== CFG11_CDMA_CNT ==
Write 1 to enable, to disable.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Enable Microphone DMA (CDMA 0x00)
|-
| 1
| Enable NTRCARD DMA on Arm11 side (CDMA 0x01)
|-
| 2-4
| ?
|-
| 5
| WiFi. Enabled during kernel init since 11.4.
|}

== CFG11_SPI_CNT ==
When the corresponding bit is 0, the bus has to be accessed using the DS SPI registers. Otherwise it has to be accessed using the 3DS SPI registers.
{| class="wikitable" border="1"
! Bit
! Description
|-
| 0
| Enable [[SPI Registers]] 0x10160800.
|-
| 1
| Enable [[SPI Registers]] 0x10142800.
|-
| 2
| Enable [[SPI Registers]] 0x10143800.
|}

== CFG11_GPU_N3DS_CNT ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 0
| Enable N3DS mode? (enables access to the extra N3DS FCRAM banks, etc.)
|-
| 1
| Texture related? (observing texture glitches when disabling this bit)
|}

== CFG11_CDMA_PERIPHERALS ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 0-17
| CDMA Peripheral 0x00-0x11 data request target (0=Old CDMA, 1=New CDMA)
|-
| 18-31
| Unused
|}

== CFG11_BOOTROM_OVERLAY_CNT ==
Bit0: Enable bootrom overlay functionality.

== CFG11_BOOTROM_OVERLAY_VAL ==
The 32-bit value to overlay data-reads to bootrom with. See [[PDN Registers#PDN_LGR_CPU_CNT<0-3>|PDN_LGR_CPU_CNT]]<0-3>.

== CFG11_SOCINFO ==
Read-only register. Identifies the maximum mode-switching capabilities of the SoC.

* CTR: O3DS
* LGR1: N3DS prototype, 2 cores, no L2C
* LGR2: retail N3DS, 4 cores, has L2C

{| class="wikitable" border="1"
! Bits
! Description
! Used by
|-
| 0
| CTR mode (1 on all 3DSes)
| Boot11
|-
| 1
| LGR1 (1 on all N3DSes, orginally 2 cores, and 2x clockrate)
| Kernel11
|-
| 2
| LGR2 (1 on all released N3DSes, 4 cores and 3x clockrate)
| Kernel11
|}

==CFG11_GPUPROT==
{| class="wikitable" border="1"
! Old3DS
! Bits
! Description
|-
| style="background: green" | Yes
| 3-0
| Old FCRAM DMA cutoff size, 0 = no protection.
|-
| style="background: red" | No
| 7-4
| New FCRAM DMA cutoff size, 0 = no protection.
|-
| style="background: green" | Yes
| 8
| AXIWRAM protection, 0 = accessible.
|-
| style="background: red" | No
| 10-9
| QTM DMA cutoff size
|-
| style="background: green" | Yes
| 31-11
| Zeroes
|}

For the old FCRAM DMA cutoff, it protects starting from 0x28000000-(0x800000*x) until end of FCRAM. There is no way to protect the first 0x800000-bytes.

For the new FCRAM DMA cutoff, it protects starting from 0x30000000-(0x800000*x) until end of FCRAM. When the old FCRAM cutoff is set to non-zero, the first 0x800000-bytes bytes of new FCRAM are protected.

On New3DS the old+new FCRAM cutoff can be used at the same time, however this isn't done officially.

For the QTM DMA cutoff, it protects starting from 0x1F400000-(0x100000*x) until end of QTM mem.

On cold boot this reg is set to 0.

When this register is set to value 0, the GPU can access the entire FCRAM, AXIWRAM, and on New3DS all QTM-mem.

[[SVC|Initialized]] during kernel boot, and used with [[SVC]] 0x59 which was implemented with [[11.3.0-36|v11.3]].

==CFG11_WIFICNT==
{| class="wikitable" border="1"
! Old3DS
! Bits
! Description
|-
| style="background: green" | Yes
| 0
| Enable wifi subsystem
|}

CONFIG11 Registers

2021-01-23T15:28:39Z

TuxSH: /* CFG11_SOCINFO */

= Registers =
{| class="wikitable" border="1"
! Old3DS
! Name
! Address
! Width
! Used by
|-
| style="background: green" | Yes
| [[#CFG11_SHAREDWRAM_32K_CODE|CFG11_SHAREDWRAM_32K_CODE]]<0-7>
| 0x10140000
| 1*8
| Boot11, Process9, [[DSP Services]]
|-
| style="background: green" | Yes
| [[#CFG11_SHAREDWRAM_32K_DATA|CFG11_SHAREDWRAM_32K_DATA]]<0-7>
| 0x10140008
| 1*8
| Boot11, Process9, [[DSP Services]]
|-style="border-top: double"
| style="background: green" | Yes
| ?
| 0x10140100
| 4
| ?
|-
| style="background: green" | Yes
| [[#CFG11_FIQ_MASK|CFG11_FIQ_MASK]]
| 0x10140104
| 1
| Kernel11.
|-
| style="background: green" | Yes
| Debug related bitfield?
Observed: 0b1100(N3DS)/0b0000(O3DS)
| 0x10140105
| 1
|
|-
| style="background: green" | Yes
| [[#CFG11_CDMA_CNT|CFG_CDMA_CNT]]
| 0x1014010C
| 2
| TwlBg
|-
| style="background: green" | Yes
| [[#CFG11_GPUPROT|CFG11_GPUPROT]]
| 0x10140140
| 4
| Kernel11
|-
| style="background: green" | Yes
| [[#CFG11_WIFICNT|CFG11_WIFICNT]]
| 0x10140180
| 1
| TwlBg, [[NWM Services]]
|-
| style="background: green" | Yes
| [[#CFG11_SPI_CNT|CFG11_SPI_CNT]]
| 0x101401C0
| 2
| [[SPI Services]], TwlBg
|-style="border-top: double"
| style="background: green" | Yes
| ?
| 0x10140200
| 4
|
|-style="border-top: double"
| style="background: red" | No
| [[#CFG11_GPU_N3DS_CNT|CFG11_GPU_N3DS_CNT]]
| 0x10140400
| 1
| NewKernel11
|-
| style="background: red" | No
| [[#CFG11_CDMA_PERIPHERALS|CFG11_CDMA_PERIPHERALS]]
| 0x10140410
| 4
| NewKernel11
|-
| style="background: red" | No
| [[#CFG11_BOOTROM_OVERLAY_CNT|CFG11_BOOTROM_OVERLAY_CNT]]
| 0x10140420
| 1
| NewKernel11
|-
| style="background: red" | No
| [[#CFG11_BOOTROM_OVERLAY_VAL|CFG11_BOOTROM_OVERLAY_VAL]]
| 0x10140424
| 4
| NewKernel11
|-
| style="background: red" | No
| ?
| 0x10140428
| 4
|
|-style="border-top: double"
| style="background: green" | Yes
| [[#CFG11_SOCINFO|CFG11_SOCINFO]]
| 0x10140FFC
| 2
| Boot11, Kernel11
|}

== CFG11_SHAREDWRAM_32K_CODE ==
Used for mapping 32K chunks of shared WRAM for DSP data.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| Master (0=ARM9?, 1=ARM11?, 2 or 3=DSP/code)
|-
| 2-4
| Offset (0..7) (slot 0..7) (LSB of address in 32Kbyte units)
|-
| 5-6
| Not used (0)
|-
| 7
| Enable (0=Disable, 1=Enable)
|}

== CFG11_SHAREDWRAM_32K_DATA ==
Used for mapping 32K chunks of shared WRAM for DSP data.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| Master (0=ARM9?, 1=ARM11?, 2 or 3=DSP/data)
|-
| 2-4
| Offset (0..7) (slot 0..7) (LSB of address in 32Kbyte units)
|-
| 5-6
| Not used (0)
|-
| 7
| Enable (0=Disable, 1=Enable)
|}

== CFG11_FIQ_MASK ==
Write bit N to mask FIQ interrutps on core N? (judging from what Kernel11 does -- it only ever configures FIQ for core1)

Reset value: 0xF

== CFG11_CDMA_CNT ==
Write 1 to enable, to disable.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Enable Microphone DMA (CDMA 0x00)
|-
| 1
| Enable NTRCARD DMA on Arm11 side (CDMA 0x01)
|-
| 2-4
| ?
|-
| 5
| WiFi. Enabled during kernel init since 11.4.
|}

== CFG11_SPI_CNT ==
When the corresponding bit is 0, the bus has to be accessed using the DS SPI registers. Otherwise it has to be accessed using the 3DS SPI registers.
{| class="wikitable" border="1"
! Bit
! Description
|-
| 0
| Enable [[SPI Registers]] 0x10160800.
|-
| 1
| Enable [[SPI Registers]] 0x10142800.
|-
| 2
| Enable [[SPI Registers]] 0x10143800.
|}

== CFG11_GPU_N3DS_CNT ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 0
| Enable N3DS mode? (enables access to the extra N3DS FCRAM banks, etc.)
|-
| 1
| Texture related? (observing texture glitches when disabling this bit)
|}

== CFG11_CDMA_PERIPHERALS ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 0-17
| CDMA Peripheral 0x00-0x11 data request target (0=Old CDMA, 1=New CDMA)
|-
| 18-31
| Unused
|}

== CFG11_BOOTROM_OVERLAY_CNT ==
Bit0: Enable bootrom overlay functionality.

== CFG11_BOOTROM_OVERLAY_VAL ==
The 32-bit value to overlay data-reads to bootrom with. See [[PDN Registers#PDN_LGR_CPU_CNT<0-3>|PDN_LGR_CPU_CNT]]<0-3>.

== CFG11_SOCINFO ==
Read-only register. Identifies the maximum mode-switching capabilities of the SoC.

* CTR: O3DS
* LGR1: N3DS prototype, 2 cores, no L2C
* LGR2: retail N3DS, 4 cores, has L2C

{| class="wikitable" border="1"
! Bits
! Description
! Used by
|-
| 0
| CTR mode (1 on all 3DSes)
| Boot11
|-
| 1
| LGR1 (1 on all N3DSes, orginally 2 cores, and 2x clockrate)
| Kernel11
|-
| 2
| LGR2 (1 on all released N3DSes, 4 cores and 3x clockrate)
| Kernel11
|}

==CFG11_GPUPROT==
{| class="wikitable" border="1"
! Old3DS
! Bits
! Description
|-
| style="background: green" | Yes
| 3-0
| Old FCRAM DMA cutoff size, 0 = no protection.
|-
| style="background: red" | No
| 7-4
| New FCRAM DMA cutoff size, 0 = no protection.
|-
| style="background: green" | Yes
| 8
| AXIWRAM protection, 0 = accessible.
|-
| style="background: red" | No
| 10-9
| QTM DMA cutoff size
|-
| style="background: green" | Yes
| 31-11
| Zeroes
|}

For the old FCRAM DMA cutoff, it protects starting from 0x28000000-(0x800000*x) until end of FCRAM. There is no way to protect the first 0x800000-bytes.

For the new FCRAM DMA cutoff, it protects starting from 0x30000000-(0x800000*x) until end of FCRAM. When the old FCRAM cutoff is set to non-zero, the first 0x800000-bytes bytes of new FCRAM are protected.

On New3DS the old+new FCRAM cutoff can be used at the same time, however this isn't done officially.

For the QTM DMA cutoff, it protects starting from 0x1F400000-(0x100000*x) until end of QTM mem.

On cold boot this reg is set to 0.

When this register is set to value 0, the GPU can access the entire FCRAM, AXIWRAM, and on New3DS all QTM-mem.

[[SVC|Initialized]] during kernel boot, and used with [[SVC]] 0x59 which was implemented with [[11.3.0-36|v11.3]].

==CFG11_WIFICNT==
{| class="wikitable" border="1"
! Old3DS
! Bits
! Description
|-
| style="background: green" | Yes
| 0
| Enable wifi subsystem
|}

PDN Registers

2021-01-22T19:34:22Z

TuxSH: Cleanup /*PDN_LGR_SOCMODE*/

=Register table=
{| class="wikitable" border="1"
! Old3DS
! Name
! Address
! Width
! Used by
|-
| style="background: green" | Yes
| [[#PDN_SLEEP_CNT|PDN_SLEEP_CNT]]
| 0x10141000
| 2
| Kernel11
|-
| style="background: green" | Yes
| [[#PDN_WAKE_ENABLE|PDN_WAKE_ENABLE]]
| 0x10141008
| 4
| [[PTM Services]], [[PDN Services]]
|-
| style="background: green" | Yes
| [[#PDN_WAKE_REASON|PDN_WAKE_REASON]]
| 0x1014100C
| 4
| [[PTM Services]], TwlBg, [[PDN Services]]
|-style="border-top: double"
| style="background: green" | Yes
| [[#LGY_MODE|LGY_MODE]]
| 0x10141100
| 2
| TwlProcess9, TwlBg
|-
| style="background: green" | Yes
| [[#LGY_SLEEP_CNT|LGY_SLEEP_CNT]]
| 0x10141104
| 2
| TwlBg
|-
| style="background: green" | Yes
| [[#LGY_IRQ_ENABLE|LGY_IRQ_ENABLE]]
| 0x10141108
| 2
| TwlBg
|-
| style="background: green" | Yes
| [[#LGY_PAD_CNT|LGY_PAD_CNT]]
| 0x1014110A
| 2
| TwlBg
|-
| style="background: green" | Yes
| [[#LGY_HIDEMU_MASK|LGY_HIDEMU_MASK]]
| 0x10141110
| 2
| TwlBg
|-
| style="background: green" | Yes
| [[#LGY_HIDEMU_PAD|LGY_HIDEMU_PAD]]
| 0x10141112
| 2
| TwlBg
|-
| style="background: green" | Yes
| [[#LGY_GPIOEMU_MASK|LGY_GPIOEMU_MASK]]
| 0x10141114
| 2
| [[Codec Services]], TwlBg
|-
| style="background: green" | Yes
| [[#LGY_GPIOEMU_DATA|LGY_GPIOEMU_DATA]]
| 0x10141116
| 2
| [[Codec Services]], TwlBg
|-
| style="background: green" | Yes
| [[#LGY_CARDDETECTEMU_MASK|LGY_CARDDETECTEMU_MASK]]
| 0x10141118
| 1
| TwlBg
|-
| style="background: green" | Yes
| [[#LGY_CARDDETECTEMU_DATA|LGY_CARDDETECTEMU_DATA]]
| 0x10141119
| 1
| TwlBg
|-
| style="background: green" | Yes
| LGY_?
| 0x10141120
| 1
| TwlBg
|-
|-style="border-top: double"
| style="background: green" | Yes
| [[#PDN_GPU_CNT|PDN_GPU_CNT]]
| 0x10141200
| 4
| Boot11, Kernel11, [[PDN Services]], TwlBg
|-
| style="background: green" | Yes
| [[#PDN_VRAM_CNT|PDN_VRAM_CNT]]
| 0x10141204
| 1
| Boot11, Kernel11, TwlBg
|-
| style="background: green" | Yes
| [[#PDN_LCD_CNT|PDN_LCD_CNT]]
| 0x10141208
| 1
| Boot11
|-
| style="background: green" | Yes
| [[#PDN_FCRAM_CNT|PDN_FCRAM_CNT]]
| 0x10141210
| 2
| Kernel11, TwlBg
|-
| style="background: green" | Yes
| [[#PDN_I2S_CNT|PDN_I2S_CNT]]
| 0x10141220
| 1
| Boot11, TwlBg, [[PDN Services]]
|-
| style="background: green" | Yes
| [[#PDN_CAMERA_CNT|PDN_CAMERA_CNT]]
| 0x10141224
| 1
| [[PDN Services]]
|-
| style="background: green" | Yes
| [[#PDN_DSP_CNT|PDN_DSP_CNT]]
| 0x10141230
| 1
| Process9, [[PDN Services]]
|-
| style="background: red" | No
| [[#PDN_MVD_CNT|PDN_MVD_CNT]]
| 0x10141240
| 1
|
|-style="border-top: double"
| style="background: red" | No
| [[#PDN_LGR_SOCMODE|PDN_LGR_SOCMODE]]
| 0x10141300
| 2
| NewKernel11
|-
| style="background: red" | No
| [[#PDN_LGR_CNT|PDN_LGR_CNT]]
| 0x10141304
| 2
| NewKernel11
|-
| style="background: red" | No
| [[#PDN_LGR_CPU_CNT<0-3>|PDN_LGR_CPU_CNT]]<0-3>
| 0x10141310
| 1*4
| NewKernel11
|}

=Sleep registers=
==PDN_SLEEP_CNT==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| 1 = Enter sleep mode
|-
| 2-14
| Unused.
|-
| 15
| 1 = VRAM is powered down
|}

Kernel11 powers down VRAM (it's unclear whether bit15 is power-down or self-refresh mode) by first disabling the 8 banks using [[GPU/External_Registers#Map|GX register 0x10400030]], then by disabling the GPU clock using [[#PDN_GPU_CNT|PDN_GPU_CNT]] bit 16 and finally writes to and polls this register.

==PDN_WAKE_ENABLE==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| [[HID_Registers#HID_PAD_CNT|HID_PAD_CNT]]
|-
| 3
| Shell opened
|-
| 4
| Headphones not plugged in
|-
| 8
| WiFi (?)
|-
| 19
| Shell GPIO (?)
|-
| 26
| [[I2C_Registers#Device_3|MCU interrupt]]
|-
| 30
| Touch screen pressed
|-
| 31
| CTR gamecard inserted/removed
|-
|}
List in progress.

This is a OR list of wake triggers that will wake up the console from sleep and raise IRQ 0x58.

==PDN_WAKE_REASON==
Same layout as [[#PDN_WAKE_ENABLE|PDN_WAKE_ENABLE]].

This is a OR list of the wake triggers that actually woke up the console.

For each bit, write 1 to acknowledge, and 0 to clear (?).

=Legacy registers=
==LGY_MODE==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| Read only legacy mode set on reg 0x10018000.
|-
| 2-14
| Unused.
|-
| 15
| 1 = enable legacy mode.
|}
To boot into DSi or GBA mode first set register 0x10018000 to the desired mode and setup LgyFb. Then disable FCRAM by clearing bit 0 in reg 0x10201000, writing 0 to PDN_FCRAM_CNT followed by 1 and waiting for bit 2 to clear.

The very last 3DS-mode register poke the [[FIRM|TWL_FIRM]] Process9 does before it gets switched into TWL-mode, is writing 0x8000 to this register. Before writing this register, TWL Process9 waits for ARM7 to change the value of this register. The Process9 code for this runs from ITCM, since switching into TWL-mode includes remapping all ARM9 physical memory.

==LGY_SLEEP_CNT==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Write 1 to wakeup GBA mode.
|-
| 1
| Sleep state/ack. 1 when GBA mode entered sleep. Write 1 to ack.
|-
| 2
| ?
|-
| 3-14
| Unused.
|-
| 15
| 1 = IRQ enable (IRQ 0x59)
|}
When a GBA game enters sleep mode and bit 15 is 1, IRQ 0x59 fires and bit 1 is set. Bit 1 must be acknowledged/written together with bit 0 otherwise GBA mode wakes up from sleep early sometimes.

==LGY_IRQ_ENABLE==
[[ARM11_Interrupts|Arm11 interrupt]] enable bits for legacy interrupts, same bit layout as the GPIOEMU regs below.

==LGY_PAD_CNT==
Also named "KEYCNT" on certain other DS(i)/GBA documentations.
The value of this register is copied to [[HID_Registers|HID_PAD_CNT]] when GBA mode enters sleep.

==LGY_HIDEMU_MASK==
Set bits will use the corresponding values from [[#LGY_HIDEMU_PAD|LGY_HIDEMU_PAD]] instead of allowing the hardware to read it from [[HID_Registers#HID_PAD|HID_PAD]].

This is set to 0x1FFF (all buttons and the debug key) and [[#LGY_HIDEMU_PAD|LGY_HIDEMU_PAD]] is set to 0 when the "Close this software and return to HOME Menu?" dialog is shown to prevent the button presses from propagating to the DS/GBA CPU.

==LGY_HIDEMU_PAD==
Works the same way as [[HID_Registers#HID_PAD|HID_PAD]], but the values set here are only replaced in the HID_PAD seen by the DS/GBA CPU when the corresponding bits in [[#LGY_HIDEMU_MASK|LGY_HIDEMU_MASK]] are set.

==LGY_GPIOEMU_MASK==
Set bits will read bits from [[#LGY_GPIOEMU_DATA|LGY_GPIOEMU_DATA]] (override).

This is used to trigger things like the TWL MCU interrupt in TWL mode.

==LGY_GPIOEMU_DATA==
See above

==LGY_CARDDETECTEMU_MASK==
Set bits will read bits from [[#LGY_CARDDETECTEMU_DATA|LGY_CARDDETECTEMU_DATA]] (override).

Bit0 signals cartridge removal.

==LGY_CARDDETECTEMU_DATA==
See above

=Clock and reset registers=
==PDN_GPU_CNT==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| GPU main block + VRAM + LCD reset. 0 = reset.
|-
| 1
| PSC block reset? 0 = reset.
|-
| 2
| Geoshader block reset? 0 = reset.
|-
| 3
| Rasterization block reset? 0 = reset.
|-
| 4
| PPF block reset. 0 = reset.
|-
| 5
| PDC block reset? 0 = reset.
|-
| 6
| PDC related reset. 0 = reset.
|-
| 7-15
| Unused.
|-
| 16
| Clock enable for all blocks, VRAM and LCD. 1 = enable.
|}

PDN uses a 12 ARM11 cycle delay to deassert reset.

==PDN_VRAM_CNT==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Clock. 1 = enable, 0 = disable
|}

This register seems to be unimplemented in released models: while it is used in tandem with PDN_GPU_CNT.bit16 in Boot11 screeninit code, Kernel11 only uses PDN_GPU_CNT.bit16 to power-off VRAM before going to sleep.

==PDN_LCD_CNT==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Clock. 1 = enable, 0 = disable
|}

This register seems to be unimplemented in released models, only to be used in Boot11, as PDN_GPU_CNT.bit16 also drives the LCD clock.

==PDN_FCRAM_CNT==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Reset. 0 = reset.
|-
| 1
| Clock. 1 = enable, 0 = disable
|-
| 2
| Acknowledge clock request. Gets set or unset when toggling bit 1.
|}
Twl-/AgbBg use this to disable FCRAM for the GBA rom in GBA mode or DSi main RAM in DSi mode. AgbBg clears bit 0 in reg 0x10201000 before touching this reg.

Kernel11 uses it to put the FCRAM in self-refresh mode (clock disable) before going to sleep.

==PDN_I2S_CNT==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| I2S1 Clock (maybe?) 1 = enable, 0 = disable
|-
| 1
| I2S2 Clock. 1 = enable, 0 = disable
|}

I2S1 clock enable bit seems to be unimplemented. Maybe it's because DSP clock enable drives it?

==PDN_CAMERA_CNT==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Clock. 1 = enable, 0 = disable
|}

==PDN_DSP_CNT==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Reset. 0 = reset.
|-
| 1
| Clock. 1 = enable, 0 = disable
|}

PDN services holds reset for 0x30 Arm11 cycles.

==PDN_MVD_CNT==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Reset. 0 = reset
|}

This doesn't seem to be used by anything, but does have a clear effect on the hardware.

The reset value for this register is 1 (out-of-reset at boot).

=N3DS SoC (LGR) registers=
== PDN_LGR_SOCMODE ==
This is used for configuring the New3DS ARM11 CPU clock-rate. This register is New3DS-only: reading from here on Old3DS always returns all-zeros even when one tried writing data here prior to the read.

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-2
| SoC mode.
Possible values:
0=CTR+256MHz
1=LGR2+256MHz, 5=LGR2+804MHz
2=LGR1+256MHz, 3=LGR1+536MHz

N3DS modes (LGR1/LGR2) enable the New 3DS FCRAM extension and are needed to access N3DS-only devices.

* CTR: O3DSS
* LGR1: N3DS prototype, 2 cores, no L2C
* LGR2: retail N3DS, 4 cores, has L2C
|-
| 15
| Busy
|}

On firmlaunch, the kernel sets the mode to O3DS.

[[SVC#KernelSetState|svcKernelSetState]] type10, only implemented on New3DS, uses this register. This piece of code choses the mode matching the input Param0 bit0 state (1 for higher clock), using the state of [[CONFIG11 Registers#CFG11_SOCINFO|CFG11_SOCINFO]] to determine which mode is the best (which is always LGR2 on all released New 3DS units).

== PDN_LGR_CNT ==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Enables the N3DS extramem block
|-
| 8
| Enables the L2C block (LGR2 only)
|}

Kernel11 sets this to 0x101 when bit 2 in [[CONFIG11 Registers#CFG11_SOCINFO|CFG11_SOCINFO]] (LGR2 supported) is set otherwise 1.

== PDN_LGR_CPU_CNT<0-3> ==
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| nRESET, 0 = reset. Also enable the bootrom instruction overlay.
|-
| 1
| Enable bootrom data overlay
|-
| 4
| Reset operation in progress
|-
| 5
| Always 1?
|}

Only usable for core2 and core3.

The normal Arm11 bootrom checks cpuid and hangs if cpuid >= 2. This is a problem when booting the 2 additional New3DS Arm11 MPCores. NewKernel11 solves this by using a hardware feature to overlay the bootrom with a configurable branch to a kernel function. This overlay feature was added with the New3DS.

Bit1 in register above enables a bootrom data-override for physical addresses 0xFFFF0000-0xFFFF1000 and 0x10000-0x11000. All _data reads_ made to those regions now read the 32-bit value provided in [[CONFIG11 Registers #CFG11_BOOTROM_OVERLAY_VAL|CFG11_BOOTROM_OVERLAY_VAL]].

Bit0 sets the core out of reset and enables a bootrom instruction-overlay which means that _instruction reads_ made to the bootrom region are overridden. We have not been able to dump what instructions are actually placed at bootrom by this switch (because reading the area only yields data-reads). Jumping randomly into the 0xFFFF0000-0xFFFF1000 region works fine and jumps to the value provided by the data overlay [[CONFIG11 Registers #CFG11_BOOTROM_OVERLAY_VAL|CFG11_BOOTROM_OVERLAY_VAL]]. Thus we may predict that the entire bootrom region is filled by:
ldr pc, [pc]

Or equivalent. However, jumping to some high addresses such as 0xFFFF0FF0+ will crash the core. This may be explained by prefetching in the Arm pipeline, and might help us identify what instructions are placed by the instruction-overlay.

ARM11 Interrupts

2021-01-21T17:54:20Z

TuxSH: /* Private Interrupts */

== Interrupts ==

Interrupt priority is 0-0xF. A priority of 0xF means that the interrupt is disabled.

= Private Interrupts =

Each CPU core has 32 software interrupts that are private and belong to that core. These interrupts are numbers 0-0x1F for each core. The hardware interrupts are not core-specific and start at interrupt ID 0x20.

{| class="wikitable" border="1"
! IRQ
! Listener
! Description
|-
| 0
|
| MPCore software-interrupt. Not configured.
|-
| 0x1-0x3
|
| MPCore software-interrupt. Used by Boot11 and Kernel11 to kickstart Core1/2/3.
|-
| 0x4
| Kernel
| MPCore software-interrupt. Used to manage the performance counter.
|-
| 0x5
| Kernel
| MPCore software-interrupt. Does apparently nothing.
|-
| 0x6
| Kernel
| MPCore software-interrupt. Extensively used by [[SVC|KernelSetState]] (and contains most of the actual code of the latter).
|-
| 0x7
| Kernel
| MPCore software-interrupt. See [[KCacheMaintenanceInterruptEvent]]
|-
| 0x8
| Kernel
| MPCore software-interrupt. Used for scheduling.
|-
| 0x9
| Kernel
| MPCore software-interrupt. Used when handling exceptions that require termination of a thread or a process, and in some cases by svcSetDebugThreadContext, to store VFP registers in the thread's register storage.
|-
| 0xA
| Kernel
| TLB operations interrupt, see [[KTLBOperationsInterruptEvent]]
|-
| 0xB-0xE
|
| MPCore software-interrupt. Not configured.
|-
| 0xF
| dmnt/debugger
| MPCore software-interrupt. Used to abstract FIQ (debug). This interrupt is never sent to core2 nor core3 on N3DS.
|-
| 0x1D
| Kernel
| MPCore timer.
|-
| 0x1E
| Kernel
| MPCore watchdog - set when the watchdog counter reaches 0 in timer mode, causes interrupt 30 to set as pending. Only set on core 1 as core 1's timer is used for everything.
|}

= Hardware Interrupts =

There are 0x60 hardware interrupts starting at 0x20 and continuing up to 0x7F. These are not private and are accessible from any core.

{| class="wikitable" border="1"
! IRQ
! Listener
! Description
|-
| 0x24
| ?
| SPI bus 2 interrupt status update
|-
| 0x28
| gsp, TwlBg
| PSC0
|-
| 0x29
| gsp, TwlBg
| PSC1
|-
| 0x2A
| gsp, TwlBg
| PDC0 (VBlank0)
|-
| 0x2B
| gsp, TwlBg
| PDC1 (VBlank1)
|-
| 0x2C
| gsp, TwlBg
| PPF
|-
| 0x2D
| gsp, TwlBg
| P3D
|-
| 0x30-0x38
| Kernel
| Old CDMA Event 0..8 (9 separate IRQ lines)
|-
| 0x39
| Kernel
| Old CDMA Faulting (eg. CCR=0, or event>15)
|-
| 0x3A
| Kernel
| New CDMA Event 0..31 (shared IRQ line)
|-
| 0x3B
| Kernel
| New CDMA Faulting (eg. CCR=0)
|-
| 0x40
| nwm
| WIFI SDIO Controller @ 0x10122000
|-
| 0x41
| nwm
| WIFI SDIO Controller IRQ pin @ 0x10122000
|-
| 0x42
| nwm_dev?
| Debug WIFI SDIO Controller @ 0x10100000 ?
|-
| 0x43
| nwm_dev?
| Debug WIFI SDIO Controller @ 0x10100000 ?
|-
| 0x44
| ?
| NTRCARD (maybe?)
|-
| 0x45
| mvd (New3DS)
| L2B_0 (First RGB-to-RGBA Converter)
|-
| 0x46
| mvd (New3DS)
| L2B_1 (Second RGB-to-RGBA Converter)
|-
| 0x48
| camera
| Camera Bus 0 (DSi cameras)
|-
| 0x49
| camera
| Camera Bus 1 (left-eye)
|-
| 0x4A
| dsp
| General interrupt from DSP, including semaphore and command/reply registers status change
|-
| 0x4B
| camera
| Y2R Conversion Finished
|-
| 0x4C
| TwlBg
| LGYFB_0 Legacy GBA/NDS Video
|-
| 0x4D
| TwlBg
| LGYFB_1 Legacy GBA/NDS Video
|-
| 0x4E
| mvd (New3DS)
| Y2R2 End Event
|-
| 0x4F
| mvd (New3DS)
| MVD general interrupt?
|-
| 0x50
| pxi, TwlBg
| Sync (bit 29 from Arm9's PXI_SYNC)
|-
| 0x51
| pxi, TwlBg
| Sync 2 (bit 30 from Arm9's PXI_SYNC)
|-
| 0x52
| pxi, TwlBg
| Send Fifo Empty
|-
| 0x53
| pxi, TwlBg
| Receive Fifo Not Empty
|-
| 0x54
| i2c, TwlBg
| I2C Bus0 work done
|-
| 0x55
| i2c, TwlBg
| I2C Bus1 work done
|-
| 0x56
| spi, TwlBg
| SPI bus 3 interrupt status update
|-
| 0x57
| spi, TwlBg
| SPI bus 1 interrupt status update
|-
| 0x58
| Kernel
| PDN (wake event or SoC mode changed)
|-
| 0x59
| TwlBg
| PDN Legacy Sleep
|-
| 0x5A
| mic
| General microphone interrupt (?)
|-
| 0x5B
| -
| [[HID_Registers#HID_PAD_CNT|HID_PAD_CNT]]
|-
| 0x5C
| i2c, TwlBg
| I2C Bus2 work done
|-
| 0x5F
| mp
| DS WiFi registers
|-
| 0x60
| gpio, TwlBg
| Shell opened
|-
| 0x62
| gpio, TwlBg
| Shell closed
|-
| 0x63
| gpio, TwlBg
| Touchscreen Pen Down
|-
| 0x64
| gpio, TwlBg
| Headphone jack plugged in/out
|-
| 0x66
| gpio, TwlBg
| GPIO2_1
|-
| 0x68
| gpio, TwlBg
| C-stick Interrupt
|-
| 0x69
| gpio, TwlBg
| IrDA Interrupt
|-
| 0x6A
| gpio, TwlBg
| Gyro Interrupt
|-
| 0x6B
| gpio, TwlBg
| GPIO3_3
|-
| 0x6C
| gpio, TwlBg
| GPIO3_4
|-
| 0x6D
| gpio, TwlBg
| GPIO3_5
|-
| 0x6E
| gpio, TwlBg
| GPIO3_6
|-
| 0x6F
| gpio, TwlBg
| GPIO3_7
|-
| 0x70
| gpio, TwlBg
| GPIO3_8
|-
| 0x71
| gpio, TwlBg
| MCU (HOME/POWER pressed/released or WiFi switch pressed, etc.)
|-
| 0x72
| gpio, TwlBg
| NFC
|-
| 0x73
| TwlBg
| GPIO3_11
|-
| 0x74
| ?
| Gamecard related
|-
| 0x75
| ?
| Gamecard inserted
|-
| 0x76
| -
| L2C
|-
| 0x78 to 0x7B
| Kernel
| Core 0-3 Performance monitor counter (any) overflow
|-
| 0x7A to 0x82 (PDN_MPCORE_CFG bit2 set) or
0x7C to 0x84 (bit2 clear)
| Kernel
| Other PMU interrupts (line may not exist at all)
|}
(interrupts from 0x80 and up can't be mapped in available builds of the kernel)

There are 2 tables in the Arm11 kernel: the first has 32 * 2(or 32 * 4) 8-byte entries. This table is for the private interrupts that belong to each core. The data for each interrupt can be found by doing table_base + (core_num * 0x100) + (intr_num * 8). The second table is for public hardware interrupts and the data for each interrupt can be retrieved by doing table_base + (intr_num * 8).

The Arm11 kernel configures interrupts the following way (it seems the GPIO IRQ layout doesn't match released 3DS models):

<nowiki>Interrupts 0x00 to 0x1F: edge-triggered, N-N
Interrupt 0x20: level-sensitive, 1-N
Interrupt 0x21: level-sensitive, 1-N
Interrupt 0x22: level-sensitive, 1-N
Interrupt 0x23: level-sensitive, 1-N
Interrupt 0x24: edge-triggered, 1-N
Interrupt 0x25: level-sensitive, 1-N
Interrupt 0x28: level-sensitive, 1-N
Interrupt 0x29: level-sensitive, 1-N
Interrupt 0x2a: level-sensitive, 1-N
Interrupt 0x2b: level-sensitive, 1-N
Interrupt 0x2c: level-sensitive, 1-N
Interrupt 0x2d: level-sensitive, 1-N
Interrupt 0x30: level-sensitive, 1-N
Interrupt 0x31: level-sensitive, 1-N
Interrupt 0x32: level-sensitive, 1-N
Interrupt 0x33: level-sensitive, 1-N
Interrupt 0x34: level-sensitive, 1-N
Interrupt 0x35: level-sensitive, 1-N
Interrupt 0x36: level-sensitive, 1-N
Interrupt 0x37: level-sensitive, 1-N
Interrupt 0x38: level-sensitive, 1-N
Interrupt 0x39: level-sensitive, 1-N
Interrupt 0x3a: level-sensitive, 1-N
Interrupt 0x3b: level-sensitive, 1-N
Interrupt 0x40: edge-triggered, 1-N
Interrupt 0x41: edge-triggered, 1-N
Interrupt 0x42: edge-triggered, 1-N
Interrupt 0x43: edge-triggered, 1-N
Interrupt 0x44: edge-triggered, 1-N
Interrupt 0x45: edge-triggered, 1-N
Interrupt 0x46: edge-triggered, 1-N
Interrupt 0x48: edge-triggered, 1-N
Interrupt 0x49: edge-triggered, 1-N
Interrupt 0x4a: edge-triggered, 1-N
Interrupt 0x4b: edge-triggered, 1-N
Interrupt 0x4c: edge-triggered, 1-N
Interrupt 0x4d: edge-triggered, 1-N
Interrupt 0x4e: edge-triggered, 1-N
Interrupt 0x4f: level-sensitive, 1-N
Interrupt 0x50: edge-triggered, 1-N
Interrupt 0x51: edge-triggered, 1-N
Interrupt 0x52: edge-triggered, 1-N
Interrupt 0x53: edge-triggered, 1-N
Interrupt 0x54: edge-triggered, 1-N
Interrupt 0x55: edge-triggered, 1-N
Interrupt 0x56: edge-triggered, 1-N
Interrupt 0x57: edge-triggered, 1-N
Interrupt 0x58: level-sensitive, 1-N
Interrupt 0x59: edge-triggered, 1-N
Interrupt 0x5a: edge-triggered, 1-N
Interrupt 0x5b: edge-triggered, 1-N
Interrupt 0x5f: edge-triggered, 1-N
Interrupt 0x60: edge-triggered, 1-N
Interrupt 0x61: edge-triggered, 1-N
Interrupt 0x64: edge-triggered, 1-N
Interrupt 0x65: edge-triggered, 1-N
Interrupt 0x66: edge-triggered, 1-N
Interrupt 0x68: edge-triggered, 1-N
Interrupt 0x69: edge-triggered, 1-N
Interrupt 0x6a: edge-triggered, 1-N
Interrupt 0x6b: edge-triggered, 1-N
Interrupt 0x6c: edge-triggered, 1-N
Interrupt 0x6d: edge-triggered, 1-N
Interrupt 0x6e: edge-triggered, 1-N
Interrupt 0x6f: edge-triggered, 1-N
Interrupt 0x70: edge-triggered, 1-N
Interrupt 0x71: edge-triggered, 1-N
Interrupt 0x72: edge-triggered, 1-N
Interrupt 0x73: edge-triggered, 1-N
Interrupt 0x74: edge-triggered, 1-N
Interrupt 0x75: edge-triggered, 1-N
Interrupt 0x76: level-sensitive, 1-N
Interrupt 0x77: level-sensitive, 1-N
Interrupt 0x78: edge-triggered, 1-N
Interrupt 0x79: level-sensitive, 1-N
Interrupt 0x7a: level-sensitive, 1-N
Interrupt 0x7b: level-sensitive, 1-N
Interrupt 0x7c: level-sensitive, 1-N
Interrupt 0x7d: level-sensitive, 1-N</nowiki>

= InterruptData =
{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| [[KBaseInterruptEvent]] *
| Pointer to the KBaseInterruptEvent object for this interrupt
|-
| 0x4
| u8
| Interrupt will be disabled by the IRQ handler as soon as it is acknowledged.
Ignored for FIQ: the FIQ handler always sets bit2 of [[PDN_Registers#PDN_FIQ_CNT|PDN_FIQ_CNT]]
|-
| 0x5
| u8
| Interrupt is disabled
|-
| 0x6
| u8
| Interrupt priority
|-
| 0x7
| u8
| Unused, alignment
|}

= Interrupt Table (New3DS) =
(0xFFF318F4 in 10.3)

{| class="wikitable" border="1"
! Offset
! Type
! Description
|-
| 0x0
| InterruptData[224]
| Data for all hardware and software interrupts
|-
| 0x700
| [[KObjectMutex]]
| Mutex
|}

ARM11 Interrupts

2021-01-21T17:48:43Z

TuxSH: /* Hardware Interrupts */

== Interrupts ==

Interrupt priority is 0-0xF. A priority of 0xF means that the interrupt is disabled.

= Private Interrupts =

Each CPU core has 32 software interrupts that are private and belong to that core. These interrupts are numbers 0-0x1F for each core. The hardware interrupts are not core-specific and start at interrupt ID 0x20.

{| class="wikitable" border="1"
! IRQ
! Listener
! Description
|-
| 0
|
| MPCore software-interrupt. Not configured.
|-
| 0x1
|
| MPCore software-interrupt. Used by BOOT11 to kickstart Core1.
|-
| 0x2-0x3
|
| MPCore software-interrupt. Seem to be unused.
|-
| 0x4
| Kernel
| MPCore software-interrupt. Used to manage the performance counter.
|-
| 0x5
| Kernel
| MPCore software-interrupt. Does apparently nothing.
|-
| 0x6
| Kernel
| MPCore software-interrupt. Extensively used by [[SVC|KernelSetState]] (and contains most of the actual code of the latter).
|-
| 0x7
| Kernel
| MPCore software-interrupt. See [[KCacheMaintenanceInterruptEvent]]
|-
| 0x8
| Kernel
| MPCore software-interrupt. Used for scheduling.
|-
| 0x9
| Kernel
| MPCore software-interrupt. Used when handling exceptions that require termination of a thread or a process, and in some cases by svcSetDebugThreadContext, to store VFP registers in the thread's register storage.
|-
| 0xA
| Kernel
| TLB operations interrupt, see [[KTLBOperationsInterruptEvent]]
|-
| 0xB-0xE
|
| MPCore software-interrupt. Not configured.
|-
| 0xF
| dmnt/debugger
| MPCore software-interrupt. Used to abstract FIQ (debug). This interrupt is never sent to core2 nor core3 on N3DS.
|-
| 0x1D
| Kernel
| MPCore timer.
|-
| 0x1E
| Kernel
| MPCore watchdog - set when the watchdog counter reaches 0 in timer mode, causes interrupt 30 to set as pending. Only set on core 1 as core 1's timer is used for everything.
|}

= Hardware Interrupts =

There are 0x60 hardware interrupts starting at 0x20 and continuing up to 0x7F. These are not private and are accessible from any core.

{| class="wikitable" border="1"
! IRQ
! Listener
! Description
|-
| 0x24
| ?
| SPI bus 2 interrupt status update
|-
| 0x28
| gsp, TwlBg
| PSC0
|-
| 0x29
| gsp, TwlBg
| PSC1
|-
| 0x2A
| gsp, TwlBg
| PDC0 (VBlank0)
|-
| 0x2B
| gsp, TwlBg
| PDC1 (VBlank1)
|-
| 0x2C
| gsp, TwlBg
| PPF
|-
| 0x2D
| gsp, TwlBg
| P3D
|-
| 0x30-0x38
| Kernel
| Old CDMA Event 0..8 (9 separate IRQ lines)
|-
| 0x39
| Kernel
| Old CDMA Faulting (eg. CCR=0, or event>15)
|-
| 0x3A
| Kernel
| New CDMA Event 0..31 (shared IRQ line)
|-
| 0x3B
| Kernel
| New CDMA Faulting (eg. CCR=0)
|-
| 0x40
| nwm
| WIFI SDIO Controller @ 0x10122000
|-
| 0x41
| nwm
| WIFI SDIO Controller IRQ pin @ 0x10122000
|-
| 0x42
| nwm_dev?
| Debug WIFI SDIO Controller @ 0x10100000 ?
|-
| 0x43
| nwm_dev?
| Debug WIFI SDIO Controller @ 0x10100000 ?
|-
| 0x44
| ?
| NTRCARD (maybe?)
|-
| 0x45
| mvd (New3DS)
| L2B_0 (First RGB-to-RGBA Converter)
|-
| 0x46
| mvd (New3DS)
| L2B_1 (Second RGB-to-RGBA Converter)
|-
| 0x48
| camera
| Camera Bus 0 (DSi cameras)
|-
| 0x49
| camera
| Camera Bus 1 (left-eye)
|-
| 0x4A
| dsp
| General interrupt from DSP, including semaphore and command/reply registers status change
|-
| 0x4B
| camera
| Y2R Conversion Finished
|-
| 0x4C
| TwlBg
| LGYFB_0 Legacy GBA/NDS Video
|-
| 0x4D
| TwlBg
| LGYFB_1 Legacy GBA/NDS Video
|-
| 0x4E
| mvd (New3DS)
| Y2R2 End Event
|-
| 0x4F
| mvd (New3DS)
| MVD general interrupt?
|-
| 0x50
| pxi, TwlBg
| Sync (bit 29 from Arm9's PXI_SYNC)
|-
| 0x51
| pxi, TwlBg
| Sync 2 (bit 30 from Arm9's PXI_SYNC)
|-
| 0x52
| pxi, TwlBg
| Send Fifo Empty
|-
| 0x53
| pxi, TwlBg
| Receive Fifo Not Empty
|-
| 0x54
| i2c, TwlBg
| I2C Bus0 work done
|-
| 0x55
| i2c, TwlBg
| I2C Bus1 work done
|-
| 0x56
| spi, TwlBg
| SPI bus 3 interrupt status update
|-
| 0x57
| spi, TwlBg
| SPI bus 1 interrupt status update
|-
| 0x58
| Kernel
| PDN (wake event or SoC mode changed)
|-
| 0x59
| TwlBg
| PDN Legacy Sleep
|-
| 0x5A
| mic
| General microphone interrupt (?)
|-
| 0x5B
| -
| [[HID_Registers#HID_PAD_CNT|HID_PAD_CNT]]
|-
| 0x5C
| i2c, TwlBg
| I2C Bus2 work done
|-
| 0x5F
| mp
| DS WiFi registers
|-
| 0x60
| gpio, TwlBg
| Shell opened
|-
| 0x62
| gpio, TwlBg
| Shell closed
|-
| 0x63
| gpio, TwlBg
| Touchscreen Pen Down
|-
| 0x64
| gpio, TwlBg
| Headphone jack plugged in/out
|-
| 0x66
| gpio, TwlBg
| GPIO2_1
|-
| 0x68
| gpio, TwlBg
| C-stick Interrupt
|-
| 0x69
| gpio, TwlBg
| IrDA Interrupt
|-
| 0x6A
| gpio, TwlBg
| Gyro Interrupt
|-
| 0x6B
| gpio, TwlBg
| GPIO3_3
|-
| 0x6C
| gpio, TwlBg
| GPIO3_4
|-
| 0x6D
| gpio, TwlBg
| GPIO3_5
|-
| 0x6E
| gpio, TwlBg
| GPIO3_6
|-
| 0x6F
| gpio, TwlBg
| GPIO3_7
|-
| 0x70
| gpio, TwlBg
| GPIO3_8
|-
| 0x71
| gpio, TwlBg
| MCU (HOME/POWER pressed/released or WiFi switch pressed, etc.)
|-
| 0x72
| gpio, TwlBg
| NFC
|-
| 0x73
| TwlBg
| GPIO3_11
|-
| 0x74
| ?
| Gamecard related
|-
| 0x75
| ?
| Gamecard inserted
|-
| 0x76
| -
| L2C
|-
| 0x78 to 0x7B
| Kernel
| Core 0-3 Performance monitor counter (any) overflow
|-
| 0x7A to 0x82 (PDN_MPCORE_CFG bit2 set) or
0x7C to 0x84 (bit2 clear)
| Kernel
| Other PMU interrupts (line may not exist at all)
|}
(interrupts from 0x80 and up can't be mapped in available builds of the kernel)

There are 2 tables in the Arm11 kernel: the first has 32 * 2(or 32 * 4) 8-byte entries. This table is for the private interrupts that belong to each core. The data for each interrupt can be found by doing table_base + (core_num * 0x100) + (intr_num * 8). The second table is for public hardware interrupts and the data for each interrupt can be retrieved by doing table_base + (intr_num * 8).

The Arm11 kernel configures interrupts the following way (it seems the GPIO IRQ layout doesn't match released 3DS models):

<nowiki>Interrupts 0x00 to 0x1F: edge-triggered, N-N
Interrupt 0x20: level-sensitive, 1-N
Interrupt 0x21: level-sensitive, 1-N
Interrupt 0x22: level-sensitive, 1-N
Interrupt 0x23: level-sensitive, 1-N
Interrupt 0x24: edge-triggered, 1-N
Interrupt 0x25: level-sensitive, 1-N
Interrupt 0x28: level-sensitive, 1-N
Interrupt 0x29: level-sensitive, 1-N
Interrupt 0x2a: level-sensitive, 1-N
Interrupt 0x2b: level-sensitive, 1-N
Interrupt 0x2c: level-sensitive, 1-N
Interrupt 0x2d: level-sensitive, 1-N
Interrupt 0x30: level-sensitive, 1-N
Interrupt 0x31: level-sensitive, 1-N
Interrupt 0x32: level-sensitive, 1-N
Interrupt 0x33: level-sensitive, 1-N
Interrupt 0x34: level-sensitive, 1-N
Interrupt 0x35: level-sensitive, 1-N
Interrupt 0x36: level-sensitive, 1-N
Interrupt 0x37: level-sensitive, 1-N
Interrupt 0x38: level-sensitive, 1-N
Interrupt 0x39: level-sensitive, 1-N
Interrupt 0x3a: level-sensitive, 1-N
Interrupt 0x3b: level-sensitive, 1-N
Interrupt 0x40: edge-triggered, 1-N
Interrupt 0x41: edge-triggered, 1-N
Interrupt 0x42: edge-triggered, 1-N
Interrupt 0x43: edge-triggered, 1-N
Interrupt 0x44: edge-triggered, 1-N
Interrupt 0x45: edge-triggered, 1-N
Interrupt 0x46: edge-triggered, 1-N
Interrupt 0x48: edge-triggered, 1-N
Interrupt 0x49: edge-triggered, 1-N
Interrupt 0x4a: edge-triggered, 1-N
Interrupt 0x4b: edge-triggered, 1-N
Interrupt 0x4c: edge-triggered, 1-N
Interrupt 0x4d: edge-triggered, 1-N
Interrupt 0x4e: edge-triggered, 1-N
Interrupt 0x4f: level-sensitive, 1-N
Interrupt 0x50: edge-triggered, 1-N
Interrupt 0x51: edge-triggered, 1-N
Interrupt 0x52: edge-triggered, 1-N
Interrupt 0x53: edge-triggered, 1-N
Interrupt 0x54: edge-triggered, 1-N
Interrupt 0x55: edge-triggered, 1-N
Interrupt 0x56: edge-triggered, 1-N
Interrupt 0x57: edge-triggered, 1-N
Interrupt 0x58: level-sensitive, 1-N
Interrupt 0x59: edge-triggered, 1-N
Interrupt 0x5a: edge-triggered, 1-N
Interrupt 0x5b: edge-triggered, 1-N
Interrupt 0x5f: edge-triggered, 1-N
Interrupt 0x60: edge-triggered, 1-N
Interrupt 0x61: edge-triggered, 1-N
Interrupt 0x64: edge-triggered, 1-N
Interrupt 0x65: edge-triggered, 1-N
Interrupt 0x66: edge-triggered, 1-N
Interrupt 0x68: edge-triggered, 1-N
Interrupt 0x69: edge-triggered, 1-N
Interrupt 0x6a: edge-triggered, 1-N
Interrupt 0x6b: edge-triggered, 1-N
Interrupt 0x6c: edge-triggered, 1-N
Interrupt 0x6d: edge-triggered, 1-N
Interrupt 0x6e: edge-triggered, 1-N
Interrupt 0x6f: edge-triggered, 1-N
Interrupt 0x70: edge-triggered, 1-N
Interrupt 0x71: edge-triggered, 1-N
Interrupt 0x72: edge-triggered, 1-N
Interrupt 0x73: edge-triggered, 1-N
Interrupt 0x74: edge-triggered, 1-N
Interrupt 0x75: edge-triggered, 1-N
Interrupt 0x76: level-sensitive, 1-N
Interrupt 0x77: level-sensitive, 1-N
Interrupt 0x78: edge-triggered, 1-N
Interrupt 0x79: level-sensitive, 1-N
Interrupt 0x7a: level-sensitive, 1-N
Interrupt 0x7b: level-sensitive, 1-N
Interrupt 0x7c: level-sensitive, 1-N
Interrupt 0x7d: level-sensitive, 1-N</nowiki>

= InterruptData =
{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| [[KBaseInterruptEvent]] *
| Pointer to the KBaseInterruptEvent object for this interrupt
|-
| 0x4
| u8
| Interrupt will be disabled by the IRQ handler as soon as it is acknowledged.
Ignored for FIQ: the FIQ handler always sets bit2 of [[PDN_Registers#PDN_FIQ_CNT|PDN_FIQ_CNT]]
|-
| 0x5
| u8
| Interrupt is disabled
|-
| 0x6
| u8
| Interrupt priority
|-
| 0x7
| u8
| Unused, alignment
|}

= Interrupt Table (New3DS) =
(0xFFF318F4 in 10.3)

{| class="wikitable" border="1"
! Offset
! Type
! Description
|-
| 0x0
| InterruptData[224]
| Data for all hardware and software interrupts
|-
| 0x700
| [[KObjectMutex]]
| Mutex
|}

GPIO Registers

2021-01-20T22:52:45Z

TuxSH: /* GPIO pins */

= Registers =

== GPIO ==

{| class="wikitable" border="1"
! Old3DS
! Name
! Address
! Width
|-
| style="background: green" | Yes
| [[#GPIOn_DATA|GPIO1_DATA]]
| 0x10147000
| 1
|-
| style="background: green" | Yes
| [[#GPIOn_DATA|GPIO2_DATA]]
| 0x10147010
| 1
|-
| style="background: green" | Yes
| [[#GPIOn_DIR|GPIO2_DIR]]
| 0x10147011
| 1
|-
| style="background: green" | Yes
| [[#GPIOn_INTCFG|GPIO2_INTCFG]]
| 0x10147012
| 1
|-
| style="background: green" | Yes
| [[#GPIOn_INTEN|GPIO2_INTEN]]
| 0x10147013
| 1
|-
| style="background: green" | Yes
| [[#GPIOn_DATA2|GPIO2_DATA2]]
| 0x10147014
| 2
|-
| style="background: green" | Yes
| [[#GPIOn_DATA|GPIO3_DATA]]
| 0x10147020
| 2
|-
| style="background: green" | Yes
| [[#GPIOn_DIR|GPIO3_DIR]]
| 0x10147022
| 2
|-
| style="background: green" | Yes
| [[#GPIOn_INTCFG|GPIO3_INTCFG]]
| 0x10147024
| 2
|-
| style="background: green" | Yes
| [[#GPIOn_INTEN|GPIO3_INTEN]]
| 0x10147026
| 2
|-
| style="background: green" | Yes
| [[#GPIOn_DATA2|GPIO2_DATA2]]
| 0x10147028
| 2
|-
|}

== Legacy RTC ==
{| class="wikitable" border="1"
! Name
! Address
! Width
! Description
|-
| [[#RTC_CNT_(0x10147100)|RTC_CNT]]
| 0x10147100
| 2
| Control register
|-
| RTC_REG_STAT1
| 0x10147110
| 1
| Rtc status register 1 (command 0). Bitswapped
|-
| RTC_REG_STAT2
| 0x10147111
| 1
| Rtc status register 2 (command 1). Bitswapped
|-
| RTC_REG_CLKADJ
| 0x10147112
| 1
| Rtc clock adjustment register (command 6). Bitswapped
|-
| RTC_REG_FREE
| 0x10147113
| 1
| The free general purpose rtc register (command 7). Bitswapped
|-
| RTC_REG_TIME1
| 0x10147120
| 4
| Byte-wise bit-swapped (bit7 is bit0, etc.) BCD RTC (byte0 = seconds, byte1 = minutes, byte2 = hours, byte3 = day of week)
|-
| RTC_REG_TIME2
| 0x10147124
| 4 (3?)
| Day, month and year all byte-wise bit-swapped
|-
| RTC_REG_ALRMTIM1
| 0x10147130
| 4 (3?)
| Rtc alarm time register 1 (command 4). Byte-wise bit-swapped
|-
| RTC_REG_ALRMTIM2
| 0x10147134
| 4 (3?)
| Rtc alarm time register 2 (command 5). Byte-wise bit-swapped
|-
| RTC_REG_COUNT
| 0x10147140
| 4 (3?)
| Rtc dsi counter register (ex command 0). Byte-wise bit-swapped
|-
| RTC_REG_FOUT1
| 0x10147150
| 1
| Rtc dsi fout register 1 (ex command 1). Bitswapped
|-
| RTC_REG_FOUT2
| 0x10147151
| 1
| Rtc dsi fout register 2 (ex command 2). Bitswapped
|-
| RTC_REG_ALRMDAT1
| 0x10147160
| 4 (3?)
| Rtc dsi alarm date register 1 (ex command 4). Byte-wise bit-swapped
|-
| RTC_REG_ALRMDAT2
| 0x10147164
| 4 (3?)
| Rtc dsi alarm date register 2 (ex command 5). Byte-wise bit-swapped
|-
|}

= Descriptions =

== GPIO ==
=== GPIO pins ===

[[GPIO Services]] bitmasks use this table, in that order:

{| class="wikitable" border="1"
! Bit
! IRQ ID
! Description
|-
| 0
| ?
| GPIO1_0 (?)
|-
| 1
| 0x63
| Touch Pen down
|-
| 2
| 0x60
| Shell closed
|-style="border-top: double"
| 0
| 0x64
| Headphones inserted
|-
| 1
| 0x66
| GPIO2_1 (?)
|-style="border-top: double"
| DATA2.0
| -
| GPIO2_DATA2_0 (wifi related?)
|-style="border-top: double"
| 0
| 0x68
| C-stick
|-
| 1
| 0x69
| IrDA
|-
| 2
| 0x6A
| Gyro
|-
| 3
| 0x6B
| GPIO3_3 (?)
|-
| 4
| 0x6C
| GPIO3_4 (?)
|-
| 5
| 0x6D
| GPIO3_5 (?)
|-
| 6
| 0x6E
| GPIO3_6 (?)
|-
| 7
| 0x6F
| GPIO3_7 (?)
|-
| 8
| 0x70
| GPIO3_8 (?)
|-
| 9
| 0x71
| MCU
|-
| 10
| 0x72
| NFC
|-
| 11
| 0x73
| GPIO3_11 (?)
|-
|-style="border-top: double"
| DATA2.0
| -
| GPIO3_DATA2_0 (wifi related?)
|}

=== GPIOn_DATA ===
Pin values, one bit per pin.

=== GPIOn_DIR ===
Pin directions for GPIO2 and GPIO3, one bit per pin.

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Input
|-
| 1
| Output
|}

=== GPIOn_INTCFG ===
Interrupt configuration for GPIO2 and GPIO3 pins (not the extra ones), one bit per pin.

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Falling edge
|-
| 1
| Rising edge
|}

=== GPIOn_INTEN ===
Interrupt enable bits for GPIO2 and GPIO3 pins (not the extra ones), one bit per pin.

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Interrupt disabled
|-
| 1
| Interrupt enabled
|}

=== GPIOn_DATA2 ===
Extra pins for GPIO2 and GPIO3 (one bit each). These two pins, in total, are not bound to any IRQ and are not configurable.

=== Default values ===
After bootrom initialization, these are the values of the registers:

{| class="wikitable" border="1"
! Address
! Value
|-
| 0x10147000
| 0x0003
|-
| 0x10147010
| 0x00000002
|-
| 0x10147014
| 0x0000
|-
| 0x10147020
| 0x00000DFB
|-
| 0x10147024
| 0x00000000
|-
| 0x10147028
| 0x0000
|}

== Legacy RTC ==
=== RTC_CNT (0x10147100) ===
{| class="wikitable" border="1"
! Bit
! Description
|-
| 0
| Latch STAT1
|-
| 1
| Latch STAT2
|-
| 2
| Latch CLKADJ
|-
| 3
| Latch FREE
|-
| 4
| Latch TIME
|-
| 5
| Latch ALRMTIM1
|-
| 6
| Latch ALRMTIM2
|-
| 7
| Latch COUNT
|-
| 8
| Latch FOUT1
|-
| 9
| Latch FOUT2
|-
| 10
| Latch ALRMDAT1
|-
| 11
| Latch ALRMDAT2
|-
| 12
| ARM7 Busy? This may be chipselect
|-
| 13
| ARM7 write command received? (writing 1 clears it seems)
|-
| 14
| ARM7 read command recieved? (writing 1 clears it seems)
|-
| 15
| DS SIO SI pin (rtc irq pin)
|}

GPIO Registers

2021-01-20T22:51:34Z

TuxSH: Rewrite page

= Registers =

== GPIO ==

{| class="wikitable" border="1"
! Old3DS
! Name
! Address
! Width
|-
| style="background: green" | Yes
| [[#GPIOn_DATA|GPIO1_DATA]]
| 0x10147000
| 1
|-
| style="background: green" | Yes
| [[#GPIOn_DATA|GPIO2_DATA]]
| 0x10147010
| 1
|-
| style="background: green" | Yes
| [[#GPIOn_DIR|GPIO2_DIR]]
| 0x10147011
| 1
|-
| style="background: green" | Yes
| [[#GPIOn_INTCFG|GPIO2_INTCFG]]
| 0x10147012
| 1
|-
| style="background: green" | Yes
| [[#GPIOn_INTEN|GPIO2_INTEN]]
| 0x10147013
| 1
|-
| style="background: green" | Yes
| [[#GPIOn_DATA2|GPIO2_DATA2]]
| 0x10147014
| 2
|-
| style="background: green" | Yes
| [[#GPIOn_DATA|GPIO3_DATA]]
| 0x10147020
| 2
|-
| style="background: green" | Yes
| [[#GPIOn_DIR|GPIO3_DIR]]
| 0x10147022
| 2
|-
| style="background: green" | Yes
| [[#GPIOn_INTCFG|GPIO3_INTCFG]]
| 0x10147024
| 2
|-
| style="background: green" | Yes
| [[#GPIOn_INTEN|GPIO3_INTEN]]
| 0x10147026
| 2
|-
| style="background: green" | Yes
| [[#GPIOn_DATA2|GPIO2_DATA2]]
| 0x10147028
| 2
|-
|}

== Legacy RTC ==
{| class="wikitable" border="1"
! Name
! Address
! Width
! Description
|-
| [[#RTC_CNT_(0x10147100)|RTC_CNT]]
| 0x10147100
| 2
| Control register
|-
| RTC_REG_STAT1
| 0x10147110
| 1
| Rtc status register 1 (command 0). Bitswapped
|-
| RTC_REG_STAT2
| 0x10147111
| 1
| Rtc status register 2 (command 1). Bitswapped
|-
| RTC_REG_CLKADJ
| 0x10147112
| 1
| Rtc clock adjustment register (command 6). Bitswapped
|-
| RTC_REG_FREE
| 0x10147113
| 1
| The free general purpose rtc register (command 7). Bitswapped
|-
| RTC_REG_TIME1
| 0x10147120
| 4
| Byte-wise bit-swapped (bit7 is bit0, etc.) BCD RTC (byte0 = seconds, byte1 = minutes, byte2 = hours, byte3 = day of week)
|-
| RTC_REG_TIME2
| 0x10147124
| 4 (3?)
| Day, month and year all byte-wise bit-swapped
|-
| RTC_REG_ALRMTIM1
| 0x10147130
| 4 (3?)
| Rtc alarm time register 1 (command 4). Byte-wise bit-swapped
|-
| RTC_REG_ALRMTIM2
| 0x10147134
| 4 (3?)
| Rtc alarm time register 2 (command 5). Byte-wise bit-swapped
|-
| RTC_REG_COUNT
| 0x10147140
| 4 (3?)
| Rtc dsi counter register (ex command 0). Byte-wise bit-swapped
|-
| RTC_REG_FOUT1
| 0x10147150
| 1
| Rtc dsi fout register 1 (ex command 1). Bitswapped
|-
| RTC_REG_FOUT2
| 0x10147151
| 1
| Rtc dsi fout register 2 (ex command 2). Bitswapped
|-
| RTC_REG_ALRMDAT1
| 0x10147160
| 4 (3?)
| Rtc dsi alarm date register 1 (ex command 4). Byte-wise bit-swapped
|-
| RTC_REG_ALRMDAT2
| 0x10147164
| 4 (3?)
| Rtc dsi alarm date register 2 (ex command 5). Byte-wise bit-swapped
|-
|}

= Descriptions =

== GPIO ==
=== GPIO pins ===

[[GPIO services]] bitmasks use this table, in that order:

{| class="wikitable" border="1"
! Bit
! IRQ ID
! Description
|-
| 0
| ?
| GPIO1_0 (?)
|-
| 1
| 0x63
| Touch Pen down
|-
| 2
| 0x60
| Shell closed
|-style="border-top: double"
| 0
| 0x64
| Headphones inserted
|-
| 1
| 0x66
| GPIO2_1 (?)
|-style="border-top: double"
| DATA2.0
| -
| GPIO2_DATA2_0 (wifi related?)
|-style="border-top: double"
| 0
| 0x68
| C-stick
|-
| 1
| 0x69
| IrDA
|-
| 2
| 0x6A
| Gyro
|-
| 3
| 0x6B
| GPIO3_3 (?)
|-
| 4
| 0x6C
| GPIO3_4 (?)
|-
| 5
| 0x6D
| GPIO3_5 (?)
|-
| 6
| 0x6E
| GPIO3_6 (?)
|-
| 7
| 0x6F
| GPIO3_7 (?)
|-
| 8
| 0x70
| GPIO3_8 (?)
|-
| 9
| 0x71
| MCU
|-
| 10
| 0x72
| NFC
|-
| 11
| 0x73
| GPIO3_11 (?)
|-
|-style="border-top: double"
| DATA2.0
| -
| GPIO3_DATA2_0 (wifi related?)
|}

=== GPIOn_DATA ===
Pin values, one bit per pin.

=== GPIOn_DIR ===
Pin directions for GPIO2 and GPIO3, one bit per pin.

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Input
|-
| 1
| Output
|}

=== GPIOn_INTCFG ===
Interrupt configuration for GPIO2 and GPIO3 pins (not the extra ones), one bit per pin.

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Falling edge
|-
| 1
| Rising edge
|}

=== GPIOn_INTEN ===
Interrupt enable bits for GPIO2 and GPIO3 pins (not the extra ones), one bit per pin.

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Interrupt disabled
|-
| 1
| Interrupt enabled
|}

=== GPIOn_DATA2 ===
Extra pins for GPIO2 and GPIO3 (one bit each). These two pins, in total, are not bound to any IRQ and are not configurable.

=== Default values ===
After bootrom initialization, these are the values of the registers:

{| class="wikitable" border="1"
! Address
! Value
|-
| 0x10147000
| 0x0003
|-
| 0x10147010
| 0x00000002
|-
| 0x10147014
| 0x0000
|-
| 0x10147020
| 0x00000DFB
|-
| 0x10147024
| 0x00000000
|-
| 0x10147028
| 0x0000
|}

== Legacy RTC ==
=== RTC_CNT (0x10147100) ===
{| class="wikitable" border="1"
! Bit
! Description
|-
| 0
| Latch STAT1
|-
| 1
| Latch STAT2
|-
| 2
| Latch CLKADJ
|-
| 3
| Latch FREE
|-
| 4
| Latch TIME
|-
| 5
| Latch ALRMTIM1
|-
| 6
| Latch ALRMTIM2
|-
| 7
| Latch COUNT
|-
| 8
| Latch FOUT1
|-
| 9
| Latch FOUT2
|-
| 10
| Latch ALRMDAT1
|-
| 11
| Latch ALRMDAT2
|-
| 12
| ARM7 Busy? This may be chipselect
|-
| 13
| ARM7 write command received? (writing 1 clears it seems)
|-
| 14
| ARM7 read command recieved? (writing 1 clears it seems)
|-
| 15
| DS SIO SI pin (rtc irq pin)
|}