ARM7 Registers
The 3DS utilizes an onboard ARM7 core to handle TWL_FIRM and AGB_FIRM's ARM7 requirements. This is due to the fact that much of the hardware used by both ARM7 and ARM9 is (evidently) not physically hooked up to ARM11. Thus, ARM11 cannot simply emulate ARM7.
This core seems to have the AGB BIOS available through hardware. This, combined with the onboard 2D graphics engine, makes for almost perfect Gameboy Advance "emulation."
Registers
ARM9 interfaces with the ARM7 through the following registers:
| Name | Address | Width |
|---|---|---|
| ARM7_CNT | 0x10018000 | 0x1 |
| ARM7_CODE | 0x10018080 | ? |
| ARM7_?_STATE | 0x10018104 | 0x1 |
| ARM7_? | 0x10018108 | 0x2 |
| ARM7_? | 0x10018110 | 0x8? |
ARM7_CNT
This indicates (controls?) the mode of the ARM7. 1 = TWL, 2 = AGB.
ARM7_CODE
This is the first code that will be run after execution begins. TwlProcess9 uses this to put ARM7 in a loop (TWL), and to set the POSTFLG and branch to more copied code (AGB).This doesn't seem to start execution by itself.
Memory map
The virtual memory mapping for the ARM7 is the same as for the other core. However, it has additional internal memory mapped to it. Interestingly enough, this memory all seems to lie within ARM9's own "internal memory."
- 0x8060000 -> 0x3800000 (ARM7-WRAM (64KB))
- 0x806C000 -> ?
- 0x80C0000 -> ? (0x10018104 is set to 1 before changing memory here, and 0 afterwards)
- 0x80BFE00 -> 0x3007E00 (CPU internal area, AGB boot code is written here)