Difference between revisions of "ARM7 Registers"
m |
WulfyStylez (talk | contribs) (RTC is a guess, but what else is a hardware device with up to 0x8 stored at power-off?) |
||
| Line 17: | Line 17: | ||
| 0x10018080 | | 0x10018080 | ||
| ? | | ? | ||
| + | |- | ||
| + | | ARM7_SAVE_MODE | ||
| + | | 0x10018100 | ||
| + | | 0x2 | ||
|- | |- | ||
| ARM7_?_CNT | | ARM7_?_CNT | ||
| Line 22: | Line 26: | ||
| 0x2 | | 0x2 | ||
|- | |- | ||
| − | | | + | | ARM7_RTC_CNT? |
| 0x10018108 | | 0x10018108 | ||
| 0x2 | | 0x2 | ||
|- | |- | ||
| − | | | + | | ? |
| 0x10018110 | | 0x10018110 | ||
| 0x4 | | 0x4 | ||
|- | |- | ||
| − | | | + | | ? |
| 0x10018114 | | 0x10018114 | ||
| 0x4 | | 0x4 | ||
|- | |- | ||
| − | | | + | | ARM7_RTC_LO? |
| 0x10018118 | | 0x10018118 | ||
| 0x4 | | 0x4 | ||
|- | |- | ||
| − | | | + | | ARM7_RTC_HI? |
| 0x1001811C | | 0x1001811C | ||
| 0x4 | | 0x4 | ||
| + | |- | ||
| + | | ARM7_SAVE_CFG | ||
| + | | 0x10018120 | ||
| + | | 0x10 | ||
|} | |} | ||
== ARM7_CNT == | == ARM7_CNT == | ||
| − | This | + | This seems to control the mode of the ARM7. 1 = TWL, 2 = AGB. |
== ARM7_CODE == | == ARM7_CODE == | ||
This is the first code that will be run after execution begins. TwlProcess9 uses this to put ARM7 in a loop (TWL), and to set the POSTFLG and branch to more copied code (AGB).This doesn't seem to start execution by itself. | This is the first code that will be run after execution begins. TwlProcess9 uses this to put ARM7 in a loop (TWL), and to set the POSTFLG and branch to more copied code (AGB).This doesn't seem to start execution by itself. | ||
| − | == | + | == ARM7_SAVE_MODE == |
| − | + | This tells the save storage emulation hardware which device type to emulate (EEPROM, 512k flash, and SRAM are all that have been spotted). This comes directly from the [[3DS_Virtual_Console#Footer|ROM footer]]. | |
| + | |||
| + | == ARM7_RTC(?) == | ||
| + | These registers may be used to control a realtime clock. To set or read the data here, first ARM7_RTC_CNT's bit 15 is waited on. Next ARM7_RTC_CNT is set to zero. | ||
| + | |||
| + | For a write: the two registers are written, a 1 is written to ARM7_RTC_CNT, and it is waited on the same as before. Afterwards if bit 14 is not set in ARM7_RTC_CNT, the value was set successfully. | ||
| + | |||
| + | For a read: a 2 is written to ARM7_RTC_CNT, it's waited on again. Afterwards, if bit 14 is not set, the RTC can be read. Presumably the hardware can be re-enabled by writing a zero to ARM7_RTC_CNT at this point, but AGB_FIRM does not. | ||
| + | |||
| + | == ARM7_SAVE_CFG == | ||
| + | This is copied from rom footer + 0x10. It presumably configures details about storage, such as IDs, and likely allows enabling the RTC for games which need it. Format of this data is unknown, and slightly difficult to determine without some hardware poking. | ||
= Memory map = | = Memory map = | ||
Revision as of 04:59, 13 May 2016
The 3DS utilizes an onboard ARM7 core to handle TWL_FIRM and AGB_FIRM's ARM7 requirements. This is due to the fact that much of the hardware used by both ARM7 and ARM9 is (evidently) not physically hooked up to ARM11. Thus, ARM11 cannot simply emulate ARM7.
ARM7 has the AGB BIOS implemented in hardware. The BIOS is completely identical to the original AGB BIOS. The system is booted silently by calling SWI 0x1 (RegisterRamReset), followed by jumping to the code that does SWI 0x0 (SoftReset) to finish booting. The boot splash is still in BIOS, however, and can be seen by calling (or replacing one of the previous interrupts with) SWI 0x26 (HardReset).
Registers
ARM9 interfaces with the ARM7 through the following registers:
| Name | Address | Width |
|---|---|---|
| ARM7_CNT | 0x10018000 | 0x1 |
| ARM7_CODE | 0x10018080 | ? |
| ARM7_SAVE_MODE | 0x10018100 | 0x2 |
| ARM7_?_CNT | 0x10018104 | 0x2 |
| ARM7_RTC_CNT? | 0x10018108 | 0x2 |
| ? | 0x10018110 | 0x4 |
| ? | 0x10018114 | 0x4 |
| ARM7_RTC_LO? | 0x10018118 | 0x4 |
| ARM7_RTC_HI? | 0x1001811C | 0x4 |
| ARM7_SAVE_CFG | 0x10018120 | 0x10 |
ARM7_CNT
This seems to control the mode of the ARM7. 1 = TWL, 2 = AGB.
ARM7_CODE
This is the first code that will be run after execution begins. TwlProcess9 uses this to put ARM7 in a loop (TWL), and to set the POSTFLG and branch to more copied code (AGB).This doesn't seem to start execution by itself.
ARM7_SAVE_MODE
This tells the save storage emulation hardware which device type to emulate (EEPROM, 512k flash, and SRAM are all that have been spotted). This comes directly from the ROM footer.
ARM7_RTC(?)
These registers may be used to control a realtime clock. To set or read the data here, first ARM7_RTC_CNT's bit 15 is waited on. Next ARM7_RTC_CNT is set to zero.
For a write: the two registers are written, a 1 is written to ARM7_RTC_CNT, and it is waited on the same as before. Afterwards if bit 14 is not set in ARM7_RTC_CNT, the value was set successfully.
For a read: a 2 is written to ARM7_RTC_CNT, it's waited on again. Afterwards, if bit 14 is not set, the RTC can be read. Presumably the hardware can be re-enabled by writing a zero to ARM7_RTC_CNT at this point, but AGB_FIRM does not.
ARM7_SAVE_CFG
This is copied from rom footer + 0x10. It presumably configures details about storage, such as IDs, and likely allows enabling the RTC for games which need it. Format of this data is unknown, and slightly difficult to determine without some hardware poking.
Memory map
The virtual memory mapping for the ARM7 is the same as for the other core. However, it has additional internal memory mapped to it. Interestingly enough, much of this memory seems to lie within ARM9's own "internal memory."
- 0x08060000 -> 0x03800000, ARM7-WRAM (64KB)
- 0x080B0000 -> 0x03000000, GBA on-chip WRAM (32KB)
- 0x080C0000 -> EEPROM/SRAM/Flash (0x10018104 must be set to 1 before reading memory here, and restored to its previous value afterwards)
- 0x01FFC000 -> 0x01000000, ARM9 ITCM under TWL (16KB)