CONFIG9 Registers

Registers

NAME	PHYSICAL ADDRESS	WIDTH
REG_SYSPROT9	0x10000000	1
REG_SYSPROT11	0x10000001	1
?	0x10000004	4
REG_CARDCONF	0x1000000C	2
REG_CARDCTRL	0x10000010	1
?	0x10000011	1
?	0x10000012	2
REG_EXTMEMCNT9	0x10000200	1
?	0x10000204	2
REG_SOCREVISION?	0x10000FFC	4
REG_BOOTENV	0x10010000	4
REG_UNITINFO	0x10010010	1

REG_CARDCONF

Bit	Description
1-0	Gamecard active controller select (0=NTRCARD, 1=?, 2=CTRCARD1, 3=CTRCARD2)
8	?

Depending on the gamecard controller that has been selected, one of the following gamecard registers will become active:

Selecting NTRCARD will activate the register space at 0x10164000.
Selecting CTRCARD1 will activate the register space at 0x10004000.
Selecting CTRCARD2 will activate the register space at 0x10005000.

REG_SYSPROT9

Writing values to SYSPROT sets the specified bitmask. The ARM9 bootrom(+0x8000) is disabled by writing bit0. bit1 is used by NATIVE_FIRM to make sure console-unique TWL AES-keys are only set at hard-boot. It is not possible to set any other bits.

From disassembly of the New3DS process9, it appears that setting bit1 disables the 0x10012000+ region.

REG_SYSPROT11

ARM11 bootrom (+0x8000) is disabled by writing bit0. It is not possible to set any other bits.

REG_EXTMEMCNT9

This register is presumably New3DS-only. Only bit0 is writable: 0 = disable New3DS ARM9 memory at 0x08100000 size 0x80000, 1 = enable.

This bit is set by New3DS ARM9-kernel crt0.

The data in this extended memory doesn't change when disabling the memory, then re-enabling the memory. Reading this extended memory while disabled results in zeros.

0x10010000

Initially this is value zero. NATIVE_FIRM writes value 1 here when a FIRM launch begins. The LGY FIRM writes value 3 here when handling PXI command 0x00020080(first TWL PXI command), it also writes value 7 here when handling PXI command 0x00030080(first AGB PXI command). This register can be read to determine what "mode" the system is running under: hard-boot, FIRM launch, or TWL/AGB FIRM.