DSiBrew - User contributions [en]

DSi system flaws

2026-02-01T19:14:13Z

PoroCYon:

= Hardware =
Flaws in this category pertain to the underlying hardware that powers the DSi. This includes [[Stage1]], [[AES_Engine]], etc.

{| class="wikitable" border="1"
! Summary
! Description
! Fixed with hardware model/revision
! Newest hardware model/revision this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| [[AES_Engine]] allows partial key overwrite
| After using the key generator to generate the normal-key, you could overwrite parts of the normal-key with your own data and then recover the key-generator output by comparing the new crypto output with the original crypto output. From the normal-key outputs, you could deduce the key-generator function.
This applies to the keyX/keyY too.

The 3DS TWL AES engine is also [https://www.3dbrew.org/wiki/3DS_System_Flaws affected].
|
|
| 2011
|
| {{User|Yellows8}}
|-
| Undefined instruction/abort exception handler backed by RAM not cleared on reset
| Much like the 3DS boot0, some of the DSi's exception handlers are backed by RAM which isn't immediately cleared on a reset. Using fault injection, it is possible to cause an undefined instruction exception before the clearing happens, making the CPU jump to code remaining in RAM from the previous boot cycle. This only works on the ARM7, as on the ARM9, it is backed by main memory, which is only initialized by [[stage2]].
|
|
| June 2016
|
| {{User|Nocash}}, Normmatt, dark_samus, ApacheThunder (first successful exploit: {{User|PoroCYon}}, March 2021)
|-
| ARM7 ROM controls lockout of both boot ROMs
| After the execution of both boot ROMs, and right before jumping to stage2, the ARM7 locks out both boot ROMs using the SCFG registers, while the ARM9 waits for this lockout (as a synchronization mechanism). By using the above exploit to take control of the ARM7, it is possible to, in the exploit payload, mimic the ARM7 ROM execution such that it performs all the loading steps, but "forgets" to lock out the ROMs. By then injecting <i>another</i> glitch, it is possible to break the ARM9 out of the waiting loop, booting the system into the System Menu (or Unlaunch) with both boot ROMs still enabled, allowing one to dump the ARM9 boot ROM.
|
|
| 2021-2022
|
| Theorized to be possible by {{User|PoroCYon}} in 2021, first successful exploit by stuckpixel and Normmatt early November 2022, then exploited successfully two weeks later again by {{User|PoroCYon}}.
|-
| [[Stage2]] binary load region not validated
| [[Stage1]] doesn't validate the the load address/size for [[Stage2]] binaries. If all RSA / hash checks pass and the binary were located in memory used by [[Stage1]], this would allow running code under the context of [[Stage1]]. This is currently useless due to RSA however.
This is somewhat similar to [https://www.3dbrew.org/wiki/3DS_System_Flaws 3DS] bootROM issues, however 3DS does attempt validation at least.
|
|
| 2022
| December 19, 2022
| {{User|Yellows8}}, {{User|PoroCYon}}
|-
| [[Stage2]] header RSA signature padding not checked properly
| [[Stage1]] uses the SWI RSA_Decrypt_Unpad routine to verify the RSA signature of the [[stage2]] header. However, it does not check the return value of this function. This will make stage1 use uninitialized memory as the plaintext RSA message for signatures with improper padding. Normally, this memory is all-zeros, and due to the specific structure of this RSA message, this will quickly be caught by stage1. However, given that GCD private keys have been leaked (see below), it is in theory possible to use a signature from a gamecart to boot from [NAND] or [NVRAM].
|
|
| 2022 / 2024?
| November 2023 / February 1st, 2026
| Originally {{User|PoroCYon}} / TuxSH for the implications of the GCD private keys being known.
|-
| [[stage1]] hash verification code is vulnerable to fault injection
| The [[stage1]] code that verifies the first two SHA1 hashes in the RSA signature appendix (the header hash and the "hash of hashes" redundancy hash) is constructed in such a way that they can be both bypassed with a single injected fault. This makes it possible to exploit both bootroms using a modchip
|
|
| 2022
| nov/dec 2023, see [https://media.ccc.de/v/37c3-11736-nintendo_hacking_2023_2008 37c3 talk]
|-
| Gamecart (GCD) boot private keys included in Gigaleaks
| With private keys you can generate valid RSA signatures, and thus use an "ntrboot-style" flashcart to gain code execution without any real exploit.
|
|
| Dec 2023/Jan 2024
| July 2024
| asie?
|}

= Software =
== Stage2 ==
Flaws in this category pertain to [[Stage2]]. There is no known updated version of Stage2 post-launch.

{| class="wikitable" border="1"
! Summary
! Description
! Fixed with system version
! Newest system version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| Poor [[System Menu]] [[TMD]] size check
| [[Stage2]] loads the System Menu's TMD for verification and loading, and it attempts to check the size. However, instead of checking if <code>size > capacity</code>, it checks if <code>size > size</code>, which is always false, resulting in a buffer overflow.
| None
|
| August 2017
|
| {{User|Nocash}}
|}

== System Menu ==
Flaws in this category pertain to [[System Menu]].

{| class="wikitable" border="1"
! Summary
! Description
! Fixed with system version
! Newest system version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| DS games are not patched to verify overlays
| While the System Menu checks all cartridge overlays to prevent unauthorized software, no such check exists when the overlays are actually loaded, despite an [https://wiibrew.org/wiki/MIOS MIOS]-like patcher being possible to implement. By changing the overlay after it is checked, it is possible to run arbitrary code.
|
|
| January 2010
|
| Datel, and {{User|blasty}} by [https://hackmii.com/2010/02/lawsuit-coming-in-3-2-1/ reverse engineering] Datel's [[Action Replay]]
|}

== Applications ==
Flaws in this category pertain to applications launched by [[System Menu]]. See also [[DSi exploits]].

DSi exploits

2026-02-01T19:00:57Z

PoroCYon: /* DSiWare (True DSi-Mode) Exploits */

This page is dedicated to the listing of exploits for the Nintendo DSi. Anyone may contribute to this list. This page my not, however be deleted in any way, this ensures that that development of this page is not slowed down. Due to the fact that this page has not changed for over a year due to resets, no more resets.

== Type of exploits ==
Here is a general list of all the different types/terms of exploits to know. This is to know the differences of each exploit.
== NTR/NDS-Mode Exploits ==
These are ARM9 exploits that takes over a NDS-mode cartridge. These cartridges (on the back) are labeled as ''NTR''. These type of exploits are very limited since there's no SD or NAND access. They can be used to run a small binary payload making these exploits almost useless.

{| class="wikitable" border="1"
! Name
! Description
! Author
! Source
|-
| [[FIFA NDS]]
| Every single FIFA game on the Nintendo DS has been exploited.
| Everyone
| [https://github.com/CTurt/Dara CTurt's Source Code]
|-
| [[Bangai-O-Sploit]]
| A ''primary'' entrypoint for the game, ''Bangai-O Spirit'', on the Nintendo DS. This game was successfully exploit through sound.
| smealum
| [https://github.com/smealum/bangai-o-sploit Install]
|-
| [[NDS-ILH-Save-Exploit]]
| "I Love Horses" Nintendo DS save exploit
| [https://github.com/mojobojo/ mojobojo]
| [https://github.com/mojobojo/NDS-ILH-Save-Exploit Install]
|-
| [[ABR-NDS-SaveExploit]]
| A stack smash savegame exploit for the game "Asterix Brain Trainer"
| [https://github.com/WemI0/ Weml0]
| [https://github.com/WemI0/ABR-NDS-SaveExploit Install]
|-
| [[HaxxStation]]
| DS Download Station exploit, allowing one to run any commercial homebrew over from the DS download play application.
| shutterbug2000, Gericom, and Apache Thunder
| [https://github.com/Gericom/dspatch See Here]
|-
| [[BreakingNews]]
| A stack smash savegame exploit for the game "The New York Times: Crossword" resulting from stack buffer overflow (profile slot names).
| [[User:ChampionLeake|ChampionLeake]]
| [https://github.com/ChampionLeake/BreakingNews/ Install]
|-
| [[NDS-FC2008-Save-Exploit]]
| A savegame exploit for the game "Führerschein Coach 2008".
| [https://github.com/toombaumarkt/ toombaumarkt]
| [https://github.com/toombaumarkt/NDS-FC2008-Save-Exploit Install]
|-
| [[WordJong-Overflow]]
| A buffer overflow exploit for the game WordJong DS (U).
| [https://github.com/Borgars/ Borgars]
| [https://github.com/Borgars/WordJong-Overflow Install]
|-
| [[CorruptedClues]]
| A stack smash savegame exploit for the game "Cate West: The Vanishing Files", resulted by unchecked string sizes from the highscore data.
| [[User:ChampionLeake|ChampionLeake]]
| [https://github.com/ChampionLeake/CorruptedClues Install]
|}

== TWL/DSi-Enhanced Cart Exploits ==
These are ARM9 exploits that take over a enhanced DSi-mode cartridge. These cartridges (on the back) are labeled as ''TWL''. Unfortunately they don't have SD or NAND access but can be used to gather console information and maybe find other vulnerabilities. These exploits can also be used for dslink, which can load homebrew applications via internet connections.

{| class="wikitable" border="1"
! Name
! Description
! Author
! Source
|-
| [[The Biggest Losers]]
| Exploit for The Biggest Loser which runs in DSi mode if you use a real cartridge on a DSi or 3DS system, otherwise, it runs in DS mode.
| st4rk
| [https://github.com/st4rk/The-Biggest-Loser Install]
[https://davejmurphy.com/dslink/ WinterMute's dslink]
|-
| [[Cookhack]]
| DSi Cooking Coach exploit
| WinterMute
| [https://github.com/WinterMute/savesploits/tree/master/cookhack PoC]
[https://davejmurphy.com/dslink/ dslink]
|-
| [[Classichack]]
| DSi Classic Word Games exploit
| WinterMute
| [https://github.com/WinterMute/savesploits/tree/master/classichack PoC]
[https://davejmurphy.com/dslink/ dslink]
|-
| [[SystemFlaaw]]
| The first DSi exclusive cartridge title to be exploited for the game, SystemFlaw
| zoogie
| [https://github.com/zoogie/SystemFlaaw Install]
|}

== DSiWare (True DSi-Mode) Exploits ==
These are ARM9 exploits that take over a DSiWare title. They run in the same context that the DSi-Enhanced games do, but with additional SD and NAND access. These exploits are valuable since they can be used to downgrade the console firmware to older versions, or install a persistent exploit such as Unlaunch. You can also run commercial homebrew applications from the SD card. However this doesn't allow any cartridge access.

{| class="wikitable" border="1"
! Name
! Description
! Author
! Source
|-
| [[Sudokuhax]]
| One of the first DSiWare exploits for the Nintendo DSi on the game SUDOKU by EA. (You must have the 1st version of this game in order to use the exploit as it was patched.
| TeamTwiizer, yellows8
| [https://github.com/yellows8/dsi/tree/master/exploits/sudokuhax Install]
|-
| [[grtpwn]]
| A Gameloft DSiWare savegame exploit for the game, Guitar Rock Tour!
| yellows8
| [https://github.com/yellows8/dsi/tree/master/exploits/grtpwn Install]
|-
| [[exidiahax]]
| A Gameloft DSiWare savegame exploit for the game, Legend of Exidia!
| yellows8
| [https://github.com/yellows8/dsi/tree/master/exploits/exidiahax Install]
|-
| [[fieldrunhax]]
| A Subatomic Studios DSiWare savegame exploit for the game, FIELDRUNNERS!
| yellows8
| [https://github.com/yellows8/dsi/tree/master/exploits/fieldrunhax Install]
|-
| [[4swordhax]]
| A DSiWare savegame exploit for the game, The Legend of Zelda: Four Swords Anniversary Edition!
| yellows8
| [https://github.com/yellows8/dsi/tree/master/exploits/4swordhax Install]
|-
| [[Flipnote ( ͡° ͜ʖ ͡°)]] and [[ugopwn]]
| A Primary entrypoint for the DSiWare Application, Flipnote Studio! This exploit was first exploit by shutterbug2000. Later, WinterMute and fincs released a stable version of the exploit.
| shutterbug2000, WinterMute, fincs, zoogie
| [https://davejmurphy.com/%CD%A1-%CD%9C%CA%96-%CD%A1/ Install]
|-
| [[UNO*pwn]]
| A DSiWare savegame exploit for the game, UNO, that involves a simple stack buffer overflow within the player's username with the settings functionality of the game!
| [[User:ChampionLeake|ChampionLeake]]
| [https://github.com/ChampionLeake/UNO-pwn Install]
|-
| [[Memory Pit]]
| A primary exploit for the DSi that involves the system application "Camera"! All you need is an SD Card to use this exploit.
| shutterbug2000
| [https://gbatemp.net/threads/memory-pit-a-new-dsi-exploit-for-dsi-camera.539432 Install], [https://github.com/ChampionLeake/BrokenPit Open-source]
|-
| [[petit-compwner]]
| The last string argument of interpreter command "COLSET" is not bounds checked, thus a trivial stack smash can occur if the string is overly long.
| zoogie
| [https://github.com/zoogie/petit-compwner/releases Release]
|-
| [[stylehax]]
| A primary entrypoint, using a use-after-free in Opera 9.50 (which uses WebKit under the hood).
| @0x1337cafe
| [https://github.com/nathanfarlow/stylehax Release], [https://farlow.dev/2023/03/02/hacking-the-nintendo-dsi-browser Writeup]
|-
| [[Wrfuxxed]]
| Exploit in a factory test image (WRFU Tester) that communicates with a UART backchannel in a cartridge. Requires a compatible flashcart (currently DSpico only).
| Gericom, XLuma, lifehackerhansol
| [https://github.com/LNH-team/dspico-wrfuxxed Github], [https://github.com/LNH-team/dspico-wrfuxxed/blob/develop/wrfuxxed.md writeup]
|}

== ARM7 Exploits ==
These exploits take over the ARM7 processor. In the DSi, these processor handles critical operations and cryptography operations, among other things. These exploits are extremely rare and there's no concrete targets. The DSi menu (The Launcher) is known to run in the ARM7 context. At the moment there's only one exploit known as RocketLauncher. These exploits allow FULL ACCESS with the DSi launcher.
{| class="wikitable" border="1"
! Name
! Description
! Author
! Source
|-
| [[RocketLauncher]]
| One of the first ever unlocked ARM7 DSi exploit involving the DS Cart White list in secton 3. This exploit only works on firmwares v1.4!
| ApacheThunder, stuckpixel, NoCash, Gericom, and Normmatt
| [https://github.com/ApacheThunder/RocketLauncher source]
|}

== Bootcode Exploits ==

These exploits gain full SCFG_EXT access rights immediately after powering on the system (right before starting the launcher). These exploits are significantly rare and concrete targets can be the launcher's ''title.tmd''. At the moment, nocash's exploit, ''Unlaunch'' is the only known usable exploit.

{| class="wikitable" border="1"
! Name
! Description
! Author
! Source
|-
| [[Unlaunch]]
| Possibly one of the first bootcode exploit for the Nintendo DSi! This exploit deals with taking advantage of the launcher's "title.tmd" size as it's not checked, allowing esculated permissions!
| NoCash
| [https://problemkaputt.de/unlaunch.htm Install & Writeup]
|-
| Unnamed modchip
| A modchip that exlploits the bootROMs of the Nintendo DSi. It enables code execution on both cores before boot ROM lockout.
| PoroCYon
| [https://media.ccc.de/v/37c3-11736-nintendo_hacking_2023_2008 37c3 talk], [https://icosahedron.website/@pcy/111676158956228552 video], [https://github.com/dsi-modchip/guide DIY guide]
|}

DSi exploits

2026-02-01T19:00:26Z

PoroCYon:

This page is dedicated to the listing of exploits for the Nintendo DSi. Anyone may contribute to this list. This page my not, however be deleted in any way, this ensures that that development of this page is not slowed down. Due to the fact that this page has not changed for over a year due to resets, no more resets.

== Type of exploits ==
Here is a general list of all the different types/terms of exploits to know. This is to know the differences of each exploit.
== NTR/NDS-Mode Exploits ==
These are ARM9 exploits that takes over a NDS-mode cartridge. These cartridges (on the back) are labeled as ''NTR''. These type of exploits are very limited since there's no SD or NAND access. They can be used to run a small binary payload making these exploits almost useless.

{| class="wikitable" border="1"
! Name
! Description
! Author
! Source
|-
| [[FIFA NDS]]
| Every single FIFA game on the Nintendo DS has been exploited.
| Everyone
| [https://github.com/CTurt/Dara CTurt's Source Code]
|-
| [[Bangai-O-Sploit]]
| A ''primary'' entrypoint for the game, ''Bangai-O Spirit'', on the Nintendo DS. This game was successfully exploit through sound.
| smealum
| [https://github.com/smealum/bangai-o-sploit Install]
|-
| [[NDS-ILH-Save-Exploit]]
| "I Love Horses" Nintendo DS save exploit
| [https://github.com/mojobojo/ mojobojo]
| [https://github.com/mojobojo/NDS-ILH-Save-Exploit Install]
|-
| [[ABR-NDS-SaveExploit]]
| A stack smash savegame exploit for the game "Asterix Brain Trainer"
| [https://github.com/WemI0/ Weml0]
| [https://github.com/WemI0/ABR-NDS-SaveExploit Install]
|-
| [[HaxxStation]]
| DS Download Station exploit, allowing one to run any commercial homebrew over from the DS download play application.
| shutterbug2000, Gericom, and Apache Thunder
| [https://github.com/Gericom/dspatch See Here]
|-
| [[BreakingNews]]
| A stack smash savegame exploit for the game "The New York Times: Crossword" resulting from stack buffer overflow (profile slot names).
| [[User:ChampionLeake|ChampionLeake]]
| [https://github.com/ChampionLeake/BreakingNews/ Install]
|-
| [[NDS-FC2008-Save-Exploit]]
| A savegame exploit for the game "Führerschein Coach 2008".
| [https://github.com/toombaumarkt/ toombaumarkt]
| [https://github.com/toombaumarkt/NDS-FC2008-Save-Exploit Install]
|-
| [[WordJong-Overflow]]
| A buffer overflow exploit for the game WordJong DS (U).
| [https://github.com/Borgars/ Borgars]
| [https://github.com/Borgars/WordJong-Overflow Install]
|-
| [[CorruptedClues]]
| A stack smash savegame exploit for the game "Cate West: The Vanishing Files", resulted by unchecked string sizes from the highscore data.
| [[User:ChampionLeake|ChampionLeake]]
| [https://github.com/ChampionLeake/CorruptedClues Install]
|}

== TWL/DSi-Enhanced Cart Exploits ==
These are ARM9 exploits that take over a enhanced DSi-mode cartridge. These cartridges (on the back) are labeled as ''TWL''. Unfortunately they don't have SD or NAND access but can be used to gather console information and maybe find other vulnerabilities. These exploits can also be used for dslink, which can load homebrew applications via internet connections.

{| class="wikitable" border="1"
! Name
! Description
! Author
! Source
|-
| [[The Biggest Losers]]
| Exploit for The Biggest Loser which runs in DSi mode if you use a real cartridge on a DSi or 3DS system, otherwise, it runs in DS mode.
| st4rk
| [https://github.com/st4rk/The-Biggest-Loser Install]
[https://davejmurphy.com/dslink/ WinterMute's dslink]
|-
| [[Cookhack]]
| DSi Cooking Coach exploit
| WinterMute
| [https://github.com/WinterMute/savesploits/tree/master/cookhack PoC]
[https://davejmurphy.com/dslink/ dslink]
|-
| [[Classichack]]
| DSi Classic Word Games exploit
| WinterMute
| [https://github.com/WinterMute/savesploits/tree/master/classichack PoC]
[https://davejmurphy.com/dslink/ dslink]
|-
| [[SystemFlaaw]]
| The first DSi exclusive cartridge title to be exploited for the game, SystemFlaw
| zoogie
| [https://github.com/zoogie/SystemFlaaw Install]
|}

== DSiWare (True DSi-Mode) Exploits ==
These are ARM9 exploits that take over a DSiWare title. They run in the same context that the DSi-Enhanced games do, but with additional SD and NAND access. These exploits are valuable since they can be used to downgrade the console firmware to older versions, or install a persistent exploit such as Unlaunch. You can also run commercial homebrew applications from the SD card. However this doesn't allow any cartridge access.

{| class="wikitable" border="1"
! Name
! Description
! Author
! Source
|-
| [[Sudokuhax]]
| One of the first DSiWare exploits for the Nintendo DSi on the game SUDOKU by EA. (You must have the 1st version of this game in order to use the exploit as it was patched.
| TeamTwiizer, yellows8
| [https://github.com/yellows8/dsi/tree/master/exploits/sudokuhax Install]
|-
| [[grtpwn]]
| A Gameloft DSiWare savegame exploit for the game, Guitar Rock Tour!
| yellows8
| [https://github.com/yellows8/dsi/tree/master/exploits/grtpwn Install]
|-
| [[exidiahax]]
| A Gameloft DSiWare savegame exploit for the game, Legend of Exidia!
| yellows8
| [https://github.com/yellows8/dsi/tree/master/exploits/exidiahax Install]
|-
| [[fieldrunhax]]
| A Subatomic Studios DSiWare savegame exploit for the game, FIELDRUNNERS!
| yellows8
| [https://github.com/yellows8/dsi/tree/master/exploits/fieldrunhax Install]
|-
| [[4swordhax]]
| A DSiWare savegame exploit for the game, The Legend of Zelda: Four Swords Anniversary Edition!
| yellows8
| [https://github.com/yellows8/dsi/tree/master/exploits/4swordhax Install]
|-
| [[Flipnote ( ͡° ͜ʖ ͡°)]] and [[ugopwn]]
| A Primary entrypoint for the DSiWare Application, Flipnote Studio! This exploit was first exploit by shutterbug2000. Later, WinterMute and fincs released a stable version of the exploit.
| shutterbug2000, WinterMute, fincs, zoogie
| [https://davejmurphy.com/%CD%A1-%CD%9C%CA%96-%CD%A1/ Install]
|-
| [[UNO*pwn]]
| A DSiWare savegame exploit for the game, UNO, that involves a simple stack buffer overflow within the player's username with the settings functionality of the game!
| [[User:ChampionLeake|ChampionLeake]]
| [https://github.com/ChampionLeake/UNO-pwn Install]
|-
| [[Memory Pit]]
| A primary exploit for the DSi that involves the system application "Camera"! All you need is an SD Card to use this exploit.
| shutterbug2000
| [https://gbatemp.net/threads/memory-pit-a-new-dsi-exploit-for-dsi-camera.539432 Install], [https://github.com/ChampionLeake/BrokenPit Open-source]
|-
| [[petit-compwner]]
| The last string argument of interpreter command "COLSET" is not bounds checked, thus a trivial stack smash can occur if the string is overly long.
| zoogie
| [https://github.com/zoogie/petit-compwner/releases Release]
|-
| [[stylehax]]
| A primary entrypoint, using a use-after-free in Opera 9.50 (which uses WebKit under the hood).
| @0x1337cafe
| [https://github.com/nathanfarlow/stylehax Release], [https://farlow.dev/2023/03/02/hacking-the-nintendo-dsi-browser Writeup]
|-
| [https://github.com/LNH-team/dspico-wrfuxxed/blob/develop/wrfuxxed.md Wrfuxxed]
| Exploit in a factory test image (WRFU Tester) that communicates with a UART backchannel in a cartridge. Requires a compatible flashcart (currently DSpico only).
| Gericom, XLuma, lifehackerhansol
| [https://github.com/LNH-team/dspico-wrfuxxed Github]
|}

== ARM7 Exploits ==
These exploits take over the ARM7 processor. In the DSi, these processor handles critical operations and cryptography operations, among other things. These exploits are extremely rare and there's no concrete targets. The DSi menu (The Launcher) is known to run in the ARM7 context. At the moment there's only one exploit known as RocketLauncher. These exploits allow FULL ACCESS with the DSi launcher.
{| class="wikitable" border="1"
! Name
! Description
! Author
! Source
|-
| [[RocketLauncher]]
| One of the first ever unlocked ARM7 DSi exploit involving the DS Cart White list in secton 3. This exploit only works on firmwares v1.4!
| ApacheThunder, stuckpixel, NoCash, Gericom, and Normmatt
| [https://github.com/ApacheThunder/RocketLauncher source]
|}

== Bootcode Exploits ==

These exploits gain full SCFG_EXT access rights immediately after powering on the system (right before starting the launcher). These exploits are significantly rare and concrete targets can be the launcher's ''title.tmd''. At the moment, nocash's exploit, ''Unlaunch'' is the only known usable exploit.

{| class="wikitable" border="1"
! Name
! Description
! Author
! Source
|-
| [[Unlaunch]]
| Possibly one of the first bootcode exploit for the Nintendo DSi! This exploit deals with taking advantage of the launcher's "title.tmd" size as it's not checked, allowing esculated permissions!
| NoCash
| [https://problemkaputt.de/unlaunch.htm Install & Writeup]
|-
| Unnamed modchip
| A modchip that exlploits the bootROMs of the Nintendo DSi. It enables code execution on both cores before boot ROM lockout.
| PoroCYon
| [https://media.ccc.de/v/37c3-11736-nintendo_hacking_2023_2008 37c3 talk], [https://icosahedron.website/@pcy/111676158956228552 video], [https://github.com/dsi-modchip/guide DIY guide]
|}

DSi exploits

2026-02-01T18:59:12Z

PoroCYon: /* TWL/DSi-Enhanced Cart Exploits */

This page is dedicated to the listing of exploits for the Nintendo DSi. Anyone may contribute to this list. This page my not, however be deleted in any way, this ensures that that development of this page is not slowed down. Due to the fact that this page has not changed for over a year due to resets, no more resets.

== Type of exploits ==
Here is a general list of all the different types/terms of exploits to know. This is to know the differences of each exploit.
== NTR/NDS-Mode Exploits ==
These are ARM9 exploits that takes over a NDS-mode cartridge. These cartridges (on the back) are labeled as ''NTR''. These type of exploits are very limited since there's no SD or NAND access. They can be used to run a small binary payload making these exploits almost useless.

{| class="wikitable" border="1"
! Name
! Description
! Author
! Source
|-
| [[FIFA NDS]]
| Every single FIFA game on the Nintendo DS has been exploited.
| Everyone
| [https://github.com/CTurt/Dara CTurt's Source Code]
|-
| [[Bangai-O-Sploit]]
| A ''primary'' entrypoint for the game, ''Bangai-O Spirit'', on the Nintendo DS. This game was successfully exploit through sound.
| smealum
| [https://github.com/smealum/bangai-o-sploit Install]
|-
| [[NDS-ILH-Save-Exploit]]
| "I Love Horses" Nintendo DS save exploit
| [https://github.com/mojobojo/ mojobojo]
| [https://github.com/mojobojo/NDS-ILH-Save-Exploit Install]
|-
| [[ABR-NDS-SaveExploit]]
| A stack smash savegame exploit for the game "Asterix Brain Trainer"
| [https://github.com/WemI0/ Weml0]
| [https://github.com/WemI0/ABR-NDS-SaveExploit Install]
|-
| [[HaxxStation]]
| DS Download Station exploit, allowing one to run any commercial homebrew over from the DS download play application.
| shutterbug2000, Gericom, and Apache Thunder
| [https://github.com/Gericom/dspatch See Here]
|-
| [[BreakingNews]]
| A stack smash savegame exploit for the game "The New York Times: Crossword" resulting from stack buffer overflow (profile slot names).
| [[User:ChampionLeake|ChampionLeake]]
| [https://github.com/ChampionLeake/BreakingNews/ Install]
|-
| [[NDS-FC2008-Save-Exploit]]
| A savegame exploit for the game "Führerschein Coach 2008".
| [https://github.com/toombaumarkt/ toombaumarkt]
| [https://github.com/toombaumarkt/NDS-FC2008-Save-Exploit Install]
|-
| [[WordJong-Overflow]]
| A buffer overflow exploit for the game WordJong DS (U).
| [https://github.com/Borgars/ Borgars]
| [https://github.com/Borgars/WordJong-Overflow Install]
|-
| [[CorruptedClues]]
| A stack smash savegame exploit for the game "Cate West: The Vanishing Files", resulted by unchecked string sizes from the highscore data.
| [[User:ChampionLeake|ChampionLeake]]
| [https://github.com/ChampionLeake/CorruptedClues Install]
|}

== TWL/DSi-Enhanced Cart Exploits ==
These are ARM9 exploits that take over a enhanced DSi-mode cartridge. These cartridges (on the back) are labeled as ''TWL''. Unfortunately they don't have SD or NAND access but can be used to gather console information and maybe find other vulnerabilities. These exploits can also be used for dslink, which can load homebrew applications via internet connections.

{| class="wikitable" border="1"
! Name
! Description
! Author
! Source
|-
| [[The Biggest Losers]]
| Exploit for The Biggest Loser which runs in DSi mode if you use a real cartridge on a DSi or 3DS system, otherwise, it runs in DS mode.
| st4rk
| [https://github.com/st4rk/The-Biggest-Loser Install]
[https://davejmurphy.com/dslink/ WinterMute's dslink]
|-
| [[Cookhack]]
| DSi Cooking Coach exploit
| WinterMute
| [https://github.com/WinterMute/savesploits/tree/master/cookhack PoC]
[https://davejmurphy.com/dslink/ dslink]
|-
| [[Classichack]]
| DSi Classic Word Games exploit
| WinterMute
| [https://github.com/WinterMute/savesploits/tree/master/classichack PoC]
[https://davejmurphy.com/dslink/ dslink]
|-
| [[SystemFlaaw]]
| The first DSi exclusive cartridge title to be exploited for the game, SystemFlaw
| zoogie
| [https://github.com/zoogie/SystemFlaaw Install]
|-
| [https://github.com/LNH-team/dspico-wrfuxxed/blob/develop/wrfuxxed.md Wrfuxxed]
| Exploit in a factory test image (WRFU Tester) that communicates with a UART backchannel in a cartridge.
| Gericom, XLuma, lifehackerhansol
| [https://github.com/LNH-team/dspico-wrfuxxed Github]
|}

== DSiWare (True DSi-Mode) Exploits ==
These are ARM9 exploits that take over a DSiWare title. They run in the same context that the DSi-Enhanced games do, but with additional SD and NAND access. These exploits are valuable since they can be used to downgrade the console firmware to older versions, or install a persistent exploit such as Unlaunch. You can also run commercial homebrew applications from the SD card. However this doesn't allow any cartridge access.

{| class="wikitable" border="1"
! Name
! Description
! Author
! Source
|-
| [[Sudokuhax]]
| One of the first DSiWare exploits for the Nintendo DSi on the game SUDOKU by EA. (You must have the 1st version of this game in order to use the exploit as it was patched.
| TeamTwiizer, yellows8
| [https://github.com/yellows8/dsi/tree/master/exploits/sudokuhax Install]
|-
| [[grtpwn]]
| A Gameloft DSiWare savegame exploit for the game, Guitar Rock Tour!
| yellows8
| [https://github.com/yellows8/dsi/tree/master/exploits/grtpwn Install]
|-
| [[exidiahax]]
| A Gameloft DSiWare savegame exploit for the game, Legend of Exidia!
| yellows8
| [https://github.com/yellows8/dsi/tree/master/exploits/exidiahax Install]
|-
| [[fieldrunhax]]
| A Subatomic Studios DSiWare savegame exploit for the game, FIELDRUNNERS!
| yellows8
| [https://github.com/yellows8/dsi/tree/master/exploits/fieldrunhax Install]
|-
| [[4swordhax]]
| A DSiWare savegame exploit for the game, The Legend of Zelda: Four Swords Anniversary Edition!
| yellows8
| [https://github.com/yellows8/dsi/tree/master/exploits/4swordhax Install]
|-
| [[Flipnote ( ͡° ͜ʖ ͡°)]] and [[ugopwn]]
| A Primary entrypoint for the DSiWare Application, Flipnote Studio! This exploit was first exploit by shutterbug2000. Later, WinterMute and fincs released a stable version of the exploit.
| shutterbug2000, WinterMute, fincs, zoogie
| [https://davejmurphy.com/%CD%A1-%CD%9C%CA%96-%CD%A1/ Install]
|-
| [[UNO*pwn]]
| A DSiWare savegame exploit for the game, UNO, that involves a simple stack buffer overflow within the player's username with the settings functionality of the game!
| [[User:ChampionLeake|ChampionLeake]]
| [https://github.com/ChampionLeake/UNO-pwn Install]
|-
| [[Memory Pit]]
| A primary exploit for the DSi that involves the system application "Camera"! All you need is an SD Card to use this exploit.
| shutterbug2000
| [https://gbatemp.net/threads/memory-pit-a-new-dsi-exploit-for-dsi-camera.539432 Install], [https://github.com/ChampionLeake/BrokenPit Open-source]
|-
| [[petit-compwner]]
| The last string argument of interpreter command "COLSET" is not bounds checked, thus a trivial stack smash can occur if the string is overly long.
| zoogie
| [https://github.com/zoogie/petit-compwner/releases Release]
|-
| [[stylehax]]
| A primary entrypoint, using a use-after-free in Opera 9.50 (which uses WebKit under the hood).
| @0x1337cafe
| [https://github.com/nathanfarlow/stylehax Release], [https://farlow.dev/2023/03/02/hacking-the-nintendo-dsi-browser Writeup]
|}

== ARM7 Exploits ==
These exploits take over the ARM7 processor. In the DSi, these processor handles critical operations and cryptography operations, among other things. These exploits are extremely rare and there's no concrete targets. The DSi menu (The Launcher) is known to run in the ARM7 context. At the moment there's only one exploit known as RocketLauncher. These exploits allow FULL ACCESS with the DSi launcher.
{| class="wikitable" border="1"
! Name
! Description
! Author
! Source
|-
| [[RocketLauncher]]
| One of the first ever unlocked ARM7 DSi exploit involving the DS Cart White list in secton 3. This exploit only works on firmwares v1.4!
| ApacheThunder, stuckpixel, NoCash, Gericom, and Normmatt
| [https://github.com/ApacheThunder/RocketLauncher source]
|}

== Bootcode Exploits ==

These exploits gain full SCFG_EXT access rights immediately after powering on the system (right before starting the launcher). These exploits are significantly rare and concrete targets can be the launcher's ''title.tmd''. At the moment, nocash's exploit, ''Unlaunch'' is the only known usable exploit.

{| class="wikitable" border="1"
! Name
! Description
! Author
! Source
|-
| [[Unlaunch]]
| Possibly one of the first bootcode exploit for the Nintendo DSi! This exploit deals with taking advantage of the launcher's "title.tmd" size as it's not checked, allowing esculated permissions!
| NoCash
| [https://problemkaputt.de/unlaunch.htm Install & Writeup]
|-
| Unnamed modchip
| A modchip that exlploits the bootROMs of the Nintendo DSi. It enables code execution on both cores before boot ROM lockout.
| PoroCYon
| [https://media.ccc.de/v/37c3-11736-nintendo_hacking_2023_2008 37c3 talk], [https://icosahedron.website/@pcy/111676158956228552 video], [https://github.com/dsi-modchip/guide DIY guide]
|}

DSi XL testpoints

2025-04-30T15:02:19Z

PoroCYon: oops, needs a correction

== UTL-CPU-01 testpoints ==

{| class="wikitable" border="1"
|-
! number
! name (TWL testpoint)
! short name (some TWL PCBs)
! voltage standard
! comment
|-
| TP1
| EXTB+
| EXB+
| ?
|
|-
| TP2
| VIN
|
| ≃5V DC
| External charger power input
|-
| TP3
| Rosc
|
| ?
| ?
|-
| TP4
| RICHG
| RCG
| ?
| Recharge?
|-
| TP5
| GND
| GND
| ground
| (near external charger connector)
|-
| TP6
| VDD12
| V12
| 1.2V power rail
| CPU-TWL core voltage
|-
| TP7
| BT+
|
| battery +
| at 2-pin power connector to UTL-SUB-01
|-
| TP8
| VDET-
| VDT-
| ?
| ?
|-
| TP9
| DET
| DT
| ?
| ?
|-
| TP10
| VDD18
| V18
| 1.8V power rail
| Various I/O and core voltage (incl. RTC)
|-
| TP11
| ?
|
| ?
| something charging?
|-
| TP12
| VDD10
| V10
| 10V power rail
| For LCDs
|-
| TP13
| VDD33
| V33
| 3.3V power rail
| Various I/O and core voltage
|-
| TP14
| GND
| GND
| ground
| (near PMIC)
|-
| TP15
| B+
|
| ?
| battery + ?
|-
| TP16
| VDD-5
| V-5
| -5V power rail
| For LCDs
|-
| TP17
| PVDD
| PVD
| ?
| ?
|-
| TP18
| VDD5
| V5
| 5.0V power rail
| For LCDs
|-
| TP19
| SG?
|
| ?
| ?
|-
| TP20
| BLA1
| BA1
| ?
| backlight anode for lower screen
|-
| TP21
| VDD42?
| V42?
| 4.2V? power rail (it's certainly a power rail)
| generated from VDD5 using diode voltage drops? (to D6, C22, D3)
|-
| TP22
| BLC1
| BC1
| ?
| backlight cathode for lower screen
|-
| TP23
| BLA2
| BA2
| ?
| backlight anode for upper screen
|-
! scope="row" colspan="5" | (TP24, TP25 don't exist)
|-
| TP26
| BLC2
| BC2
| ?
| backlight cathode for upper screen
|-
! scope="row" colspan="5" | (TP27 doesn't exist)
|-
| TP28
| MIC-
|
| ground
| same net as (analog) ground
|-
| TP29
| MIC+
|
| analog
| Analog microphone-in signal
|-
| TP30
| SPRP
|
| analog
| positive signal for right built-in speaker
|-
| TP31
| SPRN
|
| analog
| negative signal for right built-in speaker
|-
| TP32
| SPLP
|
| analog
| positive signal for left built-in speaker
|-
| TP33
| SPLN
|
| analog
| negative signal for left built-in speaker
|-
| TP34
| GND
| GND
| ground
| probably analog ground
|-
| TP35
| SR
|
| analog
| headphone tip
|-
| TP36
| SL
|
| analog
| headphone ring
|-
! scope="row" colspan="5" | (TP37, TP38 don't exist)
|-
| TP39
| ORANGE
| ORG
| 3V3? 4V2? (at anode)
| Orange LED charging indicator
|-
| TP40
| BLUE
| BLE
| 3V3? 4V2? (at anode)
| Blue LED power good indicator
|-
| TP41
| RED
|
| open collector (connected to LED cathode)
| Red LED battery low indicator
|-
| TP42
| MC1_IO7
| M1_7
| 3V3
| MSB of gamecard parallell ROM *or* AUXSPI COPI signal
|-
| TP43
| MC1_IO6
| M1_6
| 3V3
| 6th bit of gamecard parallell ROM *or* AUXSPI CIPO signal
|-
| TP44
| MC1_VCC
| M1_V
| 3.3V power
| power supply to gamecard (can be switched off by SoC)
|-
! scope="row" colspan="5" | (TP45 doesn't exist)
|-
| TP46
| MC1_IO5
| M1_5
| 3V3
|
|-
| TP47
| MC1_IO4
| M1_4
| 3V3
|
|-
| TP48
| MC1_IO3
| M1_3
| 3V3
|
|-
| TP49
| MC1_DET
| M1_DT
| 3V3
| Cartridge detected in slot (active-low)
|-
| TP50
| MC1_IO2
| M1_2
| 3V3
|
|-
| TP51
| MC1_IREQ
| M1_IRQ
| 3V3
| gamecart->SoC IRQ
|-
| TP52
| MC1_IO1
| M1_1
| 3V3
|
|-
| TP53
| MC1_RES
| M1_RES
| 3V3
| SoC->gamecart reset signal
|-
| TP54
| MC1_IO0
| M1_0
| 3V3
|
|-
| TP55
| MC1_CS
| M1_CS
| 3V3
| parallell ROM select (active-low)
|-
| TP56
| MC1_CLK
| M1_CLK
| 3V3
|
|-
| TP57
| MC1_CS2
| M1_CS2
| 3V3
| AUXSPI select (active-low)
|-
| TP58
| /mRST
|
| 3V3
| BPTWL reset (active-low)
|-
| TP59
| mFE
|
| 3V3
| BPTWL flash enable (cf. 78K0/Kx2 Serial Flash Programming protocol, see NEC/Renesas docs)
|-
| TP60
| VOLP
| VLP
| 3V3
| volume + button (also RxD6 for 78K0 SFP. There's a series resistor to the physical button as protection against shorts)
|-
| TP61
| VOLN
| VLN
| 3V3
| volume - button (also TxD6 for 78K0 SFP. There's a series resistor to the physical button as protection against shorts)
|-
| TP62
| ATH_TX_H
| A_T_H
| 3V3
| AR6002 ANTD, "Control signal for shared antenna switch", probably enables Ath TX antenna
|-
| TP63
| WL_TXPE
| WL_T
| 3V3
| Old Wifi TX enable?
|-
! scope="row" colspan="5" | (TP64 doesn't exist)
|-
| TP65
| WL_RXPE
| WL_R
| 3V3
| Old Wifi RX enable?
|-
| TP66
| /WIFI_RST
| /WF_RST
| 3V3
| New WiFi (Ath6k) reset (active-low)
|-
! scope="row" colspan="5" | (TP67, TP68 don't exist)
|-
| TP69
| SPI_MOSI
|
| 3V3
| SPI bus
|-
! scope="row" colspan="5" | (TP70 doesn't exist)
|-
| TP71
| SPI_MISO
|
| 3V3
| SPI bus
|-
! scope="row" colspan="5" | (TP72 doesn't exist)
|-
| TP73
| SPI_SCK
| SPI_SK
| 3V3
| SPI bus
|-
! scope="row" colspan="5" | (TP74, TP75 don't exist)
|-
| TP76
| SPI_CS1
| SPI_C1
| 3V3
| SPI chip select 1 (PMIC)
|-
! scope="row" colspan="5" | (TP77 doesn't exist)
|-
| TP78
| SPI_CS3
| SPI_C3
| 3V3
| SPI chip select 3 (TSC)
|-
| TP79
| SPI_CS2
| SPI_C2
| 3V3
| SPI chip select 2 ([[NVRAM]])
|-
| TP80
| SCL
|
| 1V8
| CPU-TWL bus
|-
! scope="row" colspan="5" | (TP81 doesn't exist)
|-
| TP82
| SDA
|
| 1V8
| CPU-TWL bus
|-
| TP83
| PENIRQ
| PNIRQ
| 1V8? 3V3?
| touchscreen pen down
|-
| TP84
| R7
|
| 1V8?
| hinge magnet detect signal (active-low)
|-
| TP85
| RESET
| RST
| 3V3, but use as open drain/collector
| CPU-TWL reset signal
|-
| TP86
| P05
|
| 3V3?
| dpad left button
|-
| TP87
| P04
|
| 3V3?
| dpad right button
|-
| TP88
| P03
|
| 3V3?
| start button
|-
| TP89
| P02
|
| 3V3?
| select button
|-
| TP90
| P01
|
| 3V3?
| B button
|-
| TP91
| P00
|
| 3V3?
| A button
|-
| TP92
| PM_SLP
|
| ?
| ?
|-
| TP93
| VCNT5
|
| ?
| ?
|-
| TP94
| GPIO330?
| 330?
| 3V3
| GPIO debug testpoint
|-
| TP95
| R01
|
| ?
| Y button
|-
| TP96
| R00
|
| ?
| X button
|-
| TP97
| P09
|
| 3V3
| shoulder-L button
|-
| TP98
| P08
|
| 3V3
| shoulder-R button
|-
| TP99
| PMOFF
|
| 3V3
|
|-
| TP100
| P07
|
| 3V3?
| dpad down button
|-
| TP101
| HP#SP
| H#S
| 3V3
| audio out is headphones (1) or speakers (0). aka GPIO331
|-
| TP102
| P06
|
| 3V3?
| dpad up button
|-
! scope="row" colspan="5" | (TP103 doesn't exist)
|-
| TP104
| /IRQ_O?
|
| 3V3
| "powerbutton pressed" signal from the BPTWL to the CPU-TWL. aka GPIO332
|-
| TP105
| LDR20
| LR20
|
| top LCD R.bit0
|-
| TP106
| LDR21
| LR21
|
| top LCD R.bit1
|-
| TP107
| LDR22
| LR22
|
| top LCD R.bit2
|-
| TP108
| LDR23
| LR23
|
| top LCD R.bit3
|-
| TP109
| LDR24
| LR24
|
| top LCD R.bit4
|-
| TP110
| LDB21
| LB21
|
| top LCD B.bit1
|-
| TP111
| LDG21
| LG21
|
| top LCD G.bit1
|-
| TP112
| LDG22
| LG22
|
| top LCD G.bit2
|-
| TP113
| LDG25
| LG25
|
| top LCD G.bit5
|-
| TP114
| LDB20
| LB20
|
| top LCD B.bit0
|-
| TP115
| LDB23
| LB23
|
| top LCD B.bit3
|-
| TP116
| LDR11
| LR11
|
| bottom LCD R.bit1
|-
| TP117
| LDR12
| LR12
|
| bottom LCD R.bit4
|-
| TP118
| LDR15
| LR15
|
| bottom LCD R.bit5
|-
| TP119
| LDR25
| LR25
|
| top LCD R.bit5
|-
| TP120
| LDG20
| LG20
|
| top LCD G.bit2
|-
| TP121
| LDG23
| LG23
|
| top LCD G.bit3
|-
| TP122
| LDG24
| LG24
|
| top LCD G.bit4
|-
| TP123
| LDB22
| LB22
|
| top LCD B.bit2
|-
| TP124
| LDB24
| LB24
|
| top LCD B.bit4
|-
| TP125
| LDB25
| LB25
|
| top LCD B.bit5
|-
| TP126
| LDR10
| LR10
|
| bottom LCD R.bit0
|-
| TP127
| LDR13
| LR13
|
| bottom LCD R.bit3
|-
| TP128
| LDR14
| LR14
|
| bottom LCD R.bit4
|-
| TP129
| LDG10
| LG10
|
| bottom LCD G.bit0
|-
| TP130
| LDG11
| LG11
|
| bottom LCD G.bit1
|-
| TP131
| LDG12
| LG12
|
| bottom LCD G.bit2
|-
| TP132
| LDG13
| LG13
|
| bottom LCD G.bit3
|-
| TP133
| LDG15
| LG15
|
| bottom LCD G.bit5
|-
| TP134
| LDB11
| LB11
|
| bottom LCD B.bit1
|-
| TP135
| LDG14
| LG14
|
| bottom LCD G.bit4
|-
| TP136
| LDB10
| LB10
|
| bottom LCD B.bit0
|-
| TP137
| COM2
|
| ?
| ?
|-
| TP138
| LDB12
| LB12
|
| bottom LCD B.bit2
|-
| TP139
| LDB13
| LB13
|
| bottom LCD B.bit3
|-
| TP140
| LDB14
| LB14
|
| bottom LCD B.bit4
|-
| TP141
| LDB15
| LB15
|
| bottom LCD B.bit5
|-
| TP142
| INI
|
| ?
| LCD controller ?
|-
| TP143
| GSP
|
|
| LCD controller Vsync?
|-
| TP144
| GCK
|
| ?
| LCD controller ?
|-
| TP145
| REV
|
|
| LCD controller ?
|-
| TP146
| LS
|
|
| LCD controller Hsync?
|-
| TP147
| SPL
|
|
| LCD controller ?
|-
| TP148
| DCLK
| DCK
|
| LCD controller dot clock
|-
| TP149
| CAM_RST
| CM_RST
| 1V8?
| Camera reset signal
|-
| TP150
| COM1
|
| ?
| ?
|-
! scope="row" colspan="5" | (TP151 doesn't exist)
|-
| TP152
| CAM_D4
| CM_D4
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP153
| HSYNC
|
| 1V8?
| Camera horizontal sync/blank (conn. thru R133, 0Ω) (Aptina MT9V133-D LINE_VALID, active-low)
|-
| TP154
| CAM_D3
| CM_D3
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP155
| VSYNC
|
| 1V8?
| Camera vertical sync/blank (conn. thru R132, 0Ω) (Aptina MT9V133-D FRAME_VALID, active-low)
|-
| TP156
| CKI
|
| 1V8?
| Camera clock something? (Aptina MT9V133-D EXTCLK? PIXCLK?)
|-
| TP157
| CAM_D2
| CM_D2
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP158
| CAM_D7
| CM_D7
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP159
| CAM_D1
| CM_D1
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP160
| X+
|
| ?
| touchscreen
|-
| TP161
| Y+
|
| ?
| touchscreen
|-
| TP162
| X-
|
| ?
| touchscreen, same net as Y-
|-
| TP163
| Y-
|
| ?
| touchscreen, same net as X-
|-
| TP164
| CAM_D6
| CM_D6
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP165
| CAM_D0
| CM_D0
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP166
| RCLK
| RCK
| 1V8?
| Camera (conn. thru R100, 100Ω) (Aptina MT9V133-D EXTCLK? PIXCLK?)
|-
| TP167
| CAM_D5
| CM_D5
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP168
| VDD28
| V28
| 2.8V power rail
| Only used by the camera. Generated by an LDO (U12) from VDD33 (Aptina MT9V133-D analog power rail?)
|-
! scope="row" colspan="5" | (TP169 doesn't exist)
|-
| TP170
| CAM_LED
| CM_LED
| Camera LED cathode?
| Connected through Q13 and R68 to BPTWL.
|-
| TP171
| RTC_INT
| RC_INT
| 1V8
| RTC->CPU-TWL interrupt
|-
| TP172
| SD10_CLK
| S10_CK
| 3V3
| SD card
|-
| TP173
| SD10_DATA0
| S10_D0
| 3V3
| SD card
|-
| TP174
| SD10_DATA1
| S10_D1
| 3V3
| SD card
|-
| TP175
| SD10_DATA2
| S10_D2
| 3V3
| SD card
|-
| TP176
| SD10_DATA3
| S10_D3
| 3V3
| SD card
|-
| TP177
| SD10_CMD
| S10_CD
| 3V3
| SD card
|-
| TP178
| SD10_CP
| S10_CP
| 3V3
| SD card (card detect)
|-
| TP179
| SD10_WP
| S10_WP
| 3V3
| SD card write protect
|-
| TP180
| GND
| GND
| ground
|
|-
! scope="row" colspan="5" | (TP181 doesn't exist)
|-
| TP182
| SD10_VDD
| S10_V
| 3.3V power rail
| same net as VDD33
|-
| TP183
| AOUT
|
|
| charging/battery status ?
|-
| TP184
| ADPO
|
|
| charging/battery status ?
|-
| TP185
| SCL1
|
| 3V3
| BPTWL bus
|-
| TP186
| SDA1
|
| 3V3
| BPTWL bus
|-
| TP187
| SND_SDI
| SND_DI
| 1V8
| I2S bus
|-
| TP188
| SND_SDO
| SND_DO
| 1V8
| I2S bus
|-
| TP189
| SND_WS
|
| 1V8
| I2S bus
|-
| TP190
| SND_SCLK aka BCLK
| SND_BK
| 1V8
| I2S bus
|-
| TP191
| SND_MCLK
| SND_MK
| 1V8
| Reference frequency for TSC
|-
| TP192
| PWSWO
| PSWO
| 3V3?
| powerbutton "output" from PMIC to BPTWL?
|-
| TP193
| TH
|
| ?
| battery internal temperature detector?
|-
| TP194
| VSHD
|
| 5.0V power rail
| Same net as VDD5. For LCDs.
|}

== UTL-SUB-01 testpoints ==

{| class="wikitable" border="1"
|-
! number
! name (TWL testpoint)
! voltage standard
! comment
|-
| TP1
| ?
| ?
| to TH1 component
|-
| TP2
| GND
| (GND)
| ground
|-
| TP3
| P06
| 3V3?
| D-pad up
|-
| TP4
| P04
| 3V3?
| D-pad right
|-
| TP5
| P05
| 3V3?
| D-pad left
|-
| TP6
| P07
| 3V3?
| D-pad down
|-
| TP7
| PWSW
| ?
| raw powerbutton input (to PMIC and BPTWL)
|-
| TP8
| RED
| open collector (at cathode)
| Battery low LED (DL1)
|-
| TP9
| YELLOW
| open collector (at cathode)
| WiFi indicator LED (DL4)
|-
| TP10
| BLUE
| 3V3? 4V2? (at anode)
| Power on/good LED (DL2)
|-
| TP11
| ORANGE
| 3V3? 4V2? (at anode)
| Charging indicator (DL3)
|-
| TP12
| VDD42
| 4.2V power supply
| Power supply for TP8/TP10 LEDs
|}

== P16 pinout ==

The P16 pinout changed from [https://problemkaputt.de/gbatek-aux-dsi-internal-connectors.htm what it was on the regular DSi]. Some nets are now found in P24 instead (see below).

{| class="wikitable" border="1"
|-
! name
! pin no
! pin no
! name
|-
| GND
| 1
| 2
| GND
|-
| GND
| 3
| 4
| GND
|-
| GND
| 5
| 6
| GND
|-
| SD10_CLK
| 7
| 8
| GND
|-
| VDD33
| 9
| 10
| SD10_D0
|-
| VDD33
| 11
| 12
| SD10_D1
|-
| GND
| 13
| 14
| SD10_WP
|-
| SD10_CMD
| 15
| 16
| VDD33
|-
| GND
| 17
| 18
| P08
|-
| SD10_D3
| 19
| 20
| VDD33
|-
| SD10_D2
| 21
| 22
| SD10_CD
|-
| GND
| 23
| 24
| GND
|-
| GND
| 25
| 26
| GND
|}

== P24 pinout ==

P24 is a mezzanine connector for the VOLP/VOLN buttons and the shoulder L button (which were on P16 on the DSi).

{| class="wikitable" border="1"
|-
! name
! pin no
! pin no
! name
|-
| GND
| 1
| 2
| GND
|-
| N/C
| 3
| 4
| VOLP
|-
| P09 (shoulder-L)
| 5
| 6
| VOLN
|-
| GND
| 7-13
| 8-14
| GND
|}

[[Category:Hardware]]

DSi XL testpoints

2025-02-04T00:45:56Z

PoroCYon:

== UTL-CPU-01 testpoints ==

{| class="wikitable" border="1"
|-
! number
! name (TWL testpoint)
! short name (some TWL PCBs)
! voltage standard
! comment
|-
| TP1
| EXTB+
| EXB+
| ?
|
|-
| TP2
| VIN
|
| ≃5V DC
| External charger power input
|-
| TP3
| Rosc
|
| ?
| ?
|-
| TP4
| RICHG
| RCG
| ?
| Recharge?
|-
| TP5
| GND
| GND
| ground
| (near external charger connector)
|-
| TP6
| VDD12
| V12
| 1.2V power rail
| CPU-TWL core voltage
|-
| TP7
| BT+
|
| battery +
| at 2-pin power connector to UTL-SUB-01
|-
| TP8
| VDET-
| VDT-
| ?
| ?
|-
| TP9
| DET
| DT
| ?
| ?
|-
| TP10
| VDD18
| V18
| 1.8V power rail
| Various I/O and core voltage (incl. RTC)
|-
| TP11
| ?
|
| ?
| something charging?
|-
| TP12
| VDD10
| V10
| 10V power rail
| For LCDs
|-
| TP13
| VDD33
| V33
| 3.3V power rail
| Various I/O and core voltage
|-
| TP14
| GND
| GND
| ground
| (near PMIC)
|-
| TP15
| B+
|
| ?
| battery + ?
|-
| TP16
| VDD-5
| V-5
| -5V power rail
| For LCDs
|-
| TP17
| PVDD
| PVD
| ?
| ?
|-
| TP18
| VDD5
| V5
| 5.0V power rail
| For LCDs
|-
| TP19
| SG?
|
| ?
| ?
|-
| TP20
| BLA1
| BA1
| ?
| backlight anode for lower screen
|-
| TP21
| VDD42?
| V42?
| 4.2V? power rail (it's certainly a power rail)
| generated from VDD5 using diode voltage drops? (to D6, C22, D3)
|-
| TP22
| BLC1
| BC1
| ?
| backlight cathode for lower screen
|-
| TP23
| BLA2
| BA2
| ?
| backlight anode for upper screen
|-
! scope="row" colspan="5" | (TP24, TP25 don't exist)
|-
| TP26
| BLC2
| BC2
| ?
| backlight cathode for upper screen
|-
! scope="row" colspan="5" | (TP27 doesn't exist)
|-
| TP28
| MIC-
|
| ground
| same net as (analog) ground
|-
| TP29
| MIC+
|
| analog
| Analog microphone-in signal
|-
| TP30
| SPRP
|
| analog
| positive signal for right built-in speaker
|-
| TP31
| SPRN
|
| analog
| negative signal for right built-in speaker
|-
| TP32
| SPLP
|
| analog
| positive signal for left built-in speaker
|-
| TP33
| SPLN
|
| analog
| negative signal for left built-in speaker
|-
| TP34
| GND
| GND
| ground
| probably analog ground
|-
| TP35
| SR
|
| analog
| headphone tip
|-
| TP36
| SL
|
| analog
| headphone ring
|-
! scope="row" colspan="5" | (TP37, TP38 don't exist)
|-
| TP39
| ORANGE
| ORG
| 3V3? 4V2? (at anode)
| Orange LED charging indicator
|-
| TP40
| BLUE
| BLE
| 3V3? 4V2? (at anode)
| Blue LED power good indicator
|-
| TP41
| RED
|
| open collector (connected to LED cathode)
| Red LED battery low indicator
|-
| TP42
| MC1_IO7
| M1_7
| 3V3
| MSB of gamecard parallell ROM *or* AUXSPI COPI signal
|-
| TP43
| MC1_IO6
| M1_6
| 3V3
| 6th bit of gamecard parallell ROM *or* AUXSPI CIPO signal
|-
| TP44
| MC1_VCC
| M1_V
| 3.3V power
| power supply to gamecard (can be switched off by SoC)
|-
! scope="row" colspan="5" | (TP45 doesn't exist)
|-
| TP46
| MC1_IO5
| M1_5
| 3V3
|
|-
| TP47
| MC1_IO4
| M1_4
| 3V3
|
|-
| TP48
| MC1_IO3
| M1_3
| 3V3
|
|-
| TP49
| MC1_DET
| M1_DT
| 3V3
| Cartridge detected in slot (active-low)
|-
| TP50
| MC1_IO2
| M1_2
| 3V3
|
|-
| TP51
| MC1_IREQ
| M1_IRQ
| 3V3
| gamecart->SoC IRQ
|-
| TP52
| MC1_IO1
| M1_1
| 3V3
|
|-
| TP53
| MC1_RES
| M1_RES
| 3V3
| SoC->gamecart reset signal
|-
| TP54
| MC1_IO0
| M1_0
| 3V3
|
|-
| TP55
| MC1_CS
| M1_CS
| 3V3
| parallell ROM select (active-low)
|-
| TP56
| MC1_CLK
| M1_CLK
| 3V3
|
|-
| TP57
| MC1_CS2
| M1_CS2
| 3V3
| AUXSPI select (active-low)
|-
| TP58
| /mRST
|
| 3V3
| BPTWL reset (active-low)
|-
| TP59
| mFE
|
| 3V3
| BPTWL flash enable (cf. 78K0/Kx2 Serial Flash Programming protocol, see NEC/Renesas docs)
|-
| TP60
| VOLP
| VLP
| 3V3
| volume + button (also RxD6 for 78K0 SFP. There's a series resistor to the physical button as protection against shorts)
|-
| TP61
| VOLN
| VLN
| 3V3
| volume - button (also TxD6 for 78K0 SFP. There's a series resistor to the physical button as protection against shorts)
|-
| TP62
| ATH_TX_H
| A_T_H
| 3V3
| AR6002 ANTD, "Control signal for shared antenna switch", probably enables Ath TX antenna
|-
| TP63
| WL_TXPE
| WL_T
| 3V3
| Old Wifi TX enable?
|-
! scope="row" colspan="5" | (TP64 doesn't exist)
|-
| TP65
| WL_RXPE
| WL_R
| 3V3
| Old Wifi RX enable?
|-
| TP66
| /WIFI_RST
| /WF_RST
| 3V3
| New WiFi (Ath6k) reset (active-low)
|-
! scope="row" colspan="5" | (TP67, TP68 don't exist)
|-
| TP69
| SPI_MOSI
|
| 3V3
| SPI bus
|-
! scope="row" colspan="5" | (TP70 doesn't exist)
|-
| TP71
| SPI_MISO
|
| 3V3
| SPI bus
|-
! scope="row" colspan="5" | (TP72 doesn't exist)
|-
| TP73
| SPI_SCK
| SPI_SK
| 3V3
| SPI bus
|-
! scope="row" colspan="5" | (TP74, TP75 don't exist)
|-
| TP76
| SPI_CS1
| SPI_C1
| 3V3
| SPI chip select 1 (PMIC)
|-
! scope="row" colspan="5" | (TP77 doesn't exist)
|-
| TP78
| SPI_CS3
| SPI_C3
| 3V3
| SPI chip select 3 (TSC)
|-
| TP79
| SPI_CS2
| SPI_C2
| 3V3
| SPI chip select 2 ([[NVRAM]])
|-
| TP80
| SCL
|
| 1V8
| CPU-TWL bus
|-
! scope="row" colspan="5" | (TP81 doesn't exist)
|-
| TP82
| SDA
|
| 1V8
| CPU-TWL bus
|-
| TP83
| PENIRQ
| PNIRQ
| 1V8? 3V3?
| touchscreen pen down
|-
| TP84
| R7
|
| 1V8?
| hinge magnet detect signal (active-low)
|-
| TP85
| RESET
| RST
| 3V3, but use as open drain/collector
| CPU-TWL reset signal
|-
| TP86
| P05
|
| 3V3?
| dpad left button
|-
| TP87
| P04
|
| 3V3?
| dpad right button
|-
| TP88
| P03
|
| 3V3?
| start button
|-
| TP89
| P02
|
| 3V3?
| select button
|-
| TP90
| P01
|
| 3V3?
| B button
|-
| TP91
| P00
|
| 3V3?
| A button
|-
| TP92
| PM_SLP
|
| ?
| ?
|-
| TP93
| VCNT5
|
| ?
| ?
|-
| TP94
| GPIO330?
| 330?
| 3V3
| GPIO debug testpoint
|-
| TP95
| R01
|
| ?
| Y button
|-
| TP96
| R00
|
| ?
| X button
|-
| TP97
| P09
|
| 3V3
| shoulder-L button
|-
| TP98
| P08
|
| 3V3
| shoulder-R button
|-
| TP99
| MUTE
|
| 3V3
| ? (controlled by GPIO333 through U17)
|-
| TP100
| P07
|
| 3V3?
| dpad down button
|-
| TP101
| HP#SP
| H#S
| 3V3
| audio out is headphones (1) or speakers (0). aka GPIO331
|-
| TP102
| P06
|
| 3V3?
| dpad up button
|-
! scope="row" colspan="5" | (TP103 doesn't exist)
|-
| TP104
| /IRQ_O?
|
| 3V3
| "powerbutton pressed" signal from the BPTWL to the CPU-TWL. aka GPIO332
|-
| TP105
| LDR20
| LR20
|
| top LCD R.bit0
|-
| TP106
| LDR21
| LR21
|
| top LCD R.bit1
|-
| TP107
| LDR22
| LR22
|
| top LCD R.bit2
|-
| TP108
| LDR23
| LR23
|
| top LCD R.bit3
|-
| TP109
| LDR24
| LR24
|
| top LCD R.bit4
|-
| TP110
| LDB21
| LB21
|
| top LCD B.bit1
|-
| TP111
| LDG21
| LG21
|
| top LCD G.bit1
|-
| TP112
| LDG22
| LG22
|
| top LCD G.bit2
|-
| TP113
| LDG25
| LG25
|
| top LCD G.bit5
|-
| TP114
| LDB20
| LB20
|
| top LCD B.bit0
|-
| TP115
| LDB23
| LB23
|
| top LCD B.bit3
|-
| TP116
| LDR11
| LR11
|
| bottom LCD R.bit1
|-
| TP117
| LDR12
| LR12
|
| bottom LCD R.bit4
|-
| TP118
| LDR15
| LR15
|
| bottom LCD R.bit5
|-
| TP119
| LDR25
| LR25
|
| top LCD R.bit5
|-
| TP120
| LDG20
| LG20
|
| top LCD G.bit2
|-
| TP121
| LDG23
| LG23
|
| top LCD G.bit3
|-
| TP122
| LDG24
| LG24
|
| top LCD G.bit4
|-
| TP123
| LDB22
| LB22
|
| top LCD B.bit2
|-
| TP124
| LDB24
| LB24
|
| top LCD B.bit4
|-
| TP125
| LDB25
| LB25
|
| top LCD B.bit5
|-
| TP126
| LDR10
| LR10
|
| bottom LCD R.bit0
|-
| TP127
| LDR13
| LR13
|
| bottom LCD R.bit3
|-
| TP128
| LDR14
| LR14
|
| bottom LCD R.bit4
|-
| TP129
| LDG10
| LG10
|
| bottom LCD G.bit0
|-
| TP130
| LDG11
| LG11
|
| bottom LCD G.bit1
|-
| TP131
| LDG12
| LG12
|
| bottom LCD G.bit2
|-
| TP132
| LDG13
| LG13
|
| bottom LCD G.bit3
|-
| TP133
| LDG15
| LG15
|
| bottom LCD G.bit5
|-
| TP134
| LDB11
| LB11
|
| bottom LCD B.bit1
|-
| TP135
| LDG14
| LG14
|
| bottom LCD G.bit4
|-
| TP136
| LDB10
| LB10
|
| bottom LCD B.bit0
|-
| TP137
| COM2
|
| ?
| ?
|-
| TP138
| LDB12
| LB12
|
| bottom LCD B.bit2
|-
| TP139
| LDB13
| LB13
|
| bottom LCD B.bit3
|-
| TP140
| LDB14
| LB14
|
| bottom LCD B.bit4
|-
| TP141
| LDB15
| LB15
|
| bottom LCD B.bit5
|-
| TP142
| INI
|
| ?
| LCD controller ?
|-
| TP143
| GSP
|
|
| LCD controller Vsync?
|-
| TP144
| GCK
|
| ?
| LCD controller ?
|-
| TP145
| REV
|
|
| LCD controller ?
|-
| TP146
| LS
|
|
| LCD controller Hsync?
|-
| TP147
| SPL
|
|
| LCD controller ?
|-
| TP148
| DCLK
| DCK
|
| LCD controller dot clock
|-
| TP149
| CAM_RST
| CM_RST
| 1V8?
| Camera reset signal
|-
| TP150
| COM1
|
| ?
| ?
|-
! scope="row" colspan="5" | (TP151 doesn't exist)
|-
| TP152
| CAM_D4
| CM_D4
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP153
| HSYNC
|
| 1V8?
| Camera horizontal sync/blank (conn. thru R133, 0Ω) (Aptina MT9V133-D LINE_VALID, active-low)
|-
| TP154
| CAM_D3
| CM_D3
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP155
| VSYNC
|
| 1V8?
| Camera vertical sync/blank (conn. thru R132, 0Ω) (Aptina MT9V133-D FRAME_VALID, active-low)
|-
| TP156
| CKI
|
| 1V8?
| Camera clock something? (Aptina MT9V133-D EXTCLK? PIXCLK?)
|-
| TP157
| CAM_D2
| CM_D2
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP158
| CAM_D7
| CM_D7
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP159
| CAM_D1
| CM_D1
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP160
| X+
|
| ?
| touchscreen
|-
| TP161
| Y+
|
| ?
| touchscreen
|-
| TP162
| X-
|
| ?
| touchscreen, same net as Y-
|-
| TP163
| Y-
|
| ?
| touchscreen, same net as X-
|-
| TP164
| CAM_D6
| CM_D6
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP165
| CAM_D0
| CM_D0
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP166
| RCLK
| RCK
| 1V8?
| Camera (conn. thru R100, 100Ω) (Aptina MT9V133-D EXTCLK? PIXCLK?)
|-
| TP167
| CAM_D5
| CM_D5
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP168
| VDD28
| V28
| 2.8V power rail
| Only used by the camera. Generated by an LDO (U12) from VDD33 (Aptina MT9V133-D analog power rail?)
|-
! scope="row" colspan="5" | (TP169 doesn't exist)
|-
| TP170
| CAM_LED
| CM_LED
| Camera LED cathode?
| Connected through Q13 and R68 to BPTWL.
|-
| TP171
| RTC_INT
| RC_INT
| 1V8
| RTC->CPU-TWL interrupt
|-
| TP172
| SD10_CLK
| S10_CK
| 3V3
| SD card
|-
| TP173
| SD10_DATA0
| S10_D0
| 3V3
| SD card
|-
| TP174
| SD10_DATA1
| S10_D1
| 3V3
| SD card
|-
| TP175
| SD10_DATA2
| S10_D2
| 3V3
| SD card
|-
| TP176
| SD10_DATA3
| S10_D3
| 3V3
| SD card
|-
| TP177
| SD10_CMD
| S10_CD
| 3V3
| SD card
|-
| TP178
| SD10_CP
| S10_CP
| 3V3
| SD card (card detect)
|-
| TP179
| SD10_WP
| S10_WP
| 3V3
| SD card write protect
|-
| TP180
| GND
| GND
| ground
|
|-
! scope="row" colspan="5" | (TP181 doesn't exist)
|-
| TP182
| SD10_VDD
| S10_V
| 3.3V power rail
| same net as VDD33
|-
| TP183
| AOUT
|
|
| charging/battery status ?
|-
| TP184
| ADPO
|
|
| charging/battery status ?
|-
| TP185
| SCL1
|
| 3V3
| BPTWL bus
|-
| TP186
| SDA1
|
| 3V3
| BPTWL bus
|-
| TP187
| SND_SDI
| SND_DI
| 1V8
| I2S bus
|-
| TP188
| SND_SDO
| SND_DO
| 1V8
| I2S bus
|-
| TP189
| SND_WS
|
| 1V8
| I2S bus
|-
| TP190
| SND_SCLK aka BCLK
| SND_BK
| 1V8
| I2S bus
|-
| TP191
| SND_MCLK
| SND_MK
| 1V8
| Reference frequency for TSC
|-
| TP192
| PWSWO
| PSWO
| 3V3?
| powerbutton "output" from PMIC to BPTWL?
|-
| TP193
| TH
|
| ?
| battery internal temperature detector?
|-
| TP194
| VSHD
|
| 5.0V power rail
| Same net as VDD5. For LCDs.
|}

== UTL-SUB-01 testpoints ==

{| class="wikitable" border="1"
|-
! number
! name (TWL testpoint)
! voltage standard
! comment
|-
| TP1
| ?
| ?
| to TH1 component
|-
| TP2
| GND
| (GND)
| ground
|-
| TP3
| P06
| 3V3?
| D-pad up
|-
| TP4
| P04
| 3V3?
| D-pad right
|-
| TP5
| P05
| 3V3?
| D-pad left
|-
| TP6
| P07
| 3V3?
| D-pad down
|-
| TP7
| PWSW
| ?
| raw powerbutton input (to PMIC and BPTWL)
|-
| TP8
| RED
| open collector (at cathode)
| Battery low LED (DL1)
|-
| TP9
| YELLOW
| open collector (at cathode)
| WiFi indicator LED (DL4)
|-
| TP10
| BLUE
| 3V3? 4V2? (at anode)
| Power on/good LED (DL2)
|-
| TP11
| ORANGE
| 3V3? 4V2? (at anode)
| Charging indicator (DL3)
|-
| TP12
| VDD42
| 4.2V power supply
| Power supply for TP8/TP10 LEDs
|}

== P16 pinout ==

The P16 pinout changed from [https://problemkaputt.de/gbatek-aux-dsi-internal-connectors.htm what it was on the regular DSi]. Some nets are now found in P24 instead (see below).

{| class="wikitable" border="1"
|-
! name
! pin no
! pin no
! name
|-
| GND
| 1
| 2
| GND
|-
| GND
| 3
| 4
| GND
|-
| GND
| 5
| 6
| GND
|-
| SD10_CLK
| 7
| 8
| GND
|-
| VDD33
| 9
| 10
| SD10_D0
|-
| VDD33
| 11
| 12
| SD10_D1
|-
| GND
| 13
| 14
| SD10_WP
|-
| SD10_CMD
| 15
| 16
| VDD33
|-
| GND
| 17
| 18
| P08
|-
| SD10_D3
| 19
| 20
| VDD33
|-
| SD10_D2
| 21
| 22
| SD10_CD
|-
| GND
| 23
| 24
| GND
|-
| GND
| 25
| 26
| GND
|}

== P24 pinout ==

P24 is a mezzanine connector for the VOLP/VOLN buttons and the shoulder L button (which were on P16 on the DSi).

{| class="wikitable" border="1"
|-
! name
! pin no
! pin no
! name
|-
| GND
| 1
| 2
| GND
|-
| N/C
| 3
| 4
| VOLP
|-
| P09 (shoulder-L)
| 5
| 6
| VOLN
|-
| GND
| 7-13
| 8-14
| GND
|}

[[Category:Hardware]]

Stage1

2024-01-22T00:46:27Z

PoroCYon: clarify error codes

[[Image:boot-stage1-error.jpeg|frame|When the Stage 1 bootloader (in ROM) fails, it displays a 32-bit hexadecimal number on the top screen.]]

The first stage of the DSi's bootloader lives in ROM, on the CPU-TWL SoC die. It loads further encrypted+signed stages from the selected boot medium (usually [[NAND]] flash), starting with a plaintext offset table in the sector at offset 0x200. The code of the ROMs live at the upper 32k of the BIOS memory areas, i.e. at 0xffff8000 for the ARM9, and 0x00008000 for the ARM7.

The bootroms perform the following steps to load, verify and decrypt the [[Stage2|second-stage bootloader]]:
# Perform some initialization, such as clearing and setting up the .data and .bss sections, setting up the MPU and an RSA heap (ARM9), and the AES hardware (ARM7).
## At this moment, main RAM (aka FCRAM aka DRAM) isn't initialized yet, and is unusable. It is only initialized at the very beginning of [[stage2]].
## The ARM9 initializes its DTCM to reside at 0x02ff8000, an area normally backed by DRAM that also contains the exception vectors. DTCM is marked as no-execute, and the NWRAM area is marked as cacheable. ITCM is r/w/x.
# Read configuration bytes from [[NVRAM]]: the first 0x28 bytes and the single byte at 0x2ff are loaded.
# Decide on the boot medium:
## If the magic key combination "X+start+select+lid down" is held down and a game cartridge is inserted, booting from it is attempted (much like the 3DS boot ROMs). Note that the contents of the game cartridge must adhere to the regular [[stage2]] header format, so booting from retail game cartridges won't work.
## If the most significant bit of the byte at 0x2ff of NVRAM is high, NAND will be used as a boot medium.
## As a fallback, the console will try to boot from NVRAM. (On retail consoles, this always fails as NVRAM does not contain any bootcode.)
## If one boot method fails, the bootroms will continue trying with the next one.
# 0x200 bytes at offset 0x200 from the boot medium are read. This contains the [[Stage2|stage2 header]]. (For gamecart boots, the offset is 0 instead.)
# The RSA signature of the stage2 header is verified, and the first two SHA1 hashes (of the rest of the stage2 header, and the hash of the RSA message itself) are verified.
# On failure, goto 10.
# On success, the ARM9 instructs the ARM7 to load and decrypt the stage2 ARM7 binary from the boot medium. DMA is used from the boot medium to the AES hardware, but the output of the AES accelerator is simply read by software.
## Depending on the option bits in the stage2 header, this payload may be compressed.
## Uncompressed payloads are loaded into NWRAM on the ARM7 side, and then mapped to the ARM9 using the MBK registers.
## For compressed payloads, either the above can happen too, or the compressed data can first be sent to the ARM9 using the IPC FIFO, where the latter then performs the decompression.
## After the loading happens, the SHA1 hash is checked, but the result is not yet communicated.
# The above is repeated for the stage2 ARM9 binary.
# Only once both binaries have been checked will the ARM9 communicate the hash comparison result to the ARM7.
# On failure, both cores will lock up, and the ARM9 will display an error code on the top screen (see below).
# On success, both cores will:
## Deinitialize some hardware (partially clear RAM, deinitialize the MPU, etc.)
## Prepare keys for the next bootstage (some in the AES hardware, others copied to WRAM or ITCM)
## The ARM7 will lock out both boot ROMs from the system memory bus using the SCFG registers. The ARM9 waits for this lockout to happen.
## Both cores, now synchronized using the lockout, will now jump to [[stage2]] code. (Current stage2 binaries will immediately re-synchronize the cores, however.)

Error codes are supposed to be interpreted as a 32-bit unsigned little-endian integer, the least significant byte describing the status of the NAND boot attempt, the next of the NVRAM boot attempt, and the third one describes the game cartridge boot attempt. The most significant byte is always 0.

The individual bytes carry the following meaning:
* 00: The boot method has not been attempted, or failed during physical initialization (eg. NAND clk shorted, or no cartridge was inserted when attempting a game cartridge boot).
* FE: stage2 header verification failed.
* FD: stage2 ARM7 binary verification failed.
* FC: stage2 ARM9 binary verification failed.
The boot ROM does not use any other error codes.

In practice, the error codes carry the following meanings:

{| border="1" cellpadding="3" cellspacing="0"
! Error Code !! Description
|-
| 00FxFExx || Failed to run ntrboot exploit.
|-
| 0000FE00 || Error communicating with NAND chip (it's missing, CLK is shorted, etc.), or the most significant bit of the byte at 0x2ff of [[NVRAM]] has been cleared. (If you have a modchip installed, it could also mean the modchip exploit failed.)
|-
| 0000FEFC || Integrity error in ARM9 info block of Stage 2 (address at 0x220)
|-
| 0000FEFD || Integrity error in ARM7 info block of Stage 2 (address at 0x230)
|-
| 0000FEFE || Integrity error in the stage2 header (or error in [[NVRAM]] header: first 40 bytes must have a specific value).
|}

DSi exploits

2024-01-01T21:38:45Z

PoroCYon: /* Bootcode Exploits */

This page is dedicated to the listing of exploits for the Nintendo DSi. Anyone may contribute to this list. This page my not, however be deleted in any way, this ensures that that development of this page is not slowed down. Due to the fact that this page has not changed for over a year due to resets, no more resets.

== Type of exploits ==
Here is a general list of all the different types/terms of exploits to know. This is to know the differences of each exploit.
== NTR/NDS-Mode Exploits ==
These are ARM9 exploits that takes over a NDS-mode cartridge. These cartridges (on the back) are labeled as ''NTR''. These type of exploits are very limited since there's no SD or NAND access. They can be used to run a small binary payload making these exploits almost useless.

{| class="wikitable" border="1"
! Name
! Description
! Author
! Source
|-
| [[FIFA NDS]]
| Every single FIFA game on the Nintendo DS has been exploited.
| Everyone
| [https://github.com/CTurt/Dara CTurt's Source Code]
|-
| [[Bangai-O-Sploit]]
| A ''primary'' entrypoint for the game, ''Bangai-O Spirit'', on the Nintendo DS. This game was successfully exploit through sound.
| smealum
| [https://github.com/smealum/bangai-o-sploit Install]
|-
| [[NDS-ILH-Save-Exploit]]
| "I Love Horses" Nintendo DS save exploit
| [https://github.com/mojobojo/ mojobojo]
| [https://github.com/mojobojo/NDS-ILH-Save-Exploit Install]
|-
| [[ABR-NDS-SaveExploit]]
| A stack smash savegame exploit for the game "Asterix Brain Trainer"
| [https://github.com/WemI0/ Weml0]
| [https://github.com/WemI0/ABR-NDS-SaveExploit Install]
|-
| [[HaxxStation]]
| DS Download Station exploit, allowing one to run any commercial homebrew over from the DS download play application.
| shutterbug2000, Gericom, and Apache Thunder
| [https://gbatemp.net/threads/haxxstation-ds-download-station-exploit.473648/ See Here]
|-
| [[BreakingNews]]
| A stack smash savegame exploit for the game "The New York Times: Crossword" resulting from stack buffer overflow (profile slot names).
| [[User:ChampionLeake|ChampionLeake]]
| [https://github.com/ChampionLeake/BreakingNews/ Install]
|-
| [[NDS-FC2008-Save-Exploit]]
| A savegame exploit for the game "Führerschein Coach 2008".
| [https://github.com/toombaumarkt/ toombaumarkt]
| [https://github.com/toombaumarkt/NDS-FC2008-Save-Exploit Install]
|}

== TWL/DSi-Enhanced Cart Exploits ==
These are ARM9 exploits that take over a enhanced DSi-mode cartridge. These cartridges (on the back) are labeled as ''TWL''. Unfortunately they don't have SD or NAND access but can be used to gather console information and maybe find other vulnerabilities. These exploits can also be used for dslink, which can load homebrew applications via internet connections.

{| class="wikitable" border="1"
! Name
! Description
! Author
! Source
|-
| [[The Biggest Losers]]
| Exploit for The Biggest Loser which runs in DSi mode if you use a real cartridge on a DSi or 3DS system, otherwise, it runs in DS mode.
| st4rk
| [https://github.com/st4rk/The-Biggest-Loser Install]
[https://davejmurphy.com/dslink/ WinterMute's dslink]
|-
| [[Cookhack]]
| DSi Cooking Coach exploit
| WinterMute
| [https://github.com/WinterMute/savesploits/tree/master/cookhack PoC]
[https://davejmurphy.com/dslink/ dslink]
|-
| [[Classichack]]
| DSi Classic Word Games exploit
| WinterMute
| [https://github.com/WinterMute/savesploits/tree/master/classichack PoC]
[https://davejmurphy.com/dslink/ dslink]
|-
| [[SystemFlaaw]]
| The first DSi exclusive cartridge title to be exploited for the game, SystemFlaw
| zoogie
| [https://github.com/zoogie/SystemFlaaw Install]
|}

== DSiWare (True DSi-Mode) Exploits ==
These are ARM9 exploits that take over a DSiWare title. They run in the same context that the DSi-Enhanced games do, but with additional SD and NAND access. These exploits are valuable since they can be used to downgrade the console firmware to older versions, or install a persistent exploit such as Unlaunch. You can also run commercial homebrew applications from the SD card. However this doesn't allow any cartridge access.

{| class="wikitable" border="1"
! Name
! Description
! Author
! Source
|-
| [[Sudokuhax]]
| One of the first DSiWare exploits for the Nintendo DSi on the game SUDOKU by EA. (You must have the 1st version of this game in order to use the exploit as it was patched.
| TeamTwiizer, yellows8
| [https://github.com/yellows8/dsi/tree/master/exploits/sudokuhax Install]
|-
| [[grtpwn]]
| A Gameloft DSiWare savegame exploit for the game, Guitar Rock Tour!
| yellows8
| [https://github.com/yellows8/dsi/tree/master/exploits/grtpwn Install]
|-
| [[exidiahax]]
| A Gameloft DSiWare savegame exploit for the game, Legend of Exidia!
| yellows8
| [https://github.com/yellows8/dsi/tree/master/exploits/exidiahax Install]
|-
| [[fieldrunhax]]
| A Subatomic Studios DSiWare savegame exploit for the game, FIELDRUNNERS!
| yellows8
| [https://github.com/yellows8/dsi/tree/master/exploits/fieldrunhax Install]
|-
| [[4swordhax]]
| A DSiWare savegame exploit for the game, The Legend of Zelda: Four Swords Anniversary Edition!
| yellows8
| [https://github.com/yellows8/dsi/tree/master/exploits/4swordhax Install]
|-
| [[Flipnote ( ͡° ͜ʖ ͡°)]] and [[ugopwn]]
| A Primary entrypoint for the DSiWare Application, Flipnote Studio! This exploit was first exploit by shutterbug2000. Later, WinterMute and fincs released a stable version of the exploit.
| shutterbug2000, WinterMute, fincs, zoogie
| [https://davejmurphy.com/%CD%A1-%CD%9C%CA%96-%CD%A1/ Install]
|-
| [[UNO*pwn]]
| A DSiWare savegame exploit for the game, UNO, that involves a simple stack buffer overflow within the player's username with the settings functionality of the game!
| [[User:ChampionLeake|ChampionLeake]]
| [https://github.com/ChampionLeake/UNO-pwn Install]
|-
| [[Memory Pit]]
| A primary exploit for the DSi that involves the system application "Camera"! All you need is an SD Card to use this exploit.
| shutterbug2000
| [https://gbatemp.net/threads/memory-pit-a-new-dsi-exploit-for-dsi-camera.539432/ See Here]
|-
| [[petit-compwner]]
| The last string argument of interpreter command "COLSET" is not bounds checked, thus a trivial stack smash can occur if the string is overly long.
| zoogie
| [https://github.com/zoogie/petit-compwner/releases Release]
|-
| [[stylehax]]
| A primary entrypoint, using a use-after-free in Opera 9.50 (which uses WebKit under the hood).
| @0x1337cafe
| [https://github.com/nathanfarlow/stylehax Release], [https://farlow.dev/2023/03/02/hacking-the-nintendo-dsi-browser Writeup]
|}

== ARM7 Exploits ==
These exploits take over the ARM7 processor. In the DSi, these processor handles critical operations and cryptography operations, among other things. These exploits are extremely rare and there's no concrete targets. The DSi menu (The Launcher) is known to run in the ARM7 context. At the moment there's only one exploit known as RocketLauncher. These exploits allow FULL ACCESS with the DSi launcher.
{| class="wikitable" border="1"
! Name
! Description
! Author
! Source
|-
| [[RocketLauncher]]
| One of the first ever unlocked ARM7 DSi exploit involving the DS Cart White list in secton 3. This exploit only works on firmwares v1.4!
| ApacheThunder, stuckpixel, NoCash, Gericom, and Normmatt
| [https://gbatemp.net/threads/announcing-rocketlauncher-the-first-exploit-with-unlocked-arm7.476288/ Writeup]
|}

== Bootcode Exploits ==

These exploits gain full SCFG_EXT access rights immediately after powering on the system (right before starting the launcher). These exploits are significantly rare and concrete targets can be the launcher's ''title.tmd''. At the moment, nocash's exploit, ''Unlaunch'' is the only known usable exploit.

{| class="wikitable" border="1"
! Name
! Description
! Author
! Source
|-
| [[Unlaunch]]
| Possibly one of the first bootcode exploit for the Nintendo DSi! This exploit deals with taking advantage of the launcher's "title.tmd" size as it's not checked, allowing esculated permissions!
| NoCash
| [https://problemkaputt.de/unlaunch.htm Install & Writeup]
|-
| Unnamed modchip
| A modchip that exlploits the bootROMs of the Nintendo DSi. It enables code execution on both cores before boot ROM lockout.
| PoroCYon
| [https://media.ccc.de/v/37c3-11736-nintendo_hacking_2023_2008 37c3 talk], [https://icosahedron.website/@pcy/111676158956228552 video], [https://github.com/dsi-modchip/guide DIY guide]
|}

DSi system flaws

2024-01-01T21:34:19Z

PoroCYon: /* Hardware */

= Hardware =
Flaws in this category pertain to the underlying hardware that powers the DSi. This includes [[Stage1]], [[AES_Engine]], etc.

{| class="wikitable" border="1"
! Summary
! Description
! Fixed with hardware model/revision
! Newest hardware model/revision this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| [[AES_Engine]] allows partial key overwrite
| After using the key generator to generate the normal-key, you could overwrite parts of the normal-key with your own data and then recover the key-generator output by comparing the new crypto output with the original crypto output. From the normal-key outputs, you could deduce the key-generator function.
This applies to the keyX/keyY too.

The 3DS TWL AES engine is also [https://www.3dbrew.org/wiki/3DS_System_Flaws affected].
|
|
| 2011
|
| {{User|Yellows8}}
|-
| Undefined instruction/abort exception handler backed by RAM not cleared on reset
| Much like the 3DS boot0, some of the DSi's exception handlers are backed by RAM which isn't immediately cleared on a reset. Using fault injection, it is possible to cause an undefined instruction exception before the clearing happens, making the CPU jump to code remaining in RAM from the previous boot cycle. This only works on the ARM7, as on the ARM9, it is backed by main memory, which is only initialized by [[stage2]].
|
|
| June 2016
|
| {{User|Nocash}}, Normmatt, dark_samus, ApacheThunder (first successful exploit: {{User|PoroCYon}}, March 2021)
|-
| ARM7 ROM controls lockout of both boot ROMs
| After the execution of both boot ROMs, and right before jumping to stage2, the ARM7 locks out both boot ROMs using the SCFG registers, while the ARM9 waits for this lockout (as a synchronization mechanism). By using the above exploit to take control of the ARM7, it is possible to, in the exploit payload, mimic the ARM7 ROM execution such that it performs all the loading steps, but "forgets" to lock out the ROMs. By then injecting <i>another</i> glitch, it is possible to break the ARM9 out of the waiting loop, booting the system into the System Menu (or Unlaunch) with both boot ROMs still enabled, allowing one to dump the ARM9 boot ROM.
|
|
| 2021-2022
|
| Theorized to be possible by {{User|PoroCYon}} in 2021, first successful exploit by stuckpixel and Normmatt early November 2022, then exploited successfully two weeks later again by {{User|PoroCYon}}.
|-
| [[Stage2]] binary load region not validated
| [[Stage1]] doesn't validate the the load address/size for [[Stage2]] binaries. If all RSA / hash checks pass and the binary were located in memory used by [[Stage1]], this would allow running code under the context of [[Stage1]]. This is currently useless due to RSA however.
This is somewhat similar to [https://www.3dbrew.org/wiki/3DS_System_Flaws 3DS] bootROM issues, however 3DS does attempt validation at least.
|
|
| 2022
| December 19, 2022
| {{User|Yellows8}}, {{User|PoroCYon}}
|-
| [[Stage2]] header RSA signature padding not checked properly
| [[Stage1]] uses the SWI RSA_Decrypt_Unpad routine to verify the RSA signature of the [[stage2]] header. However, it does not check the return value of this function. This will make stage1 use zero-initialized memory as the plaintext RSA message for signatures with improper padding. However, due to the specific structure of this RSA message, this will quickly be caught by stage1.
|
|
| 2022
|
| {{User|PoroCYon}}
|-
| [[stage1]] hash verification code is vulnerable to fault injection
| The [[stage1]] code that verifies the first two SHA1 hashes in the RSA signature appendix (the header hash and the "hash of hashes" redundancy hash) is constructed in such a way that they can be both bypassed with a single injected fault. This makes it possible to exploit both bootroms using a a modchip
|
|
| 2022
| nov/dec 2023, see [https://media.ccc.de/v/37c3-11736-nintendo_hacking_2023_2008 37c3 talk]
|}

= Software =
== Stage2 ==
Flaws in this category pertain to [[Stage2]]. There is no known updated version of Stage2 post-launch.

{| class="wikitable" border="1"
! Summary
! Description
! Fixed with system version
! Newest system version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| Poor [[System Menu]] [[TMD]] size check
| [[Stage2]] loads the System Menu's TMD for verification and loading, and it attempts to check the size. However, instead of checking if <code>size > capacity</code>, it checks if <code>size > size</code>, which is always false, resulting in a buffer overflow.
| None
|
| August 2017
|
| {{User|Nocash}}
|}

== System Menu ==
Flaws in this category pertain to [[System Menu]].

{| class="wikitable" border="1"
! Summary
! Description
! Fixed with system version
! Newest system version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| DS games are not patched to verify overlays
| While the System Menu checks all cartridge overlays to prevent unauthorized software, no such check exists when the overlays are actually loaded, despite an [https://wiibrew.org/wiki/MIOS MIOS]-like patcher being possible to implement. By changing the overlay after it is checked, it is possible to run arbitrary code.
|
|
| January 2010
|
| Datel, and {{User|blasty}} by reverse engineering Datel's [[Action Replay]]
|}

== Applications ==
Flaws in this category pertain to applications launched by [[System Menu]]. See also [[DSi exploits]].

DSi XL testpoints

2023-12-01T19:03:11Z

PoroCYon: fix TP169 colspan

== UTL-CPU-01 testpoints ==

{| class="wikitable" border="1"
|-
! number
! name (TWL testpoint)
! short name (some TWL PCBs)
! voltage standard
! comment
|-
| TP1
| EXTB+
| EXB+
| ?
|
|-
| TP2
| VIN
|
| ≃5V DC
| External charger power input
|-
| TP3
| Rosc
|
| ?
| ?
|-
| TP4
| RICHG
| RCG
| ?
| Recharge?
|-
| TP5
| GND
| GND
| ground
| (near external charger connector)
|-
| TP6
| VDD12
| V12
| 1.2V power rail
| CPU-TWL core voltage
|-
| TP7
| BT+
|
| battery +
| at 2-pin power connector to UTL-SUB-01
|-
| TP8
| VDET-
| VDT-
| ?
| ?
|-
| TP9
| DET
| DT
| ?
| ?
|-
| TP10
| VDD18
| V18
| 1.8V power rail
| Various I/O and core voltage (incl. RTC)
|-
| TP11
| ?
|
| ?
| something charging?
|-
| TP12
| VDD10
| V10
| 10V power rail
| For LCDs
|-
| TP13
| VDD33
| V33
| 3.3V power rail
| Various I/O and core voltage
|-
| TP14
| GND
| GND
| ground
| (near PMIC)
|-
| TP15
| B+
|
| ?
| battery + ?
|-
| TP16
| VDD-5
| V-5
| -5V power rail
| For LCDs
|-
| TP17
| PVDD
| PVD
| ?
| ?
|-
| TP18
| VDD5
| V5
| 5.0V power rail
| For LCDs
|-
| TP19
| SG?
|
| ?
| ?
|-
| TP20
| BLA1
| BA1
| ?
| backlight anode for lower screen
|-
| TP21
| VDD42?
| V42?
| 4.2V? power rail (it's certainly a power rail)
| generated from VDD5 using diode voltage drops? (to D6, C22, D3)
|-
| TP22
| BLC1
| BC1
| ?
| backlight cathode for lower screen
|-
| TP23
| BLA2
| BA2
| ?
| backlight anode for upper screen
|-
! scope="row" colspan="5" | (TP24, TP25 don't exist)
|-
| TP26
| BLC2
| BC2
| ?
| backlight cathode for upper screen
|-
! scope="row" colspan="5" | (TP27 doesn't exist)
|-
| TP28
| MIC-
|
| ground
| same net as (analog) ground
|-
| TP29
| MIC+
|
| analog
| Analog microphone-in signal
|-
| TP30
| SPRP
|
| analog
| positive signal for right built-in speaker
|-
| TP31
| SPRN
|
| analog
| negative signal for right built-in speaker
|-
| TP32
| SPLP
|
| analog
| positive signal for left built-in speaker
|-
| TP33
| SPLN
|
| analog
| negative signal for left built-in speaker
|-
| TP34
| GND
| GND
| ground
| probably analog ground
|-
| TP35
| SR
|
| analog
| headphone tip
|-
| TP36
| SL
|
| analog
| headphone ring
|-
! scope="row" colspan="5" | (TP37, TP38 don't exist)
|-
| TP39
| ORANGE
| ORG
| 3V3? 4V2? (at anode)
| Orange LED charging indicator
|-
| TP40
| BLUE
| BLE
| 3V3? 4V2? (at anode)
| Blue LED power good indicator
|-
| TP41
| RED
|
| open collector (connected to LED cathode)
| Red LED battery low indicator
|-
| TP42
| MC1_IO7
| M1_7
| 3V3
| MSB of gamecard parallell ROM *or* AUXSPI COPI signal
|-
| TP43
| MC1_IO6
| M1_6
| 3V3
| 6th bit of gamecard parallell ROM *or* AUXSPI CIPO signal
|-
| TP44
| MC1_VCC
| M1_V
| 3.3V power
| power supply to gamecard (can be switched off by SoC)
|-
! scope="row" colspan="5" | (TP45 doesn't exist)
|-
| TP46
| MC1_IO5
| M1_5
| 3V3
|
|-
| TP47
| MC1_IO4
| M1_4
| 3V3
|
|-
| TP48
| MC1_IO3
| M1_3
| 3V3
|
|-
| TP49
| MC1_DET
| M1_DT
| 3V3
| Cartridge detected in slot (active-low)
|-
| TP50
| MC1_IO2
| M1_2
| 3V3
|
|-
| TP51
| MC1_IREQ
| M1_IRQ
| 3V3
| gamecart->SoC IRQ
|-
| TP52
| MC1_IO1
| M1_1
| 3V3
|
|-
| TP53
| MC1_RES
| M1_RES
| 3V3
| SoC->gamecart reset signal
|-
| TP54
| MC1_IO0
| M1_0
| 3V3
|
|-
| TP55
| MC1_CS
| M1_CS
| 3V3
| parallell ROM select (active-low)
|-
| TP56
| MC1_CLK
| M1_CLK
| 3V3
|
|-
| TP57
| MC1_CS2
| M1_CS2
| 3V3
| AUXSPI select (active-low)
|-
| TP58
| /mRST
|
| 3V3
| BPTWL reset (active-low)
|-
| TP59
| mFE
|
| 3V3
| BPTWL flash enable (cf. 78K0/Kx2 Serial Flash Programming protocol, see NEC/Renesas docs)
|-
| TP60
| VOLP
| VLP
| 3V3
| volume + button (also RxD6 for 78K0 SFP. There's a series resistor to the physical button as protection against shorts)
|-
| TP61
| VOLN
| VLN
| 3V3
| volume - button (also TxD6 for 78K0 SFP. There's a series resistor to the physical button as protection against shorts)
|-
| TP62
| ATH_TX_H
| A_T_H
| 3V3
| AR6002 ANTD, "Control signal for shared antenna switch", probably enables Ath TX antenna
|-
| TP63
| WL_TXPE
| WL_T
| 3V3
| Old Wifi TX enable?
|-
! scope="row" colspan="5" | (TP64 doesn't exist)
|-
| TP65
| WL_RXPE
| WL_R
| 3V3
| Old Wifi RX enable?
|-
| TP66
| /WIFI_RST
| /WF_RST
| 3V3
| New WiFi (Ath6k) reset (active-low)
|-
! scope="row" colspan="5" | (TP67, TP68 don't exist)
|-
| TP69
| SPI_MOSI
|
| 3V3
| SPI bus
|-
! scope="row" colspan="5" | (TP70 doesn't exist)
|-
| TP71
| SPI_MISO
|
| 3V3
| SPI bus
|-
! scope="row" colspan="5" | (TP72 doesn't exist)
|-
| TP73
| SPI_SCK
| SPI_SK
| 3V3
| SPI bus
|-
! scope="row" colspan="5" | (TP74, TP75 don't exist)
|-
| TP76
| SPI_CS1
| SPI_C1
| 3V3
| SPI chip select 1 (PMIC)
|-
! scope="row" colspan="5" | (TP77 doesn't exist)
|-
| TP78
| SPI_CS3
| SPI_C3
| 3V3
| SPI chip select 3 (TSC)
|-
| TP79
| SPI_CS2
| SPI_C2
| 3V3
| SPI chip select 2 ([[NVRAM]])
|-
| TP80
| SCL
|
| 1V8
| CPU-TWL bus
|-
! scope="row" colspan="5" | (TP81 doesn't exist)
|-
| TP82
| SDA
|
| 1V8
| CPU-TWL bus
|-
| TP83
| PENIRQ
| PNIRQ
| 1V8? 3V3?
| touchscreen pen down
|-
| TP84
| R7
|
| 1V8?
| hinge magnet detect signal (active-low)
|-
| TP85
| RESET
| RST
| 3V3, but use as open drain/collector
| CPU-TWL reset signal
|-
| TP86
| P05
|
| 3V3?
| dpad left button
|-
| TP87
| P04
|
| 3V3?
| dpad right button
|-
| TP88
| P03
|
| 3V3?
| start button
|-
| TP89
| P02
|
| 3V3?
| select button
|-
| TP90
| P01
|
| 3V3?
| B button
|-
| TP91
| P00
|
| 3V3?
| A button
|-
| TP92
| PM_SLP
|
| ?
| ?
|-
| TP93
| VCNT5
|
| ?
| ?
|-
| TP94
| GPIO330?
| 330?
| 3V3
| GPIO debug testpoint
|-
| TP95
| R01
|
| ?
| Y button
|-
| TP96
| R00
|
| ?
| X button
|-
| TP97
| P09
|
| 3V3
| shoulder-L button
|-
| TP98
| P08
|
| 3V3
| shoulder-R button
|-
| TP99
| MUTE
|
| 3V3
| ? (controlled by GPIO333 through U17)
|-
| TP100
| P07
|
| 3V3?
| dpad down button
|-
| TP101
| HP#SP
| H#S
| 3V3
| audio out is headphones (1) or speakers (0). aka GPIO331
|-
| TP102
| P06
|
| 3V3?
| dpad up button
|-
! scope="row" colspan="5" | (TP103 doesn't exist)
|-
| TP104
| /IRQ_O?
|
| 3V3
| "powerbutton pressed" signal from the BPTWL to the CPU-TWL. aka GPIO332
|-
| TP105
| LDR20
| LR20
|
| top LCD R.bit0
|-
| TP106
| LDR21
| LR21
|
| top LCD R.bit1
|-
| TP107
| LDR22
| LR22
|
| top LCD R.bit2
|-
| TP108
| LDR23
| LR23
|
| top LCD R.bit3
|-
| TP109
| LDR24
| LR24
|
| top LCD R.bit4
|-
| TP110
| LDB21
| LB21
|
| top LCD B.bit1
|-
| TP111
| LDG21
| LG21
|
| top LCD G.bit1
|-
| TP112
| LDG22
| LG22
|
| top LCD G.bit2
|-
| TP113
| LDG25
| LG25
|
| top LCD G.bit5
|-
| TP114
| LDB20
| LB20
|
| top LCD B.bit0
|-
| TP115
| LDB23
| LB23
|
| top LCD B.bit3
|-
| TP116
| LDR11
| LR11
|
| bottom LCD R.bit1
|-
| TP117
| LDR12
| LR12
|
| bottom LCD R.bit4
|-
| TP118
| LDR15
| LR15
|
| bottom LCD R.bit5
|-
| TP119
| LDR25
| LR25
|
| top LCD R.bit5
|-
| TP120
| LDG20
| LG20
|
| top LCD G.bit2
|-
| TP121
| LDG23
| LG23
|
| top LCD G.bit3
|-
| TP122
| LDG24
| LG24
|
| top LCD G.bit4
|-
| TP123
| LDB22
| LB22
|
| top LCD B.bit2
|-
| TP124
| LDB24
| LB24
|
| top LCD B.bit4
|-
| TP125
| LDB25
| LB25
|
| top LCD B.bit5
|-
| TP126
| LDR10
| LR10
|
| bottom LCD R.bit0
|-
| TP127
| LDR13
| LR13
|
| bottom LCD R.bit3
|-
| TP128
| LDR14
| LR14
|
| bottom LCD R.bit4
|-
| TP129
| LDG10
| LG10
|
| bottom LCD G.bit0
|-
| TP130
| LDG11
| LG11
|
| bottom LCD G.bit1
|-
| TP131
| LDG12
| LG12
|
| bottom LCD G.bit2
|-
| TP132
| LDG13
| LG13
|
| bottom LCD G.bit3
|-
| TP133
| LDG15
| LG15
|
| bottom LCD G.bit5
|-
| TP134
| LDB11
| LB11
|
| bottom LCD B.bit1
|-
| TP135
| LDG14
| LG14
|
| bottom LCD G.bit4
|-
| TP136
| LDB10
| LB10
|
| bottom LCD B.bit0
|-
| TP137
| COM2
|
| ?
| ?
|-
| TP138
| LDB12
| LB12
|
| bottom LCD B.bit2
|-
| TP139
| LDB13
| LB13
|
| bottom LCD B.bit3
|-
| TP140
| LDB14
| LB14
|
| bottom LCD B.bit4
|-
| TP141
| LDB15
| LB15
|
| bottom LCD B.bit5
|-
| TP142
| INI
|
| ?
| LCD controller ?
|-
| TP143
| GSP
|
|
| LCD controller Vsync?
|-
| TP144
| GCK
|
| ?
| LCD controller ?
|-
| TP145
| REV
|
|
| LCD controller ?
|-
| TP146
| LS
|
|
| LCD controller Hsync?
|-
| TP147
| SPL
|
|
| LCD controller ?
|-
| TP148
| DCLK
| DCK
|
| LCD controller dot clock
|-
| TP149
| CAM_RST
| CM_RST
| 1V8?
| Camera reset signal
|-
| TP150
| COM1
|
| ?
| ?
|-
! scope="row" colspan="5" | (TP151 doesn't exist)
|-
| TP152
| CAM_D4
| CM_D4
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP153
| HSYNC
|
| 1V8?
| Camera horizontal sync/blank (conn. thru R133, 0Ω) (Aptina MT9V133-D LINE_VALID, active-low)
|-
| TP154
| CAM_D3
| CM_D3
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP155
| VSYNC
|
| 1V8?
| Camera vertical sync/blank (conn. thru R132, 0Ω) (Aptina MT9V133-D FRAME_VALID, active-low)
|-
| TP156
| CKI
|
| 1V8?
| Camera clock something? (Aptina MT9V133-D EXTCLK? PIXCLK?)
|-
| TP157
| CAM_D2
| CM_D2
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP158
| CAM_D7
| CM_D7
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP159
| CAM_D1
| CM_D1
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP160
| X+
|
| ?
| touchscreen
|-
| TP161
| Y+
|
| ?
| touchscreen
|-
| TP162
| X-
|
| ?
| touchscreen, same net as Y-
|-
| TP163
| Y-
|
| ?
| touchscreen, same net as X-
|-
| TP164
| CAM_D6
| CM_D6
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP165
| CAM_D0
| CM_D0
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP166
| RCLK
| RCK
| 1V8?
| Camera (conn. thru R100, 100Ω) (Aptina MT9V133-D EXTCLK? PIXCLK?)
|-
| TP167
| CAM_D5
| CM_D5
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP168
| VDD28
| V28
| 2.8V power rail
| Only used by the camera. Generated by an LDO (U12) from VDD33 (Aptina MT9V133-D analog power rail?)
|-
! scope="row" colspan="5" | (TP169 doesn't exist)
|-
| TP170
| CAM_LED
| CM_LED
| Camera LED cathode?
| Connected through Q13 and R68 to BPTWL.
|-
| TP171
| RTC_INT
| RC_INT
| 1V8?
| RTC->CPU-TWL interrupt
|-
| TP172
| SD10_CLK
| S10_CK
| 3V3
| SD card
|-
| TP173
| SD10_DATA0
| S10_D0
| 3V3
| SD card
|-
| TP174
| SD10_DATA1
| S10_D1
| 3V3
| SD card
|-
| TP175
| SD10_DATA2
| S10_D2
| 3V3
| SD card
|-
| TP176
| SD10_DATA3
| S10_D3
| 3V3
| SD card
|-
| TP177
| SD10_CMD
| S10_CD
| 3V3
| SD card
|-
| TP178
| SD10_CP
| S10_CP
| 3V3
| SD card (card detect)
|-
| TP179
| SD10_WP
| S10_WP
| 3V3
| SD card write protect
|-
| TP180
| GND
| GND
| ground
|
|-
! scope="row" colspan="5" | (TP181 doesn't exist)
|-
| TP182
| SD10_VDD
| S10_V
| 3.3V power rail
| same net as VDD33
|-
| TP183
| AOUT
|
|
| charging/battery status ?
|-
| TP184
| ADPO
|
|
| charging/battery status ?
|-
| TP185
| SCL1
|
| 3V3
| BPTWL bus
|-
| TP186
| SDA1
|
| 3V3
| BPTWL bus
|-
| TP187
| SND_SDI
| SND_DI
| 1V8
| I2S bus
|-
| TP188
| SND_SDO
| SND_DO
| 1V8
| I2S bus
|-
| TP189
| SND_WS
|
| 1V8
| I2S bus
|-
| TP190
| SND_SCLK aka BCLK
| SND_BK
| 1V8
| I2S bus
|-
| TP191
| SND_MCLK
| SND_MK
| 1V8
| Reference frequency for TSC
|-
| TP192
| PWSWO
| PSWO
| 3V3?
| powerbutton "output" from PMIC to BPTWL?
|-
| TP193
| TH
|
| ?
| battery internal temperature detector?
|-
| TP194
| VSHD
|
| 5.0V power rail
| Same net as VDD5. For LCDs.
|}

== UTL-SUB-01 testpoints ==

{| class="wikitable" border="1"
|-
! number
! name (TWL testpoint)
! voltage standard
! comment
|-
| TP1
| ?
| ?
| to TH1 component
|-
| TP2
| GND
| (GND)
| ground
|-
| TP3
| P06
| 3V3?
| D-pad up
|-
| TP4
| P04
| 3V3?
| D-pad right
|-
| TP5
| P05
| 3V3?
| D-pad left
|-
| TP6
| P07
| 3V3?
| D-pad down
|-
| TP7
| PWSW
| ?
| raw powerbutton input (to PMIC and BPTWL)
|-
| TP8
| RED
| open collector (at cathode)
| Battery low LED (DL1)
|-
| TP9
| YELLOW
| open collector (at cathode)
| WiFi indicator LED (DL4)
|-
| TP10
| BLUE
| 3V3? 4V2? (at anode)
| Power on/good LED (DL2)
|-
| TP11
| ORANGE
| 3V3? 4V2? (at anode)
| Charging indicator (DL3)
|-
| TP12
| VDD42
| 4.2V power supply
| Power supply for TP8/TP10 LEDs
|}

== P16 pinout ==

The P16 pinout changed from [https://problemkaputt.de/gbatek-aux-dsi-internal-connectors.htm what it was on the regular DSi]. Some nets are now found in P24 instead (see below).

{| class="wikitable" border="1"
|-
! name
! pin no
! pin no
! name
|-
| GND
| 1
| 2
| GND
|-
| GND
| 3
| 4
| GND
|-
| GND
| 5
| 6
| GND
|-
| SD10_CLK
| 7
| 8
| GND
|-
| VDD33
| 9
| 10
| SD10_D0
|-
| VDD33
| 11
| 12
| SD10_D1
|-
| GND
| 13
| 14
| SD10_WP
|-
| SD10_CMD
| 15
| 16
| VDD33
|-
| GND
| 17
| 18
| P08
|-
| SD10_D3
| 19
| 20
| VDD33
|-
| SD10_D2
| 21
| 22
| SD10_CD
|-
| GND
| 23
| 24
| GND
|-
| GND
| 25
| 26
| GND
|}

== P24 pinout ==

P24 is a mezzanine connector for the VOLP/VOLN buttons and the shoulder L button (which were on P16 on the DSi).

{| class="wikitable" border="1"
|-
! name
! pin no
! pin no
! name
|-
| GND
| 1
| 2
| GND
|-
| N/C
| 3
| 4
| VOLP
|-
| P09 (shoulder-L)
| 5
| 6
| VOLN
|-
| GND
| 7-13
| 8-14
| GND
|}

[[Category:Hardware]]

DSi XL testpoints

2023-12-01T19:02:29Z

PoroCYon: add shorter names, used in some TWL PCB revisions

== UTL-CPU-01 testpoints ==

{| class="wikitable" border="1"
|-
! number
! name (TWL testpoint)
! short name (some TWL PCBs)
! voltage standard
! comment
|-
| TP1
| EXTB+
| EXB+
| ?
|
|-
| TP2
| VIN
|
| ≃5V DC
| External charger power input
|-
| TP3
| Rosc
|
| ?
| ?
|-
| TP4
| RICHG
| RCG
| ?
| Recharge?
|-
| TP5
| GND
| GND
| ground
| (near external charger connector)
|-
| TP6
| VDD12
| V12
| 1.2V power rail
| CPU-TWL core voltage
|-
| TP7
| BT+
|
| battery +
| at 2-pin power connector to UTL-SUB-01
|-
| TP8
| VDET-
| VDT-
| ?
| ?
|-
| TP9
| DET
| DT
| ?
| ?
|-
| TP10
| VDD18
| V18
| 1.8V power rail
| Various I/O and core voltage (incl. RTC)
|-
| TP11
| ?
|
| ?
| something charging?
|-
| TP12
| VDD10
| V10
| 10V power rail
| For LCDs
|-
| TP13
| VDD33
| V33
| 3.3V power rail
| Various I/O and core voltage
|-
| TP14
| GND
| GND
| ground
| (near PMIC)
|-
| TP15
| B+
|
| ?
| battery + ?
|-
| TP16
| VDD-5
| V-5
| -5V power rail
| For LCDs
|-
| TP17
| PVDD
| PVD
| ?
| ?
|-
| TP18
| VDD5
| V5
| 5.0V power rail
| For LCDs
|-
| TP19
| SG?
|
| ?
| ?
|-
| TP20
| BLA1
| BA1
| ?
| backlight anode for lower screen
|-
| TP21
| VDD42?
| V42?
| 4.2V? power rail (it's certainly a power rail)
| generated from VDD5 using diode voltage drops? (to D6, C22, D3)
|-
| TP22
| BLC1
| BC1
| ?
| backlight cathode for lower screen
|-
| TP23
| BLA2
| BA2
| ?
| backlight anode for upper screen
|-
! scope="row" colspan="5" | (TP24, TP25 don't exist)
|-
| TP26
| BLC2
| BC2
| ?
| backlight cathode for upper screen
|-
! scope="row" colspan="5" | (TP27 doesn't exist)
|-
| TP28
| MIC-
|
| ground
| same net as (analog) ground
|-
| TP29
| MIC+
|
| analog
| Analog microphone-in signal
|-
| TP30
| SPRP
|
| analog
| positive signal for right built-in speaker
|-
| TP31
| SPRN
|
| analog
| negative signal for right built-in speaker
|-
| TP32
| SPLP
|
| analog
| positive signal for left built-in speaker
|-
| TP33
| SPLN
|
| analog
| negative signal for left built-in speaker
|-
| TP34
| GND
| GND
| ground
| probably analog ground
|-
| TP35
| SR
|
| analog
| headphone tip
|-
| TP36
| SL
|
| analog
| headphone ring
|-
! scope="row" colspan="5" | (TP37, TP38 don't exist)
|-
| TP39
| ORANGE
| ORG
| 3V3? 4V2? (at anode)
| Orange LED charging indicator
|-
| TP40
| BLUE
| BLE
| 3V3? 4V2? (at anode)
| Blue LED power good indicator
|-
| TP41
| RED
|
| open collector (connected to LED cathode)
| Red LED battery low indicator
|-
| TP42
| MC1_IO7
| M1_7
| 3V3
| MSB of gamecard parallell ROM *or* AUXSPI COPI signal
|-
| TP43
| MC1_IO6
| M1_6
| 3V3
| 6th bit of gamecard parallell ROM *or* AUXSPI CIPO signal
|-
| TP44
| MC1_VCC
| M1_V
| 3.3V power
| power supply to gamecard (can be switched off by SoC)
|-
! scope="row" colspan="5" | (TP45 doesn't exist)
|-
| TP46
| MC1_IO5
| M1_5
| 3V3
|
|-
| TP47
| MC1_IO4
| M1_4
| 3V3
|
|-
| TP48
| MC1_IO3
| M1_3
| 3V3
|
|-
| TP49
| MC1_DET
| M1_DT
| 3V3
| Cartridge detected in slot (active-low)
|-
| TP50
| MC1_IO2
| M1_2
| 3V3
|
|-
| TP51
| MC1_IREQ
| M1_IRQ
| 3V3
| gamecart->SoC IRQ
|-
| TP52
| MC1_IO1
| M1_1
| 3V3
|
|-
| TP53
| MC1_RES
| M1_RES
| 3V3
| SoC->gamecart reset signal
|-
| TP54
| MC1_IO0
| M1_0
| 3V3
|
|-
| TP55
| MC1_CS
| M1_CS
| 3V3
| parallell ROM select (active-low)
|-
| TP56
| MC1_CLK
| M1_CLK
| 3V3
|
|-
| TP57
| MC1_CS2
| M1_CS2
| 3V3
| AUXSPI select (active-low)
|-
| TP58
| /mRST
|
| 3V3
| BPTWL reset (active-low)
|-
| TP59
| mFE
|
| 3V3
| BPTWL flash enable (cf. 78K0/Kx2 Serial Flash Programming protocol, see NEC/Renesas docs)
|-
| TP60
| VOLP
| VLP
| 3V3
| volume + button (also RxD6 for 78K0 SFP. There's a series resistor to the physical button as protection against shorts)
|-
| TP61
| VOLN
| VLN
| 3V3
| volume - button (also TxD6 for 78K0 SFP. There's a series resistor to the physical button as protection against shorts)
|-
| TP62
| ATH_TX_H
| A_T_H
| 3V3
| AR6002 ANTD, "Control signal for shared antenna switch", probably enables Ath TX antenna
|-
| TP63
| WL_TXPE
| WL_T
| 3V3
| Old Wifi TX enable?
|-
! scope="row" colspan="5" | (TP64 doesn't exist)
|-
| TP65
| WL_RXPE
| WL_R
| 3V3
| Old Wifi RX enable?
|-
| TP66
| /WIFI_RST
| /WF_RST
| 3V3
| New WiFi (Ath6k) reset (active-low)
|-
! scope="row" colspan="5" | (TP67, TP68 don't exist)
|-
| TP69
| SPI_MOSI
|
| 3V3
| SPI bus
|-
! scope="row" colspan="5" | (TP70 doesn't exist)
|-
| TP71
| SPI_MISO
|
| 3V3
| SPI bus
|-
! scope="row" colspan="5" | (TP72 doesn't exist)
|-
| TP73
| SPI_SCK
| SPI_SK
| 3V3
| SPI bus
|-
! scope="row" colspan="5" | (TP74, TP75 don't exist)
|-
| TP76
| SPI_CS1
| SPI_C1
| 3V3
| SPI chip select 1 (PMIC)
|-
! scope="row" colspan="5" | (TP77 doesn't exist)
|-
| TP78
| SPI_CS3
| SPI_C3
| 3V3
| SPI chip select 3 (TSC)
|-
| TP79
| SPI_CS2
| SPI_C2
| 3V3
| SPI chip select 2 ([[NVRAM]])
|-
| TP80
| SCL
|
| 1V8
| CPU-TWL bus
|-
! scope="row" colspan="5" | (TP81 doesn't exist)
|-
| TP82
| SDA
|
| 1V8
| CPU-TWL bus
|-
| TP83
| PENIRQ
| PNIRQ
| 1V8? 3V3?
| touchscreen pen down
|-
| TP84
| R7
|
| 1V8?
| hinge magnet detect signal (active-low)
|-
| TP85
| RESET
| RST
| 3V3, but use as open drain/collector
| CPU-TWL reset signal
|-
| TP86
| P05
|
| 3V3?
| dpad left button
|-
| TP87
| P04
|
| 3V3?
| dpad right button
|-
| TP88
| P03
|
| 3V3?
| start button
|-
| TP89
| P02
|
| 3V3?
| select button
|-
| TP90
| P01
|
| 3V3?
| B button
|-
| TP91
| P00
|
| 3V3?
| A button
|-
| TP92
| PM_SLP
|
| ?
| ?
|-
| TP93
| VCNT5
|
| ?
| ?
|-
| TP94
| GPIO330?
| 330?
| 3V3
| GPIO debug testpoint
|-
| TP95
| R01
|
| ?
| Y button
|-
| TP96
| R00
|
| ?
| X button
|-
| TP97
| P09
|
| 3V3
| shoulder-L button
|-
| TP98
| P08
|
| 3V3
| shoulder-R button
|-
| TP99
| MUTE
|
| 3V3
| ? (controlled by GPIO333 through U17)
|-
| TP100
| P07
|
| 3V3?
| dpad down button
|-
| TP101
| HP#SP
| H#S
| 3V3
| audio out is headphones (1) or speakers (0). aka GPIO331
|-
| TP102
| P06
|
| 3V3?
| dpad up button
|-
! scope="row" colspan="5" | (TP103 doesn't exist)
|-
| TP104
| /IRQ_O?
|
| 3V3
| "powerbutton pressed" signal from the BPTWL to the CPU-TWL. aka GPIO332
|-
| TP105
| LDR20
| LR20
|
| top LCD R.bit0
|-
| TP106
| LDR21
| LR21
|
| top LCD R.bit1
|-
| TP107
| LDR22
| LR22
|
| top LCD R.bit2
|-
| TP108
| LDR23
| LR23
|
| top LCD R.bit3
|-
| TP109
| LDR24
| LR24
|
| top LCD R.bit4
|-
| TP110
| LDB21
| LB21
|
| top LCD B.bit1
|-
| TP111
| LDG21
| LG21
|
| top LCD G.bit1
|-
| TP112
| LDG22
| LG22
|
| top LCD G.bit2
|-
| TP113
| LDG25
| LG25
|
| top LCD G.bit5
|-
| TP114
| LDB20
| LB20
|
| top LCD B.bit0
|-
| TP115
| LDB23
| LB23
|
| top LCD B.bit3
|-
| TP116
| LDR11
| LR11
|
| bottom LCD R.bit1
|-
| TP117
| LDR12
| LR12
|
| bottom LCD R.bit4
|-
| TP118
| LDR15
| LR15
|
| bottom LCD R.bit5
|-
| TP119
| LDR25
| LR25
|
| top LCD R.bit5
|-
| TP120
| LDG20
| LG20
|
| top LCD G.bit2
|-
| TP121
| LDG23
| LG23
|
| top LCD G.bit3
|-
| TP122
| LDG24
| LG24
|
| top LCD G.bit4
|-
| TP123
| LDB22
| LB22
|
| top LCD B.bit2
|-
| TP124
| LDB24
| LB24
|
| top LCD B.bit4
|-
| TP125
| LDB25
| LB25
|
| top LCD B.bit5
|-
| TP126
| LDR10
| LR10
|
| bottom LCD R.bit0
|-
| TP127
| LDR13
| LR13
|
| bottom LCD R.bit3
|-
| TP128
| LDR14
| LR14
|
| bottom LCD R.bit4
|-
| TP129
| LDG10
| LG10
|
| bottom LCD G.bit0
|-
| TP130
| LDG11
| LG11
|
| bottom LCD G.bit1
|-
| TP131
| LDG12
| LG12
|
| bottom LCD G.bit2
|-
| TP132
| LDG13
| LG13
|
| bottom LCD G.bit3
|-
| TP133
| LDG15
| LG15
|
| bottom LCD G.bit5
|-
| TP134
| LDB11
| LB11
|
| bottom LCD B.bit1
|-
| TP135
| LDG14
| LG14
|
| bottom LCD G.bit4
|-
| TP136
| LDB10
| LB10
|
| bottom LCD B.bit0
|-
| TP137
| COM2
|
| ?
| ?
|-
| TP138
| LDB12
| LB12
|
| bottom LCD B.bit2
|-
| TP139
| LDB13
| LB13
|
| bottom LCD B.bit3
|-
| TP140
| LDB14
| LB14
|
| bottom LCD B.bit4
|-
| TP141
| LDB15
| LB15
|
| bottom LCD B.bit5
|-
| TP142
| INI
|
| ?
| LCD controller ?
|-
| TP143
| GSP
|
|
| LCD controller Vsync?
|-
| TP144
| GCK
|
| ?
| LCD controller ?
|-
| TP145
| REV
|
|
| LCD controller ?
|-
| TP146
| LS
|
|
| LCD controller Hsync?
|-
| TP147
| SPL
|
|
| LCD controller ?
|-
| TP148
| DCLK
| DCK
|
| LCD controller dot clock
|-
| TP149
| CAM_RST
| CM_RST
| 1V8?
| Camera reset signal
|-
| TP150
| COM1
|
| ?
| ?
|-
! scope="row" colspan="5" | (TP151 doesn't exist)
|-
| TP152
| CAM_D4
| CM_D4
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP153
| HSYNC
|
| 1V8?
| Camera horizontal sync/blank (conn. thru R133, 0Ω) (Aptina MT9V133-D LINE_VALID, active-low)
|-
| TP154
| CAM_D3
| CM_D3
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP155
| VSYNC
|
| 1V8?
| Camera vertical sync/blank (conn. thru R132, 0Ω) (Aptina MT9V133-D FRAME_VALID, active-low)
|-
| TP156
| CKI
|
| 1V8?
| Camera clock something? (Aptina MT9V133-D EXTCLK? PIXCLK?)
|-
| TP157
| CAM_D2
| CM_D2
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP158
| CAM_D7
| CM_D7
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP159
| CAM_D1
| CM_D1
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP160
| X+
|
| ?
| touchscreen
|-
| TP161
| Y+
|
| ?
| touchscreen
|-
| TP162
| X-
|
| ?
| touchscreen, same net as Y-
|-
| TP163
| Y-
|
| ?
| touchscreen, same net as X-
|-
| TP164
| CAM_D6
| CM_D6
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP165
| CAM_D0
| CM_D0
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP166
| RCLK
| RCK
| 1V8?
| Camera (conn. thru R100, 100Ω) (Aptina MT9V133-D EXTCLK? PIXCLK?)
|-
| TP167
| CAM_D5
| CM_D5
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP168
| VDD28
| V28
| 2.8V power rail
| Only used by the camera. Generated by an LDO (U12) from VDD33 (Aptina MT9V133-D analog power rail?)
|-
! scope="row" colspan=" | (TP169 doesn't exist)
|-
| TP170
| CAM_LED
| CM_LED
| Camera LED cathode?
| Connected through Q13 and R68 to BPTWL.
|-
| TP171
| RTC_INT
| RC_INT
| 1V8?
| RTC->CPU-TWL interrupt
|-
| TP172
| SD10_CLK
| S10_CK
| 3V3
| SD card
|-
| TP173
| SD10_DATA0
| S10_D0
| 3V3
| SD card
|-
| TP174
| SD10_DATA1
| S10_D1
| 3V3
| SD card
|-
| TP175
| SD10_DATA2
| S10_D2
| 3V3
| SD card
|-
| TP176
| SD10_DATA3
| S10_D3
| 3V3
| SD card
|-
| TP177
| SD10_CMD
| S10_CD
| 3V3
| SD card
|-
| TP178
| SD10_CP
| S10_CP
| 3V3
| SD card (card detect)
|-
| TP179
| SD10_WP
| S10_WP
| 3V3
| SD card write protect
|-
| TP180
| GND
| GND
| ground
|
|-
! scope="row" colspan="5" | (TP181 doesn't exist)
|-
| TP182
| SD10_VDD
| S10_V
| 3.3V power rail
| same net as VDD33
|-
| TP183
| AOUT
|
|
| charging/battery status ?
|-
| TP184
| ADPO
|
|
| charging/battery status ?
|-
| TP185
| SCL1
|
| 3V3
| BPTWL bus
|-
| TP186
| SDA1
|
| 3V3
| BPTWL bus
|-
| TP187
| SND_SDI
| SND_DI
| 1V8
| I2S bus
|-
| TP188
| SND_SDO
| SND_DO
| 1V8
| I2S bus
|-
| TP189
| SND_WS
|
| 1V8
| I2S bus
|-
| TP190
| SND_SCLK aka BCLK
| SND_BK
| 1V8
| I2S bus
|-
| TP191
| SND_MCLK
| SND_MK
| 1V8
| Reference frequency for TSC
|-
| TP192
| PWSWO
| PSWO
| 3V3?
| powerbutton "output" from PMIC to BPTWL?
|-
| TP193
| TH
|
| ?
| battery internal temperature detector?
|-
| TP194
| VSHD
|
| 5.0V power rail
| Same net as VDD5. For LCDs.
|}

== UTL-SUB-01 testpoints ==

{| class="wikitable" border="1"
|-
! number
! name (TWL testpoint)
! voltage standard
! comment
|-
| TP1
| ?
| ?
| to TH1 component
|-
| TP2
| GND
| (GND)
| ground
|-
| TP3
| P06
| 3V3?
| D-pad up
|-
| TP4
| P04
| 3V3?
| D-pad right
|-
| TP5
| P05
| 3V3?
| D-pad left
|-
| TP6
| P07
| 3V3?
| D-pad down
|-
| TP7
| PWSW
| ?
| raw powerbutton input (to PMIC and BPTWL)
|-
| TP8
| RED
| open collector (at cathode)
| Battery low LED (DL1)
|-
| TP9
| YELLOW
| open collector (at cathode)
| WiFi indicator LED (DL4)
|-
| TP10
| BLUE
| 3V3? 4V2? (at anode)
| Power on/good LED (DL2)
|-
| TP11
| ORANGE
| 3V3? 4V2? (at anode)
| Charging indicator (DL3)
|-
| TP12
| VDD42
| 4.2V power supply
| Power supply for TP8/TP10 LEDs
|}

== P16 pinout ==

The P16 pinout changed from [https://problemkaputt.de/gbatek-aux-dsi-internal-connectors.htm what it was on the regular DSi]. Some nets are now found in P24 instead (see below).

{| class="wikitable" border="1"
|-
! name
! pin no
! pin no
! name
|-
| GND
| 1
| 2
| GND
|-
| GND
| 3
| 4
| GND
|-
| GND
| 5
| 6
| GND
|-
| SD10_CLK
| 7
| 8
| GND
|-
| VDD33
| 9
| 10
| SD10_D0
|-
| VDD33
| 11
| 12
| SD10_D1
|-
| GND
| 13
| 14
| SD10_WP
|-
| SD10_CMD
| 15
| 16
| VDD33
|-
| GND
| 17
| 18
| P08
|-
| SD10_D3
| 19
| 20
| VDD33
|-
| SD10_D2
| 21
| 22
| SD10_CD
|-
| GND
| 23
| 24
| GND
|-
| GND
| 25
| 26
| GND
|}

== P24 pinout ==

P24 is a mezzanine connector for the VOLP/VOLN buttons and the shoulder L button (which were on P16 on the DSi).

{| class="wikitable" border="1"
|-
! name
! pin no
! pin no
! name
|-
| GND
| 1
| 2
| GND
|-
| N/C
| 3
| 4
| VOLP
|-
| P09 (shoulder-L)
| 5
| 6
| VOLN
|-
| GND
| 7-13
| 8-14
| GND
|}

[[Category:Hardware]]

DSi XL testpoints

2023-12-01T15:01:46Z

PoroCYon: /* UTL-CPU-01 testpoints */

== UTL-CPU-01 testpoints ==

{| class="wikitable" border="1"
|-
! number
! name (TWL testpoint)
! voltage standard
! comment
|-
| TP1
| EXTB+
| ?
|
|-
| TP2
| VIN
| ≃5V DC
| External charger power input
|-
| TP3
| Rosc
| ?
| ?
|-
| TP4
| RICHG
| ?
| Recharge?
|-
| TP5
| GND
| ground
| (near external charger connector)
|-
| TP6
| VDD12 (aka V12)
| 1.2V power rail
| CPU-TWL core voltage
|-
| TP7
| BT+
| battery +
| at 2-pin power connector to UTL-SUB-01
|-
| TP8
| VDET-
| ?
| ?
|-
| TP9
| DET
| ?
| ?
|-
| TP10
| VDD18 (aka V18)
| 1.8V power rail
| Various I/O and core voltage (incl. RTC)
|-
| TP11
| ?
| ?
| something charging?
|-
| TP12
| VDD10
| 10V power rail
| For LCDs
|-
| TP13
| VDD33 (aka V33)
| 3.3V power rail
| Various I/O and core voltage
|-
| TP14
| GND
| ground
| (near PMIC)
|-
| TP15
| B+
| ?
| battery + ?
|-
| TP16
| VDD-5
| -5V power rail
| For LCDs
|-
| TP17
| PVDD
| ?
| ?
|-
| TP18
| VDD5
| 5.0V power rail
| For LCDs
|-
| TP19
| SG?
| ?
| ?
|-
| TP20
| BLA1
| ?
| backlight anode for lower screen
|-
| TP21
| VDD42?
| 4.2V? power rail (it's certainly a power rail)
| generated from VDD5 using diode voltage drops? (to D6, C22, D3)
|-
| TP22
| BLC1
| ?
| backlight cathode for lower screen
|-
| TP23
| BLA2
| ?
| backlight anode for upper screen
|-
! scope="row" colspan="4" | (TP24, TP25 don't exist)
|-
| TP26
| BLC2
| ?
| backlight cathode for upper screen
|-
! scope="row" colspan="4" | (TP27 doesn't exist)
|-
| TP28
| MIC-
| ground
| same net as (analog) ground
|-
| TP29
| MIC+
| analog
| Analog microphone-in signal
|-
| TP30
| SPRP
| analog
| positive signal for right built-in speaker
|-
| TP31
| SPRN
| analog
| negative signal for right built-in speaker
|-
| TP32
| SPLP
| analog
| positive signal for left built-in speaker
|-
| TP33
| SPLN
| analog
| negative signal for left built-in speaker
|-
| TP34
| GND
| ground
| probably analog ground
|-
| TP35
| SR
| analog
| headphone tip
|-
| TP36
| SL
| analog
| headphone ring
|-
! scope="row" colspan="4" | (TP37, TP38 don't exist)
|-
| TP39
| ORANGE
| 3V3? 4V2? (at anode)
| Orange LED charging indicator
|-
| TP40
| BLUE
| 3V3? 4V2? (at anode)
| Blue LED power good indicator
|-
| TP41
| RED
| open collector (connected to LED cathode)
| Red LED battery low indicator
|-
| TP42
| MC1_D7
| 3V3
| MSB of gamecard parallell ROM *or* AUXSPI COPI signal
|-
| TP43
| MC1_D6
| 3V3
| 6th bit of gamecard parallell ROM *or* AUXSPI CIPO signal
|-
| TP44
| MC1_VCC
| 3.3V power
| power supply to gamecard (can be switched off by SoC)
|-
! scope="row" colspan="4" | (TP45 doesn't exist)
|-
| TP46
| MC1_D5
| 3V3
|
|-
| TP47
| MC1_D4
| 3V3
|
|-
| TP48
| MC1_D3
| 3V3
|
|-
| TP49
| MC1_DET
| 3V3
| Cartridge detected in slot (active-low)
|-
| TP50
| MC1_D2
| 3V3
|
|-
| TP51
| MC1_IREQ
| 3V3
| gamecart->SoC IRQ
|-
| TP52
| MC1_D1
| 3V3
|
|-
| TP53
| MC1_RES
| 3V3
| SoC->gamecart reset signal
|-
| TP54
| MC1_D0
| 3V3
|
|-
| TP55
| MC1_CS
| 3V3
| parallell ROM select (active-low)
|-
| TP56
| MC1_CLK
| 3V3
|
|-
| TP57
| MC1_CS2
| 3V3
| AUXSPI select (active-low)
|-
| TP58
| mRST
| 3V3
| BPTWL reset (active-low)
|-
| TP59
| mFE
| 3V3
| BPTWL flash enable (cf. 78K0/Kx2 Serial Flash Programming protocol, see NEC/Renesas docs)
|-
| TP60
| VOLP
| 3V3
| volume + button (also RxD6 for 78K0 SFP. There's a series resistor to the physical button as protection against shorts)
|-
| TP61
| VOLN
| 3V3
| volume - button (also TxD6 for 78K0 SFP. There's a series resistor to the physical button as protection against shorts)
|-
| TP62
| ATH_TX_H
| 3V3
| AR6002 ANTD, "Control signal for shared antenna switch", probably enables Ath TX antenna
|-
| TP63
| WL_TXPE
| 3V3
| Old Wifi TX enable?
|-
! scope="row" colspan="4" | (TP64 doesn't exist)
|-
| TP65
| WL_RXPE
| 3V3
| Old Wifi RX enable?
|-
| TP66
| /WIFI_RST
| 3V3
| New WiFi (Ath6k) reset (active-low)
|-
! scope="row" colspan="4" | (TP67, TP68 don't exist)
|-
| TP69
| SPI_MOSI
| 3V3
| SPI bus
|-
! scope="row" colspan="4" | (TP70 doesn't exist)
|-
| TP71
| SPI_MISO
| 3V3
| SPI bus
|-
! scope="row" colspan="4" | (TP72 doesn't exist)
|-
| TP73
| SPI_SCK
| 3V3
| SPI bus
|-
! scope="row" colspan="4" | (TP74, TP75 don't exist)
|-
| TP76
| SPI_CS1
| 3V3
| SPI chip select 1 (PMIC)
|-
! scope="row" colspan="4" | (TP77 doesn't exist)
|-
| TP78
| SPI_CS3
| 3V3
| SPI chip select 3 (TSC)
|-
| TP79
| SPI_CS2
| 3V3
| SPI chip select 2 ([[NVRAM]])
|-
| TP80
| SCL
| 1V8
| CPU-TWL bus
|-
! scope="row" colspan="4" | (TP81 doesn't exist)
|-
| TP82
| SDA
| 1V8
| CPU-TWL bus
|-
| TP83
| PENIRQ
| 1V8? 3V3?
| touchscreen pen down
|-
| TP84
| R7
| 1V8?
| hinge magnet detect signal (active-low)
|-
| TP85
| RESET
| 3V3, but use as open drain/collector
| CPU-TWL reset signal
|-
| TP86
| P05
| 3V3?
| dpad left button
|-
| TP87
| P04
| 3V3?
| dpad right button
|-
| TP88
| P03
| 3V3?
| start button
|-
| TP89
| P02
| 3V3?
| select button
|-
| TP90
| P01
| 3V3?
| B button
|-
| TP91
| P00
| 3V3?
| A button
|-
| TP92
| PM_SLP
| ?
| ?
|-
| TP93
| VCNT5
| ?
| ?
|-
| TP94
| GPIO330?
| 3V3
| GPIO debug testpoint
|-
| TP95
| R01
| ?
| Y button
|-
| TP96
| R00
| ?
| X button
|-
| TP97
| P09
| 3V3
| shoulder-L button
|-
| TP98
| P08
| 3V3
| shoulder-R button
|-
| TP99
| MUTE
| 3V3
| ? (controlled by GPIO333 through U17)
|-
| TP100
| P07
| 3V3?
| dpad down button
|-
| TP101
| HP#SP
| 3V3
| audio out is headphones (1) or speakers (0). aka GPIO331
|-
| TP102
| P06
| 3V3?
| dpad up button
|-
! scope="row" colspan="4" | (TP103 doesn't exist)
|-
| TP104
| nIRQ_O?
| 3V3
| "powerbutton pressed" signal from the BPTWL to the CPU-TWL. aka GPIO332
|-
| TP105
| LDR20
|
| top LCD R.bit0
|-
| TP106
| LDR21
|
| top LCD R.bit1
|-
| TP107
| LDR22
|
| top LCD R.bit2
|-
| TP108
| LDR23
|
| top LCD R.bit3
|-
| TP109
| LDR24
|
| top LCD R.bit4
|-
| TP110
| LDB21
|
| top LCD B.bit1
|-
| TP111
| LDG21
|
| top LCD G.bit1
|-
| TP112
| LDG22
|
| top LCD G.bit2
|-
| TP113
| LDG25
|
| top LCD G.bit5
|-
| TP114
| LDB20
|
| top LCD B.bit0
|-
| TP115
| LDB23
|
| top LCD B.bit3
|-
| TP116
| LDR11
|
| bottom LCD R.bit1
|-
| TP117
| LDR12
|
| bottom LCD R.bit4
|-
| TP118
| LDR15
|
| bottom LCD R.bit5
|-
| TP119
| LDR25
|
| top LCD R.bit5
|-
| TP120
| LDG20
|
| top LCD G.bit2
|-
| TP121
| LDG23
|
| top LCD G.bit3
|-
| TP122
| LDG24
|
| top LCD G.bit4
|-
| TP123
| LDB22
|
| top LCD B.bit2
|-
| TP124
| LDB24
|
| top LCD B.bit4
|-
| TP125
| LDB25
|
| top LCD B.bit5
|-
| TP126
| LDR10
|
| bottom LCD R.bit0
|-
| TP127
| LDR13
|
| bottom LCD R.bit3
|-
| TP128
| LDR14
|
| bottom LCD R.bit4
|-
| TP129
| LDG10
|
| bottom LCD G.bit0
|-
| TP130
| LDG11
|
| bottom LCD G.bit1
|-
| TP131
| LDG12
|
| bottom LCD G.bit2
|-
| TP132
| LDG13
|
| bottom LCD G.bit3
|-
| TP133
| LDG15
|
| bottom LCD G.bit5
|-
| TP134
| LDB11
|
| bottom LCD B.bit1
|-
| TP135
| LDG14
|
| bottom LCD G.bit4
|-
| TP136
| LDB10
|
| bottom LCD B.bit0
|-
| TP137
| COM2
| ?
| ?
|-
| TP138
| LDB12
|
| bottom LCD B.bit2
|-
| TP139
| LDB13
|
| bottom LCD B.bit3
|-
| TP140
| LDB14
|
| bottom LCD B.bit4
|-
| TP141
| LDB15
|
| bottom LCD B.bit5
|-
| TP142
| INI
| ?
| LCD controller ?
|-
| TP143
| GSP
|
| LCD controller Vsync?
|-
| TP144
| GCK
| ?
| LCD controller ?
|-
| TP145
| REV
|
| LCD controller ?
|-
| TP146
| LS
|
| LCD controller Hsync?
|-
| TP147
| SPL
|
| LCD controller ?
|-
| TP148
| DCLK
|
| LCD controller dot clock
|-
| TP149
| CAM_RST
| 1V8?
| Camera reset signal
|-
| TP150
| COM1
| ?
| ?
|-
! scope="row" colspan="4" | (TP151 doesn't exist)
|-
| TP152
| CAM_D4
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP153
| HSYNC
| 1V8?
| Camera horizontal sync/blank (conn. thru R133, 0Ω) (Aptina MT9V133-D LINE_VALID, active-low)
|-
| TP154
| CAM_D3
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP155
| VSYNC
| 1V8?
| Camera vertical sync/blank (conn. thru R132, 0Ω) (Aptina MT9V133-D FRAME_VALID, active-low)
|-
| TP156
| CKI
| 1V8?
| Camera clock something? (Aptina MT9V133-D EXTCLK? PIXCLK?)
|-
| TP157
| CAM_D2
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP158
| CAM_D7
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP159
| CAM_D1
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP160
| X+
| ?
| touchscreen
|-
| TP161
| Y+
| ?
| touchscreen
|-
| TP162
| X-
| ?
| touchscreen, same net as Y-
|-
| TP163
| Y-
| ?
| touchscreen, same net as X-
|-
| TP164
| CAM_D6
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP165
| CAM_D0
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP166
| RCLK
| 1V8?
| Camera (conn. thru R100, 100Ω) (Aptina MT9V133-D EXTCLK? PIXCLK?)
|-
| TP167
| CAM_D5
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP168
| VDD28
| 2.8V power rail
| Only used by the camera. Generated by an LDO (U12) from VDD33 (Aptina MT9V133-D analog power rail?)
|-
! scope="row" colspan="4" | (TP169 doesn't exist)
|-
| TP170
| CAM_LED
| Camera LED cathode?
| Connected through Q13 and R68 to BPTWL.
|-
| TP171
| RTC_INT
| 1V8?
| RTC->CPU-TWL interrupt
|-
| TP172
| SD10_CLK
| 3V3
| SD card
|-
| TP173
| SD10_D0
| 3V3
| SD card
|-
| TP174
| SD10_D1
| 3V3
| SD card
|-
| TP175
| SD10_D2
| 3V3
| SD card
|-
| TP176
| SD10_D3
| 3V3
| SD card
|-
| TP177
| SD10_CMD
| 3V3
| SD card
|-
| TP178
| SD10_CP
| 3V3
| SD card (card detect)
|-
| TP179
| SD10_WP
| 3V3
| SD card write protect
|-
| TP180
| GND
| ground
|
|-
! scope="row" colspan="4" | (TP181 doesn't exist)
|-
| TP182
| SD10_VDD
| 3.3V power rail
| same net as VDD33
|-
| TP183
| AOUT
|
| charging/battery status ?
|-
| TP184
| ADPO
|
| charging/battery status ?
|-
| TP185
| SCL1
| 3V3
| BPTWL bus
|-
| TP186
| SDA1
| 3V3
| BPTWL bus
|-
| TP187
| SDI
| 1V8
| I2S bus
|-
| TP188
| SDO
| 1V8
| I2S bus
|-
| TP189
| WS
| 1V8
| I2S bus
|-
| TP190
| SCLK aka BCLK
| 1V8
| I2S bus
|-
| TP191
| MCLK
| 1V8
| Reference frequency for TSC
|-
| TP192
| PWSWO
| 3V3?
| powerbutton "output" from PMIC to BPTWL?
|-
| TP193
| TH
| ?
| something battery charger?
|-
| TP194
| VSHD
| 5.0V power rail
| Same net as VDD5. For LCDs.
|}

== UTL-SUB-01 testpoints ==

{| class="wikitable" border="1"
|-
! number
! name (TWL testpoint)
! voltage standard
! comment
|-
| TP1
| ?
| ?
| to TH1 component
|-
| TP2
| GND
| (GND)
| ground
|-
| TP3
| P06
| 3V3?
| D-pad up
|-
| TP4
| P04
| 3V3?
| D-pad right
|-
| TP5
| P05
| 3V3?
| D-pad left
|-
| TP6
| P07
| 3V3?
| D-pad down
|-
| TP7
| PWSW
| ?
| raw powerbutton input (to PMIC and BPTWL)
|-
| TP8
| RED
| open collector (at cathode)
| Battery low LED (DL1)
|-
| TP9
| YELLOW
| open collector (at cathode)
| WiFi indicator LED (DL4)
|-
| TP10
| BLUE
| 3V3? 4V2? (at anode)
| Power on/good LED (DL2)
|-
| TP11
| ORANGE
| 3V3? 4V2? (at anode)
| Charging indicator (DL3)
|-
| TP12
| VDD42
| 4.2V power supply
| Power supply for TP8/TP10 LEDs
|}

== P16 pinout ==

The P16 pinout changed from [https://problemkaputt.de/gbatek-aux-dsi-internal-connectors.htm what it was on the regular DSi]. Some nets are now found in P24 instead (see below).

{| class="wikitable" border="1"
|-
! name
! pin no
! pin no
! name
|-
| GND
| 1
| 2
| GND
|-
| GND
| 3
| 4
| GND
|-
| GND
| 5
| 6
| GND
|-
| SD10_CLK
| 7
| 8
| GND
|-
| VDD33
| 9
| 10
| SD10_D0
|-
| VDD33
| 11
| 12
| SD10_D1
|-
| GND
| 13
| 14
| SD10_WP
|-
| SD10_CMD
| 15
| 16
| VDD33
|-
| GND
| 17
| 18
| P08
|-
| SD10_D3
| 19
| 20
| VDD33
|-
| SD10_D2
| 21
| 22
| SD10_CD
|-
| GND
| 23
| 24
| GND
|-
| GND
| 25
| 26
| GND
|}

== P24 pinout ==

P24 is a mezzanine connector for the VOLP/VOLN buttons and the shoulder L button (which were on P16 on the DSi).

{| class="wikitable" border="1"
|-
! name
! pin no
! pin no
! name
|-
| GND
| 1
| 2
| GND
|-
| N/C
| 3
| 4
| VOLP
|-
| P09 (shoulder-L)
| 5
| 6
| VOLN
|-
| GND
| 7-13
| 8-14
| GND
|}

[[Category:Hardware]]

WiFi Module

2023-09-01T19:49:28Z

PoroCYon: Xtensa JTAG stuff (yeah)

== Introduction ==

There appear to be 3 WiFi modules at use in the DSi. These implement both the "old" WiFi chip (MM3315/MM3218) for DS-mode backwards compatibility, as well as a new Atheros 6k-based WiFi chip. The DS WiFi is configured through profiles 1-3 and is limited to 802.11b 1-2Mbps and WEP encryption while the Atheros supports 802.11g rates and WPA encryption, configured through profiles 4-6.

Next to the WiFi chips, these modules also carry the [[NVRAM]] chip. The DSi only uses a tiny portion of the 128KB available for startup data, calibration, and user settings. Newer revisions of this board have a SPI EEPROM that has no backing memory for most of the 1Mbit address space (presumably as cost savings?). Thus, older modules can be used for installing the "dslink" WiFi loader (to be launched in DSi mode via save-game hacks in DSi hybrid games), while newer modules require a hardmod (chip replacement) to achieve this (as demonstrated by khmann, using an ST M34PE20 chip as replacement). All revisions of the module have footprints for both large and small NVRAM chip, and the change to the limited chip occurred prior to the release of the dslink exploit.

The Mitsumi WiFi is controlled through data in the NVRAM (eg: [https://problemkaputt.de/gbatek-ds-firmware-wifi-calibration-data.htm calibration data, allowed channels]), while the Atheros configuration is stored in the other tiny IC on the board, an I2C EEPROM.

The pinout of the connector can be found in FCC documents (see below). This connector includes pins for JTAG access to the Xtensa core in the Atheros chip (using 3.3V signals, though the 1.8V rail needs to be supplied from an external source as well). It presumably uses the same debug interface as found in the ESP8266 and ESP32 chips (which also use Xtensa CPUs), though no reports of people attempting to connect to it have been found at the time of writing.

If this module is disconnected the DSi turns on to a black screen, because it can't read the NVRAM. If the DSi doesn't like the data contained on the module it will give either error 0000FEFE or 0000FE00 at poweron. See [[stage1]] for more information.

== Models ==

The original DSi DWM-W015 module features two wireless chips; a Mitsumi MM3218 for DS compatibility and a more modern Atheros AR6002G BGA which share the antenna through an RF switch. It also features 1Mbit of SPI EEPROM ([[Media:STM45PE10.pdf|ST M45PE10]]) for NVRAM. It has enough space to store a full copy of the old DS firmware.

The updated DWM-W015A module uses a tiny "5A32" chip as NVRAM (UDFN/XSON, as opposed to the SOIC-sized chip in the older revision). Only the first and last few memory blocks are actually backed by a nonvolatile memory, other addresses return garbage.

The DSiXL or DSi/LL module is labeled DWM-W024, and includes only an Atheros AR6013G-AL1C, a 5A32 variant, empty SPI flash pads, and another small chip, the Atheros-native I2C configuration.
For reference, the 3DS DWM-W028 module is reported to use an Atheros AR6014G-AL1C. The connector pinout is unchanged. These AR601x chips contain the combined functionality of both the AR6002 and MM3218 chips found on the DWM-W015.

== Photos ==

=== DWM-W015 ===

[http://www.flickr.com/photos/micahdowty/3846960965/sizes/o/in/photostream/ Image source]

[[Image:Dwm-w015-scanlime.jpg|800px]]

=== DWM-W015A ===

[[Image:DWM-W015a.jpg]]

Note the circle in this image shows a 10k resistor from pin 5 WP to GND, which the ST M45PE10 datasheet indicates will write-protect the first 64K. To disable this protection according to the SPI datasheet, remove the resistor and solder pin 5 to pin 6 VCC.

=== DWM-W024 ===

[[Image:Dwm-w024.jpg|800px]]

== Debugging the Ath6k Xtensa CPU ==

In case you want to run your own code on it (and subsequently need to debug it), the Atheros chip has two debug facilities: UART and JTAG. UART is a simple serial connection for printf-debugging, while JTAG can be used for single-stepping, breakpoints, etc.

'''NOTE THAT BOTH UART AND JTAG USE 1.8V LOGIC LEVELS. DO NOT DRIVE WITH 3.3 OR 5.0 V!!!'''

=== UART ===

Serial communication on the Xtensa side can be done as [https://problemkaputt.de/gbatek-dsi-atheros-wifi-internal-i-o-00c000h-serial-uart-hw2-hw4-hw6.htm described in GBATEK]. On the DWM-W015, the UART testpoints appear on the bottom side of the PCB, near the edge (see below). On the DWM-W024, RX and TX are probably one of the four testpoints on the top side (see above).

[[Image:Dwm-w015-bottom-marked.jpg|400px]]

=== JTAG ===

The four primary JTAG pins are exposed on the connector to the main board. However, the AR6002 has two extra pins that control JTAG functionality: JTAG_nRST and EJTAG_RST. They are marked in the image below, and they work as follows:

* '''JTAG_nRST''' resets the CPU core when pulled low. Some debuggers use this signal.
* '''EJTAG_RST''' is latched on chip powerup. If high, after a 'system' reset (read: the nWIFI_RST on the connector is pulled low), the Xtensa CPU is held at reset until JTAG_nRST is brought high. If EJTAG_RST is low, nothing special happens.

Thus, if your debugger has a JTAG_nRST signal (and you want to use it), pull EJTAG_RST to VDD18, and connect JTAG_nRST to your debugger. Otherwise, pull EJTAG_RST to ground (or leave it floating as-is, it probably has an internal pulldown).

As debugger, OpenOCD (or its fork for the ESP32) and any JTAG dongle compatible with it should work. '''Note that all JTAG communications use 1.8V! Using a higher voltage will kill the AR6002!'''

[[Image:Dwm-w015-top-marked.jpg|400px]]

=== DWM-W024 testpoints ===

The DWM-W024 has four testpoints with currently-unknown functionality. These are probably UART TX, UART RX, JTAG_nRST, and EJTAG_RST. However, which testpoint is which signal is not yet known.

== Documents and external links ==

* [https://fccid.io/EW4DWMW015/Label/Label-Location-1031953.pdf FCC "label location"] document of the DWM-W015 (includes pinout)
* [https://fccid.io/EW4DWMW024/Label/Label-format-and-location-1137926.pdf FCC "label location"] document of the DWM-W024 (includes pinout)
* [[File:3002_Datasheet.pdf]] MM3315 aka RF3002 datasheet (old DS WiFi baseband chip)
* [[File:9008-pk020_Rev(B).pdf]] RF9008 datasheet (old DS WiFi RF chip)
* [[File:AR6002_Atheros.pdf.zip]] AR6002 datasheet (zipped to circumvent wiki upload size limits)
* [https://problemkaputt.de/gbatek-dsi-atheros-wifi-internal-hardware.htm GBATEK's information on the AR6002].
* [https://problemkaputt.de/gbatek-aux-dsi-chipset-pinouts.htm MM3218 and AR60xx chip pinouts on GBATEK]

File:Dwm-w015-scanlime.jpg

2023-09-01T19:32:15Z

PoroCYon: DWM-W015, both sides of the PCB, photo taken by scanlime (source: http://www.flickr.com/photos/micahdowty/3846960965/sizes/o/in/photostream/ )

== Summary ==
DWM-W015, both sides of the PCB, photo taken by scanlime (source: http://www.flickr.com/photos/micahdowty/3846960965/sizes/o/in/photostream/ )

File:Dwm-w015-bottom-marked.jpg

2023-09-01T19:29:54Z

PoroCYon: DWM-W015 bottom side, with UART testpoints marked

== Summary ==
DWM-W015 bottom side, with UART testpoints marked

File:Dwm-w015-top-marked.jpg

2023-09-01T19:29:26Z

PoroCYon: DWM-W015 top side, marked with JTAG_nRST and EJTAG_RST pins

== Summary ==
DWM-W015 top side, marked with JTAG_nRST and EJTAG_RST pins

File:Dwm-w015-top-no-ar6002-for-dsibrew.jpg

2023-09-01T19:28:52Z

PoroCYon: DWM-W015 top side (AR6002 desoldered) Composite of two images with different lighting direction, merged using the 'Lighten' blend mode in GNU IMP. This has been done to eliminate the effect of shadows.

== Summary ==
DWM-W015 top side (AR6002 desoldered)

Composite of two images with different lighting direction, merged using the 'Lighten' blend mode in GNU IMP. This has been done to eliminate the effect of shadows.

DSi XL testpoints

2023-09-01T19:13:35Z

PoroCYon: wifi updates

== UTL-CPU-01 testpoints ==

{| class="wikitable" border="1"
|-
! number
! name (TWL testpoint)
! voltage standard
! comment
|-
| TP1
| EXTB+
| ?
|
|-
| TP2
| VIN
| ≃5V DC
| External charger power input
|-
| TP3
| Rosc
| ?
| ?
|-
| TP4
| RICHG
| ?
| Recharge?
|-
| TP5
| GND
| ground
| (near external charger connector)
|-
| TP6
| VDD12 (aka V12)
| 1.2V power rail
| CPU-TWL core voltage
|-
| TP7
| BT+
| battery +
| at 2-pin power connector to UTL-SUB-01
|-
| TP8
| VDET-
| ?
| ?
|-
| TP9
| DET
| ?
| ?
|-
| TP10
| VDD18 (aka V18)
| 1.8V power rail
| Various I/O and core voltage (incl. RTC)
|-
| TP11
| ?
| ?
| something charging?
|-
| TP12
| VDD10
| 10V power rail
| For LCDs
|-
| TP13
| VDD33 (aka V33)
| 3.3V power rail
| Various I/O and core voltage
|-
| TP14
| GND
| ground
| (near PMIC)
|-
| TP15
| B+
| ?
| battery + ?
|-
| TP16
| VDD-5
| -5V power rail
| For LCDs
|-
| TP17
| PVDD
| ?
| ?
|-
| TP18
| VDD5
| 5.0V power rail
| For LCDs
|-
| TP19
| SG?
| ?
| ?
|-
| TP20
| BLA1
| ?
| backlight anode for lower screen
|-
| TP21
| VDD42?
| 4.2V? power rail (it's certainly a power rail)
| generated from VDD5 using diode voltage drops? (to D6, C22, D3)
|-
| TP22
| BLC1
| ?
| backlight cathode for lower screen
|-
| TP23
| BLA2
| ?
| backlight anode for upper screen
|-
! scope="row" colspan="4" | (TP24, TP25 don't exist)
|-
| TP26
| BLC2
| ?
| backlight cathode for upper screen
|-
! scope="row" colspan="4" | (TP27 doesn't exist)
|-
| TP28
| MIC-
| ground
| same net as (analog) ground
|-
| TP29
| MIC+
| analog
| Analog microphone-in signal
|-
| TP30
| SPRP
| analog
| positive signal for right built-in speaker
|-
| TP31
| SPRN
| analog
| negative signal for right built-in speaker
|-
| TP32
| SPLP
| analog
| positive signal for left built-in speaker
|-
| TP33
| SPLN
| analog
| negative signal for left built-in speaker
|-
| TP34
| GND
| ground
| probably analog ground
|-
| TP35
| SR
| analog
| headphone tip
|-
| TP36
| SL
| analog
| headphone ring
|-
! scope="row" colspan="4" | (TP37, TP38 don't exist)
|-
| TP39
| ORANGE
| 3V3? 4V2? (at anode)
| Orange LED charging indicator
|-
| TP40
| BLUE
| 3V3? 4V2? (at anode)
| Blue LED power good indicator
|-
| TP41
| RED
| open collector (connected to LED cathode)
| Red LED battery low indicator
|-
| TP42
| MC1_D7
| 3V3
| MSB of gamecard parallell ROM *or* AUXSPI COPI signal
|-
| TP43
| MC1_D6
| 3V3
| 6th bit of gamecard parallell ROM *or* AUXSPI CIPO signal
|-
| TP44
| MC1_VCC
| 3.3V power
| power supply to gamecard (can be switched off by SoC)
|-
! scope="row" colspan="4" | (TP45 doesn't exist)
|-
| TP46
| MC1_D5
| 3V3
|
|-
| TP47
| MC1_D4
| 3V3
|
|-
| TP48
| MC1_D3
| 3V3
|
|-
| TP49
| MC1_DET
| 3V3
| Cartridge detected in slot (active-low)
|-
| TP50
| MC1_D2
| 3V3
|
|-
| TP51
| MC1_IREQ
| 3V3
| gamecart->SoC IRQ
|-
| TP52
| MC1_D1
| 3V3
|
|-
| TP53
| MC1_RES
| 3V3
| SoC->gamecart reset signal
|-
| TP54
| MC1_D0
| 3V3
|
|-
| TP55
| MC1_CS
| 3V3
| parallell ROM select (active-low)
|-
| TP56
| MC1_CLK
| 3V3
|
|-
| TP57
| MC1_CS2
| 3V3
| AUXSPI select (active-low)
|-
| TP58
| mRST
| 3V3
| BPTWL reset (active-low)
|-
| TP59
| mFE
| 3V3
| BPTWL flash enable (cf. 78K0/Kx2 Serial Flash Programming protocol, see NEC/Renesas docs)
|-
| TP60
| VOLP
| 3V3
| volume + button (also RxD6 for 78K0 SFP. There's a series resistor to the physical button as protection against shorts)
|-
| TP61
| VOLN
| 3V3
| volume - button (also TxD6 for 78K0 SFP. There's a series resistor to the physical button as protection against shorts)
|-
| TP62
| ATH_TX_H
| 3V3
| AR6002 ANTD, "Control signal for shared antenna switch", probably enables Ath TX antenna
|-
| TP63
| WL_TXPE
| 3V3
| Old Wifi TX enable?
|-
! scope="row" colspan="4" | (TP64 doesn't exist)
|-
| TP65
| WL_RXPE
| 3V3
| Old Wifi RX enable?
|-
| TP66
| /WIFI_RST
| 3V3
| New WiFi (Ath6k) reset (active-low)
|-
! scope="row" colspan="4" | (TP67, TP68 don't exist)
|-
| TP69
| SPI_MOSI
| 3V3
| SPI bus
|-
! scope="row" colspan="4" | (TP70 doesn't exist)
|-
| TP71
| SPI_MISO
| 3V3
| SPI bus
|-
! scope="row" colspan="4" | (TP72 doesn't exist)
|-
| TP73
| SPI_SCK
| 3V3
| SPI bus
|-
! scope="row" colspan="4" | (TP74, TP75 don't exist)
|-
| TP76
| SPI_CS1
| 3V3
| SPI chip select 1 (PMIC)
|-
! scope="row" colspan="4" | (TP77 doesn't exist)
|-
| TP78
| SPI_CS3
| 3V3
| SPI chip select 3 (TSC)
|-
| TP79
| SPI_CS2
| 3V3
| SPI chip select 2 ([[NVRAM]])
|-
| TP80
| SCL
| 1V8
| CPU-TWL bus
|-
! scope="row" colspan="4" | (TP81 doesn't exist)
|-
| TP82
| SDA
| 1V8
| CPU-TWL bus
|-
| TP83
| PENIRQ
| 1V8? 3V3?
| touchscreen pen down
|-
| TP84
| R7
| 1V8?
| hinge magnet detect signal (active-low)
|-
| TP85
| RESET
| 3V3, but use as open drain/collector
| CPU-TWL reset signal
|-
| TP86
| P05
| 3V3?
| dpad left button
|-
| TP87
| P04
| 3V3?
| dpad right button
|-
| TP88
| P03
| 3V3?
| start button
|-
| TP89
| P02
| 3V3?
| select button
|-
| TP90
| P01
| 3V3?
| B button
|-
| TP91
| P00
| 3V3?
| A button
|-
| TP92
| PM_SLP
| ?
| ?
|-
| TP93
| VCNT5
| ?
| ?
|-
| TP94
| GPIO330?
| 3V3
| GPIO debug testpoint
|-
| TP95
| R01
| ?
| Y button
|-
| TP96
| R00
| ?
| X button
|-
| TP97
| P09
| 3V3
| shoulder-L button
|-
| TP98
| P08
| 3V3
| shoulder-R button
|-
| TP99
| MUTE
| 3V3
| ? (controlled by GPIO333 through U17)
|-
| TP100
| P07
| 3V3?
| dpad down button
|-
| TP101
| HP#SP
| 3V3
| audio out is headphones (1) or speakers (0). aka GPIO331
|-
| TP102
| P06
| 3V3?
| dpad up button
|-
! scope="row" colspan="4" | (TP103 doesn't exist)
|-
| TP104
| nIRQ_O?
| 3V3
| "powerbutton pressed" signal from the BPTWL to the CPU-TWL. aka GPIO332
|-
| TP105
| LDR20
|
| top LCD R.bit0
|-
| TP106
| LDR21
|
| top LCD R.bit1
|-
| TP107
| LDR22
|
| top LCD R.bit2
|-
| TP108
| LDR23
|
| top LCD R.bit3
|-
| TP109
| LDR24
|
| top LCD R.bit4
|-
| TP110
| LDB21
|
| top LCD B.bit1
|-
| TP111
| LDG21
|
| top LCD G.bit1
|-
| TP112
| LDG22
|
| top LCD G.bit2
|-
| TP113
| LDG25
|
| top LCD G.bit5
|-
| TP114
| LDB20
|
| top LCD B.bit0
|-
| TP115
| LDB23
|
| top LCD B.bit3
|-
| TP116
| LDR11
|
| bottom LCD R.bit1
|-
| TP117
| LDR12
|
| bottom LCD R.bit4
|-
| TP118
| LDR15
|
| bottom LCD R.bit5
|-
| TP119
| LDR25
|
| top LCD R.bit5
|-
| TP120
| LDG20
|
| top LCD G.bit2
|-
| TP121
| LDG23
|
| top LCD G.bit3
|-
| TP122
| LDG24
|
| top LCD G.bit4
|-
| TP123
| LDB22
|
| top LCD B.bit2
|-
| TP124
| LDB24
|
| top LCD B.bit4
|-
| TP125
| LDB25
|
| top LCD B.bit5
|-
| TP126
| LDR10
|
| bottom LCD R.bit0
|-
| TP127
| LDR13
|
| bottom LCD R.bit3
|-
| TP128
| LDR14
|
| bottom LCD R.bit4
|-
| TP129
| LDG10
|
| bottom LCD G.bit0
|-
| TP130
| LDG11
|
| bottom LCD G.bit1
|-
| TP131
| LDG12
|
| bottom LCD G.bit2
|-
| TP132
| LDG13
|
| bottom LCD G.bit3
|-
| TP133
| LDG15
|
| bottom LCD G.bit5
|-
| TP134
| LDB11
|
| bottom LCD B.bit1
|-
| TP135
| LDG14
|
| bottom LCD G.bit4
|-
| TP136
| LDB10
|
| bottom LCD B.bit0
|-
| TP137
| COM2
| ?
| ?
|-
| TP138
| LDB12
|
| bottom LCD B.bit2
|-
| TP139
| LDB13
|
| bottom LCD B.bit3
|-
| TP140
| LDB14
|
| bottom LCD B.bit4
|-
| TP141
| LDB15
|
| bottom LCD B.bit5
|-
| TP142
| INI
| ?
| LCD controller ?
|-
| TP143
| GSP
|
| LCD controller Vsync?
|-
| TP144
| GCK
| ?
| LCD controller ?
|-
| TP145
| REV
|
| LCD controller ?
|-
| TP146
| LS
|
| LCD controller Hsync?
|-
| TP147
| SPL
|
| LCD controller ?
|-
| TP148
| DCLK
|
| LCD controller dot clock
|-
| TP149
| CAM_RST
| 1V8?
| Camera reset signal
|-
| TP150
| COM1
| ?
| ?
|-
! scope="row" colspan="4" | (TP151 doesn't exist)
|-
| TP152
| CAM_D4
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP153
| HSYNC
| 1V8?
| Camera horizontal sync/blank (conn. thru R133, 0Ω) (Aptina MT9V133-D LINE_VALID, active-low)
|-
| TP154
| CAM_D3
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP155
| VSYNC
| 1V8?
| Camera vertical sync/blank (conn. thru R132, 0Ω) (Aptina MT9V133-D FRAME_VALID, active-low)
|-
| TP156
| CKI
| 1V8?
| Camera clock something? (Aptina MT9V133-D EXTCLK? PIXCLK?)
|-
| TP157
| CAM_D2
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP158
| CAM_D7
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP159
| CAM_D1
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP160
| X+
| ?
| touchscreen
|-
| TP161
| Y+
| ?
| touchscreen
|-
| TP162
| X-
| ?
| touchscreen, same net as Y-
|-
| TP163
| Y-
| ?
| touchscreen, same net as X-
|-
| TP164
| CAM_D6
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP165
| CAM_D0
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP166
| RCLK
| 1V8?
| Camera (conn. thru R100, 100Ω) (Aptina MT9V133-D EXTCLK? PIXCLK?)
|-
| TP167
| CAM_D5
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP168
| VDD28
| 2.8V power rail
| Only used by the camera. Generated by an LDO (U12) from VDD33 (Aptina MT9V133-D analog power rail?)
|-
! scope="row" colspan="4" | (TP169 doesn't exist)
|-
| TP170
| CAM_LED
| Camera LED cathode?
| Connected through Q13 and R68 to BPTWL.
|-
| TP171
| RTC_INT
| 1V8?
| RTC->CPU-TWL interrupt
|-
| TP172
| SD10_CLK
| 3V3
| SD card
|-
| TP173
| SD10_D0
| 3V3
| SD card
|-
| TP174
| SD10_D1
| 3V3
| SD card
|-
| TP175
| SD10_D2
| 3V3
| SD card
|-
| TP176
| SD10_D3
| 3V3
| SD card
|-
| TP177
| SD10_CMD
| 3V3
| SD card
|-
| TP178
| SD10_CP
| 3V3
| SD card (card detect)
|-
| TP179
| SD10_WP
| 3V3
| SD card write protect
|-
| TP180
| GND
| ground
|
|-
! scope="row" colspan="4" | (TP181 doesn't exist)
|-
| TP182
| SD10_VDD
| 3.3V power rail
| same net as VDD33
|-
| TP183
| AOUT
|
| charging/battery status ?
|-
| TP184
| ADPO
|
| charging/battery status ?
|-
| TP185
| SCL1
| 3V3
| BPTWL bus
|-
| TP186
| SDA1
| 3V3
| BPTWL bus
|-
| TP187
| SDI
| 1V8? 3V3?
| I2S bus
|-
| TP188
| SDO
| 1V8? 3V3?
| I2S bus
|-
| TP189
| WS
| 1V8? 3V3?
| I2S bus
|-
| TP190
| SCLK
| 1V8? 3V3?
| I2S bus
|-
| TP191
| MCLK
| 1V8? 3V3?
| I2S bus
|-
| TP192
| PWSWO
| 3V3?
| powerbutton "output" from PMIC to BPTWL?
|-
| TP193
| TH
| ?
| something battery charger?
|-
| TP194
| VSHD
| 5.0V power rail
| Same net as VDD5. For LCDs.
|}

== UTL-SUB-01 testpoints ==

{| class="wikitable" border="1"
|-
! number
! name (TWL testpoint)
! voltage standard
! comment
|-
| TP1
| ?
| ?
| to TH1 component
|-
| TP2
| GND
| (GND)
| ground
|-
| TP3
| P06
| 3V3?
| D-pad up
|-
| TP4
| P04
| 3V3?
| D-pad right
|-
| TP5
| P05
| 3V3?
| D-pad left
|-
| TP6
| P07
| 3V3?
| D-pad down
|-
| TP7
| PWSW
| ?
| raw powerbutton input (to PMIC and BPTWL)
|-
| TP8
| RED
| open collector (at cathode)
| Battery low LED (DL1)
|-
| TP9
| YELLOW
| open collector (at cathode)
| WiFi indicator LED (DL4)
|-
| TP10
| BLUE
| 3V3? 4V2? (at anode)
| Power on/good LED (DL2)
|-
| TP11
| ORANGE
| 3V3? 4V2? (at anode)
| Charging indicator (DL3)
|-
| TP12
| VDD42
| 4.2V power supply
| Power supply for TP8/TP10 LEDs
|}

== P16 pinout ==

The P16 pinout changed from [https://problemkaputt.de/gbatek-aux-dsi-internal-connectors.htm what it was on the regular DSi]. Some nets are now found in P24 instead (see below).

{| class="wikitable" border="1"
|-
! name
! pin no
! pin no
! name
|-
| GND
| 1
| 2
| GND
|-
| GND
| 3
| 4
| GND
|-
| GND
| 5
| 6
| GND
|-
| SD10_CLK
| 7
| 8
| GND
|-
| VDD33
| 9
| 10
| SD10_D0
|-
| VDD33
| 11
| 12
| SD10_D1
|-
| GND
| 13
| 14
| SD10_WP
|-
| SD10_CMD
| 15
| 16
| VDD33
|-
| GND
| 17
| 18
| P08
|-
| SD10_D3
| 19
| 20
| VDD33
|-
| SD10_D2
| 21
| 22
| SD10_CD
|-
| GND
| 23
| 24
| GND
|-
| GND
| 25
| 26
| GND
|}

== P24 pinout ==

P24 is a mezzanine connector for the VOLP/VOLN buttons and the shoulder L button (which were on P16 on the DSi).

{| class="wikitable" border="1"
|-
! name
! pin no
! pin no
! name
|-
| GND
| 1
| 2
| GND
|-
| N/C
| 3
| 4
| VOLP
|-
| P09 (shoulder-L)
| 5
| 6
| VOLN
|-
| GND
| 7-13
| 8-14
| GND
|}

[[Category:Hardware]]

WiFi Module

2023-08-17T18:34:22Z

PoroCYon: /* Models */ fix link

WiFi Module

2023-08-17T18:25:19Z

PoroCYon: /* DWM-W024 */ fix image preview to have a reasonable size

File:Dwm-w024.jpg

2023-08-17T18:24:16Z

PoroCYon: PoroCYon uploaded a new version of File:Dwm-w024.jpg

DWM-W024

WiFi Module

2023-08-17T18:21:45Z

PoroCYon: fix mention/introduction of NVRAM

WiFi Module

2023-08-17T18:19:48Z

PoroCYon: clean up the article (wow it was a mess)

File:AR6002 Atheros.pdf.zip

2023-08-17T18:18:55Z

PoroCYon: Atheros AR6002 datasheet (DSi new WiFi chip), zipped to circumvent upload filesize limits

== Summary ==
Atheros AR6002 datasheet (DSi new WiFi chip), zipped to circumvent upload filesize limits

File:9008-pk020 Rev(B).pdf

2023-08-17T18:10:35Z

PoroCYon: RF9008 (DS old WiFi RF chip)

== Summary ==
RF9008 (DS old WiFi RF chip)

File:3002 Datasheet.pdf

2023-08-17T18:07:57Z

PoroCYon: MM3315/RFMD 3002 (DS old WiFi baseband chip)

== Summary ==
MM3315/RFMD 3002 (DS old WiFi baseband chip)

DSi XL testpoints

2023-08-16T11:17:55Z

PoroCYon: /* UTL-CPU-01 testpoints */ GPIO333 isn't MUTE but controls it through U17

== UTL-CPU-01 testpoints ==

{| class="wikitable" border="1"
|-
! number
! name (TWL testpoint)
! voltage standard
! comment
|-
| TP1
| EXTB+
| ?
|
|-
| TP2
| VIN
| ≃5V DC
| External charger power input
|-
| TP3
| Rosc
| ?
| ?
|-
| TP4
| RICHG
| ?
| Recharge?
|-
| TP5
| GND
| ground
| (near external charger connector)
|-
| TP6
| VDD12 (aka V12)
| 1.2V power rail
| CPU-TWL core voltage
|-
| TP7
| BT+
| battery +
| at 2-pin power connector to UTL-SUB-01
|-
| TP8
| VDET-
| ?
| ?
|-
| TP9
| DET
| ?
| ?
|-
| TP10
| VDD18 (aka V18)
| 1.8V power rail
| Various I/O and core voltage (incl. RTC)
|-
| TP11
| ?
| ?
| something charging?
|-
| TP12
| VDD10
| 10V power rail
| For LCDs
|-
| TP13
| VDD33 (aka V33)
| 3.3V power rail
| Various I/O and core voltage
|-
| TP14
| GND
| ground
| (near PMIC)
|-
| TP15
| B+
| ?
| battery + ?
|-
| TP16
| VDD-5
| -5V power rail
| For LCDs
|-
| TP17
| PVDD
| ?
| ?
|-
| TP18
| VDD5
| 5.0V power rail
| For LCDs
|-
| TP19
| SG?
| ?
| ?
|-
| TP20
| BLA1
| ?
| backlight anode for lower screen
|-
| TP21
| VDD42?
| 4.2V? power rail (it's certainly a power rail)
| generated from VDD5 using diode voltage drops? (to D6, C22, D3)
|-
| TP22
| BLC1
| ?
| backlight cathode for lower screen
|-
| TP23
| BLA2
| ?
| backlight anode for upper screen
|-
! scope="row" colspan="4" | (TP24, TP25 don't exist)
|-
| TP26
| BLC2
| ?
| backlight cathode for upper screen
|-
! scope="row" colspan="4" | (TP27 doesn't exist)
|-
| TP28
| MIC-
| ground
| same net as (analog) ground
|-
| TP29
| MIC+
| analog
| Analog microphone-in signal
|-
| TP30
| SPRP
| analog
| positive signal for right built-in speaker
|-
| TP31
| SPRN
| analog
| negative signal for right built-in speaker
|-
| TP32
| SPLP
| analog
| positive signal for left built-in speaker
|-
| TP33
| SPLN
| analog
| negative signal for left built-in speaker
|-
| TP34
| GND
| ground
| probably analog ground
|-
| TP35
| SR
| analog
| headphone tip
|-
| TP36
| SL
| analog
| headphone ring
|-
! scope="row" colspan="4" | (TP37, TP38 don't exist)
|-
| TP39
| ORANGE
| 3V3? 4V2? (at anode)
| Orange LED charging indicator
|-
| TP40
| BLUE
| 3V3? 4V2? (at anode)
| Blue LED power good indicator
|-
| TP41
| RED
| open collector (connected to LED cathode)
| Red LED battery low indicator
|-
| TP42
| MC1_D7
| 3V3
| MSB of gamecard parallell ROM *or* AUXSPI COPI signal
|-
| TP43
| MC1_D6
| 3V3
| 6th bit of gamecard parallell ROM *or* AUXSPI CIPO signal
|-
| TP44
| MC1_VCC
| 3.3V power
| power supply to gamecard (can be switched off by SoC)
|-
! scope="row" colspan="4" | (TP45 doesn't exist)
|-
| TP46
| MC1_D5
| 3V3
|
|-
| TP47
| MC1_D4
| 3V3
|
|-
| TP48
| MC1_D3
| 3V3
|
|-
| TP49
| MC1_DET
| 3V3
| Cartridge detected in slot (active-low)
|-
| TP50
| MC1_D2
| 3V3
|
|-
| TP51
| MC1_IREQ
| 3V3
| gamecart->SoC IRQ
|-
| TP52
| MC1_D1
| 3V3
|
|-
| TP53
| MC1_RES
| 3V3
| SoC->gamecart reset signal
|-
| TP54
| MC1_D0
| 3V3
|
|-
| TP55
| MC1_CS
| 3V3
| parallell ROM select (active-low)
|-
| TP56
| MC1_CLK
| 3V3
|
|-
| TP57
| MC1_CS2
| 3V3
| AUXSPI select (active-low)
|-
| TP58
| mRST
| 3V3
| BPTWL reset (active-low)
|-
| TP59
| mFE
| 3V3
| BPTWL flash enable (cf. 78K0/Kx2 Serial Flash Programming protocol, see NEC/Renesas docs)
|-
| TP60
| VOLP
| 3V3
| volume + button (also RxD6 for 78K0 SFP. There's a series resistor to the physical button as protection against shorts)
|-
| TP61
| VOLN
| 3V3
| volume - button (also TxD6 for 78K0 SFP. There's a series resistor to the physical button as protection against shorts)
|-
| TP62
| ATH_TX_H
| 3V3
| something new (Atheros) wifi?
|-
| TP63
| WL_TXPE
| 3V3
| ?
|-
! scope="row" colspan="4" | (TP64 doesn't exist)
|-
| TP65
| WL_RXPE
| 3V3
| ?
|-
| TP66
| /WIFI_RST
| 3V3
| WiFi chip(s) reset (active-lw)
|-
! scope="row" colspan="4" | (TP67, TP68 don't exist)
|-
| TP69
| SPI_MOSI
| 3V3
| SPI bus
|-
! scope="row" colspan="4" | (TP70 doesn't exist)
|-
| TP71
| SPI_MISO
| 3V3
| SPI bus
|-
! scope="row" colspan="4" | (TP72 doesn't exist)
|-
| TP73
| SPI_SCK
| 3V3
| SPI bus
|-
! scope="row" colspan="4" | (TP74, TP75 don't exist)
|-
| TP76
| SPI_CS1
| 3V3
| SPI chip select 1 (PMIC)
|-
! scope="row" colspan="4" | (TP77 doesn't exist)
|-
| TP78
| SPI_CS3
| 3V3
| SPI chip select 3 (TSC)
|-
| TP79
| SPI_CS2
| 3V3
| SPI chip select 2 ([[NVRAM]])
|-
| TP80
| SCL
| 1V8
| CPU-TWL bus
|-
! scope="row" colspan="4" | (TP81 doesn't exist)
|-
| TP82
| SDA
| 1V8
| CPU-TWL bus
|-
| TP83
| PENIRQ
| 1V8? 3V3?
| touchscreen pen down
|-
| TP84
| R7
| 1V8?
| hinge magnet detect signal (active-low)
|-
| TP85
| RESET
| 3V3, but use as open drain/collector
| CPU-TWL reset signal
|-
| TP86
| P05
| 3V3?
| dpad left button
|-
| TP87
| P04
| 3V3?
| dpad right button
|-
| TP88
| P03
| 3V3?
| start button
|-
| TP89
| P02
| 3V3?
| select button
|-
| TP90
| P01
| 3V3?
| B button
|-
| TP91
| P00
| 3V3?
| A button
|-
| TP92
| PM_SLP
| ?
| ?
|-
| TP93
| VCNT5
| ?
| ?
|-
| TP94
| GPIO330?
| 3V3
| GPIO debug testpoint
|-
| TP95
| R01
| ?
| Y button
|-
| TP96
| R00
| ?
| X button
|-
| TP97
| P09
| 3V3
| shoulder-L button
|-
| TP98
| P08
| 3V3
| shoulder-R button
|-
| TP99
| MUTE
| 3V3
| ? (controlled by GPIO333 through U17)
|-
| TP100
| P07
| 3V3?
| dpad down button
|-
| TP101
| HP#SP
| 3V3
| audio out is headphones (1) or speakers (0). aka GPIO331
|-
| TP102
| P06
| 3V3?
| dpad up button
|-
! scope="row" colspan="4" | (TP103 doesn't exist)
|-
| TP104
| nIRQ_O?
| 3V3
| "powerbutton pressed" signal from the BPTWL to the CPU-TWL. aka GPIO332
|-
| TP105
| LDR20
|
| top LCD R.bit0
|-
| TP106
| LDR21
|
| top LCD R.bit1
|-
| TP107
| LDR22
|
| top LCD R.bit2
|-
| TP108
| LDR23
|
| top LCD R.bit3
|-
| TP109
| LDR24
|
| top LCD R.bit4
|-
| TP110
| LDB21
|
| top LCD B.bit1
|-
| TP111
| LDG21
|
| top LCD G.bit1
|-
| TP112
| LDG22
|
| top LCD G.bit2
|-
| TP113
| LDG25
|
| top LCD G.bit5
|-
| TP114
| LDB20
|
| top LCD B.bit0
|-
| TP115
| LDB23
|
| top LCD B.bit3
|-
| TP116
| LDR11
|
| bottom LCD R.bit1
|-
| TP117
| LDR12
|
| bottom LCD R.bit4
|-
| TP118
| LDR15
|
| bottom LCD R.bit5
|-
| TP119
| LDR25
|
| top LCD R.bit5
|-
| TP120
| LDG20
|
| top LCD G.bit2
|-
| TP121
| LDG23
|
| top LCD G.bit3
|-
| TP122
| LDG24
|
| top LCD G.bit4
|-
| TP123
| LDB22
|
| top LCD B.bit2
|-
| TP124
| LDB24
|
| top LCD B.bit4
|-
| TP125
| LDB25
|
| top LCD B.bit5
|-
| TP126
| LDR10
|
| bottom LCD R.bit0
|-
| TP127
| LDR13
|
| bottom LCD R.bit3
|-
| TP128
| LDR14
|
| bottom LCD R.bit4
|-
| TP129
| LDG10
|
| bottom LCD G.bit0
|-
| TP130
| LDG11
|
| bottom LCD G.bit1
|-
| TP131
| LDG12
|
| bottom LCD G.bit2
|-
| TP132
| LDG13
|
| bottom LCD G.bit3
|-
| TP133
| LDG15
|
| bottom LCD G.bit5
|-
| TP134
| LDB11
|
| bottom LCD B.bit1
|-
| TP135
| LDG14
|
| bottom LCD G.bit4
|-
| TP136
| LDB10
|
| bottom LCD B.bit0
|-
| TP137
| COM2
| ?
| ?
|-
| TP138
| LDB12
|
| bottom LCD B.bit2
|-
| TP139
| LDB13
|
| bottom LCD B.bit3
|-
| TP140
| LDB14
|
| bottom LCD B.bit4
|-
| TP141
| LDB15
|
| bottom LCD B.bit5
|-
| TP142
| INI
| ?
| LCD controller ?
|-
| TP143
| GSP
|
| LCD controller Vsync?
|-
| TP144
| GCK
| ?
| LCD controller ?
|-
| TP145
| REV
|
| LCD controller ?
|-
| TP146
| LS
|
| LCD controller Hsync?
|-
| TP147
| SPL
|
| LCD controller ?
|-
| TP148
| DCLK
|
| LCD controller dot clock
|-
| TP149
| CAM_RST
| 1V8?
| Camera reset signal
|-
| TP150
| COM1
| ?
| ?
|-
! scope="row" colspan="4" | (TP151 doesn't exist)
|-
| TP152
| CAM_D4
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP153
| HSYNC
| 1V8?
| Camera horizontal sync/blank (conn. thru R133, 0Ω) (Aptina MT9V133-D LINE_VALID, active-low)
|-
| TP154
| CAM_D3
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP155
| VSYNC
| 1V8?
| Camera vertical sync/blank (conn. thru R132, 0Ω) (Aptina MT9V133-D FRAME_VALID, active-low)
|-
| TP156
| CKI
| 1V8?
| Camera clock something? (Aptina MT9V133-D EXTCLK? PIXCLK?)
|-
| TP157
| CAM_D2
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP158
| CAM_D7
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP159
| CAM_D1
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP160
| X+
| ?
| touchscreen
|-
| TP161
| Y+
| ?
| touchscreen
|-
| TP162
| X-
| ?
| touchscreen, same net as Y-
|-
| TP163
| Y-
| ?
| touchscreen, same net as X-
|-
| TP164
| CAM_D6
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP165
| CAM_D0
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP166
| RCLK
| 1V8?
| Camera (conn. thru R100, 100Ω) (Aptina MT9V133-D EXTCLK? PIXCLK?)
|-
| TP167
| CAM_D5
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP168
| VDD28
| 2.8V power rail
| Only used by the camera. Generated by an LDO (U12) from VDD33 (Aptina MT9V133-D analog power rail?)
|-
! scope="row" colspan="4" | (TP169 doesn't exist)
|-
| TP170
| CAM_LED
| Camera LED cathode?
| Connected through Q13 and R68 to BPTWL.
|-
| TP171
| RTC_INT
| 1V8?
| RTC->CPU-TWL interrupt
|-
| TP172
| SD10_CLK
| 3V3
| SD card
|-
| TP173
| SD10_D0
| 3V3
| SD card
|-
| TP174
| SD10_D1
| 3V3
| SD card
|-
| TP175
| SD10_D2
| 3V3
| SD card
|-
| TP176
| SD10_D3
| 3V3
| SD card
|-
| TP177
| SD10_CMD
| 3V3
| SD card
|-
| TP178
| SD10_CP
| 3V3
| SD card (card detect)
|-
| TP179
| SD10_WP
| 3V3
| SD card write protect
|-
| TP180
| GND
| ground
|
|-
! scope="row" colspan="4" | (TP181 doesn't exist)
|-
| TP182
| SD10_VDD
| 3.3V power rail
| same net as VDD33
|-
| TP183
| AOUT
|
| charging/battery status ?
|-
| TP184
| ADPO
|
| charging/battery status ?
|-
| TP185
| SCL1
| 3V3
| BPTWL bus
|-
| TP186
| SDA1
| 3V3
| BPTWL bus
|-
| TP187
| SDI
| 1V8? 3V3?
| I2S bus
|-
| TP188
| SDO
| 1V8? 3V3?
| I2S bus
|-
| TP189
| WS
| 1V8? 3V3?
| I2S bus
|-
| TP190
| SCLK
| 1V8? 3V3?
| I2S bus
|-
| TP191
| MCLK
| 1V8? 3V3?
| I2S bus
|-
| TP192
| PWSWO
| 3V3?
| powerbutton "output" from PMIC to BPTWL?
|-
| TP193
| TH
| ?
| something battery charger?
|-
| TP194
| VSHD
| 5.0V power rail
| Same net as VDD5. For LCDs.
|}

== UTL-SUB-01 testpoints ==

{| class="wikitable" border="1"
|-
! number
! name (TWL testpoint)
! voltage standard
! comment
|-
| TP1
| ?
| ?
| to TH1 component
|-
| TP2
| GND
| (GND)
| ground
|-
| TP3
| P06
| 3V3?
| D-pad up
|-
| TP4
| P04
| 3V3?
| D-pad right
|-
| TP5
| P05
| 3V3?
| D-pad left
|-
| TP6
| P07
| 3V3?
| D-pad down
|-
| TP7
| PWSW
| ?
| raw powerbutton input (to PMIC and BPTWL)
|-
| TP8
| RED
| open collector (at cathode)
| Battery low LED (DL1)
|-
| TP9
| YELLOW
| open collector (at cathode)
| WiFi indicator LED (DL4)
|-
| TP10
| BLUE
| 3V3? 4V2? (at anode)
| Power on/good LED (DL2)
|-
| TP11
| ORANGE
| 3V3? 4V2? (at anode)
| Charging indicator (DL3)
|-
| TP12
| VDD42
| 4.2V power supply
| Power supply for TP8/TP10 LEDs
|}

== P16 pinout ==

The P16 pinout changed from [https://problemkaputt.de/gbatek-aux-dsi-internal-connectors.htm what it was on the regular DSi]. Some nets are now found in P24 instead (see below).

{| class="wikitable" border="1"
|-
! name
! pin no
! pin no
! name
|-
| GND
| 1
| 2
| GND
|-
| GND
| 3
| 4
| GND
|-
| GND
| 5
| 6
| GND
|-
| SD10_CLK
| 7
| 8
| GND
|-
| VDD33
| 9
| 10
| SD10_D0
|-
| VDD33
| 11
| 12
| SD10_D1
|-
| GND
| 13
| 14
| SD10_WP
|-
| SD10_CMD
| 15
| 16
| VDD33
|-
| GND
| 17
| 18
| P08
|-
| SD10_D3
| 19
| 20
| VDD33
|-
| SD10_D2
| 21
| 22
| SD10_CD
|-
| GND
| 23
| 24
| GND
|-
| GND
| 25
| 26
| GND
|}

== P24 pinout ==

P24 is a mezzanine connector for the VOLP/VOLN buttons and the shoulder L button (which were on P16 on the DSi).

{| class="wikitable" border="1"
|-
! name
! pin no
! pin no
! name
|-
| GND
| 1
| 2
| GND
|-
| N/C
| 3
| 4
| VOLP
|-
| P09 (shoulder-L)
| 5
| 6
| VOLN
|-
| GND
| 7-13
| 8-14
| GND
|}

[[Category:Hardware]]

DSi XL testpoints

2023-08-13T16:18:30Z

PoroCYon: /* UTL-CPU-01 testpoints */ (forgot one, sorry)

== UTL-CPU-01 testpoints ==

{| class="wikitable" border="1"
|-
! number
! name (TWL testpoint)
! voltage standard
! comment
|-
| TP1
| EXTB+
| ?
|
|-
| TP2
| VIN
| ≃5V DC
| External charger power input
|-
| TP3
| Rosc
| ?
| ?
|-
| TP4
| RICHG
| ?
| Recharge?
|-
| TP5
| GND
| ground
| (near external charger connector)
|-
| TP6
| VDD12 (aka V12)
| 1.2V power rail
| CPU-TWL core voltage
|-
| TP7
| BT+
| battery +
| at 2-pin power connector to UTL-SUB-01
|-
| TP8
| VDET-
| ?
| ?
|-
| TP9
| DET
| ?
| ?
|-
| TP10
| VDD18 (aka V18)
| 1.8V power rail
| Various I/O and core voltage (incl. RTC)
|-
| TP11
| ?
| ?
| something charging?
|-
| TP12
| VDD10
| 10V power rail
| For LCDs
|-
| TP13
| VDD33 (aka V33)
| 3.3V power rail
| Various I/O and core voltage
|-
| TP14
| GND
| ground
| (near PMIC)
|-
| TP15
| B+
| ?
| battery + ?
|-
| TP16
| VDD-5
| -5V power rail
| For LCDs
|-
| TP17
| PVDD
| ?
| ?
|-
| TP18
| VDD5
| 5.0V power rail
| For LCDs
|-
| TP19
| SG?
| ?
| ?
|-
| TP20
| BLA1
| ?
| backlight anode for lower screen
|-
| TP21
| VDD42?
| 4.2V? power rail (it's certainly a power rail)
| generated from VDD5 using diode voltage drops? (to D6, C22, D3)
|-
| TP22
| BLC1
| ?
| backlight cathode for lower screen
|-
| TP23
| BLA2
| ?
| backlight anode for upper screen
|-
! scope="row" colspan="4" | (TP24, TP25 don't exist)
|-
| TP26
| BLC2
| ?
| backlight cathode for upper screen
|-
! scope="row" colspan="4" | (TP27 doesn't exist)
|-
| TP28
| MIC-
| ground
| same net as (analog) ground
|-
| TP29
| MIC+
| analog
| Analog microphone-in signal
|-
| TP30
| SPRP
| analog
| positive signal for right built-in speaker
|-
| TP31
| SPRN
| analog
| negative signal for right built-in speaker
|-
| TP32
| SPLP
| analog
| positive signal for left built-in speaker
|-
| TP33
| SPLN
| analog
| negative signal for left built-in speaker
|-
| TP34
| GND
| ground
| probably analog ground
|-
| TP35
| SR
| analog
| headphone tip
|-
| TP36
| SL
| analog
| headphone ring
|-
! scope="row" colspan="4" | (TP37, TP38 don't exist)
|-
| TP39
| ORANGE
| 3V3? 4V2? (at anode)
| Orange LED charging indicator
|-
| TP40
| BLUE
| 3V3? 4V2? (at anode)
| Blue LED power good indicator
|-
| TP41
| RED
| open collector (connected to LED cathode)
| Red LED battery low indicator
|-
| TP42
| MC1_D7
| 3V3
| MSB of gamecard parallell ROM *or* AUXSPI COPI signal
|-
| TP43
| MC1_D6
| 3V3
| 6th bit of gamecard parallell ROM *or* AUXSPI CIPO signal
|-
| TP44
| MC1_VCC
| 3.3V power
| power supply to gamecard (can be switched off by SoC)
|-
! scope="row" colspan="4" | (TP45 doesn't exist)
|-
| TP46
| MC1_D5
| 3V3
|
|-
| TP47
| MC1_D4
| 3V3
|
|-
| TP48
| MC1_D3
| 3V3
|
|-
| TP49
| MC1_DET
| 3V3
| Cartridge detected in slot (active-low)
|-
| TP50
| MC1_D2
| 3V3
|
|-
| TP51
| MC1_IREQ
| 3V3
| gamecart->SoC IRQ
|-
| TP52
| MC1_D1
| 3V3
|
|-
| TP53
| MC1_RES
| 3V3
| SoC->gamecart reset signal
|-
| TP54
| MC1_D0
| 3V3
|
|-
| TP55
| MC1_CS
| 3V3
| parallell ROM select (active-low)
|-
| TP56
| MC1_CLK
| 3V3
|
|-
| TP57
| MC1_CS2
| 3V3
| AUXSPI select (active-low)
|-
| TP58
| mRST
| 3V3
| BPTWL reset (active-low)
|-
| TP59
| mFE
| 3V3
| BPTWL flash enable (cf. 78K0/Kx2 Serial Flash Programming protocol, see NEC/Renesas docs)
|-
| TP60
| VOLP
| 3V3
| volume + button (also RxD6 for 78K0 SFP. There's a series resistor to the physical button as protection against shorts)
|-
| TP61
| VOLN
| 3V3
| volume - button (also TxD6 for 78K0 SFP. There's a series resistor to the physical button as protection against shorts)
|-
| TP62
| ATH_TX_H
| 3V3
| something new (Atheros) wifi?
|-
| TP63
| WL_TXPE
| 3V3
| ?
|-
! scope="row" colspan="4" | (TP64 doesn't exist)
|-
| TP65
| WL_RXPE
| 3V3
| ?
|-
| TP66
| /WIFI_RST
| 3V3
| WiFi chip(s) reset (active-lw)
|-
! scope="row" colspan="4" | (TP67, TP68 don't exist)
|-
| TP69
| SPI_MOSI
| 3V3
| SPI bus
|-
! scope="row" colspan="4" | (TP70 doesn't exist)
|-
| TP71
| SPI_MISO
| 3V3
| SPI bus
|-
! scope="row" colspan="4" | (TP72 doesn't exist)
|-
| TP73
| SPI_SCK
| 3V3
| SPI bus
|-
! scope="row" colspan="4" | (TP74, TP75 don't exist)
|-
| TP76
| SPI_CS1
| 3V3
| SPI chip select 1 (PMIC)
|-
! scope="row" colspan="4" | (TP77 doesn't exist)
|-
| TP78
| SPI_CS3
| 3V3
| SPI chip select 3 (TSC)
|-
| TP79
| SPI_CS2
| 3V3
| SPI chip select 2 ([[NVRAM]])
|-
| TP80
| SCL
| 1V8
| CPU-TWL bus
|-
! scope="row" colspan="4" | (TP81 doesn't exist)
|-
| TP82
| SDA
| 1V8
| CPU-TWL bus
|-
| TP83
| PENIRQ
| 1V8? 3V3?
| touchscreen pen down
|-
| TP84
| R7
| 1V8?
| hinge magnet detect signal (active-low)
|-
| TP85
| RESET
| 3V3, but use as open drain/collector
| CPU-TWL reset signal
|-
| TP86
| P05
| 3V3?
| dpad left button
|-
| TP87
| P04
| 3V3?
| dpad right button
|-
| TP88
| P03
| 3V3?
| start button
|-
| TP89
| P02
| 3V3?
| select button
|-
| TP90
| P01
| 3V3?
| B button
|-
| TP91
| P00
| 3V3?
| A button
|-
| TP92
| PM_SLP
| ?
| ?
|-
| TP93
| VCNT5
| ?
| ?
|-
| TP94
| GPIO330?
| 3V3
| GPIO debug testpoint
|-
| TP95
| R01
| ?
| Y button
|-
| TP96
| R00
| ?
| X button
|-
| TP97
| P09
| 3V3
| shoulder-L button
|-
| TP98
| P08
| 3V3
| shoulder-R button
|-
| TP99
| MUTE
| 3V3
| ? (aka GPIO333?)
|-
| TP100
| P07
| 3V3?
| dpad down button
|-
| TP101
| HP#SP
| 3V3
| audio out is headphones (1) or speakers (0). aka GPIO331
|-
| TP102
| P06
| 3V3?
| dpad up button
|-
! scope="row" colspan="4" | (TP103 doesn't exist)
|-
| TP104
| nIRQ_O?
| 3V3
| "powerbutton pressed" signal from the BPTWL to the CPU-TWL. aka GPIO332
|-
| TP105
| LDR20
|
| top LCD R.bit0
|-
| TP106
| LDR21
|
| top LCD R.bit1
|-
| TP107
| LDR22
|
| top LCD R.bit2
|-
| TP108
| LDR23
|
| top LCD R.bit3
|-
| TP109
| LDR24
|
| top LCD R.bit4
|-
| TP110
| LDB21
|
| top LCD B.bit1
|-
| TP111
| LDG21
|
| top LCD G.bit1
|-
| TP112
| LDG22
|
| top LCD G.bit2
|-
| TP113
| LDG25
|
| top LCD G.bit5
|-
| TP114
| LDB20
|
| top LCD B.bit0
|-
| TP115
| LDB23
|
| top LCD B.bit3
|-
| TP116
| LDR11
|
| bottom LCD R.bit1
|-
| TP117
| LDR12
|
| bottom LCD R.bit4
|-
| TP118
| LDR15
|
| bottom LCD R.bit5
|-
| TP119
| LDR25
|
| top LCD R.bit5
|-
| TP120
| LDG20
|
| top LCD G.bit2
|-
| TP121
| LDG23
|
| top LCD G.bit3
|-
| TP122
| LDG24
|
| top LCD G.bit4
|-
| TP123
| LDB22
|
| top LCD B.bit2
|-
| TP124
| LDB24
|
| top LCD B.bit4
|-
| TP125
| LDB25
|
| top LCD B.bit5
|-
| TP126
| LDR10
|
| bottom LCD R.bit0
|-
| TP127
| LDR13
|
| bottom LCD R.bit3
|-
| TP128
| LDR14
|
| bottom LCD R.bit4
|-
| TP129
| LDG10
|
| bottom LCD G.bit0
|-
| TP130
| LDG11
|
| bottom LCD G.bit1
|-
| TP131
| LDG12
|
| bottom LCD G.bit2
|-
| TP132
| LDG13
|
| bottom LCD G.bit3
|-
| TP133
| LDG15
|
| bottom LCD G.bit5
|-
| TP134
| LDB11
|
| bottom LCD B.bit1
|-
| TP135
| LDG14
|
| bottom LCD G.bit4
|-
| TP136
| LDB10
|
| bottom LCD B.bit0
|-
| TP137
| COM2
| ?
| ?
|-
| TP138
| LDB12
|
| bottom LCD B.bit2
|-
| TP139
| LDB13
|
| bottom LCD B.bit3
|-
| TP140
| LDB14
|
| bottom LCD B.bit4
|-
| TP141
| LDB15
|
| bottom LCD B.bit5
|-
| TP142
| INI
| ?
| LCD controller ?
|-
| TP143
| GSP
|
| LCD controller Vsync?
|-
| TP144
| GCK
| ?
| LCD controller ?
|-
| TP145
| REV
|
| LCD controller ?
|-
| TP146
| LS
|
| LCD controller Hsync?
|-
| TP147
| SPL
|
| LCD controller ?
|-
| TP148
| DCLK
|
| LCD controller dot clock
|-
| TP149
| CAM_RST
| 1V8?
| Camera reset signal
|-
| TP150
| COM1
| ?
| ?
|-
! scope="row" colspan="4" | (TP151 doesn't exist)
|-
| TP152
| CAM_D4
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP153
| HSYNC
| 1V8?
| Camera horizontal sync/blank (conn. thru R133, 0Ω) (Aptina MT9V133-D LINE_VALID, active-low)
|-
| TP154
| CAM_D3
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP155
| VSYNC
| 1V8?
| Camera vertical sync/blank (conn. thru R132, 0Ω) (Aptina MT9V133-D FRAME_VALID, active-low)
|-
| TP156
| CKI
| 1V8?
| Camera clock something? (Aptina MT9V133-D EXTCLK? PIXCLK?)
|-
| TP157
| CAM_D2
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP158
| CAM_D7
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP159
| CAM_D1
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP160
| X+
| ?
| touchscreen
|-
| TP161
| Y+
| ?
| touchscreen
|-
| TP162
| X-
| ?
| touchscreen, same net as Y-
|-
| TP163
| Y-
| ?
| touchscreen, same net as X-
|-
| TP164
| CAM_D6
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP165
| CAM_D0
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP166
| RCLK
| 1V8?
| Camera (conn. thru R100, 100Ω) (Aptina MT9V133-D EXTCLK? PIXCLK?)
|-
| TP167
| CAM_D5
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP168
| VDD28
| 2.8V power rail
| Only used by the camera. Generated by an LDO (U12) from VDD33 (Aptina MT9V133-D analog power rail?)
|-
! scope="row" colspan="4" | (TP169 doesn't exist)
|-
| TP170
| CAM_LED
| Camera LED cathode?
| Connected through Q13 and R68 to BPTWL.
|-
| TP171
| RTC_INT
| 1V8?
| RTC->CPU-TWL interrupt
|-
| TP172
| SD10_CLK
| 3V3
| SD card
|-
| TP173
| SD10_D0
| 3V3
| SD card
|-
| TP174
| SD10_D1
| 3V3
| SD card
|-
| TP175
| SD10_D2
| 3V3
| SD card
|-
| TP176
| SD10_D3
| 3V3
| SD card
|-
| TP177
| SD10_CMD
| 3V3
| SD card
|-
| TP178
| SD10_CP
| 3V3
| SD card (card detect)
|-
| TP179
| SD10_WP
| 3V3
| SD card write protect
|-
| TP180
| GND
| ground
|
|-
! scope="row" colspan="4" | (TP181 doesn't exist)
|-
| TP182
| SD10_VDD
| 3.3V power rail
| same net as VDD33
|-
| TP183
| AOUT
|
| charging/battery status ?
|-
| TP184
| ADPO
|
| charging/battery status ?
|-
| TP185
| SCL1
| 3V3
| BPTWL bus
|-
| TP186
| SDA1
| 3V3
| BPTWL bus
|-
| TP187
| SDI
| 1V8? 3V3?
| I2S bus
|-
| TP188
| SDO
| 1V8? 3V3?
| I2S bus
|-
| TP189
| WS
| 1V8? 3V3?
| I2S bus
|-
| TP190
| SCLK
| 1V8? 3V3?
| I2S bus
|-
| TP191
| MCLK
| 1V8? 3V3?
| I2S bus
|-
| TP192
| PWSWO
| 3V3?
| powerbutton "output" from PMIC to BPTWL?
|-
| TP193
| TH
| ?
| something battery charger?
|-
| TP194
| VSHD
| 5.0V power rail
| Same net as VDD5. For LCDs.
|}

== UTL-SUB-01 testpoints ==

{| class="wikitable" border="1"
|-
! number
! name (TWL testpoint)
! voltage standard
! comment
|-
| TP1
| ?
| ?
| to TH1 component
|-
| TP2
| GND
| (GND)
| ground
|-
| TP3
| P06
| 3V3?
| D-pad up
|-
| TP4
| P04
| 3V3?
| D-pad right
|-
| TP5
| P05
| 3V3?
| D-pad left
|-
| TP6
| P07
| 3V3?
| D-pad down
|-
| TP7
| PWSW
| ?
| raw powerbutton input (to PMIC and BPTWL)
|-
| TP8
| RED
| open collector (at cathode)
| Battery low LED (DL1)
|-
| TP9
| YELLOW
| open collector (at cathode)
| WiFi indicator LED (DL4)
|-
| TP10
| BLUE
| 3V3? 4V2? (at anode)
| Power on/good LED (DL2)
|-
| TP11
| ORANGE
| 3V3? 4V2? (at anode)
| Charging indicator (DL3)
|-
| TP12
| VDD42
| 4.2V power supply
| Power supply for TP8/TP10 LEDs
|}

== P16 pinout ==

The P16 pinout changed from [https://problemkaputt.de/gbatek-aux-dsi-internal-connectors.htm what it was on the regular DSi]. Some nets are now found in P24 instead (see below).

{| class="wikitable" border="1"
|-
! name
! pin no
! pin no
! name
|-
| GND
| 1
| 2
| GND
|-
| GND
| 3
| 4
| GND
|-
| GND
| 5
| 6
| GND
|-
| SD10_CLK
| 7
| 8
| GND
|-
| VDD33
| 9
| 10
| SD10_D0
|-
| VDD33
| 11
| 12
| SD10_D1
|-
| GND
| 13
| 14
| SD10_WP
|-
| SD10_CMD
| 15
| 16
| VDD33
|-
| GND
| 17
| 18
| P08
|-
| SD10_D3
| 19
| 20
| VDD33
|-
| SD10_D2
| 21
| 22
| SD10_CD
|-
| GND
| 23
| 24
| GND
|-
| GND
| 25
| 26
| GND
|}

== P24 pinout ==

P24 is a mezzanine connector for the VOLP/VOLN buttons and the shoulder L button (which were on P16 on the DSi).

{| class="wikitable" border="1"
|-
! name
! pin no
! pin no
! name
|-
| GND
| 1
| 2
| GND
|-
| N/C
| 3
| 4
| VOLP
|-
| P09 (shoulder-L)
| 5
| 6
| VOLN
|-
| GND
| 7-13
| 8-14
| GND
|}

[[Category:Hardware]]

DSi XL testpoints

2023-08-13T16:18:07Z

PoroCYon: /* UTL-CPU-01 testpoints */ fix I2S names and voltages

== UTL-CPU-01 testpoints ==

{| class="wikitable" border="1"
|-
! number
! name (TWL testpoint)
! voltage standard
! comment
|-
| TP1
| EXTB+
| ?
|
|-
| TP2
| VIN
| ≃5V DC
| External charger power input
|-
| TP3
| Rosc
| ?
| ?
|-
| TP4
| RICHG
| ?
| Recharge?
|-
| TP5
| GND
| ground
| (near external charger connector)
|-
| TP6
| VDD12 (aka V12)
| 1.2V power rail
| CPU-TWL core voltage
|-
| TP7
| BT+
| battery +
| at 2-pin power connector to UTL-SUB-01
|-
| TP8
| VDET-
| ?
| ?
|-
| TP9
| DET
| ?
| ?
|-
| TP10
| VDD18 (aka V18)
| 1.8V power rail
| Various I/O and core voltage (incl. RTC)
|-
| TP11
| ?
| ?
| something charging?
|-
| TP12
| VDD10
| 10V power rail
| For LCDs
|-
| TP13
| VDD33 (aka V33)
| 3.3V power rail
| Various I/O and core voltage
|-
| TP14
| GND
| ground
| (near PMIC)
|-
| TP15
| B+
| ?
| battery + ?
|-
| TP16
| VDD-5
| -5V power rail
| For LCDs
|-
| TP17
| PVDD
| ?
| ?
|-
| TP18
| VDD5
| 5.0V power rail
| For LCDs
|-
| TP19
| SG?
| ?
| ?
|-
| TP20
| BLA1
| ?
| backlight anode for lower screen
|-
| TP21
| VDD42?
| 4.2V? power rail (it's certainly a power rail)
| generated from VDD5 using diode voltage drops? (to D6, C22, D3)
|-
| TP22
| BLC1
| ?
| backlight cathode for lower screen
|-
| TP23
| BLA2
| ?
| backlight anode for upper screen
|-
! scope="row" colspan="4" | (TP24, TP25 don't exist)
|-
| TP26
| BLC2
| ?
| backlight cathode for upper screen
|-
! scope="row" colspan="4" | (TP27 doesn't exist)
|-
| TP28
| MIC-
| ground
| same net as (analog) ground
|-
| TP29
| MIC+
| analog
| Analog microphone-in signal
|-
| TP30
| SPRP
| analog
| positive signal for right built-in speaker
|-
| TP31
| SPRN
| analog
| negative signal for right built-in speaker
|-
| TP32
| SPLP
| analog
| positive signal for left built-in speaker
|-
| TP33
| SPLN
| analog
| negative signal for left built-in speaker
|-
| TP34
| GND
| ground
| probably analog ground
|-
| TP35
| SR
| analog
| headphone tip
|-
| TP36
| SL
| analog
| headphone ring
|-
! scope="row" colspan="4" | (TP37, TP38 don't exist)
|-
| TP39
| ORANGE
| 3V3? 4V2? (at anode)
| Orange LED charging indicator
|-
| TP40
| BLUE
| 3V3? 4V2? (at anode)
| Blue LED power good indicator
|-
| TP41
| RED
| open collector (connected to LED cathode)
| Red LED battery low indicator
|-
| TP42
| MC1_D7
| 3V3
| MSB of gamecard parallell ROM *or* AUXSPI COPI signal
|-
| TP43
| MC1_D6
| 3V3
| 6th bit of gamecard parallell ROM *or* AUXSPI CIPO signal
|-
| TP44
| MC1_VCC
| 3.3V power
| power supply to gamecard (can be switched off by SoC)
|-
! scope="row" colspan="4" | (TP45 doesn't exist)
|-
| TP46
| MC1_D5
| 3V3
|
|-
| TP47
| MC1_D4
| 3V3
|
|-
| TP48
| MC1_D3
| 3V3
|
|-
| TP49
| MC1_DET
| 3V3
| Cartridge detected in slot (active-low)
|-
| TP50
| MC1_D2
| 3V3
|
|-
| TP51
| MC1_IREQ
| 3V3
| gamecart->SoC IRQ
|-
| TP52
| MC1_D1
| 3V3
|
|-
| TP53
| MC1_RES
| 3V3
| SoC->gamecart reset signal
|-
| TP54
| MC1_D0
| 3V3
|
|-
| TP55
| MC1_CS
| 3V3
| parallell ROM select (active-low)
|-
| TP56
| MC1_CLK
| 3V3
|
|-
| TP57
| MC1_CS2
| 3V3
| AUXSPI select (active-low)
|-
| TP58
| mRST
| 3V3
| BPTWL reset (active-low)
|-
| TP59
| mFE
| 3V3
| BPTWL flash enable (cf. 78K0/Kx2 Serial Flash Programming protocol, see NEC/Renesas docs)
|-
| TP60
| VOLP
| 3V3
| volume + button (also RxD6 for 78K0 SFP. There's a series resistor to the physical button as protection against shorts)
|-
| TP61
| VOLN
| 3V3
| volume - button (also TxD6 for 78K0 SFP. There's a series resistor to the physical button as protection against shorts)
|-
| TP62
| ATH_TX_H
| 3V3
| something new (Atheros) wifi?
|-
| TP63
| WL_TXPE
| 3V3
| ?
|-
! scope="row" colspan="4" | (TP64 doesn't exist)
|-
| TP65
| WL_RXPE
| 3V3
| ?
|-
| TP66
| /WIFI_RST
| 3V3
| WiFi chip(s) reset (active-lw)
|-
! scope="row" colspan="4" | (TP67, TP68 don't exist)
|-
| TP69
| SPI_MOSI
| 3V3
| SPI bus
|-
! scope="row" colspan="4" | (TP70 doesn't exist)
|-
| TP71
| SPI_MISO
| 3V3
| SPI bus
|-
! scope="row" colspan="4" | (TP72 doesn't exist)
|-
| TP73
| SPI_SCK
| 3V3
| SPI bus
|-
! scope="row" colspan="4" | (TP74, TP75 don't exist)
|-
| TP76
| SPI_CS1
| 3V3
| SPI chip select 1 (PMIC)
|-
! scope="row" colspan="4" | (TP77 doesn't exist)
|-
| TP78
| SPI_CS3
| 3V3
| SPI chip select 3 (TSC)
|-
| TP79
| SPI_CS2
| 3V3
| SPI chip select 2 ([[NVRAM]])
|-
| TP80
| SCL
| 1V8
| CPU-TWL bus
|-
! scope="row" colspan="4" | (TP81 doesn't exist)
|-
| TP82
| SDA
| 1V8
| CPU-TWL bus
|-
| TP83
| PENIRQ
| 1V8? 3V3?
| touchscreen pen down
|-
| TP84
| R7
| 1V8?
| hinge magnet detect signal (active-low)
|-
| TP85
| RESET
| 3V3, but use as open drain/collector
| CPU-TWL reset signal
|-
| TP86
| P05
| 3V3?
| dpad left button
|-
| TP87
| P04
| 3V3?
| dpad right button
|-
| TP88
| P03
| 3V3?
| start button
|-
| TP89
| P02
| 3V3?
| select button
|-
| TP90
| P01
| 3V3?
| B button
|-
| TP91
| P00
| 3V3?
| A button
|-
| TP92
| PM_SLP
| ?
| ?
|-
| TP93
| VCNT5
| ?
| ?
|-
| TP94
| GPIO330?
| 3V3
| GPIO debug testpoint
|-
| TP95
| R01
| ?
| Y button
|-
| TP96
| R00
| ?
| X button
|-
| TP97
| P09
| 3V3
| shoulder-L button
|-
| TP98
| P08
| 3V3
| shoulder-R button
|-
| TP99
| MUTE
| 3V3
| ? (aka GPIO333?)
|-
| TP100
| P07
| 3V3?
| dpad down button
|-
| TP101
| HP#SP
| 3V3
| audio out is headphones (1) or speakers (0). aka GPIO331
|-
| TP102
| P06
| 3V3?
| dpad up button
|-
! scope="row" colspan="4" | (TP103 doesn't exist)
|-
| TP104
| nIRQ_O?
| 3V3
| "powerbutton pressed" signal from the BPTWL to the CPU-TWL. aka GPIO332
|-
| TP105
| LDR20
|
| top LCD R.bit0
|-
| TP106
| LDR21
|
| top LCD R.bit1
|-
| TP107
| LDR22
|
| top LCD R.bit2
|-
| TP108
| LDR23
|
| top LCD R.bit3
|-
| TP109
| LDR24
|
| top LCD R.bit4
|-
| TP110
| LDB21
|
| top LCD B.bit1
|-
| TP111
| LDG21
|
| top LCD G.bit1
|-
| TP112
| LDG22
|
| top LCD G.bit2
|-
| TP113
| LDG25
|
| top LCD G.bit5
|-
| TP114
| LDB20
|
| top LCD B.bit0
|-
| TP115
| LDB23
|
| top LCD B.bit3
|-
| TP116
| LDR11
|
| bottom LCD R.bit1
|-
| TP117
| LDR12
|
| bottom LCD R.bit4
|-
| TP118
| LDR15
|
| bottom LCD R.bit5
|-
| TP119
| LDR25
|
| top LCD R.bit5
|-
| TP120
| LDG20
|
| top LCD G.bit2
|-
| TP121
| LDG23
|
| top LCD G.bit3
|-
| TP122
| LDG24
|
| top LCD G.bit4
|-
| TP123
| LDB22
|
| top LCD B.bit2
|-
| TP124
| LDB24
|
| top LCD B.bit4
|-
| TP125
| LDB25
|
| top LCD B.bit5
|-
| TP126
| LDR10
|
| bottom LCD R.bit0
|-
| TP127
| LDR13
|
| bottom LCD R.bit3
|-
| TP128
| LDR14
|
| bottom LCD R.bit4
|-
| TP129
| LDG10
|
| bottom LCD G.bit0
|-
| TP130
| LDG11
|
| bottom LCD G.bit1
|-
| TP131
| LDG12
|
| bottom LCD G.bit2
|-
| TP132
| LDG13
|
| bottom LCD G.bit3
|-
| TP133
| LDG15
|
| bottom LCD G.bit5
|-
| TP134
| LDB11
|
| bottom LCD B.bit1
|-
| TP135
| LDG14
|
| bottom LCD G.bit4
|-
| TP136
| LDB10
|
| bottom LCD B.bit0
|-
| TP137
| COM2
| ?
| ?
|-
| TP138
| LDB12
|
| bottom LCD B.bit2
|-
| TP139
| LDB13
|
| bottom LCD B.bit3
|-
| TP140
| LDB14
|
| bottom LCD B.bit4
|-
| TP141
| LDB15
|
| bottom LCD B.bit5
|-
| TP142
| INI
| ?
| LCD controller ?
|-
| TP143
| GSP
|
| LCD controller Vsync?
|-
| TP144
| GCK
| ?
| LCD controller ?
|-
| TP145
| REV
|
| LCD controller ?
|-
| TP146
| LS
|
| LCD controller Hsync?
|-
| TP147
| SPL
|
| LCD controller ?
|-
| TP148
| DCLK
|
| LCD controller dot clock
|-
| TP149
| CAM_RST
| 1V8?
| Camera reset signal
|-
| TP150
| COM1
| ?
| ?
|-
! scope="row" colspan="4" | (TP151 doesn't exist)
|-
| TP152
| CAM_D4
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP153
| HSYNC
| 1V8?
| Camera horizontal sync/blank (conn. thru R133, 0Ω) (Aptina MT9V133-D LINE_VALID, active-low)
|-
| TP154
| CAM_D3
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP155
| VSYNC
| 1V8?
| Camera vertical sync/blank (conn. thru R132, 0Ω) (Aptina MT9V133-D FRAME_VALID, active-low)
|-
| TP156
| CKI
| 1V8?
| Camera clock something? (Aptina MT9V133-D EXTCLK? PIXCLK?)
|-
| TP157
| CAM_D2
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP158
| CAM_D7
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP159
| CAM_D1
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP160
| X+
| ?
| touchscreen
|-
| TP161
| Y+
| ?
| touchscreen
|-
| TP162
| X-
| ?
| touchscreen, same net as Y-
|-
| TP163
| Y-
| ?
| touchscreen, same net as X-
|-
| TP164
| CAM_D6
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP165
| CAM_D0
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP166
| RCLK
| 1V8?
| Camera (conn. thru R100, 100Ω) (Aptina MT9V133-D EXTCLK? PIXCLK?)
|-
| TP167
| CAM_D5
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP168
| VDD28
| 2.8V power rail
| Only used by the camera. Generated by an LDO (U12) from VDD33 (Aptina MT9V133-D analog power rail?)
|-
! scope="row" colspan="4" | (TP169 doesn't exist)
|-
| TP170
| CAM_LED
| Camera LED cathode?
| Connected through Q13 and R68 to BPTWL.
|-
| TP171
| RTC_INT
| 1V8?
| RTC->CPU-TWL interrupt
|-
| TP172
| SD10_CLK
| 3V3
| SD card
|-
| TP173
| SD10_D0
| 3V3
| SD card
|-
| TP174
| SD10_D1
| 3V3
| SD card
|-
| TP175
| SD10_D2
| 3V3
| SD card
|-
| TP176
| SD10_D3
| 3V3
| SD card
|-
| TP177
| SD10_CMD
| 3V3
| SD card
|-
| TP178
| SD10_CP
| 3V3
| SD card (card detect)
|-
| TP179
| SD10_WP
| 3V3
| SD card write protect
|-
| TP180
| GND
| ground
|
|-
! scope="row" colspan="4" | (TP181 doesn't exist)
|-
| TP182
| SD10_VDD
| 3.3V power rail
| same net as VDD33
|-
| TP183
| AOUT
|
| charging/battery status ?
|-
| TP184
| ADPO
|
| charging/battery status ?
|-
| TP185
| SCL1
| 3V3
| BPTWL bus
|-
| TP186
| SDA1
| 3V3
| BPTWL bus
|-
| TP187
| SDI
| 1V8? 3V3?
| I2S bus
|-
| TP188
| 1V8? 3V3?
| SDO
| I2S bus
|-
| TP189
| WS
| 1V8? 3V3?
| I2S bus
|-
| TP190
| SCLK
| 1V8? 3V3?
| I2S bus
|-
| TP191
| MCLK
| 1V8? 3V3?
| I2S bus
|-
| TP192
| PWSWO
| 3V3?
| powerbutton "output" from PMIC to BPTWL?
|-
| TP193
| TH
| ?
| something battery charger?
|-
| TP194
| VSHD
| 5.0V power rail
| Same net as VDD5. For LCDs.
|}

== UTL-SUB-01 testpoints ==

{| class="wikitable" border="1"
|-
! number
! name (TWL testpoint)
! voltage standard
! comment
|-
| TP1
| ?
| ?
| to TH1 component
|-
| TP2
| GND
| (GND)
| ground
|-
| TP3
| P06
| 3V3?
| D-pad up
|-
| TP4
| P04
| 3V3?
| D-pad right
|-
| TP5
| P05
| 3V3?
| D-pad left
|-
| TP6
| P07
| 3V3?
| D-pad down
|-
| TP7
| PWSW
| ?
| raw powerbutton input (to PMIC and BPTWL)
|-
| TP8
| RED
| open collector (at cathode)
| Battery low LED (DL1)
|-
| TP9
| YELLOW
| open collector (at cathode)
| WiFi indicator LED (DL4)
|-
| TP10
| BLUE
| 3V3? 4V2? (at anode)
| Power on/good LED (DL2)
|-
| TP11
| ORANGE
| 3V3? 4V2? (at anode)
| Charging indicator (DL3)
|-
| TP12
| VDD42
| 4.2V power supply
| Power supply for TP8/TP10 LEDs
|}

== P16 pinout ==

The P16 pinout changed from [https://problemkaputt.de/gbatek-aux-dsi-internal-connectors.htm what it was on the regular DSi]. Some nets are now found in P24 instead (see below).

{| class="wikitable" border="1"
|-
! name
! pin no
! pin no
! name
|-
| GND
| 1
| 2
| GND
|-
| GND
| 3
| 4
| GND
|-
| GND
| 5
| 6
| GND
|-
| SD10_CLK
| 7
| 8
| GND
|-
| VDD33
| 9
| 10
| SD10_D0
|-
| VDD33
| 11
| 12
| SD10_D1
|-
| GND
| 13
| 14
| SD10_WP
|-
| SD10_CMD
| 15
| 16
| VDD33
|-
| GND
| 17
| 18
| P08
|-
| SD10_D3
| 19
| 20
| VDD33
|-
| SD10_D2
| 21
| 22
| SD10_CD
|-
| GND
| 23
| 24
| GND
|-
| GND
| 25
| 26
| GND
|}

== P24 pinout ==

P24 is a mezzanine connector for the VOLP/VOLN buttons and the shoulder L button (which were on P16 on the DSi).

{| class="wikitable" border="1"
|-
! name
! pin no
! pin no
! name
|-
| GND
| 1
| 2
| GND
|-
| N/C
| 3
| 4
| VOLP
|-
| P09 (shoulder-L)
| 5
| 6
| VOLN
|-
| GND
| 7-13
| 8-14
| GND
|}

[[Category:Hardware]]

DSi XL testpoints

2023-08-13T16:16:54Z

PoroCYon: /* UTL-CPU-01 testpoints */ oopsie

== UTL-CPU-01 testpoints ==

{| class="wikitable" border="1"
|-
! number
! name (TWL testpoint)
! voltage standard
! comment
|-
| TP1
| EXTB+
| ?
|
|-
| TP2
| VIN
| ≃5V DC
| External charger power input
|-
| TP3
| Rosc
| ?
| ?
|-
| TP4
| RICHG
| ?
| Recharge?
|-
| TP5
| GND
| ground
| (near external charger connector)
|-
| TP6
| VDD12 (aka V12)
| 1.2V power rail
| CPU-TWL core voltage
|-
| TP7
| BT+
| battery +
| at 2-pin power connector to UTL-SUB-01
|-
| TP8
| VDET-
| ?
| ?
|-
| TP9
| DET
| ?
| ?
|-
| TP10
| VDD18 (aka V18)
| 1.8V power rail
| Various I/O and core voltage (incl. RTC)
|-
| TP11
| ?
| ?
| something charging?
|-
| TP12
| VDD10
| 10V power rail
| For LCDs
|-
| TP13
| VDD33 (aka V33)
| 3.3V power rail
| Various I/O and core voltage
|-
| TP14
| GND
| ground
| (near PMIC)
|-
| TP15
| B+
| ?
| battery + ?
|-
| TP16
| VDD-5
| -5V power rail
| For LCDs
|-
| TP17
| PVDD
| ?
| ?
|-
| TP18
| VDD5
| 5.0V power rail
| For LCDs
|-
| TP19
| SG?
| ?
| ?
|-
| TP20
| BLA1
| ?
| backlight anode for lower screen
|-
| TP21
| VDD42?
| 4.2V? power rail (it's certainly a power rail)
| generated from VDD5 using diode voltage drops? (to D6, C22, D3)
|-
| TP22
| BLC1
| ?
| backlight cathode for lower screen
|-
| TP23
| BLA2
| ?
| backlight anode for upper screen
|-
! scope="row" colspan="4" | (TP24, TP25 don't exist)
|-
| TP26
| BLC2
| ?
| backlight cathode for upper screen
|-
! scope="row" colspan="4" | (TP27 doesn't exist)
|-
| TP28
| MIC-
| ground
| same net as (analog) ground
|-
| TP29
| MIC+
| analog
| Analog microphone-in signal
|-
| TP30
| SPRP
| analog
| positive signal for right built-in speaker
|-
| TP31
| SPRN
| analog
| negative signal for right built-in speaker
|-
| TP32
| SPLP
| analog
| positive signal for left built-in speaker
|-
| TP33
| SPLN
| analog
| negative signal for left built-in speaker
|-
| TP34
| GND
| ground
| probably analog ground
|-
| TP35
| SR
| analog
| headphone tip
|-
| TP36
| SL
| analog
| headphone ring
|-
! scope="row" colspan="4" | (TP37, TP38 don't exist)
|-
| TP39
| ORANGE
| 3V3? 4V2? (at anode)
| Orange LED charging indicator
|-
| TP40
| BLUE
| 3V3? 4V2? (at anode)
| Blue LED power good indicator
|-
| TP41
| RED
| open collector (connected to LED cathode)
| Red LED battery low indicator
|-
| TP42
| MC1_D7
| 3V3
| MSB of gamecard parallell ROM *or* AUXSPI COPI signal
|-
| TP43
| MC1_D6
| 3V3
| 6th bit of gamecard parallell ROM *or* AUXSPI CIPO signal
|-
| TP44
| MC1_VCC
| 3.3V power
| power supply to gamecard (can be switched off by SoC)
|-
! scope="row" colspan="4" | (TP45 doesn't exist)
|-
| TP46
| MC1_D5
| 3V3
|
|-
| TP47
| MC1_D4
| 3V3
|
|-
| TP48
| MC1_D3
| 3V3
|
|-
| TP49
| MC1_DET
| 3V3
| Cartridge detected in slot (active-low)
|-
| TP50
| MC1_D2
| 3V3
|
|-
| TP51
| MC1_IREQ
| 3V3
| gamecart->SoC IRQ
|-
| TP52
| MC1_D1
| 3V3
|
|-
| TP53
| MC1_RES
| 3V3
| SoC->gamecart reset signal
|-
| TP54
| MC1_D0
| 3V3
|
|-
| TP55
| MC1_CS
| 3V3
| parallell ROM select (active-low)
|-
| TP56
| MC1_CLK
| 3V3
|
|-
| TP57
| MC1_CS2
| 3V3
| AUXSPI select (active-low)
|-
| TP58
| mRST
| 3V3
| BPTWL reset (active-low)
|-
| TP59
| mFE
| 3V3
| BPTWL flash enable (cf. 78K0/Kx2 Serial Flash Programming protocol, see NEC/Renesas docs)
|-
| TP60
| VOLP
| 3V3
| volume + button (also RxD6 for 78K0 SFP. There's a series resistor to the physical button as protection against shorts)
|-
| TP61
| VOLN
| 3V3
| volume - button (also TxD6 for 78K0 SFP. There's a series resistor to the physical button as protection against shorts)
|-
| TP62
| ATH_TX_H
| 3V3
| something new (Atheros) wifi?
|-
| TP63
| WL_TXPE
| 3V3
| ?
|-
! scope="row" colspan="4" | (TP64 doesn't exist)
|-
| TP65
| WL_RXPE
| 3V3
| ?
|-
| TP66
| /WIFI_RST
| 3V3
| WiFi chip(s) reset (active-lw)
|-
! scope="row" colspan="4" | (TP67, TP68 don't exist)
|-
| TP69
| SPI_MOSI
| 3V3
| SPI bus
|-
! scope="row" colspan="4" | (TP70 doesn't exist)
|-
| TP71
| SPI_MISO
| 3V3
| SPI bus
|-
! scope="row" colspan="4" | (TP72 doesn't exist)
|-
| TP73
| SPI_SCK
| 3V3
| SPI bus
|-
! scope="row" colspan="4" | (TP74, TP75 don't exist)
|-
| TP76
| SPI_CS1
| 3V3
| SPI chip select 1 (PMIC)
|-
! scope="row" colspan="4" | (TP77 doesn't exist)
|-
| TP78
| SPI_CS3
| 3V3
| SPI chip select 3 (TSC)
|-
| TP79
| SPI_CS2
| 3V3
| SPI chip select 2 ([[NVRAM]])
|-
| TP80
| SCL
| 1V8
| CPU-TWL bus
|-
! scope="row" colspan="4" | (TP81 doesn't exist)
|-
| TP82
| SDA
| 1V8
| CPU-TWL bus
|-
| TP83
| PENIRQ
| 1V8? 3V3?
| touchscreen pen down
|-
| TP84
| R7
| 1V8?
| hinge magnet detect signal (active-low)
|-
| TP85
| RESET
| 3V3, but use as open drain/collector
| CPU-TWL reset signal
|-
| TP86
| P05
| 3V3?
| dpad left button
|-
| TP87
| P04
| 3V3?
| dpad right button
|-
| TP88
| P03
| 3V3?
| start button
|-
| TP89
| P02
| 3V3?
| select button
|-
| TP90
| P01
| 3V3?
| B button
|-
| TP91
| P00
| 3V3?
| A button
|-
| TP92
| PM_SLP
| ?
| ?
|-
| TP93
| VCNT5
| ?
| ?
|-
| TP94
| GPIO330?
| 3V3
| GPIO debug testpoint
|-
| TP95
| R01
| ?
| Y button
|-
| TP96
| R00
| ?
| X button
|-
| TP97
| P09
| 3V3
| shoulder-L button
|-
| TP98
| P08
| 3V3
| shoulder-R button
|-
| TP99
| MUTE
| 3V3
| ? (aka GPIO333?)
|-
| TP100
| P07
| 3V3?
| dpad down button
|-
| TP101
| HP#SP
| 3V3
| audio out is headphones (1) or speakers (0). aka GPIO331
|-
| TP102
| P06
| 3V3?
| dpad up button
|-
! scope="row" colspan="4" | (TP103 doesn't exist)
|-
| TP104
| nIRQ_O?
| 3V3
| "powerbutton pressed" signal from the BPTWL to the CPU-TWL. aka GPIO332
|-
| TP105
| LDR20
|
| top LCD R.bit0
|-
| TP106
| LDR21
|
| top LCD R.bit1
|-
| TP107
| LDR22
|
| top LCD R.bit2
|-
| TP108
| LDR23
|
| top LCD R.bit3
|-
| TP109
| LDR24
|
| top LCD R.bit4
|-
| TP110
| LDB21
|
| top LCD B.bit1
|-
| TP111
| LDG21
|
| top LCD G.bit1
|-
| TP112
| LDG22
|
| top LCD G.bit2
|-
| TP113
| LDG25
|
| top LCD G.bit5
|-
| TP114
| LDB20
|
| top LCD B.bit0
|-
| TP115
| LDB23
|
| top LCD B.bit3
|-
| TP116
| LDR11
|
| bottom LCD R.bit1
|-
| TP117
| LDR12
|
| bottom LCD R.bit4
|-
| TP118
| LDR15
|
| bottom LCD R.bit5
|-
| TP119
| LDR25
|
| top LCD R.bit5
|-
| TP120
| LDG20
|
| top LCD G.bit2
|-
| TP121
| LDG23
|
| top LCD G.bit3
|-
| TP122
| LDG24
|
| top LCD G.bit4
|-
| TP123
| LDB22
|
| top LCD B.bit2
|-
| TP124
| LDB24
|
| top LCD B.bit4
|-
| TP125
| LDB25
|
| top LCD B.bit5
|-
| TP126
| LDR10
|
| bottom LCD R.bit0
|-
| TP127
| LDR13
|
| bottom LCD R.bit3
|-
| TP128
| LDR14
|
| bottom LCD R.bit4
|-
| TP129
| LDG10
|
| bottom LCD G.bit0
|-
| TP130
| LDG11
|
| bottom LCD G.bit1
|-
| TP131
| LDG12
|
| bottom LCD G.bit2
|-
| TP132
| LDG13
|
| bottom LCD G.bit3
|-
| TP133
| LDG15
|
| bottom LCD G.bit5
|-
| TP134
| LDB11
|
| bottom LCD B.bit1
|-
| TP135
| LDG14
|
| bottom LCD G.bit4
|-
| TP136
| LDB10
|
| bottom LCD B.bit0
|-
| TP137
| COM2
| ?
| ?
|-
| TP138
| LDB12
|
| bottom LCD B.bit2
|-
| TP139
| LDB13
|
| bottom LCD B.bit3
|-
| TP140
| LDB14
|
| bottom LCD B.bit4
|-
| TP141
| LDB15
|
| bottom LCD B.bit5
|-
| TP142
| INI
| ?
| LCD controller ?
|-
| TP143
| GSP
|
| LCD controller Vsync?
|-
| TP144
| GCK
| ?
| LCD controller ?
|-
| TP145
| REV
|
| LCD controller ?
|-
| TP146
| LS
|
| LCD controller Hsync?
|-
| TP147
| SPL
|
| LCD controller ?
|-
| TP148
| DCLK
|
| LCD controller dot clock
|-
| TP149
| CAM_RST
| 1V8?
| Camera reset signal
|-
| TP150
| COM1
| ?
| ?
|-
! scope="row" colspan="4" | (TP151 doesn't exist)
|-
| TP152
| CAM_D4
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP153
| HSYNC
| 1V8?
| Camera horizontal sync/blank (conn. thru R133, 0Ω) (Aptina MT9V133-D LINE_VALID, active-low)
|-
| TP154
| CAM_D3
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP155
| VSYNC
| 1V8?
| Camera vertical sync/blank (conn. thru R132, 0Ω) (Aptina MT9V133-D FRAME_VALID, active-low)
|-
| TP156
| CKI
| 1V8?
| Camera clock something? (Aptina MT9V133-D EXTCLK? PIXCLK?)
|-
| TP157
| CAM_D2
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP158
| CAM_D7
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP159
| CAM_D1
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP160
| X+
| ?
| touchscreen
|-
| TP161
| Y+
| ?
| touchscreen
|-
| TP162
| X-
| ?
| touchscreen, same net as Y-
|-
| TP163
| Y-
| ?
| touchscreen, same net as X-
|-
| TP164
| CAM_D6
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP165
| CAM_D0
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP166
| RCLK
| 1V8?
| Camera (conn. thru R100, 100Ω) (Aptina MT9V133-D EXTCLK? PIXCLK?)
|-
| TP167
| CAM_D5
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP168
| VDD28
| 2.8V power rail
| Only used by the camera. Generated by an LDO (U12) from VDD33 (Aptina MT9V133-D analog power rail?)
|-
! scope="row" colspan="4" | (TP169 doesn't exist)
|-
| TP170
| CAM_LED
| Camera LED cathode?
| Connected through Q13 and R68 to BPTWL.
|-
| TP171
| RTC_INT
| 1V8?
| RTC->CPU-TWL interrupt
|-
| TP172
| SD10_CLK
| 3V3
| SD card
|-
| TP173
| SD10_D0
| 3V3
| SD card
|-
| TP174
| SD10_D1
| 3V3
| SD card
|-
| TP175
| SD10_D2
| 3V3
| SD card
|-
| TP176
| SD10_D3
| 3V3
| SD card
|-
| TP177
| SD10_CMD
| 3V3
| SD card
|-
| TP178
| SD10_CP
| 3V3
| SD card (card detect)
|-
| TP179
| SD10_WP
| 3V3
| SD card write protect
|-
| TP180
| GND
| ground
|
|-
! scope="row" colspan="4" | (TP181 doesn't exist)
|-
| TP182
| SD10_VDD
| 3.3V power rail
| same net as VDD33
|-
| TP183
| AOUT
|
| charging/battery status ?
|-
| TP184
| ADPO
|
| charging/battery status ?
|-
| TP185
| SCL1
| 3V3
| BPTWL bus
|-
| TP186
| SDA1
| 3V3
| BPTWL bus
|-
| TP187
| 1V8? 3V3?
| SDI
| I2S bus
|-
| TP188
| 1V8? 3V3?
| SDO
| I2S bus
|-
| TP189
| 1V8? 3V3?
| WS
| I2S bus
|-
| TP190
| 1V8? 3V3?
| SCLK
| I2S bus
|-
| TP191
| 1V8? 3V3?
| MCLK
| I2S bus
|-
| TP192
| PWSWO
| 3V3?
| powerbutton "output" from PMIC to BPTWL?
|-
| TP193
| TH
| ?
| something battery charger?
|-
| TP194
| VSHD
| 5.0V power rail
| Same net as VDD5. For LCDs.
|}

== UTL-SUB-01 testpoints ==

{| class="wikitable" border="1"
|-
! number
! name (TWL testpoint)
! voltage standard
! comment
|-
| TP1
| ?
| ?
| to TH1 component
|-
| TP2
| GND
| (GND)
| ground
|-
| TP3
| P06
| 3V3?
| D-pad up
|-
| TP4
| P04
| 3V3?
| D-pad right
|-
| TP5
| P05
| 3V3?
| D-pad left
|-
| TP6
| P07
| 3V3?
| D-pad down
|-
| TP7
| PWSW
| ?
| raw powerbutton input (to PMIC and BPTWL)
|-
| TP8
| RED
| open collector (at cathode)
| Battery low LED (DL1)
|-
| TP9
| YELLOW
| open collector (at cathode)
| WiFi indicator LED (DL4)
|-
| TP10
| BLUE
| 3V3? 4V2? (at anode)
| Power on/good LED (DL2)
|-
| TP11
| ORANGE
| 3V3? 4V2? (at anode)
| Charging indicator (DL3)
|-
| TP12
| VDD42
| 4.2V power supply
| Power supply for TP8/TP10 LEDs
|}

== P16 pinout ==

The P16 pinout changed from [https://problemkaputt.de/gbatek-aux-dsi-internal-connectors.htm what it was on the regular DSi]. Some nets are now found in P24 instead (see below).

{| class="wikitable" border="1"
|-
! name
! pin no
! pin no
! name
|-
| GND
| 1
| 2
| GND
|-
| GND
| 3
| 4
| GND
|-
| GND
| 5
| 6
| GND
|-
| SD10_CLK
| 7
| 8
| GND
|-
| VDD33
| 9
| 10
| SD10_D0
|-
| VDD33
| 11
| 12
| SD10_D1
|-
| GND
| 13
| 14
| SD10_WP
|-
| SD10_CMD
| 15
| 16
| VDD33
|-
| GND
| 17
| 18
| P08
|-
| SD10_D3
| 19
| 20
| VDD33
|-
| SD10_D2
| 21
| 22
| SD10_CD
|-
| GND
| 23
| 24
| GND
|-
| GND
| 25
| 26
| GND
|}

== P24 pinout ==

P24 is a mezzanine connector for the VOLP/VOLN buttons and the shoulder L button (which were on P16 on the DSi).

{| class="wikitable" border="1"
|-
! name
! pin no
! pin no
! name
|-
| GND
| 1
| 2
| GND
|-
| N/C
| 3
| 4
| VOLP
|-
| P09 (shoulder-L)
| 5
| 6
| VOLN
|-
| GND
| 7-13
| 8-14
| GND
|}

[[Category:Hardware]]

DSi XL testpoints

2023-08-13T16:15:19Z

PoroCYon: /* UTL-CPU-01 testpoints */ oops forgot I2S names

== UTL-CPU-01 testpoints ==

{| class="wikitable" border="1"
|-
! number
! name (TWL testpoint)
! voltage standard
! comment
|-
| TP1
| EXTB+
| ?
|
|-
| TP2
| VIN
| ≃5V DC
| External charger power input
|-
| TP3
| Rosc
| ?
| ?
|-
| TP4
| RICHG
| ?
| Recharge?
|-
| TP5
| GND
| ground
| (near external charger connector)
|-
| TP6
| VDD12 (aka V12)
| 1.2V power rail
| CPU-TWL core voltage
|-
| TP7
| BT+
| battery +
| at 2-pin power connector to UTL-SUB-01
|-
| TP8
| VDET-
| ?
| ?
|-
| TP9
| DET
| ?
| ?
|-
| TP10
| VDD18 (aka V18)
| 1.8V power rail
| Various I/O and core voltage (incl. RTC)
|-
| TP11
| ?
| ?
| something charging?
|-
| TP12
| VDD10
| 10V power rail
| For LCDs
|-
| TP13
| VDD33 (aka V33)
| 3.3V power rail
| Various I/O and core voltage
|-
| TP14
| GND
| ground
| (near PMIC)
|-
| TP15
| B+
| ?
| battery + ?
|-
| TP16
| VDD-5
| -5V power rail
| For LCDs
|-
| TP17
| PVDD
| ?
| ?
|-
| TP18
| VDD5
| 5.0V power rail
| For LCDs
|-
| TP19
| SG?
| ?
| ?
|-
| TP20
| BLA1
| ?
| backlight anode for lower screen
|-
| TP21
| VDD5?
| ?
| must be at least one power rail (to D6, C22, D3) (might be VDD42 due to diode voltage drops?)
|-
| TP22
| BLC1
| ?
| backlight cathode for lower screen
|-
| TP23
| BLA2
| ?
| backlight anode for upper screen
|-
! scope="row" colspan="4" | (TP24, TP25 don't exist)
|-
| TP26
| BLC2
| ?
| backlight cathode for upper screen
|-
! scope="row" colspan="4" | (TP27 doesn't exist)
|-
| TP28
| MIC-
| ground
| same net as (analog) ground
|-
| TP29
| MIC+
| analog
| Analog microphone-in signal
|-
| TP30
| SPRP
| analog
| positive signal for right built-in speaker
|-
| TP31
| SPRN
| analog
| negative signal for right built-in speaker
|-
| TP32
| SPLP
| analog
| positive signal for left built-in speaker
|-
| TP33
| SPLN
| analog
| negative signal for left built-in speaker
|-
| TP34
| GND
| ground
| probably analog ground
|-
| TP35
| SR
| analog
| headphone tip
|-
| TP36
| SL
| analog
| headphone ring
|-
! scope="row" colspan="4" | (TP37, TP38 don't exist)
|-
| TP39
| ORANGE
| 3V3? 4V2? (at anode)
| Orange LED charging indicator
|-
| TP40
| BLUE
| 3V3? 4V2? (at anode)
| Blue LED power good indicator
|-
| TP41
| RED
| open collector (connected to LED cathode)
| Red LED battery low indicator
|-
| TP42
| MC1_D7
| 3V3
| MSB of gamecard parallell ROM *or* AUXSPI COPI signal
|-
| TP43
| MC1_D6
| 3V3
| 6th bit of gamecard parallell ROM *or* AUXSPI CIPO signal
|-
| TP44
| MC1_VCC
| 3.3V power
| power supply to gamecard (can be switched off by SoC)
|-
! scope="row" colspan="4" | (TP45 doesn't exist)
|-
| TP46
| MC1_D5
| 3V3
|
|-
| TP47
| MC1_D4
| 3V3
|
|-
| TP48
| MC1_D3
| 3V3
|
|-
| TP49
| MC1_DET
| 3V3
| Cartridge detected in slot (active-low)
|-
| TP50
| MC1_D2
| 3V3
|
|-
| TP51
| MC1_IREQ
| 3V3
| gamecart->SoC IRQ
|-
| TP52
| MC1_D1
| 3V3
|
|-
| TP53
| MC1_RES
| 3V3
| SoC->gamecart reset signal
|-
| TP54
| MC1_D0
| 3V3
|
|-
| TP55
| MC1_CS
| 3V3
| parallell ROM select (active-low)
|-
| TP56
| MC1_CLK
| 3V3
|
|-
| TP57
| MC1_CS2
| 3V3
| AUXSPI select (active-low)
|-
| TP58
| mRST
| 3V3
| BPTWL reset (active-low)
|-
| TP59
| mFE
| 3V3
| BPTWL flash enable (cf. 78K0/Kx2 Serial Flash Programming protocol, see NEC/Renesas docs)
|-
| TP60
| VOLP
| 3V3
| volume + button (also RxD6 for 78K0 SFP. There's a series resistor to the physical button as protection against shorts)
|-
| TP61
| VOLN
| 3V3
| volume - button (also TxD6 for 78K0 SFP. There's a series resistor to the physical button as protection against shorts)
|-
| TP62
| ATH_TX_H
| 3V3
| something new (Atheros) wifi?
|-
| TP63
| WL_TXPE
| 3V3
| ?
|-
! scope="row" colspan="4" | (TP64 doesn't exist)
|-
| TP65
| WL_RXPE
| 3V3
| ?
|-
| TP66
| /WIFI_RST
| 3V3
| WiFi chip(s) reset (active-lw)
|-
! scope="row" colspan="4" | (TP67, TP68 don't exist)
|-
| TP69
| SPI_MOSI
| 3V3
| SPI bus
|-
! scope="row" colspan="4" | (TP70 doesn't exist)
|-
| TP71
| SPI_MISO
| 3V3
| SPI bus
|-
! scope="row" colspan="4" | (TP72 doesn't exist)
|-
| TP73
| SPI_SCK
| 3V3
| SPI bus
|-
! scope="row" colspan="4" | (TP74, TP75 don't exist)
|-
| TP76
| SPI_CS1
| 3V3
| SPI chip select 1 (PMIC)
|-
! scope="row" colspan="4" | (TP77 doesn't exist)
|-
| TP78
| SPI_CS3
| 3V3
| SPI chip select 3 (TSC)
|-
| TP79
| SPI_CS2
| 3V3
| SPI chip select 2 ([[NVRAM]])
|-
| TP80
| SCL
| 1V8
| CPU-TWL bus
|-
! scope="row" colspan="4" | (TP81 doesn't exist)
|-
| TP82
| SDA
| 1V8
| CPU-TWL bus
|-
| TP83
| PENIRQ
| 1V8? 3V3?
| touchscreen pen down
|-
| TP84
| R7
| 1V8?
| hinge magnet detect signal (active-low)
|-
| TP85
| RESET
| 3V3, but use as open drain/collector
| CPU-TWL reset signal
|-
| TP86
| P05
| 3V3?
| dpad left button
|-
| TP87
| P04
| 3V3?
| dpad right button
|-
| TP88
| P03
| 3V3?
| start button
|-
| TP89
| P02
| 3V3?
| select button
|-
| TP90
| P01
| 3V3?
| B button
|-
| TP91
| P00
| 3V3?
| A button
|-
| TP92
| PM_SLP
| ?
| ?
|-
| TP93
| VCNT5
| ?
| ?
|-
| TP94
| GPIO330?
| 3V3
| GPIO debug testpoint
|-
| TP95
| R01
| ?
| Y button
|-
| TP96
| R00
| ?
| X button
|-
| TP97
| P09
| 3V3
| shoulder-L button
|-
| TP98
| P08
| 3V3
| shoulder-R button
|-
| TP99
| MUTE
| 3V3
| ? (aka GPIO333?)
|-
| TP100
| P07
| 3V3?
| dpad down button
|-
| TP101
| HP#SP
| 3V3
| audio out is headphones (1) or speakers (0). aka GPIO331
|-
| TP102
| P06
| 3V3?
| dpad up button
|-
! scope="row" colspan="4" | (TP103 doesn't exist)
|-
| TP104
| nIRQ_O?
| 3V3
| "powerbutton pressed" signal from the BPTWL to the CPU-TWL. aka GPIO332
|-
| TP105
| LDR20
|
| top LCD R.bit0
|-
| TP106
| LDR21
|
| top LCD R.bit1
|-
| TP107
| LDR22
|
| top LCD R.bit2
|-
| TP108
| LDR23
|
| top LCD R.bit3
|-
| TP109
| LDR24
|
| top LCD R.bit4
|-
| TP110
| LDB21
|
| top LCD B.bit1
|-
| TP111
| LDG21
|
| top LCD G.bit1
|-
| TP112
| LDG22
|
| top LCD G.bit2
|-
| TP113
| LDG25
|
| top LCD G.bit5
|-
| TP114
| LDB20
|
| top LCD B.bit0
|-
| TP115
| LDB23
|
| top LCD B.bit3
|-
| TP116
| LDR11
|
| bottom LCD R.bit1
|-
| TP117
| LDR12
|
| bottom LCD R.bit4
|-
| TP118
| LDR15
|
| bottom LCD R.bit5
|-
| TP119
| LDR25
|
| top LCD R.bit5
|-
| TP120
| LDG20
|
| top LCD G.bit2
|-
| TP121
| LDG23
|
| top LCD G.bit3
|-
| TP122
| LDG24
|
| top LCD G.bit4
|-
| TP123
| LDB22
|
| top LCD B.bit2
|-
| TP124
| LDB24
|
| top LCD B.bit4
|-
| TP125
| LDB25
|
| top LCD B.bit5
|-
| TP126
| LDR10
|
| bottom LCD R.bit0
|-
| TP127
| LDR13
|
| bottom LCD R.bit3
|-
| TP128
| LDR14
|
| bottom LCD R.bit4
|-
| TP129
| LDG10
|
| bottom LCD G.bit0
|-
| TP130
| LDG11
|
| bottom LCD G.bit1
|-
| TP131
| LDG12
|
| bottom LCD G.bit2
|-
| TP132
| LDG13
|
| bottom LCD G.bit3
|-
| TP133
| LDG15
|
| bottom LCD G.bit5
|-
| TP134
| LDB11
|
| bottom LCD B.bit1
|-
| TP135
| LDG14
|
| bottom LCD G.bit4
|-
| TP136
| LDB10
|
| bottom LCD B.bit0
|-
| TP137
| COM2
| ?
| ?
|-
| TP138
| LDB12
|
| bottom LCD B.bit2
|-
| TP139
| LDB13
|
| bottom LCD B.bit3
|-
| TP140
| LDB14
|
| bottom LCD B.bit4
|-
| TP141
| LDB15
|
| bottom LCD B.bit5
|-
| TP142
| INI
| ?
| LCD controller ?
|-
| TP143
| GSP
|
| LCD controller Vsync?
|-
| TP144
| GCK
| ?
| LCD controller ?
|-
| TP145
| REV
|
| LCD controller ?
|-
| TP146
| LS
|
| LCD controller Hsync?
|-
| TP147
| SPL
|
| LCD controller ?
|-
| TP148
| DCLK
|
| LCD controller dot clock
|-
| TP149
| CAM_RST
| 1V8?
| Camera reset signal
|-
| TP150
| COM1
| ?
| ?
|-
! scope="row" colspan="4" | (TP151 doesn't exist)
|-
| TP152
| CAM_D4
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP153
| HSYNC
| 1V8?
| Camera horizontal sync/blank (conn. thru R133, 0Ω) (Aptina MT9V133-D LINE_VALID, active-low)
|-
| TP154
| CAM_D3
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP155
| VSYNC
| 1V8?
| Camera vertical sync/blank (conn. thru R132, 0Ω) (Aptina MT9V133-D FRAME_VALID, active-low)
|-
| TP156
| CKI
| 1V8?
| Camera clock something? (Aptina MT9V133-D EXTCLK? PIXCLK?)
|-
| TP157
| CAM_D2
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP158
| CAM_D7
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP159
| CAM_D1
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP160
| X+
| ?
| touchscreen
|-
| TP161
| Y+
| ?
| touchscreen
|-
| TP162
| X-
| ?
| touchscreen, same net as Y-
|-
| TP163
| Y-
| ?
| touchscreen, same net as X-
|-
| TP164
| CAM_D6
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP165
| CAM_D0
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP166
| RCLK
| 1V8?
| Camera (conn. thru R100, 100Ω) (Aptina MT9V133-D EXTCLK? PIXCLK?)
|-
| TP167
| CAM_D5
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP168
| VDD28
| 2.8V power rail
| Only used by the camera. Generated by an LDO (U12) from VDD33 (Aptina MT9V133-D analog power rail?)
|-
! scope="row" colspan="4" | (TP169 doesn't exist)
|-
| TP170
| CAM_LED
| Camera LED cathode?
| Connected through Q13 and R68 to BPTWL.
|-
| TP171
| RTC_INT
| 1V8?
| RTC->CPU-TWL interrupt
|-
| TP172
| SD10_CLK
| 3V3
| SD card
|-
| TP173
| SD10_D0
| 3V3
| SD card
|-
| TP174
| SD10_D1
| 3V3
| SD card
|-
| TP175
| SD10_D2
| 3V3
| SD card
|-
| TP176
| SD10_D3
| 3V3
| SD card
|-
| TP177
| SD10_CMD
| 3V3
| SD card
|-
| TP178
| SD10_CP
| 3V3
| SD card (card detect)
|-
| TP179
| SD10_WP
| 3V3
| SD card write protect
|-
| TP180
| GND
| ground
|
|-
! scope="row" colspan="4" | (TP181 doesn't exist)
|-
| TP182
| SD10_VDD
| 3.3V power rail
| same net as VDD33
|-
| TP183
| AOUT
|
| charging/battery status ?
|-
| TP184
| ADPO
|
| charging/battery status ?
|-
| TP185
| SCL1
| 3V3
| BPTWL bus
|-
| TP186
| SDA1
| 3V3
| BPTWL bus
|-
| TP187
| 1V8? 3V3?
| SDI
| I2S bus
|-
| TP188
| 1V8? 3V3?
| SDO
| I2S bus
|-
| TP189
| 1V8? 3V3?
| WS
| I2S bus
|-
| TP190
| 1V8? 3V3?
| SCLK
| I2S bus
|-
| TP191
| 1V8? 3V3?
| MCLK
| I2S bus
|-
| TP192
| PWSWO
| 3V3?
| powerbutton "output" from PMIC to BPTWL?
|-
| TP193
| TH
| ?
| something battery charger?
|-
| TP194
| VSHD
| 5.0V power rail
| Same net as VDD5. For LCDs.
|}

== UTL-SUB-01 testpoints ==

{| class="wikitable" border="1"
|-
! number
! name (TWL testpoint)
! voltage standard
! comment
|-
| TP1
| ?
| ?
| to TH1 component
|-
| TP2
| GND
| (GND)
| ground
|-
| TP3
| P06
| 3V3?
| D-pad up
|-
| TP4
| P04
| 3V3?
| D-pad right
|-
| TP5
| P05
| 3V3?
| D-pad left
|-
| TP6
| P07
| 3V3?
| D-pad down
|-
| TP7
| PWSW
| ?
| raw powerbutton input (to PMIC and BPTWL)
|-
| TP8
| RED
| open collector (at cathode)
| Battery low LED (DL1)
|-
| TP9
| YELLOW
| open collector (at cathode)
| WiFi indicator LED (DL4)
|-
| TP10
| BLUE
| 3V3? 4V2? (at anode)
| Power on/good LED (DL2)
|-
| TP11
| ORANGE
| 3V3? 4V2? (at anode)
| Charging indicator (DL3)
|-
| TP12
| VDD42
| 4.2V power supply
| Power supply for TP8/TP10 LEDs
|}

== P16 pinout ==

The P16 pinout changed from [https://problemkaputt.de/gbatek-aux-dsi-internal-connectors.htm what it was on the regular DSi]. Some nets are now found in P24 instead (see below).

{| class="wikitable" border="1"
|-
! name
! pin no
! pin no
! name
|-
| GND
| 1
| 2
| GND
|-
| GND
| 3
| 4
| GND
|-
| GND
| 5
| 6
| GND
|-
| SD10_CLK
| 7
| 8
| GND
|-
| VDD33
| 9
| 10
| SD10_D0
|-
| VDD33
| 11
| 12
| SD10_D1
|-
| GND
| 13
| 14
| SD10_WP
|-
| SD10_CMD
| 15
| 16
| VDD33
|-
| GND
| 17
| 18
| P08
|-
| SD10_D3
| 19
| 20
| VDD33
|-
| SD10_D2
| 21
| 22
| SD10_CD
|-
| GND
| 23
| 24
| GND
|-
| GND
| 25
| 26
| GND
|}

== P24 pinout ==

P24 is a mezzanine connector for the VOLP/VOLN buttons and the shoulder L button (which were on P16 on the DSi).

{| class="wikitable" border="1"
|-
! name
! pin no
! pin no
! name
|-
| GND
| 1
| 2
| GND
|-
| N/C
| 3
| 4
| VOLP
|-
| P09 (shoulder-L)
| 5
| 6
| VOLN
|-
| GND
| 7-13
| 8-14
| GND
|}

[[Category:Hardware]]

DSi XL testpoints

2023-08-13T16:14:32Z

PoroCYon: /* UTL-CPU-01 testpoints */ finished

== UTL-CPU-01 testpoints ==

{| class="wikitable" border="1"
|-
! number
! name (TWL testpoint)
! voltage standard
! comment
|-
| TP1
| EXTB+
| ?
|
|-
| TP2
| VIN
| ≃5V DC
| External charger power input
|-
| TP3
| Rosc
| ?
| ?
|-
| TP4
| RICHG
| ?
| Recharge?
|-
| TP5
| GND
| ground
| (near external charger connector)
|-
| TP6
| VDD12 (aka V12)
| 1.2V power rail
| CPU-TWL core voltage
|-
| TP7
| BT+
| battery +
| at 2-pin power connector to UTL-SUB-01
|-
| TP8
| VDET-
| ?
| ?
|-
| TP9
| DET
| ?
| ?
|-
| TP10
| VDD18 (aka V18)
| 1.8V power rail
| Various I/O and core voltage (incl. RTC)
|-
| TP11
| ?
| ?
| something charging?
|-
| TP12
| VDD10
| 10V power rail
| For LCDs
|-
| TP13
| VDD33 (aka V33)
| 3.3V power rail
| Various I/O and core voltage
|-
| TP14
| GND
| ground
| (near PMIC)
|-
| TP15
| B+
| ?
| battery + ?
|-
| TP16
| VDD-5
| -5V power rail
| For LCDs
|-
| TP17
| PVDD
| ?
| ?
|-
| TP18
| VDD5
| 5.0V power rail
| For LCDs
|-
| TP19
| SG?
| ?
| ?
|-
| TP20
| BLA1
| ?
| backlight anode for lower screen
|-
| TP21
| VDD5?
| ?
| must be at least one power rail (to D6, C22, D3) (might be VDD42 due to diode voltage drops?)
|-
| TP22
| BLC1
| ?
| backlight cathode for lower screen
|-
| TP23
| BLA2
| ?
| backlight anode for upper screen
|-
! scope="row" colspan="4" | (TP24, TP25 don't exist)
|-
| TP26
| BLC2
| ?
| backlight cathode for upper screen
|-
! scope="row" colspan="4" | (TP27 doesn't exist)
|-
| TP28
| MIC-
| ground
| same net as (analog) ground
|-
| TP29
| MIC+
| analog
| Analog microphone-in signal
|-
| TP30
| SPRP
| analog
| positive signal for right built-in speaker
|-
| TP31
| SPRN
| analog
| negative signal for right built-in speaker
|-
| TP32
| SPLP
| analog
| positive signal for left built-in speaker
|-
| TP33
| SPLN
| analog
| negative signal for left built-in speaker
|-
| TP34
| GND
| ground
| probably analog ground
|-
| TP35
| SR
| analog
| headphone tip
|-
| TP36
| SL
| analog
| headphone ring
|-
! scope="row" colspan="4" | (TP37, TP38 don't exist)
|-
| TP39
| ORANGE
| 3V3? 4V2? (at anode)
| Orange LED charging indicator
|-
| TP40
| BLUE
| 3V3? 4V2? (at anode)
| Blue LED power good indicator
|-
| TP41
| RED
| open collector (connected to LED cathode)
| Red LED battery low indicator
|-
| TP42
| MC1_D7
| 3V3
| MSB of gamecard parallell ROM *or* AUXSPI COPI signal
|-
| TP43
| MC1_D6
| 3V3
| 6th bit of gamecard parallell ROM *or* AUXSPI CIPO signal
|-
| TP44
| MC1_VCC
| 3.3V power
| power supply to gamecard (can be switched off by SoC)
|-
! scope="row" colspan="4" | (TP45 doesn't exist)
|-
| TP46
| MC1_D5
| 3V3
|
|-
| TP47
| MC1_D4
| 3V3
|
|-
| TP48
| MC1_D3
| 3V3
|
|-
| TP49
| MC1_DET
| 3V3
| Cartridge detected in slot (active-low)
|-
| TP50
| MC1_D2
| 3V3
|
|-
| TP51
| MC1_IREQ
| 3V3
| gamecart->SoC IRQ
|-
| TP52
| MC1_D1
| 3V3
|
|-
| TP53
| MC1_RES
| 3V3
| SoC->gamecart reset signal
|-
| TP54
| MC1_D0
| 3V3
|
|-
| TP55
| MC1_CS
| 3V3
| parallell ROM select (active-low)
|-
| TP56
| MC1_CLK
| 3V3
|
|-
| TP57
| MC1_CS2
| 3V3
| AUXSPI select (active-low)
|-
| TP58
| mRST
| 3V3
| BPTWL reset (active-low)
|-
| TP59
| mFE
| 3V3
| BPTWL flash enable (cf. 78K0/Kx2 Serial Flash Programming protocol, see NEC/Renesas docs)
|-
| TP60
| VOLP
| 3V3
| volume + button (also RxD6 for 78K0 SFP. There's a series resistor to the physical button as protection against shorts)
|-
| TP61
| VOLN
| 3V3
| volume - button (also TxD6 for 78K0 SFP. There's a series resistor to the physical button as protection against shorts)
|-
| TP62
| ATH_TX_H
| 3V3
| something new (Atheros) wifi?
|-
| TP63
| WL_TXPE
| 3V3
| ?
|-
! scope="row" colspan="4" | (TP64 doesn't exist)
|-
| TP65
| WL_RXPE
| 3V3
| ?
|-
| TP66
| /WIFI_RST
| 3V3
| WiFi chip(s) reset (active-lw)
|-
! scope="row" colspan="4" | (TP67, TP68 don't exist)
|-
| TP69
| SPI_MOSI
| 3V3
| SPI bus
|-
! scope="row" colspan="4" | (TP70 doesn't exist)
|-
| TP71
| SPI_MISO
| 3V3
| SPI bus
|-
! scope="row" colspan="4" | (TP72 doesn't exist)
|-
| TP73
| SPI_SCK
| 3V3
| SPI bus
|-
! scope="row" colspan="4" | (TP74, TP75 don't exist)
|-
| TP76
| SPI_CS1
| 3V3
| SPI chip select 1 (PMIC)
|-
! scope="row" colspan="4" | (TP77 doesn't exist)
|-
| TP78
| SPI_CS3
| 3V3
| SPI chip select 3 (TSC)
|-
| TP79
| SPI_CS2
| 3V3
| SPI chip select 2 ([[NVRAM]])
|-
| TP80
| SCL
| 1V8
| CPU-TWL bus
|-
! scope="row" colspan="4" | (TP81 doesn't exist)
|-
| TP82
| SDA
| 1V8
| CPU-TWL bus
|-
| TP83
| PENIRQ
| 1V8? 3V3?
| touchscreen pen down
|-
| TP84
| R7
| 1V8?
| hinge magnet detect signal (active-low)
|-
| TP85
| RESET
| 3V3, but use as open drain/collector
| CPU-TWL reset signal
|-
| TP86
| P05
| 3V3?
| dpad left button
|-
| TP87
| P04
| 3V3?
| dpad right button
|-
| TP88
| P03
| 3V3?
| start button
|-
| TP89
| P02
| 3V3?
| select button
|-
| TP90
| P01
| 3V3?
| B button
|-
| TP91
| P00
| 3V3?
| A button
|-
| TP92
| PM_SLP
| ?
| ?
|-
| TP93
| VCNT5
| ?
| ?
|-
| TP94
| GPIO330?
| 3V3
| GPIO debug testpoint
|-
| TP95
| R01
| ?
| Y button
|-
| TP96
| R00
| ?
| X button
|-
| TP97
| P09
| 3V3
| shoulder-L button
|-
| TP98
| P08
| 3V3
| shoulder-R button
|-
| TP99
| MUTE
| 3V3
| ? (aka GPIO333?)
|-
| TP100
| P07
| 3V3?
| dpad down button
|-
| TP101
| HP#SP
| 3V3
| audio out is headphones (1) or speakers (0). aka GPIO331
|-
| TP102
| P06
| 3V3?
| dpad up button
|-
! scope="row" colspan="4" | (TP103 doesn't exist)
|-
| TP104
| nIRQ_O?
| 3V3
| "powerbutton pressed" signal from the BPTWL to the CPU-TWL. aka GPIO332
|-
| TP105
| LDR20
|
| top LCD R.bit0
|-
| TP106
| LDR21
|
| top LCD R.bit1
|-
| TP107
| LDR22
|
| top LCD R.bit2
|-
| TP108
| LDR23
|
| top LCD R.bit3
|-
| TP109
| LDR24
|
| top LCD R.bit4
|-
| TP110
| LDB21
|
| top LCD B.bit1
|-
| TP111
| LDG21
|
| top LCD G.bit1
|-
| TP112
| LDG22
|
| top LCD G.bit2
|-
| TP113
| LDG25
|
| top LCD G.bit5
|-
| TP114
| LDB20
|
| top LCD B.bit0
|-
| TP115
| LDB23
|
| top LCD B.bit3
|-
| TP116
| LDR11
|
| bottom LCD R.bit1
|-
| TP117
| LDR12
|
| bottom LCD R.bit4
|-
| TP118
| LDR15
|
| bottom LCD R.bit5
|-
| TP119
| LDR25
|
| top LCD R.bit5
|-
| TP120
| LDG20
|
| top LCD G.bit2
|-
| TP121
| LDG23
|
| top LCD G.bit3
|-
| TP122
| LDG24
|
| top LCD G.bit4
|-
| TP123
| LDB22
|
| top LCD B.bit2
|-
| TP124
| LDB24
|
| top LCD B.bit4
|-
| TP125
| LDB25
|
| top LCD B.bit5
|-
| TP126
| LDR10
|
| bottom LCD R.bit0
|-
| TP127
| LDR13
|
| bottom LCD R.bit3
|-
| TP128
| LDR14
|
| bottom LCD R.bit4
|-
| TP129
| LDG10
|
| bottom LCD G.bit0
|-
| TP130
| LDG11
|
| bottom LCD G.bit1
|-
| TP131
| LDG12
|
| bottom LCD G.bit2
|-
| TP132
| LDG13
|
| bottom LCD G.bit3
|-
| TP133
| LDG15
|
| bottom LCD G.bit5
|-
| TP134
| LDB11
|
| bottom LCD B.bit1
|-
| TP135
| LDG14
|
| bottom LCD G.bit4
|-
| TP136
| LDB10
|
| bottom LCD B.bit0
|-
| TP137
| COM2
| ?
| ?
|-
| TP138
| LDB12
|
| bottom LCD B.bit2
|-
| TP139
| LDB13
|
| bottom LCD B.bit3
|-
| TP140
| LDB14
|
| bottom LCD B.bit4
|-
| TP141
| LDB15
|
| bottom LCD B.bit5
|-
| TP142
| INI
| ?
| LCD controller ?
|-
| TP143
| GSP
|
| LCD controller Vsync?
|-
| TP144
| GCK
| ?
| LCD controller ?
|-
| TP145
| REV
|
| LCD controller ?
|-
| TP146
| LS
|
| LCD controller Hsync?
|-
| TP147
| SPL
|
| LCD controller ?
|-
| TP148
| DCLK
|
| LCD controller dot clock
|-
| TP149
| CAM_RST
| 1V8?
| Camera reset signal
|-
| TP150
| COM1
| ?
| ?
|-
! scope="row" colspan="4" | (TP151 doesn't exist)
|-
| TP152
| CAM_D4
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP153
| HSYNC
| 1V8?
| Camera horizontal sync/blank (conn. thru R133, 0Ω) (Aptina MT9V133-D LINE_VALID, active-low)
|-
| TP154
| CAM_D3
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP155
| VSYNC
| 1V8?
| Camera vertical sync/blank (conn. thru R132, 0Ω) (Aptina MT9V133-D FRAME_VALID, active-low)
|-
| TP156
| CKI
| 1V8?
| Camera clock something? (Aptina MT9V133-D EXTCLK? PIXCLK?)
|-
| TP157
| CAM_D2
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP158
| CAM_D7
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP159
| CAM_D1
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP160
| X+
| ?
| touchscreen
|-
| TP161
| Y+
| ?
| touchscreen
|-
| TP162
| X-
| ?
| touchscreen, same net as Y-
|-
| TP163
| Y-
| ?
| touchscreen, same net as X-
|-
| TP164
| CAM_D6
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP165
| CAM_D0
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP166
| RCLK
| 1V8?
| Camera (conn. thru R100, 100Ω) (Aptina MT9V133-D EXTCLK? PIXCLK?)
|-
| TP167
| CAM_D5
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP168
| VDD28
| 2.8V power rail
| Only used by the camera. Generated by an LDO (U12) from VDD33 (Aptina MT9V133-D analog power rail?)
|-
! scope="row" colspan="4" | (TP169 doesn't exist)
|-
| TP170
| CAM_LED
| Camera LED cathode?
| Connected through Q13 and R68 to BPTWL.
|-
| TP171
| RTC_INT
| 1V8?
| RTC->CPU-TWL interrupt
|-
| TP172
| SD10_CLK
| 3V3
| SD card
|-
| TP173
| SD10_D0
| 3V3
| SD card
|-
| TP174
| SD10_D1
| 3V3
| SD card
|-
| TP175
| SD10_D2
| 3V3
| SD card
|-
| TP176
| SD10_D3
| 3V3
| SD card
|-
| TP177
| SD10_CMD
| 3V3
| SD card
|-
| TP178
| SD10_CP
| 3V3
| SD card (card detect)
|-
| TP179
| SD10_WP
| 3V3
| SD card write protect
|-
| TP180
| GND
| ground
|
|-
! scope="row" colspan="4" | (TP181 doesn't exist)
|-
| TP182
| SD10_VDD
| 3.3V power rail
| same net as VDD33
|-
| TP183
| AOUT
|
| charging/battery status ?
|-
| TP184
| ADPO
|
| charging/battery status ?
|-
| TP185
| SCL1
| 3V3
| BPTWL bus
|-
| TP186
| SDA1
| 3V3
| BPTWL bus
|-
| TP187
| 1V8? 3V3?
|
| I2S bus
|-
| TP188
| 1V8? 3V3?
|
| I2S bus
|-
| TP189
| 1V8? 3V3?
|
| I2S bus
|-
| TP190
| 1V8? 3V3?
|
| I2S bus
|-
| TP191
| 1V8? 3V3?
|
| I2S bus
|-
| TP192
| PWSWO
| 3V3?
| powerbutton "output" from PMIC to BPTWL?
|-
| TP193
| TH
| ?
| something battery charger?
|-
| TP194
| VSHD
| 5.0V power rail
| Same net as VDD5. For LCDs.
|}

== UTL-SUB-01 testpoints ==

{| class="wikitable" border="1"
|-
! number
! name (TWL testpoint)
! voltage standard
! comment
|-
| TP1
| ?
| ?
| to TH1 component
|-
| TP2
| GND
| (GND)
| ground
|-
| TP3
| P06
| 3V3?
| D-pad up
|-
| TP4
| P04
| 3V3?
| D-pad right
|-
| TP5
| P05
| 3V3?
| D-pad left
|-
| TP6
| P07
| 3V3?
| D-pad down
|-
| TP7
| PWSW
| ?
| raw powerbutton input (to PMIC and BPTWL)
|-
| TP8
| RED
| open collector (at cathode)
| Battery low LED (DL1)
|-
| TP9
| YELLOW
| open collector (at cathode)
| WiFi indicator LED (DL4)
|-
| TP10
| BLUE
| 3V3? 4V2? (at anode)
| Power on/good LED (DL2)
|-
| TP11
| ORANGE
| 3V3? 4V2? (at anode)
| Charging indicator (DL3)
|-
| TP12
| VDD42
| 4.2V power supply
| Power supply for TP8/TP10 LEDs
|}

== P16 pinout ==

The P16 pinout changed from [https://problemkaputt.de/gbatek-aux-dsi-internal-connectors.htm what it was on the regular DSi]. Some nets are now found in P24 instead (see below).

{| class="wikitable" border="1"
|-
! name
! pin no
! pin no
! name
|-
| GND
| 1
| 2
| GND
|-
| GND
| 3
| 4
| GND
|-
| GND
| 5
| 6
| GND
|-
| SD10_CLK
| 7
| 8
| GND
|-
| VDD33
| 9
| 10
| SD10_D0
|-
| VDD33
| 11
| 12
| SD10_D1
|-
| GND
| 13
| 14
| SD10_WP
|-
| SD10_CMD
| 15
| 16
| VDD33
|-
| GND
| 17
| 18
| P08
|-
| SD10_D3
| 19
| 20
| VDD33
|-
| SD10_D2
| 21
| 22
| SD10_CD
|-
| GND
| 23
| 24
| GND
|-
| GND
| 25
| 26
| GND
|}

== P24 pinout ==

P24 is a mezzanine connector for the VOLP/VOLN buttons and the shoulder L button (which were on P16 on the DSi).

{| class="wikitable" border="1"
|-
! name
! pin no
! pin no
! name
|-
| GND
| 1
| 2
| GND
|-
| N/C
| 3
| 4
| VOLP
|-
| P09 (shoulder-L)
| 5
| 6
| VOLN
|-
| GND
| 7-13
| 8-14
| GND
|}

[[Category:Hardware]]

DSi XL testpoints

2023-08-13T13:37:49Z

PoroCYon: /* UTL-CPU-01 testpoints */ clarify camera stuff

== UTL-CPU-01 testpoints ==

{| class="wikitable" border="1"
|-
! number
! name (TWL testpoint)
! voltage standard
! comment
|-
| TP1
| EXTB+
| ?
|
|-
| TP2
| VIN
| ~5V DC
| External charger power input
|-
| TP3
| Rosc
| ?
| ?
|-
| TP4
| RICHG?
| ?
| Recharge?
|-
| TP5
| GND
| (GND)
| ground (near external charger connector)
|-
| TP6
| V12
| 1.2V power rail
| CPU-TWL core voltage
|-
| TP7
| BT+
| battery +
| at 2-pin power connector to UTL-SUB-01
|-
| TP8
| VDET-
| ?
| ?
|-
| TP9
| DET
| ?
| ?
|-
| TP10
| V18
| 1.8V power rail
| Various I/O and core voltage (incl. RTC)
|-
| TP11
| ?
| ?
| something charging?
|-
| TP12
| VDD10?
| 10V power rail
| For LCDs
|-
| TP13
| VDD33
| 3.3V power rail
| Various I/O and core voltage
|-
| TP14
| GND
| (GND)
| ground (near PMIC)
|-
| TP15
| B+
| ?
| battery + ?
|-
| TP16
| VDD-5?
| -5V power rail
| For LCDs
|-
| TP17
| PVDD
| ?
| ?
|-
| TP18
| VDD5?
| 5V power rail
| For LCDs
|-
| TP19
| ?
| ?
| (to R7 or R104)
|-
| TP20
| BLA1
| ?
| backlight anode for lower screen
|-
| TP21
| ?
| ?
| (to D6)
|-
| TP22
| BLC1
| ?
| backlight cathode for lower screen
|-
| TP23
| BLA2
| ?
| backlight anode for upper screen
|-
! scope="row" colspan="4" | (TP24, TP25 don't exist)
|-
| TP26
| BLC2
| ?
| backlight cathode for upper screen
|-
! scope="row" colspan="4" | (TP27 doesn't exist)
|-
| TP28
| ?
| ?
| ? (found no connections. TODO!)
|-
| TP29
| ?
| ?
| ? (found no connections. TODO!)
|-
| TP30
| SPRP
| analog
| positive signal for right built-in speaker
|-
| TP31
| SPRN
| analog
| negative signal for right built-in speaker
|-
| TP32
| SPLP
| analog
| positive signal for left built-in speaker
|-
| TP33
| SPLN
| analog
| negative signal for left built-in speaker
|-
| TP34
| GND
| (GND)
| probably analog ground
|-
| TP35
| SR
| analog
| headphone tip
|-
| TP36
| SL
| analog
| headphone ring
|-
! scope="row" colspan="4" | (TP37, TP38 don't exist)
|-
| TP39
| ORANGE
| 3V3? 4V2? (at anode)
| Orange LED charging indicator
|-
| TP40
| BLUE
| 3V3? 4V2? (at anode)
| Blue LED power good indicator
|-
| TP41
| RED
| open collector (connected to LED cathode)
| Red LED battery low indicator
|-
| TP42
| MC1_D7
| 3V3
| MSB of gamecard parallell ROM *or* AUXSPI COPI signal
|-
| TP43
| MC1_D6
| 3V3
| 6th bit of gamecard parallell ROM *or* AUXSPI CIPO signal
|-
| TP44
| MC1_VCC
| 3.3V power
| power supply to gamecard (can be switched off by SoC)
|-
! scope="row" colspan="4" | (TP45 doesn't exist)
|-
| TP46
| MC1_D5
| 3V3
|
|-
| TP47
| MC1_D4
| 3V3
|
|-
| TP48
| MC1_D3
| 3V3
|
|-
| TP49
| MC1_DET
| 3V3
| Cartridge detected in slot (active-low)
|-
| TP50
| MC1_D2
| 3V3
|
|-
| TP51
| MC1_IREQ
| 3V3
| gamecart->SoC IRQ
|-
| TP52
| MC1_D1
| 3V3
|
|-
| TP53
| MC1_RES
| 3V3
| SoC->gamecart reset signal
|-
| TP54
| MC1_D0
| 3V3
|
|-
| TP55
| MC1_CS
| 3V3
| parallell ROM select (active-low)
|-
| TP56
| MC1_CLK
| 3V3
|
|-
| TP57
| MC1_CS2
| 3V3
| AUXSPI select (active-low)
|-
| TP58
| mRST
| 3V3
| BP-UTL reset (active-low)
|-
| TP59
| mFE
| 3V3
| BP-UTL flash enable (cf. 78K0/Kx2 Serial Flash Programming protocol, see NEC/Renesas docs)
|-
| TP60
| VOLP
| 3V3
| volume + button (also RxD6 for 78K0 SFP)
|-
| TP61
| VOLN
| 3V3
| volume - button (also TxD6 for 78K0 SFP)
|-
| TP62
| ATH_TX_H
| 3V3
| something new (Atheros) wifi?
|-
| TP63
| WL_TXPE
| 3V3
| ?
|-
! scope="row" colspan="4" | (TP64 doesn't exist)
|-
| TP65
| WL_RXPE
| 3V3
| ?
|-
| TP66
| /WIFI_RST
| 3V3
| WiFi chip(s) reset (active-lw)
|-
! scope="row" colspan="4" | (TP67, TP68 don't exist)
|-
| TP69
| SPI_MOSI
| 3V3
| SPI bus
|-
! scope="row" colspan="4" | (TP70 doesn't exist)
|-
| TP71
| SPI_MISO
| 3V3
| SPI bus
|-
! scope="row" colspan="4" | (TP72 doesn't exist)
|-
| TP73
| SPI_SCK
| 3V3
| SPI bus
|-
! scope="row" colspan="4" | (TP74, TP75 don't exist)
|-
| TP76
| SPI_CS1
| 3V3
| SPI chip select 1 (PMIC)
|-
! scope="row" colspan="4" | (TP77 doesn't exist)
|-
| TP78
| SPI_CS3
| 3V3
| SPI chip select 3 (TSC)
|-
| TP79
| SPI_CS2
| 3V3
| SPI chip select 2 ([[NVRAM]])
|-
| TP80
| SCL
| 1V8
| TWL bus
|-
! scope="row" colspan="4" | (TP81 doesn't exist)
|-
| TP82
| SDA
| 1V8
| TWL bus
|-
| TP83
| PENIRQ
| 1V8? 3V3?
| touchscreen pen down
|-
| TP84
| R7
| 1V8?
| hinge magnet detect signal (active-low)
|-
| TP85
| RESET
| 3V3, but use as open drain/collector
| CPU-TWL reset signal
|-
| TP86
| P05
| 3V3?
| dpad left button
|-
| TP87
| P04
| 3V3?
| dpad right button
|-
| TP88
| P03
| 3V3?
| start button
|-
| TP89
| P02
| 3V3?
| select button
|-
| TP90
| P01
| 3V3?
| B button
|-
| TP91
| P00
| 3V3?
| A button
|-
| TP92
| PM_SLP
| ?
| ?
|-
| TP93
| VCNT5
| ?
| ?
|-
| TP94
| maybe GPIO330?
| 3V3?
| ?
|-
| TP95
| R01
| ?
| Y button
|-
| TP96
| R00
| ?
| X button
|-
| TP97
| P09
| 3V3
| shoulder-L button
|-
| TP98
| P08
| 3V3
| shoulder-R button
|-
| TP99
| MUTE
| 3V3
| ? (aka GPIO333?)
|-
| TP100
| P07
| 3V3?
| dpad down button
|-
| TP101
| HP#SP
| 3V3
| audio out is headphones (1) or speakers (0). aka GPIO331
|-
| TP102
| P06
| 3V3?
| dpad up button
|-
! scope="row" colspan="4" | (TP103 doesn't exist)
|-
| TP104
| ? (maybe nIRQ_O)
| 3V3?
| (nIRQ_O is the "powerbutton pressed" signal from the BPTWL to the CPU-TWL SoC. aka GPIO332)
|-
| TP105
| LDR20
|
| top LCD R.bit0
|-
| TP106
| LDR21
|
| top LCD R.bit1
|-
| TP107
| LDR22
|
| top LCD R.bit2
|-
| TP108
| LDR23
|
| top LCD R.bit3
|-
| TP109
| LDR24
|
| top LCD R.bit4
|-
| TP110
| LDB21
|
| top LCD B.bit1
|-
| TP111
| LDG21
|
| top LCD G.bit1
|-
| TP112
| LDG22
|
| top LCD G.bit2
|-
| TP113
| LDG25
|
| top LCD G.bit5
|-
| TP114
| LDB20
|
| top LCD B.bit0
|-
| TP115
| LDB23
|
| top LCD B.bit3
|-
| TP116
| LDR11
|
| bottom LCD R.bit1
|-
| TP117
| LDR12
|
| bottom LCD R.bit4
|-
| TP118
| LDR15
|
| bottom LCD R.bit5
|-
| TP119
| LDR25
|
| top LCD R.bit5
|-
| TP120
| LDG20
|
| top LCD G.bit2
|-
| TP121
| LDG23
|
| top LCD G.bit3
|-
| TP122
| LDG24
|
| top LCD G.bit4
|-
| TP123
| LDB22
|
| top LCD B.bit2
|-
| TP124
| LDB24
|
| top LCD B.bit4
|-
| TP125
| LDB25
|
| top LCD B.bit5
|-
| TP126
| LDR10
|
| bottom LCD R.bit0
|-
| TP127
| LDR13
|
| bottom LCD R.bit3
|-
| TP128
| LDR14
|
| bottom LCD R.bit4
|-
| TP129
| LDG10
|
| bottom LCD G.bit0
|-
| TP130
| LDG11
|
| bottom LCD G.bit1
|-
| TP131
| LDG12
|
| bottom LCD G.bit2
|-
| TP132
| LDG13
|
| bottom LCD G.bit3
|-
| TP133
| LDG15
|
| bottom LCD G.bit5
|-
| TP134
| LDB11
|
| bottom LCD B.bit1
|-
| TP135
| LDG14
|
| bottom LCD G.bit4
|-
| TP136
| LDB10
|
| bottom LCD B.bit0
|-
| TP137
| ?
| ?
| ?
|-
| TP138
| LDB12
|
| bottom LCD B.bit2
|-
| TP139
| LDB13
|
| bottom LCD B.bit3
|-
| TP140
| LDB14
|
| bottom LCD B.bit4
|-
| TP141
| LDB15
|
| bottom LCD B.bit5
|-
| TP142
| VDD5 or VSHD
| 5.0V power rail
| VDD5 and VSHD are the same net
|-
| TP143
| GSP
|
| LCD controller Vsync?
|-
| TP144
| VDD5 or VSHD
| 5.0V power rail
| VDD5 and VSHD are the same net
|-
| TP145
| REV
|
| LCD controller ?
|-
| TP146
| LS
|
| LCD controller Hsync?
|-
| TP147
| SPL
|
| LCD controller ?
|-
| TP148
| DCLK
|
| LCD controller dot clock
|-
| TP149
| CAM_RST
| 1V8?
| Camera reset signal
|-
| TP150
| COM1
|
|
|-
! scope="row" colspan="4" | (TP151 doesn't exist)
|-
| TP152
| CAM_D4
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP153
| HSYNC
| 1V8?
| Camera horizontal sync/blank (conn. thru R133, 0Ω) (Aptina MT9V133-D LINE_VALID, active-low)
|-
| TP154
| CAM_D3
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP155
| VSYNC
| 1V8?
| Camera vertical sync/blank (conn. thru R132, 0Ω) (Aptina MT9V133-D FRAME_VALID, active-low)
|-
| TP156
| CKI
| 1V8?
| Camera clock something? (Aptina MT9V133-D EXTCLK? PIXCLK?)
|-
| TP157
| CAM_D2
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP158
| CAM_D7
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP159
| CAM_D1
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP160
| X+
| ?
| touchscreen
|-
| TP161
| Y+
| ?
| touchscreen
|-
| TP162
| X-
| ?
| touchscreen, same net as Y-
|-
| TP163
| Y-
| ?
| touchscreen, same net as X-
|-
| TP164
| CAM_D6
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP165
| CAM_D0
| 1V8?
| Camera parallell port (conn. thru RA6, 270Ω)
|-
| TP166
| RCLK
| 1V8?
| Camera (conn. thru R100, 100Ω) (Aptina MT9V133-D EXTCLK? PIXCLK?)
|-
| TP167
| CAM_D5
| 1V8?
| Camera parallell port (conn. thru RA7, 270Ω)
|-
| TP168
| VDD28
| 2.8V power rail
| Only used by the camera. Generated by an LDO (U12) from VDD33 (Aptina MT9V133-D analog power rail?)
|-
! scope="row" colspan="4" | (TP169 doesn't exist)
|-
| TP170
| CAM_LED
| Camera LED cathode?
| Connected through Q13 and R68 to BPTWL.
|-
| TP171
| ?
| ?
| ?
|-
| TP172
| SD10_CLK
| 3V3
| SD card
|-
| TP173
| SD10_D0
| 3V3
| SD card
|-
| TP174
| SD10_D1
| 3V3
| SD card
|-
| TP175
| SD10_D2
| 3V3
| SD card
|-
| TP176
| SD10_D3
| 3V3
| SD card
|-
| TP177
| SD10_CMD
| 3V3
| SD card
|-
| TP178
| SD10_CP
| 3V3
| SD card (card detect)
|-
| TP179
| SD10_WP
| 3V3
| SD card write protect
|-
| TP180
| GND
| ground
|
|-
! scope="row" colspan="4" | (TP181 doesn't exist)
|-
| TP182
| SD10_VDD
| 3.3V power rail
| same net as VDD33
|}

[more TODO]

== UTL-SUB-01 testpoints ==

{| class="wikitable" border="1"
|-
! number
! name (TWL testpoint)
! voltage standard
! comment
|-
| TP1
| ?
| ?
| to TH1 component
|-
| TP2
| GND
| (GND)
| ground
|-
| TP3
| P06
| 3V3?
| D-pad up
|-
| TP4
| P04
| 3V3?
| D-pad right
|-
| TP5
| P05
| 3V3?
| D-pad left
|-
| TP6
| P07
| 3V3?
| D-pad down
|-
| TP7
| PWSW
| ?
| raw powerbutton input (to PMIC and BPTWL)
|-
| TP8
| RED
| open collector (at cathode)
| Battery low LED (DL1)
|-
| TP9
| YELLOW
| open collector (at cathode)
| WiFi indicator LED (DL4)
|-
| TP10
| BLUE
| 3V3? 4V2? (at anode)
| Power on/good LED (DL2)
|-
| TP11
| ORANGE
| 3V3? 4V2? (at anode)
| Charging indicator (DL3)
|-
| TP12
| VDD42
| 4.2V power supply
| Power supply for TP8/TP10 LEDs
|}

== P16 pinout ==

The P16 pinout changed from [https://problemkaputt.de/gbatek-aux-dsi-internal-connectors.htm what it was on the regular DSi]. Some nets are now found in P24 instead (see below).

{| class="wikitable" border="1"
|-
! name
! pin no
! pin no
! name
|-
| GND
| 1
| 2
| GND
|-
| GND
| 3
| 4
| GND
|-
| GND
| 5
| 6
| GND
|-
| SD10_CLK
| 7
| 8
| GND
|-
| VDD33
| 9
| 10
| SD10_D0
|-
| VDD33
| 11
| 12
| SD10_D1
|-
| GND
| 13
| 14
| SD10_WP
|-
| SD10_CMD
| 15
| 16
| VDD33
|-
| GND
| 17
| 18
| P08
|-
| SD10_D3
| 19
| 20
| VDD33
|-
| SD10_D2
| 21
| 22
| SD10_CD
|-
| GND
| 23
| 24
| GND
|-
| GND
| 25
| 26
| GND
|}

== P24 pinout ==

P24 is a mezzanine connector for the VOLP/VOLN buttons and the shoulder L button (which were on P16 on the DSi).

{| class="wikitable" border="1"
|-
! name
! pin no
! pin no
! name
|-
| GND
| 1
| 2
| GND
|-
| N/C
| 3
| 4
| VOLP
|-
| P09 (shoulder-L)
| 5
| 6
| VOLN
|-
| GND
| 7-13
| 8-14
| GND
|}

[[Category:Hardware]]

DSi XL testpoints

2023-08-13T13:22:55Z

PoroCYon: P16 pinout

== UTL-CPU-01 testpoints ==

{| class="wikitable" border="1"
|-
! number
! name (TWL testpoint)
! voltage standard
! comment
|-
| TP1
| EXTB+
| ?
|
|-
| TP2
| VIN
| ~5V DC
| External charger power input
|-
| TP3
| Rosc
| ?
| ?
|-
| TP4
| RICHG?
| ?
| Recharge?
|-
| TP5
| GND
| (GND)
| ground (near external charger connector)
|-
| TP6
| V12
| 1.2V power rail
| CPU-TWL core voltage
|-
| TP7
| BT+
| battery +
| at 2-pin power connector to UTL-SUB-01
|-
| TP8
| VDET-
| ?
| ?
|-
| TP9
| DET
| ?
| ?
|-
| TP10
| V18
| 1.8V power rail
| Various I/O and core voltage (incl. RTC)
|-
| TP11
| ?
| ?
| something charging?
|-
| TP12
| VDD10?
| 10V power rail
| For LCDs
|-
| TP13
| VDD33
| 3.3V power rail
| Various I/O and core voltage
|-
| TP14
| GND
| (GND)
| ground (near PMIC)
|-
| TP15
| B+
| ?
| battery + ?
|-
| TP16
| VDD-5?
| -5V power rail
| For LCDs
|-
| TP17
| PVDD
| ?
| ?
|-
| TP18
| VDD5?
| 5V power rail
| For LCDs
|-
| TP19
| ?
| ?
| (to R7 or R104)
|-
| TP20
| BLA1
| ?
| backlight anode for lower screen
|-
| TP21
| ?
| ?
| (to D6)
|-
| TP22
| BLC1
| ?
| backlight cathode for lower screen
|-
| TP23
| BLA2
| ?
| backlight anode for upper screen
|-
! scope="row" colspan="4" | (TP24, TP25 don't exist)
|-
| TP26
| BLC2
| ?
| backlight cathode for upper screen
|-
! scope="row" colspan="4" | (TP27 doesn't exist)
|-
| TP28
| ?
| ?
| ? (found no connections. TODO!)
|-
| TP29
| ?
| ?
| ? (found no connections. TODO!)
|-
| TP30
| SPRP
| analog
| positive signal for right built-in speaker
|-
| TP31
| SPRN
| analog
| negative signal for right built-in speaker
|-
| TP32
| SPLP
| analog
| positive signal for left built-in speaker
|-
| TP33
| SPLN
| analog
| negative signal for left built-in speaker
|-
| TP34
| GND
| (GND)
| probably analog ground
|-
| TP35
| SR
| analog
| headphone tip
|-
| TP36
| SL
| analog
| headphone ring
|-
! scope="row" colspan="4" | (TP37, TP38 don't exist)
|-
| TP39
| ORANGE
| 3V3? 4V2? (at anode)
| Orange LED charging indicator
|-
| TP40
| BLUE
| 3V3? 4V2? (at anode)
| Blue LED power good indicator
|-
| TP41
| RED
| open collector (connected to LED cathode)
| Red LED battery low indicator
|-
| TP42
| MC1_D7
| 3V3
| MSB of gamecard parallell ROM *or* AUXSPI COPI signal
|-
| TP43
| MC1_D6
| 3V3
| 6th bit of gamecard parallell ROM *or* AUXSPI CIPO signal
|-
| TP44
| MC1_VCC
| 3.3V power
| power supply to gamecard (can be switched off by SoC)
|-
! scope="row" colspan="4" | (TP45 doesn't exist)
|-
| TP46
| MC1_D5
| 3V3
|
|-
| TP47
| MC1_D4
| 3V3
|
|-
| TP48
| MC1_D3
| 3V3
|
|-
| TP49
| MC1_DET
| 3V3
| Cartridge detected in slot (active-low)
|-
| TP50
| MC1_D2
| 3V3
|
|-
| TP51
| MC1_IREQ
| 3V3
| gamecart->SoC IRQ
|-
| TP52
| MC1_D1
| 3V3
|
|-
| TP53
| MC1_RES
| 3V3
| SoC->gamecart reset signal
|-
| TP54
| MC1_D0
| 3V3
|
|-
| TP55
| MC1_CS
| 3V3
| parallell ROM select (active-low)
|-
| TP56
| MC1_CLK
| 3V3
|
|-
| TP57
| MC1_CS2
| 3V3
| AUXSPI select (active-low)
|-
| TP58
| mRST
| 3V3
| BP-UTL reset (active-low)
|-
| TP59
| mFE
| 3V3
| BP-UTL flash enable (cf. 78K0/Kx2 Serial Flash Programming protocol, see NEC/Renesas docs)
|-
| TP60
| VOLP
| 3V3
| volume + button (also RxD6 for 78K0 SFP)
|-
| TP61
| VOLN
| 3V3
| volume - button (also TxD6 for 78K0 SFP)
|-
| TP62
| ATH_TX_H
| 3V3
| something new (Atheros) wifi?
|-
| TP63
| WL_TXPE
| 3V3
| ?
|-
! scope="row" colspan="4" | (TP64 doesn't exist)
|-
| TP65
| WL_RXPE
| 3V3
| ?
|-
| TP66
| /WIFI_RST
| 3V3
| WiFi chip(s) reset (active-lw)
|-
! scope="row" colspan="4" | (TP67, TP68 don't exist)
|-
| TP69
| SPI_MOSI
| 3V3
| SPI bus
|-
! scope="row" colspan="4" | (TP70 doesn't exist)
|-
| TP71
| SPI_MISO
| 3V3
| SPI bus
|-
! scope="row" colspan="4" | (TP72 doesn't exist)
|-
| TP73
| SPI_SCK
| 3V3
| SPI bus
|-
! scope="row" colspan="4" | (TP74, TP75 don't exist)
|-
| TP76
| SPI_CS1
| 3V3
| SPI chip select 1 (PMIC)
|-
! scope="row" colspan="4" | (TP77 doesn't exist)
|-
| TP78
| SPI_CS3
| 3V3
| SPI chip select 3 (TSC)
|-
| TP79
| SPI_CS2
| 3V3
| SPI chip select 2 ([[NVRAM]])
|-
| TP80
| SCL
| 1V8
| TWL bus
|-
! scope="row" colspan="4" | (TP81 doesn't exist)
|-
| TP82
| SDA
| 1V8
| TWL bus
|-
| TP83
| PENIRQ
| 1V8? 3V3?
| touchscreen pen down
|-
| TP84
| R7
| 1V8?
| hinge magnet detect signal (active-low)
|-
| TP85
| RESET
| 3V3, but use as open drain/collector
| CPU-TWL reset signal
|-
| TP86
| P05
| 3V3?
| dpad left button
|-
| TP87
| P04
| 3V3?
| dpad right button
|-
| TP88
| P03
| 3V3?
| start button
|-
| TP89
| P02
| 3V3?
| select button
|-
| TP90
| P01
| 3V3?
| B button
|-
| TP91
| P00
| 3V3?
| A button
|-
| TP92
| PM_SLP
| ?
| ?
|-
| TP93
| VCNT5
| ?
| ?
|-
| TP94
| maybe GPIO330?
| 3V3?
| ?
|-
| TP95
| R01
| ?
| Y button
|-
| TP96
| R00
| ?
| X button
|-
| TP97
| P09
| 3V3
| shoulder-L button
|-
| TP98
| P08
| 3V3
| shoulder-R button
|-
| TP99
| MUTE
| 3V3
| ? (aka GPIO333?)
|-
| TP100
| P07
| 3V3?
| dpad down button
|-
| TP101
| HP#SP
| 3V3
| audio out is headphones (1) or speakers (0). aka GPIO331
|-
| TP102
| P06
| 3V3?
| dpad up button
|-
! scope="row" colspan="4" | (TP103 doesn't exist)
|-
| TP104
| ? (maybe nIRQ_O)
| 3V3?
| (nIRQ_O is the "powerbutton pressed" signal from the BPTWL to the CPU-TWL SoC. aka GPIO332)
|-
| TP105
| LDR20
|
| top LCD R.bit0
|-
| TP106
| LDR21
|
| top LCD R.bit1
|-
| TP107
| LDR22
|
| top LCD R.bit2
|-
| TP108
| LDR23
|
| top LCD R.bit3
|-
| TP109
| LDR24
|
| top LCD R.bit4
|-
| TP110
| LDB21
|
| top LCD B.bit1
|-
| TP111
| LDG21
|
| top LCD G.bit1
|-
| TP112
| LDG22
|
| top LCD G.bit2
|-
| TP113
| LDG25
|
| top LCD G.bit5
|-
| TP114
| LDB20
|
| top LCD B.bit0
|-
| TP115
| LDB23
|
| top LCD B.bit3
|-
| TP116
| LDR11
|
| bottom LCD R.bit1
|-
| TP117
| LDR12
|
| bottom LCD R.bit4
|-
| TP118
| LDR15
|
| bottom LCD R.bit5
|-
| TP119
| LDR25
|
| top LCD R.bit5
|-
| TP120
| LDG20
|
| top LCD G.bit2
|-
| TP121
| LDG23
|
| top LCD G.bit3
|-
| TP122
| LDG24
|
| top LCD G.bit4
|-
| TP123
| LDB22
|
| top LCD B.bit2
|-
| TP124
| LDB24
|
| top LCD B.bit4
|-
| TP125
| LDB25
|
| top LCD B.bit5
|-
| TP126
| LDR10
|
| bottom LCD R.bit0
|-
| TP127
| LDR13
|
| bottom LCD R.bit3
|-
| TP128
| LDR14
|
| bottom LCD R.bit4
|-
| TP129
| LDG10
|
| bottom LCD G.bit0
|-
| TP130
| LDG11
|
| bottom LCD G.bit1
|-
| TP131
| LDG12
|
| bottom LCD G.bit2
|-
| TP132
| LDG13
|
| bottom LCD G.bit3
|-
| TP133
| LDG15
|
| bottom LCD G.bit5
|-
| TP134
| LDB11
|
| bottom LCD B.bit1
|-
| TP135
| LDG14
|
| bottom LCD G.bit4
|-
| TP136
| LDB10
|
| bottom LCD B.bit0
|-
| TP137
| ?
| ?
| ?
|-
| TP138
| LDB12
|
| bottom LCD B.bit2
|-
| TP139
| LDB13
|
| bottom LCD B.bit3
|-
| TP140
| LDB14
|
| bottom LCD B.bit4
|-
| TP141
| LDB15
|
| bottom LCD B.bit5
|-
| TP142
| VDD5 or VSHD
| 5.0V power rail
| VDD5 and VSHD are the same net
|-
| TP143
| GSP
|
|
|-
| TP144
| VDD5 or VSHD
| 5.0V power rail
| VDD5 and VSHD are the same net
|-
| TP145
| REV
|
|
|-
| TP146
| LS
|
|
|-
| TP147
| SPL
|
|
|-
| TP148
| DCLK
|
| dot clock
|-
| TP149
| CAM_RST
| 1V8?
| camera reset signal
|-
| TP150
| COM1
|
|
|-
! scope="row" colspan="4" | (TP151 doesn't exist)
|-
| TP152
| CAM_D4
| 1V8?
| camera parallell port (conn. thru RA7, 270Ω)
|-
| TP153
| HSYNC
| 1V8?
| horizontal sync/blank (conn. thru R133, 0Ω)
|-
| TP154
| CAM_D3
| 1V8?
| camera parallell port (conn. thru RA6, 270Ω)
|-
| TP155
| VSYNC
| 1V8?
| vertical sync/blank (conn. thru R132, 0Ω)
|-
| TP156
| CKI
| 1V8?
| camera clock something?
|-
| TP157
| CAM_D2
| 1V8?
| camera parallell port (conn. thru RA6, 270Ω)
|-
| TP158
| CAM_D7
| 1V8?
| camera parallell port (conn. thru RA7, 270Ω)
|-
| TP159
| CAM_D1
| 1V8?
| camera parallell port (conn. thru RA6, 270Ω)
|-
| TP160
| X+
| ?
| touchscreen
|-
| TP161
| Y+
| ?
| touchscreen
|-
| TP162
| X-
| ?
| touchscreen, same net as Y-
|-
| TP163
| Y-
| ?
| touchscreen, same net as X-
|-
| TP164
| CAM_D6
| 1V8?
| camera parallell port (conn. thru RA7, 270Ω)
|-
| TP165
| CAM_D0
| 1V8?
| camera parallell port (conn. thru RA6, 270Ω)
|-
| TP166
| RCLK
| 1V8?
| camera (conn. thru R100, 100Ω)
|-
| TP167
| CAM_D5
| 1V8?
| camera parallell port (conn. thru RA7, 270Ω)
|-
| TP168
| VDD28
| 2.8V power rail
| Only used by the camera. Generated by an LDO (U12) from VDD33
|-
! scope="row" colspan="4" | (TP169 doesn't exist)
|-
| TP170
| CAM_LED
| Camera LED cathode?
| Connected through Q13 and R68 to BPTWL.
|-
| TP171
| ?
| ?
| ?
|-
| TP172
| SD10_CLK
| 3V3
| SD card
|-
| TP173
| SD10_D0
| 3V3
| SD card
|-
| TP174
| SD10_D1
| 3V3
| SD card
|-
| TP175
| SD10_D2
| 3V3
| SD card
|-
| TP176
| SD10_D3
| 3V3
| SD card
|-
| TP177
| SD10_CMD
| 3V3
| SD card
|-
| TP178
| SD10_CP
| 3V3
| SD card (card detect)
|-
| TP179
| SD10_WP
| 3V3
| SD card write protect
|-
| TP180
| GND
| ground
|
|-
! scope="row" colspan="4" | (TP181 doesn't exist)
|-
| TP182
| SD10_VDD
| 3.3V power rail
| same net as VDD33
|}

[more TODO]

== UTL-SUB-01 testpoints ==

{| class="wikitable" border="1"
|-
! number
! name (TWL testpoint)
! voltage standard
! comment
|-
| TP1
| ?
| ?
| to TH1 component
|-
| TP2
| GND
| (GND)
| ground
|-
| TP3
| P06
| 3V3?
| D-pad up
|-
| TP4
| P04
| 3V3?
| D-pad right
|-
| TP5
| P05
| 3V3?
| D-pad left
|-
| TP6
| P07
| 3V3?
| D-pad down
|-
| TP7
| PWSW
| ?
| raw powerbutton input (to PMIC and BPTWL)
|-
| TP8
| RED
| open collector (at cathode)
| Battery low LED (DL1)
|-
| TP9
| YELLOW
| open collector (at cathode)
| WiFi indicator LED (DL4)
|-
| TP10
| BLUE
| 3V3? 4V2? (at anode)
| Power on/good LED (DL2)
|-
| TP11
| ORANGE
| 3V3? 4V2? (at anode)
| Charging indicator (DL3)
|-
| TP12
| VDD42
| 4.2V power supply
| Power supply for TP8/TP10 LEDs
|}

== P16 pinout ==

The P16 pinout changed from [https://problemkaputt.de/gbatek-aux-dsi-internal-connectors.htm what it was on the regular DSi]. Some nets are now found in P24 instead (see below).

{| class="wikitable" border="1"
|-
! name
! pin no
! pin no
! name
|-
| GND
| 1
| 2
| GND
|-
| GND
| 3
| 4
| GND
|-
| GND
| 5
| 6
| GND
|-
| SD10_CLK
| 7
| 8
| GND
|-
| VDD33
| 9
| 10
| SD10_D0
|-
| VDD33
| 11
| 12
| SD10_D1
|-
| GND
| 13
| 14
| SD10_WP
|-
| SD10_CMD
| 15
| 16
| VDD33
|-
| GND
| 17
| 18
| P08
|-
| SD10_D3
| 19
| 20
| VDD33
|-
| SD10_D2
| 21
| 22
| SD10_CD
|-
| GND
| 23
| 24
| GND
|-
| GND
| 25
| 26
| GND
|}

== P24 pinout ==

P24 is a mezzanine connector for the VOLP/VOLN buttons and the shoulder L button (which were on P16 on the DSi).

{| class="wikitable" border="1"
|-
! name
! pin no
! pin no
! name
|-
| GND
| 1
| 2
| GND
|-
| N/C
| 3
| 4
| VOLP
|-
| P09 (shoulder-L)
| 5
| 6
| VOLN
|-
| GND
| 7-13
| 8-14
| GND
|}

[[Category:Hardware]]

DSi XL testpoints

2023-08-13T13:17:20Z

PoroCYon: /* UTL-CPU-01 testpoints */ fixes + up to 182

== UTL-CPU-01 testpoints ==

{| class="wikitable" border="1"
|-
! number
! name (TWL testpoint)
! voltage standard
! comment
|-
| TP1
| EXTB+
| ?
|
|-
| TP2
| VIN
| ~5V DC
| External charger power input
|-
| TP3
| Rosc
| ?
| ?
|-
| TP4
| RICHG?
| ?
| Recharge?
|-
| TP5
| GND
| (GND)
| ground (near external charger connector)
|-
| TP6
| V12
| 1.2V power rail
| CPU-TWL core voltage
|-
| TP7
| BT+
| battery +
| at 2-pin power connector to UTL-SUB-01
|-
| TP8
| VDET-
| ?
| ?
|-
| TP9
| DET
| ?
| ?
|-
| TP10
| V18
| 1.8V power rail
| Various I/O and core voltage (incl. RTC)
|-
| TP11
| ?
| ?
| something charging?
|-
| TP12
| VDD10?
| 10V power rail
| For LCDs
|-
| TP13
| VDD33
| 3.3V power rail
| Various I/O and core voltage
|-
| TP14
| GND
| (GND)
| ground (near PMIC)
|-
| TP15
| B+
| ?
| battery + ?
|-
| TP16
| VDD-5?
| -5V power rail
| For LCDs
|-
| TP17
| PVDD
| ?
| ?
|-
| TP18
| VDD5?
| 5V power rail
| For LCDs
|-
| TP19
| ?
| ?
| (to R7 or R104)
|-
| TP20
| BLA1
| ?
| backlight anode for lower screen
|-
| TP21
| ?
| ?
| (to D6)
|-
| TP22
| BLC1
| ?
| backlight cathode for lower screen
|-
| TP23
| BLA2
| ?
| backlight anode for upper screen
|-
! scope="row" colspan="4" | (TP24, TP25 don't exist)
|-
| TP26
| BLC2
| ?
| backlight cathode for upper screen
|-
! scope="row" colspan="4" | (TP27 doesn't exist)
|-
| TP28
| ?
| ?
| ? (found no connections. TODO!)
|-
| TP29
| ?
| ?
| ? (found no connections. TODO!)
|-
| TP30
| SPRP
| analog
| positive signal for right built-in speaker
|-
| TP31
| SPRN
| analog
| negative signal for right built-in speaker
|-
| TP32
| SPLP
| analog
| positive signal for left built-in speaker
|-
| TP33
| SPLN
| analog
| negative signal for left built-in speaker
|-
| TP34
| GND
| (GND)
| probably analog ground
|-
| TP35
| SR
| analog
| headphone tip
|-
| TP36
| SL
| analog
| headphone ring
|-
! scope="row" colspan="4" | (TP37, TP38 don't exist)
|-
| TP39
| ORANGE
| 3V3? 4V2? (at anode)
| Orange LED charging indicator
|-
| TP40
| BLUE
| 3V3? 4V2? (at anode)
| Blue LED power good indicator
|-
| TP41
| RED
| open collector (connected to LED cathode)
| Red LED battery low indicator
|-
| TP42
| MC1_D7
| 3V3
| MSB of gamecard parallell ROM *or* AUXSPI COPI signal
|-
| TP43
| MC1_D6
| 3V3
| 6th bit of gamecard parallell ROM *or* AUXSPI CIPO signal
|-
| TP44
| MC1_VCC
| 3.3V power
| power supply to gamecard (can be switched off by SoC)
|-
! scope="row" colspan="4" | (TP45 doesn't exist)
|-
| TP46
| MC1_D5
| 3V3
|
|-
| TP47
| MC1_D4
| 3V3
|
|-
| TP48
| MC1_D3
| 3V3
|
|-
| TP49
| MC1_DET
| 3V3
| Cartridge detected in slot (active-low)
|-
| TP50
| MC1_D2
| 3V3
|
|-
| TP51
| MC1_IREQ
| 3V3
| gamecart->SoC IRQ
|-
| TP52
| MC1_D1
| 3V3
|
|-
| TP53
| MC1_RES
| 3V3
| SoC->gamecart reset signal
|-
| TP54
| MC1_D0
| 3V3
|
|-
| TP55
| MC1_CS
| 3V3
| parallell ROM select (active-low)
|-
| TP56
| MC1_CLK
| 3V3
|
|-
| TP57
| MC1_CS2
| 3V3
| AUXSPI select (active-low)
|-
| TP58
| mRST
| 3V3
| BP-UTL reset (active-low)
|-
| TP59
| mFE
| 3V3
| BP-UTL flash enable (cf. 78K0/Kx2 Serial Flash Programming protocol, see NEC/Renesas docs)
|-
| TP60
| VOLP
| 3V3
| volume + button (also RxD6 for 78K0 SFP)
|-
| TP61
| VOLN
| 3V3
| volume - button (also TxD6 for 78K0 SFP)
|-
| TP62
| ATH_TX_H
| 3V3
| something new (Atheros) wifi?
|-
| TP63
| WL_TXPE
| 3V3
| ?
|-
! scope="row" colspan="4" | (TP64 doesn't exist)
|-
| TP65
| WL_RXPE
| 3V3
| ?
|-
| TP66
| /WIFI_RST
| 3V3
| WiFi chip(s) reset (active-lw)
|-
! scope="row" colspan="4" | (TP67, TP68 don't exist)
|-
| TP69
| SPI_MOSI
| 3V3
| SPI bus
|-
! scope="row" colspan="4" | (TP70 doesn't exist)
|-
| TP71
| SPI_MISO
| 3V3
| SPI bus
|-
! scope="row" colspan="4" | (TP72 doesn't exist)
|-
| TP73
| SPI_SCK
| 3V3
| SPI bus
|-
! scope="row" colspan="4" | (TP74, TP75 don't exist)
|-
| TP76
| SPI_CS1
| 3V3
| SPI chip select 1 (PMIC)
|-
! scope="row" colspan="4" | (TP77 doesn't exist)
|-
| TP78
| SPI_CS3
| 3V3
| SPI chip select 3 (TSC)
|-
| TP79
| SPI_CS2
| 3V3
| SPI chip select 2 ([[NVRAM]])
|-
| TP80
| SCL
| 1V8
| TWL bus
|-
! scope="row" colspan="4" | (TP81 doesn't exist)
|-
| TP82
| SDA
| 1V8
| TWL bus
|-
| TP83
| PENIRQ
| 1V8? 3V3?
| touchscreen pen down
|-
| TP84
| R7
| 1V8?
| hinge magnet detect signal (active-low)
|-
| TP85
| RESET
| 3V3, but use as open drain/collector
| CPU-TWL reset signal
|-
| TP86
| P05
| 3V3?
| dpad left button
|-
| TP87
| P04
| 3V3?
| dpad right button
|-
| TP88
| P03
| 3V3?
| start button
|-
| TP89
| P02
| 3V3?
| select button
|-
| TP90
| P01
| 3V3?
| B button
|-
| TP91
| P00
| 3V3?
| A button
|-
| TP92
| PM_SLP
| ?
| ?
|-
| TP93
| VCNT5
| ?
| ?
|-
| TP94
| maybe GPIO330?
| 3V3?
| ?
|-
| TP95
| R01
| ?
| Y button
|-
| TP96
| R00
| ?
| X button
|-
| TP97
| P09
| 3V3
| shoulder-L button
|-
| TP98
| P08
| 3V3
| shoulder-R button
|-
| TP99
| MUTE
| 3V3
| ? (aka GPIO333?)
|-
| TP100
| P07
| 3V3?
| dpad down button
|-
| TP101
| HP#SP
| 3V3
| audio out is headphones (1) or speakers (0). aka GPIO331
|-
| TP102
| P06
| 3V3?
| dpad up button
|-
! scope="row" colspan="4" | (TP103 doesn't exist)
|-
| TP104
| ? (maybe nIRQ_O)
| 3V3?
| (nIRQ_O is the "powerbutton pressed" signal from the BPTWL to the CPU-TWL SoC. aka GPIO332)
|-
| TP105
| LDR20
|
| top LCD R.bit0
|-
| TP106
| LDR21
|
| top LCD R.bit1
|-
| TP107
| LDR22
|
| top LCD R.bit2
|-
| TP108
| LDR23
|
| top LCD R.bit3
|-
| TP109
| LDR24
|
| top LCD R.bit4
|-
| TP110
| LDB21
|
| top LCD B.bit1
|-
| TP111
| LDG21
|
| top LCD G.bit1
|-
| TP112
| LDG22
|
| top LCD G.bit2
|-
| TP113
| LDG25
|
| top LCD G.bit5
|-
| TP114
| LDB20
|
| top LCD B.bit0
|-
| TP115
| LDB23
|
| top LCD B.bit3
|-
| TP116
| LDR11
|
| bottom LCD R.bit1
|-
| TP117
| LDR12
|
| bottom LCD R.bit4
|-
| TP118
| LDR15
|
| bottom LCD R.bit5
|-
| TP119
| LDR25
|
| top LCD R.bit5
|-
| TP120
| LDG20
|
| top LCD G.bit2
|-
| TP121
| LDG23
|
| top LCD G.bit3
|-
| TP122
| LDG24
|
| top LCD G.bit4
|-
| TP123
| LDB22
|
| top LCD B.bit2
|-
| TP124
| LDB24
|
| top LCD B.bit4
|-
| TP125
| LDB25
|
| top LCD B.bit5
|-
| TP126
| LDR10
|
| bottom LCD R.bit0
|-
| TP127
| LDR13
|
| bottom LCD R.bit3
|-
| TP128
| LDR14
|
| bottom LCD R.bit4
|-
| TP129
| LDG10
|
| bottom LCD G.bit0
|-
| TP130
| LDG11
|
| bottom LCD G.bit1
|-
| TP131
| LDG12
|
| bottom LCD G.bit2
|-
| TP132
| LDG13
|
| bottom LCD G.bit3
|-
| TP133
| LDG15
|
| bottom LCD G.bit5
|-
| TP134
| LDB11
|
| bottom LCD B.bit1
|-
| TP135
| LDG14
|
| bottom LCD G.bit4
|-
| TP136
| LDB10
|
| bottom LCD B.bit0
|-
| TP137
| ?
| ?
| ?
|-
| TP138
| LDB12
|
| bottom LCD B.bit2
|-
| TP139
| LDB13
|
| bottom LCD B.bit3
|-
| TP140
| LDB14
|
| bottom LCD B.bit4
|-
| TP141
| LDB15
|
| bottom LCD B.bit5
|-
| TP142
| VDD5 or VSHD
| 5.0V power rail
| VDD5 and VSHD are the same net
|-
| TP143
| GSP
|
|
|-
| TP144
| VDD5 or VSHD
| 5.0V power rail
| VDD5 and VSHD are the same net
|-
| TP145
| REV
|
|
|-
| TP146
| LS
|
|
|-
| TP147
| SPL
|
|
|-
| TP148
| DCLK
|
| dot clock
|-
| TP149
| CAM_RST
| 1V8?
| camera reset signal
|-
| TP150
| COM1
|
|
|-
! scope="row" colspan="4" | (TP151 doesn't exist)
|-
| TP152
| CAM_D4
| 1V8?
| camera parallell port (conn. thru RA7, 270Ω)
|-
| TP153
| HSYNC
| 1V8?
| horizontal sync/blank (conn. thru R133, 0Ω)
|-
| TP154
| CAM_D3
| 1V8?
| camera parallell port (conn. thru RA6, 270Ω)
|-
| TP155
| VSYNC
| 1V8?
| vertical sync/blank (conn. thru R132, 0Ω)
|-
| TP156
| CKI
| 1V8?
| camera clock something?
|-
| TP157
| CAM_D2
| 1V8?
| camera parallell port (conn. thru RA6, 270Ω)
|-
| TP158
| CAM_D7
| 1V8?
| camera parallell port (conn. thru RA7, 270Ω)
|-
| TP159
| CAM_D1
| 1V8?
| camera parallell port (conn. thru RA6, 270Ω)
|-
| TP160
| X+
| ?
| touchscreen
|-
| TP161
| Y+
| ?
| touchscreen
|-
| TP162
| X-
| ?
| touchscreen, same net as Y-
|-
| TP163
| Y-
| ?
| touchscreen, same net as X-
|-
| TP164
| CAM_D6
| 1V8?
| camera parallell port (conn. thru RA7, 270Ω)
|-
| TP165
| CAM_D0
| 1V8?
| camera parallell port (conn. thru RA6, 270Ω)
|-
| TP166
| RCLK
| 1V8?
| camera (conn. thru R100, 100Ω)
|-
| TP167
| CAM_D5
| 1V8?
| camera parallell port (conn. thru RA7, 270Ω)
|-
| TP168
| VDD28
| 2.8V power rail
| Only used by the camera. Generated by an LDO (U12) from VDD33
|-
! scope="row" colspan="4" | (TP169 doesn't exist)
|-
| TP170
| CAM_LED
| Camera LED cathode?
| Connected through Q13 and R68 to BPTWL.
|-
| TP171
| ?
| ?
| ?
|-
| TP172
| SD10_CLK
| 3V3
| SD card
|-
| TP173
| SD10_D0
| 3V3
| SD card
|-
| TP174
| SD10_D1
| 3V3
| SD card
|-
| TP175
| SD10_D2
| 3V3
| SD card
|-
| TP176
| SD10_D3
| 3V3
| SD card
|-
| TP177
| SD10_CMD
| 3V3
| SD card
|-
| TP178
| SD10_CP
| 3V3
| SD card (card detect)
|-
| TP179
| SD10_WP
| 3V3
| SD card write protect
|-
| TP180
| GND
| ground
|
|-
! scope="row" colspan="4" | (TP181 doesn't exist)
|-
| TP182
| SD10_VDD
| 3.3V power rail
| same net as VDD33
|}

[more TODO]

== UTL-SUB-01 testpoints ==

{| class="wikitable" border="1"
|-
! number
! name (TWL testpoint)
! voltage standard
! comment
|-
| TP1
| ?
| ?
| to TH1 component
|-
| TP2
| GND
| (GND)
| ground
|-
| TP3
| P06
| 3V3?
| D-pad up
|-
| TP4
| P04
| 3V3?
| D-pad right
|-
| TP5
| P05
| 3V3?
| D-pad left
|-
| TP6
| P07
| 3V3?
| D-pad down
|-
| TP7
| PWSW
| ?
| raw powerbutton input (to PMIC and BPTWL)
|-
| TP8
| RED
| open collector (at cathode)
| Battery low LED (DL1)
|-
| TP9
| YELLOW
| open collector (at cathode)
| WiFi indicator LED (DL4)
|-
| TP10
| BLUE
| 3V3? 4V2? (at anode)
| Power on/good LED (DL2)
|-
| TP11
| ORANGE
| 3V3? 4V2? (at anode)
| Charging indicator (DL3)
|-
| TP12
| VDD42
| 4.2V power supply
| Power supply for TP8/TP10 LEDs
|}

== P24 pinout ==

P24 is a mezzanine connector for the VOLP/VOLN buttons and the shoulder L button (which were on P16 on the DSi). The P16 pinout has changed too, documentation for that is TODO.

{| class="wikitable" border="1"
|-
! name
! pin no
! pin no
! name
|-
| GND
| 1
| 2
| GND
|-
| N/C
| 3
| 4
| VOLP
|-
| P09 (shoulder-L)
| 5
| 6
| VOLN
|-
| GND
| 7-13
| 8-14
| GND
|}

[[Category:Hardware]]

DSi XL testpoints

2023-08-12T23:30:42Z

PoroCYon: /* UTL-CPU-01 testpoints */ up to 159

== UTL-CPU-01 testpoints ==

{| class="wikitable" border="1"
|-
! number
! name (TWL testpoint)
! voltage standard
! comment
|-
| TP1
| EXTB+
| ?
|
|-
| TP2
| VIN
| ~5V DC
| External charger power input
|-
| TP3
| Rosc
| ?
| ?
|-
| TP4
| RICHG?
| ?
| Recharge?
|-
| TP5
| GND
| (GND)
| ground (near external charger connector)
|-
| TP6
| V12
| 1.2V power rail
| CPU-TWL core voltage
|-
| TP7
| BT+
| battery +
| at 2-pin power connector to UTL-SUB-01
|-
| TP8
| VDET-
| ?
| ?
|-
| TP9
| DET
| ?
| ?
|-
| TP10
| V18
| 1.8V power rail
| Various I/O and core voltage (incl. RTC)
|-
| TP11
| ?
| ?
| something charging?
|-
| TP12
| VDD10?
| 10V power rail
| For LCDs
|-
| TP13
| V33
| 3.3V power rail
| Various I/O and core voltage
|-
| TP14
| GND
| (GND)
| ground (near PMIC)
|-
| TP15
| B+
| ?
| battery + ?
|-
| TP16
| VDD-5?
| -5V power rail
| For LCDs
|-
| TP17
| PVDD
| ?
| ?
|-
| TP18
| VDD5?
| 5V power rail
| For LCDs
|-
| TP19
| ?
| ?
| (to R7 or R104)
|-
| TP20
| BLA1?
| ?
| backlight anode for lower screen
|-
| TP21
| ?
| ?
| (to D6)
|-
| TP22
| Y-?
| ?
| touchscreen
|-
| TP23
| BLA2?
| ?
| backlight anode for upper screen
|-
! scope="row" colspan="4" | (TP24, TP25 don't exist)
|-
| TP26
| BLC2
| ?
| backlight cathode for upper screen
|-
! scope="row" colspan="4" | (TP27 doesn't exist)
|-
| TP28
| ?
| ?
| ? (found no connections. TODO!)
|-
| TP29
| ?
| ?
| ? (found no connections. TODO!)
|-
| TP30
| SPRP
| analog
| positive signal for right built-in speaker
|-
| TP31
| SPRN
| analog
| negative signal for right built-in speaker
|-
| TP32
| SPLP
| analog
| positive signal for left built-in speaker
|-
| TP33
| SPLN
| analog
| negative signal for left built-in speaker
|-
| TP34
| GND
| (GND)
| probably analog ground
|-
| TP35
| SR
| analog
| headphone tip
|-
| TP36
| SL
| analog
| headphone ring
|-
! scope="row" colspan="4" | (TP37, TP38 don't exist)
|-
| TP39
| ORANGE
| 3V3? 4V2? (at anode)
| Orange LED charging indicator
|-
| TP40
| BLUE
| 3V3? 4V2? (at anode)
| Blue LED power good indicator
|-
| TP41
| RED
| open collector (connected to LED cathode)
| Red LED battery low indicator
|-
| TP42
| MC1_D7
| 3V3
| MSB of gamecard parallell ROM *or* AUXSPI COPI signal
|-
| TP43
| MC1_D6
| 3V3
| 6th bit of gamecard parallell ROM *or* AUXSPI CIPO signal
|-
| TP44
| MC1_VCC
| 3.3V power
| power supply to gamecard (can be switched off by SoC)
|-
! scope="row" colspan="4" | (TP45 doesn't exist)
|-
| TP46
| MC1_D5
| 3V3
|
|-
| TP47
| MC1_D4
| 3V3
|
|-
| TP48
| MC1_D3
| 3V3
|
|-
| TP49
| MC1_DET
| 3V3
| Cartridge detected in slot (active-low)
|-
| TP50
| MC1_D2
| 3V3
|
|-
| TP51
| MC1_IREQ
| 3V3
| gamecart->SoC IRQ
|-
| TP52
| MC1_D1
| 3V3
|
|-
| TP53
| MC1_RES
| 3V3
| SoC->gamecart reset signal
|-
| TP54
| MC1_D0
| 3V3
|
|-
| TP55
| MC1_CS
| 3V3
| parallell ROM select (active-low)
|-
| TP56
| MC1_CLK
| 3V3
|
|-
| TP57
| MC1_CS2
| 3V3
| AUXSPI select (active-low)
|-
| TP58
| mRST
| 3V3
| BP-UTL reset (active-low)
|-
| TP59
| mFE
| 3V3
| BP-UTL flash enable (cf. 78K0/Kx2 Serial Flash Programming protocol, see NEC/Renesas docs)
|-
| TP60
| VOLP
| 3V3
| volume + button (also RxD6 for 78K0 SFP)
|-
| TP61
| VOLN
| 3V3
| volume - button (also TxD6 for 78K0 SFP)
|-
| TP62
| ATH_TX_H
| 3V3
| something new (Atheros) wifi?
|-
| TP63
| WL_TXPE
| 3V3
| ?
|-
! scope="row" colspan="4" | (TP64 doesn't exist)
|-
| TP65
| WL_RXPE
| 3V3
| ?
|-
| TP66
| /WIFI_RST
| 3V3
| WiFi chip(s) reset (active-lw)
|-
! scope="row" colspan="4" | (TP67, TP68 don't exist)
|-
| TP69
| SPI_MOSI
| 3V3
| SPI bus
|-
! scope="row" colspan="4" | (TP70 doesn't exist)
|-
| TP71
| SPI_MISO
| 3V3
| SPI bus
|-
! scope="row" colspan="4" | (TP72 doesn't exist)
|-
| TP73
| SPI_SCK
| 3V3
| SPI bus
|-
! scope="row" colspan="4" | (TP74, TP75 don't exist)
|-
| TP76
| SPI_CS1
| 3V3
| SPI chip select 1 (PMIC)
|-
! scope="row" colspan="4" | (TP77 doesn't exist)
|-
| TP78
| SPI_CS3
| 3V3
| SPI chip select 3 (TSC)
|-
| TP79
| SPI_CS2
| 3V3
| SPI chip select 2 ([[NVRAM]])
|-
| TP80
| SCL
| 1V8
| TWL bus
|-
! scope="row" colspan="4" | (TP81 doesn't exist)
|-
| TP82
| SDA
| 1V8
| TWL bus
|-
| TP83
| PENIRQ
| 1V8? 3V3?
| touchscreen pen down
|-
| TP84
| R7
| 1V8?
| hinge magnet detect signal (active-low)
|-
| TP85
| RESET
| 3V3, but use as open drain/collector
| CPU-TWL reset signal
|-
| TP86
| P05
| 3V3?
| dpad left button
|-
| TP87
| P04
| 3V3?
| dpad right button
|-
| TP88
| P03
| 3V3?
| start button
|-
| TP89
| P02
| 3V3?
| select button
|-
| TP90
| P01
| 3V3?
| B button
|-
| TP91
| P00
| 3V3?
| A button
|-
| TP92
| PM_SLP
| ?
| ?
|-
| TP93
| VCNT5
| ?
| ?
|-
| TP94
| maybe GPIO330?
| 3V3?
| ?
|-
| TP95
| R01
| ?
| Y button
|-
| TP96
| R00
| ?
| X button
|-
| TP97
| P09
| 3V3
| shoulder-L button
|-
| TP98
| P08
| 3V3
| shoulder-R button
|-
| TP99
| MUTE
| 3V3
| ? (aka GPIO333?)
|-
| TP100
| P07
| 3V3?
| dpad down button
|-
| TP101
| HP#SP
| 3V3
| audio out is headphones (1) or speakers (0). aka GPIO331
|-
| TP102
| P06
| 3V3?
| dpad up button
|-
! scope="row" colspan="4" | (TP103 doesn't exist)
|-
| TP104
| ? (maybe nIRQ_O)
| 3V3?
| (nIRQ_O is the "powerbutton pressed" signal from the BPTWL to the CPU-TWL SoC. aka GPIO332)
|-
| TP105
| LDR20
|
| top LCD R.bit0
|-
| TP106
| LDR21
|
| top LCD R.bit1
|-
| TP107
| LDR22
|
| top LCD R.bit2
|-
| TP108
| LDR23
|
| top LCD R.bit3
|-
| TP109
| LDR24
|
| top LCD R.bit4
|-
| TP110
| LDB21
|
| top LCD B.bit1
|-
| TP111
| LDG21
|
| top LCD G.bit1
|-
| TP112
| LDG22
|
| top LCD G.bit2
|-
| TP113
| LDG25
|
| top LCD G.bit5
|-
| TP114
| LDB20
|
| top LCD B.bit0
|-
| TP115
| LDB23
|
| top LCD B.bit3
|-
| TP116
| LDR11
|
| bottom LCD R.bit1
|-
| TP117
| LDR12
|
| bottom LCD R.bit4
|-
| TP118
| LDR15
|
| bottom LCD R.bit5
|-
| TP119
| LDR25
|
| top LCD R.bit5
|-
| TP120
| LDG20
|
| top LCD G.bit2
|-
| TP121
| LDG23
|
| top LCD G.bit3
|-
| TP122
| LDG24
|
| top LCD G.bit4
|-
| TP123
| LDB22
|
| top LCD B.bit2
|-
| TP124
| LDB24
|
| top LCD B.bit4
|-
| TP125
| LDB25
|
| top LCD B.bit5
|-
| TP126
| LDR10
|
| bottom LCD R.bit0
|-
| TP127
| LDR13
|
| bottom LCD R.bit3
|-
| TP128
| LDR14
|
| bottom LCD R.bit4
|-
| TP129
| LDG10
|
| bottom LCD G.bit0
|-
| TP130
| LDG11
|
| bottom LCD G.bit1
|-
| TP131
| LDG12
|
| bottom LCD G.bit2
|-
| TP132
| LDG13
|
| bottom LCD G.bit3
|-
| TP133
| LDG15
|
| bottom LCD G.bit5
|-
| TP134
| LDB11
|
| bottom LCD B.bit1
|-
| TP135
| LDG14
|
| bottom LCD G.bit4
|-
| TP136
| LDB10
|
| bottom LCD B.bit0
|-
| TP137
| ?
| ?
| ?
|-
| TP138
| LDB12
|
| bottom LCD B.bit2
|-
| TP139
| LDB13
|
| bottom LCD B.bit3
|-
| TP140
| LDB14
|
| bottom LCD B.bit4
|-
| TP141
| LDB15
|
| bottom LCD B.bit5
|-
| TP142
| VDD5 or VSHD
| 5.0V power rail
| VDD5 and VSHD are the same net
|-
| TP143
| GSP
|
|
|-
| TP144
| VDD5 or VSHD
| 5.0V power rail
| VDD5 and VSHD are the same net
|-
| TP145
| REV
|
|
|-
| TP146
| LS
|
|
|-
| TP147
| SPL
|
|
|-
| TP148
| DCLK
|
| dot clock
|-
| TP149
| CAM_RST
| 1V8?
| camera reset signal
|-
| TP150
| COM1
|
|
|-
! scope="row" colspan="4" | (TP151 doesn't exist)
|-
| TP152
| CAM_D4
| 1V8?
| camera parallell port (conn. thru RA7, 270Ω)
|-
| TP153
| HSYNC
| 1V8?
| horizontal sync/blank (conn. thru R133, 0Ω)
|-
| TP154
| CAM_D3
| 1V8?
| camera parallell port (conn. thru RA6, 270Ω)
|-
| TP155
| VSYNC
| 1V8?
| vertical sync/blank (conn. thru R132, 0Ω)
|-
| TP156
| CKI
| 1V8?
| camera clock something?
|-
| TP157
| CAM_D2
| 1V8?
| camera parallell port (conn. thru RA6, 270Ω)
|-
| TP158
| CAM_D7
| 1V8?
| camera parallell port (conn. thru RA7, 270Ω)
|-
| TP159
| CAM_D1
| 1V8?
| camera parallell port (conn. thru RA6, 270Ω)
|-
! scope="row" colspan="4" | <work in progress>
|-
| TP172
| SD10_CLK
| 3V3
| SD card
|-
| TP173
| SD10_D0
| 3V3
| SD card
|-
| TP174
| SD10_D1
| 3V3
| SD card
|-
| TP175
| SD10_D2
| 3V3
| SD card
|-
| TP176
| SD10_D3
| 3V3
| SD card
|-
| TP177
| SD10_CMD
| 3V3
| SD card
|}

[more TODO]

== UTL-SUB-01 testpoints ==

{| class="wikitable" border="1"
|-
! number
! name (TWL testpoint)
! voltage standard
! comment
|-
| TP1
| ?
| ?
| to TH1 component
|-
| TP2
| GND
| (GND)
| ground
|-
| TP3
| P06
| 3V3?
| D-pad up
|-
| TP4
| P04
| 3V3?
| D-pad right
|-
| TP5
| P05
| 3V3?
| D-pad left
|-
| TP6
| P07
| 3V3?
| D-pad down
|-
| TP7
| PWSW
| ?
| raw powerbutton input (to PMIC and BPTWL)
|-
| TP8
| RED
| open collector (at cathode)
| Battery low LED (DL1)
|-
| TP9
| YELLOW
| open collector (at cathode)
| WiFi indicator LED (DL4)
|-
| TP10
| BLUE
| 3V3? 4V2? (at anode)
| Power on/good LED (DL2)
|-
| TP11
| ORANGE
| 3V3? 4V2? (at anode)
| Charging indicator (DL3)
|-
| TP12
| VDD42
| 4.2V power supply
| Power supply for TP8/TP10 LEDs
|}

== P24 pinout ==

P24 is a mezzanine connector for the VOLP/VOLN buttons and the shoulder L button (which were on P16 on the DSi). The P16 pinout has changed too, documentation for that is TODO.

{| class="wikitable" border="1"
|-
! name
! pin no
! pin no
! name
|-
| GND
| 1
| 2
| GND
|-
| N/C
| 3
| 4
| VOLP
|-
| P09 (shoulder-L)
| 5
| 6
| VOLN
|-
| GND
| 7-13
| 8-14
| GND
|}

[[Category:Hardware]]

DSi XL testpoints

2023-08-12T21:28:50Z

PoroCYon: /* UTL-CPU-01 testpoints */ up to 139 + fixes

== UTL-CPU-01 testpoints ==

{| class="wikitable" border="1"
|-
! number
! name (TWL testpoint)
! voltage standard
! comment
|-
| TP1
| EXTB+
| ?
|
|-
| TP2
| VIN
| ~5V DC
| External charger power input
|-
| TP3
| Rosc
| ?
| ?
|-
| TP4
| RICHG?
| ?
| Recharge?
|-
| TP5
| GND
| (GND)
| ground (near external charger connector)
|-
| TP6
| V12
| 1.2V power rail
| CPU-TWL core voltage
|-
| TP7
| BT+
| battery +
| at 2-pin power connector to UTL-SUB-01
|-
| TP8
| VDET-
| ?
| ?
|-
| TP9
| DET
| ?
| ?
|-
| TP10
| V18
| 1.8V power rail
| Various I/O and core voltage (incl. RTC)
|-
| TP11
| ?
| ?
| something charging?
|-
| TP12
| VDD10?
| 10V power rail
| For LCDs
|-
| TP13
| V33
| 3.3V power rail
| Various I/O and core voltage
|-
| TP14
| GND
| (GND)
| ground (near PMIC)
|-
| TP15
| B+
| ?
| battery + ?
|-
| TP16
| VDD-5?
| -5V power rail
| For LCDs
|-
| TP17
| PVDD
| ?
| ?
|-
| TP18
| VDD5?
| 5V power rail
| For LCDs
|-
| TP19
| ?
| ?
| (to R7 or R104)
|-
| TP20
| BLA1?
| ?
| backlight anode for lower screen
|-
| TP21
| ?
| ?
| (to D6)
|-
| TP22
| Y-?
| ?
| touchscreen
|-
| TP23
| BLA2?
| ?
| backlight anode for upper screen
|-
! scope="row" colspan="4" | (TP24, TP25 don't exist)
|-
| TP26
| BLC2
| ?
| backlight cathode for upper screen
|-
! scope="row" colspan="4" | (TP27 doesn't exist)
|-
| TP28
| ?
| ?
| ? (found no connections. TODO!)
|-
| TP29
| ?
| ?
| ? (found no connections. TODO!)
|-
| TP30
| SPRP
| analog
| positive signal for right built-in speaker
|-
| TP31
| SPRN
| analog
| negative signal for right built-in speaker
|-
| TP32
| SPLP
| analog
| positive signal for left built-in speaker
|-
| TP33
| SPLN
| analog
| negative signal for left built-in speaker
|-
| TP34
| GND
| (GND)
| probably analog ground
|-
| TP35
| SR
| analog
| headphone tip
|-
| TP36
| SL
| analog
| headphone ring
|-
! scope="row" colspan="4" | (TP37, TP38 don't exist)
|-
| TP39
| ORANGE
| 3V3? 4V2? (at anode)
| Orange LED charging indicator
|-
| TP40
| BLUE
| 3V3? 4V2? (at anode)
| Blue LED power good indicator
|-
| TP41
| RED
| open collector (connected to LED cathode)
| Red LED battery low indicator
|-
| TP42
| MC1_D7
| 3V3
| MSB of gamecard parallell ROM *or* AUXSPI COPI signal
|-
| TP43
| MC1_D6
| 3V3
| 6th bit of gamecard parallell ROM *or* AUXSPI CIPO signal
|-
| TP44
| MC1_VCC
| 3.3V power
| power supply to gamecard (can be switched off by SoC)
|-
! scope="row" colspan="4" | (TP45 doesn't exist)
|-
| TP46
| MC1_D5
| 3V3
|
|-
| TP47
| MC1_D4
| 3V3
|
|-
| TP48
| MC1_D3
| 3V3
|
|-
| TP49
| MC1_DET
| 3V3
| Cartridge detected in slot (active-low)
|-
| TP50
| MC1_D2
| 3V3
|
|-
| TP51
| MC1_IREQ
| 3V3
| gamecart->SoC IRQ
|-
| TP52
| MC1_D1
| 3V3
|
|-
| TP53
| MC1_RES
| 3V3
| SoC->gamecart reset signal
|-
| TP54
| MC1_D0
| 3V3
|
|-
| TP55
| MC1_CS
| 3V3
| parallell ROM select (active-low)
|-
| TP56
| MC1_CLK
| 3V3
|
|-
| TP57
| MC1_CS2
| 3V3
| AUXSPI select (active-low)
|-
| TP58
| mRST
| 3V3
| BP-UTL reset (active-low)
|-
| TP59
| mFE
| 3V3
| BP-UTL flash enable (cf. 78K0/Kx2 Serial Flash Programming protocol, see NEC/Renesas docs)
|-
| TP60
| VOLP
| 3V3
| volume + button (also RxD6 for 78K0 SFP)
|-
| TP61
| VOLN
| 3V3
| volume - button (also TxD6 for 78K0 SFP)
|-
| TP62
| ATH_TX_H
| 3V3
| something new (Atheros) wifi?
|-
| TP63
| WL_TXPE
| 3V3
| ?
|-
! scope="row" colspan="4" | (TP64 doesn't exist)
|-
| TP65
| WL_RXPE
| 3V3
| ?
|-
| TP66
| /WIFI_RST
| 3V3
| WiFi chip(s) reset (active-lw)
|-
! scope="row" colspan="4" | (TP67, TP68 don't exist)
|-
| TP69
| SPI_MOSI
| 3V3
| SPI bus
|-
! scope="row" colspan="4" | (TP70 doesn't exist)
|-
| TP71
| SPI_MISO
| 3V3
| SPI bus
|-
! scope="row" colspan="4" | (TP72 doesn't exist)
|-
| TP73
| SPI_SCK
| 3V3
| SPI bus
|-
! scope="row" colspan="4" | (TP74, TP75 don't exist)
|-
| TP76
| SPI_CS1
| 3V3
| SPI chip select 1 (PMIC)
|-
! scope="row" colspan="4" | (TP77 doesn't exist)
|-
| TP78
| SPI_CS3
| 3V3
| SPI chip select 3 (TSC)
|-
| TP79
| SPI_CS2
| 3V3
| SPI chip select 2 ([[NVRAM]])
|-
| TP80
| SCL
| 1V8
| TWL bus
|-
! scope="row" colspan="4" | (TP81 doesn't exist)
|-
| TP82
| SDA
| 1V8
| TWL bus
|-
| TP83
| PENIRQ
| 1V8? 3V3?
| touchscreen pen down
|-
| TP84
| R7
| 1V8?
| hinge magnet detect signal (active-low)
|-
| TP85
| RESET
| 3V3, but use as open drain/collector
| CPU-TWL reset signal
|-
| TP86
| P05
| 3V3?
| dpad left button
|-
| TP87
| P04
| 3V3?
| dpad right button
|-
| TP88
| P03
| 3V3?
| start button
|-
| TP89
| P02
| 3V3?
| select button
|-
| TP90
| P01
| 3V3?
| B button
|-
| TP91
| P00
| 3V3?
| A button
|-
| TP92
| PM_SLP
| ?
| ?
|-
| TP93
| VCNT5
| ?
| ?
|-
| TP94
| maybe GPIO330?
| 3V3?
| ?
|-
| TP95
| R01
| ?
| Y button
|-
| TP96
| R00
| ?
| X button
|-
| TP97
| P09
| 3V3
| shoulder-L button
|-
| TP98
| P08
| 3V3
| shoulder-R button
|-
| TP99
| MUTE
| 3V3
| ? (aka GPIO333?)
|-
| TP100
| P07
| 3V3?
| dpad down button
|-
| TP101
| HP#SP
| 3V3
| audio out is headphones (1) or speakers (0). aka GPIO331
|-
| TP102
| P06
| 3V3?
| dpad up button
|-
! scope="row" colspan="4" | (TP103 doesn't exist)
|-
| TP104
| ? (maybe nIRQ_O)
| 3V3?
| (nIRQ_O is the "powerbutton pressed" signal from the BPTWL to the CPU-TWL SoC. aka GPIO332)
|-
| TP105
| LDR20
|
| top LCD R.bit0
|-
| TP106
| LDR21
|
| top LCD R.bit1
|-
| TP107
| LDR22
|
| top LCD R.bit2
|-
| TP108
| LDR23
|
| top LCD R.bit3
|-
| TP109
| LDR24
|
| top LCD R.bit4
|-
| TP110
| LDB21
|
| top LCD B.bit1
|-
| TP111
| LDG21
|
| top LCD G.bit1
|-
| TP112
| LDG22
|
| top LCD G.bit2
|-
| TP113
| LDG25
|
| top LCD G.bit5
|-
| TP114
| LDB20
|
| top LCD B.bit0
|-
| TP115
| LDB23
|
| top LCD B.bit3
|-
| TP116
| LDR11
|
| bottom LCD R.bit1
|-
| TP117
| LDR12
|
| bottom LCD R.bit4
|-
| TP118
| LDR15
|
| bottom LCD R.bit5
|-
| TP119
| LDR25
|
| top LCD R.bit5
|-
| TP120
| LDG20
|
| top LCD G.bit2
|-
| TP121
| LDG23
|
| top LCD G.bit3
|-
| TP122
| LDG24
|
| top LCD G.bit4
|-
| TP123
| LDB22
|
| top LCD B.bit2
|-
| TP124
| LDB24
|
| top LCD B.bit4
|-
| TP125
| LDB25
|
| top LCD B.bit5
|-
| TP126
| LDR10
|
| bottom LCD R.bit0
|-
| TP127
| LDR13
|
| bottom LCD R.bit3
|-
| TP128
| LDR14
|
| bottom LCD R.bit4
|-
| TP129
| LDG10
|
| bottom LCD G.bit0
|-
| TP130
| LDG11
|
| bottom LCD G.bit1
|-
| TP131
| LDG12
|
| bottom LCD G.bit2
|-
| TP132
| LDG13
|
| bottom LCD G.bit3
|-
| TP133
| LDG15
|
| bottom LCD G.bit5
|-
| TP134
| LDB11
|
| bottom LCD B.bit1
|-
| TP135
| LDG14
|
| bottom LCD G.bit4
|-
| TP136
| LDB10
|
| bottom LCD B.bit0
|-
| TP137
| ?
| ?
| ?
|-
| TP138
| LDB12
|
| bottom LCD B.bit2
|-
| TP139
| LDB13
|
| bottom LCD B.bit3
|-
! scope="row" colspan="4" | <work in progress>
|-
| TP172
| SD10_CLK
| 3V3
| SD card
|-
| TP173
| SD10_D0
| 3V3
| SD card
|-
| TP174
| SD10_D1
| 3V3
| SD card
|-
| TP175
| SD10_D2
| 3V3
| SD card
|-
| TP176
| SD10_D3
| 3V3
| SD card
|-
| TP177
| SD10_CMD
| 3V3
| SD card
|}

[more TODO]

== UTL-SUB-01 testpoints ==

{| class="wikitable" border="1"
|-
! number
! name (TWL testpoint)
! voltage standard
! comment
|-
| TP1
| ?
| ?
| to TH1 component
|-
| TP2
| GND
| (GND)
| ground
|-
| TP3
| P06
| 3V3?
| D-pad up
|-
| TP4
| P04
| 3V3?
| D-pad right
|-
| TP5
| P05
| 3V3?
| D-pad left
|-
| TP6
| P07
| 3V3?
| D-pad down
|-
| TP7
| PWSW
| ?
| raw powerbutton input (to PMIC and BPTWL)
|-
| TP8
| RED
| open collector (at cathode)
| Battery low LED (DL1)
|-
| TP9
| YELLOW
| open collector (at cathode)
| WiFi indicator LED (DL4)
|-
| TP10
| BLUE
| 3V3? 4V2? (at anode)
| Power on/good LED (DL2)
|-
| TP11
| ORANGE
| 3V3? 4V2? (at anode)
| Charging indicator (DL3)
|-
| TP12
| VDD42
| 4.2V power supply
| Power supply for TP8/TP10 LEDs
|}

== P24 pinout ==

P24 is a mezzanine connector for the VOLP/VOLN buttons and the shoulder L button (which were on P16 on the DSi). The P16 pinout has changed too, documentation for that is TODO.

{| class="wikitable" border="1"
|-
! name
! pin no
! pin no
! name
|-
| GND
| 1
| 2
| GND
|-
| N/C
| 3
| 4
| VOLP
|-
| P09 (shoulder-L)
| 5
| 6
| VOLN
|-
| GND
| 7-13
| 8-14
| GND
|}

[[Category:Hardware]]

DSi XL testpoints

2023-08-11T22:14:03Z

PoroCYon: /* UTL-CPU-01 testpoints */ up to 119

DSi XL testpoints

2023-08-11T15:29:07Z

PoroCYon: /* UTL-CPU-01 testpoints */ formatting fix

DSi XL testpoints

2023-08-11T15:28:19Z

PoroCYon: /* UTL-CPU-01 testpoints */ TP8x/9x

DSi XL testpoints

2023-08-10T18:25:11Z

PoroCYon: more stuff

DSi XL testpoints

2023-08-09T22:46:08Z

PoroCYon: make self-consistent

DSi XL testpoints

2023-08-09T22:44:15Z

PoroCYon: /* UTL-SUB-01 testpoints */ oops fix stuff

DSi XL testpoints

2023-08-09T20:22:13Z

PoroCYon: /* UTL-CPU-01 testpoints */ update up to TP59

DSi XL testpoints

2023-08-09T17:44:01Z

PoroCYon: create page

Hardware

2023-08-09T17:29:08Z

PoroCYon: link to DSi XL testpoints (also add mention of the DSP)

== Specifications ==
* [[Cameras|Two Aptina MT9V113 0.3 Megapixel VGA Cameras]]
* 240MB(+16MB probably reserved for wear leveling purposes (e.g. replacing bad blocks)) eMMC NAND - Samsung KMAPF0000M-S998 Movi[[NAND]]
* 16MB RAM - NEC uPD 46128512AF1 DDR SRAM or a Fujitsu 128-Mbit FCRAM 82DBS08164D-70L (datasheet: http://edevice.fujitsu.com/fj/DATASHEET/e-ds/e511454.pdf mirror:[[Media:E511454.pdf]]
* (2) 256 x 192 3.25 Inch Displays, one of which has a resistive touch screen
* Backwards compatible with Nintendo DS games, but not GBA games due to the lack of a gameboy cartridge port.
* Integrated ARM946E-S core clocked at 133 MHz in real mode and downclocked to 66 MHz for compatibility mode. ARM7TDMI at 33 MHz. Additional CEVA XpertTeak DSP core, also running at 133 MHz
* PAIC3000D Touchscreen and sound controller - possibly a TI codec: TSC2117
* Mitsumi (MM3317A) or TI 72071B0 or NEC UPD68878Y04 - Power management controller. (The charger circuit itself is fully analog, and closer to the charging port.)
* SD/SDHC Card slot
* [[WiFi_Module]] with integrated 128KB SPI Flash for [[NVRAM]], WiFi settings
* BPTWL - Microcontroller based on a NEC uPD78F0500 used as "Super I/O"/"Embedded controller", used for battery charge level monitoring, volume settings, power-on sequencing of various modules (SoC, Wifi, ...), basic troubleshooting of the power supplies. Controls the status LEDs in the hinge, and the camera LED (near the outer camera).

== Hardware Revisions ==
=== DSi ===
* board C/TWL-CPU-01 (Original rev, all pictures below)
* CPU: TWL. The latest date code picture I could find online was "0836 1m" as shown below, however other pictures with CPU covered show the NAND codes as late as 916, so...
* Suspect this is the only board where WiFi chip is available in Hybrid games like CookingCoach
* Wireless card DWM-W015

=== DSi RevA ===
* board C/TWL-CPU-10 (Newer model, can someone provide a date or serial # range?)
* CPU: TWL A. Mine is "0940 2m". My US Serial # is ~ TW71848???[5]. If yours is earlier, please update this.

=== DSi XL ===
* board C/UTL-CPU-01
* CPU is TWL A
* Wireless card DWM-W024

== Images ==
=== DSi Front ===
[[Image:Twl_front.jpg]]
[[Image:Twl_front_traces.jpg|600px]]
[[Image:TWL-CPU-10.png]]

The socket to the left of the ARM processor is the wifi chip socket.

TWL CPU pinout map: [[File:Twl_cpu_pinout.pdf]] (WIP)

=== DSi Back ===
[[Image:Twl_back.jpg]]

=== CPU with New RAM ===
[[Image:CPUv2.jpg]]

=== DSi XL Front ===
[[Image:Utl-cpu-01-sideb.jpg|600px]]

=== DSi XL Back ===
[[Image:Utl-cpu-01-sidea.jpg|600px]]

Testpoint list [[DSi XL testpoints|here]]

== NAND Pinout ==
[[Image:Dsi_nand.jpg|600px]]
[[Image:Dsi_nanddat.png|600px]]

=== DSi ===
[[Image:NAND_Compressed.jpg|600px]]

=== DSi XL ===
[[Image:Side_B_Marked_Compressed.png|600px]]

== PCB Overlay ==
=== DSi ===
[[Image:Nintendo DSi PCB Layered.jpg|600px]]
=== DSi XL ===
[[Image:Utl-pcb-overlay.jpg|600px]]

== Glamor Shot ==
[[Image:Nintendo-dsi-Glamor-Shot.jpg]]

== References ==
* http://en.wikipedia.org/wiki/Nintendo_DSi
* http://insidetronics.blogspot.com/2008/11/new-nintendo-dsi-teardown.html
* http://techon.nikkeibp.co.jp/english/NEWS_EN/20081111/161077/
* http://games.gearlive.com/playfeed/article/q408-nintendo-dsi-announced-larger-screens-dual-cameras-dsi-shop-store/
* http://www.ifixit.com/Guide/First-Look/Nintendo-DSi/714/1

Hardware

2023-08-09T17:26:07Z

PoroCYon: DSi XL images, word specs a bit better

== Specifications ==
* [[Cameras|Two Aptina MT9V113 0.3 Megapixel VGA Cameras]]
* 240MB(+16MB probably reserved for wear leveling purposes (e.g. replacing bad blocks)) eMMC NAND - Samsung KMAPF0000M-S998 Movi[[NAND]]
* 16MB RAM - NEC uPD 46128512AF1 DDR SRAM or a Fujitsu 128-Mbit FCRAM 82DBS08164D-70L (datasheet: http://edevice.fujitsu.com/fj/DATASHEET/e-ds/e511454.pdf mirror:[[Media:E511454.pdf]]
* (2) 256 x 192 3.25 Inch Displays, one of which has a resistive touch screen
* Backwards compatible with Nintendo DS games, but not GBA games due to the lack of a gameboy cartridge port.
* Integrated ARM946E-S core clocked at 133 MHz in real mode and downclocked to 66 MHz for compatibility mode. ARM7TDMI at 33 MHz
* PAIC3000D Touchscreen and sound controller - possibly a TI codec: TSC2117
* Mitsumi (MM3317A) or TI 72071B0 or NEC UPD68878Y04 - Power management controller. (The charger circuit itself is fully analog, and closer to the charging port.)
* SD/SDHC Card slot
* [[WiFi_Module]] with integrated 128KB SPI Flash for [[NVRAM]], WiFi settings
* BPTWL - Microcontroller based on a NEC uPD78F0500 used as "Super I/O"/"Embedded controller", used for battery charge level monitoring, volume settings, power-on sequencing of various modules (SoC, Wifi, ...), basic troubleshooting of the power supplies. Controls the status LEDs in the hinge, and the camera LED (near the outer camera).

== Hardware Revisions ==
=== DSi ===
* board C/TWL-CPU-01 (Original rev, all pictures below)
* CPU: TWL. The latest date code picture I could find online was "0836 1m" as shown below, however other pictures with CPU covered show the NAND codes as late as 916, so...
* Suspect this is the only board where WiFi chip is available in Hybrid games like CookingCoach
* Wireless card DWM-W015

=== DSi RevA ===
* board C/TWL-CPU-10 (Newer model, can someone provide a date or serial # range?)
* CPU: TWL A. Mine is "0940 2m". My US Serial # is ~ TW71848???[5]. If yours is earlier, please update this.

=== DSi XL ===
* board C/UTL-CPU-01
* CPU is TWL A
* Wireless card DWM-W024

== Images ==
=== DSi Front ===
[[Image:Twl_front.jpg]]
[[Image:Twl_front_traces.jpg|600px]]
[[Image:TWL-CPU-10.png]]

The socket to the left of the ARM processor is the wifi chip socket.

TWL CPU pinout map: [[File:Twl_cpu_pinout.pdf]] (WIP)

=== DSi Back ===
[[Image:Twl_back.jpg]]

=== CPU with New RAM ===
[[Image:CPUv2.jpg]]

=== DSi XL Front ===
[[Image:Utl-cpu-01-sideb.jpg|600px]]

=== DSi XL Back ===
[[Image:Utl-cpu-01-sidea.jpg|600px]]

== NAND Pinout ==
[[Image:Dsi_nand.jpg|600px]]
[[Image:Dsi_nanddat.png|600px]]

=== DSi ===
[[Image:NAND_Compressed.jpg|600px]]

=== DSi XL ===
[[Image:Side_B_Marked_Compressed.png|600px]]

== PCB Overlay ==
=== DSi ===
[[Image:Nintendo DSi PCB Layered.jpg|600px]]
=== DSi XL ===
[[Image:Utl-pcb-overlay.jpg|600px]]

== Glamor Shot ==
[[Image:Nintendo-dsi-Glamor-Shot.jpg]]

== References ==
* http://en.wikipedia.org/wiki/Nintendo_DSi
* http://insidetronics.blogspot.com/2008/11/new-nintendo-dsi-teardown.html
* http://techon.nikkeibp.co.jp/english/NEWS_EN/20081111/161077/
* http://games.gearlive.com/playfeed/article/q408-nintendo-dsi-announced-larger-screens-dual-cameras-dsi-shop-store/
* http://www.ifixit.com/Guide/First-Look/Nintendo-DSi/714/1

File:Utl-pcb-overlay.jpg

2023-08-09T17:22:30Z

PoroCYon: Top/bottom overlay image of the DSi XL PCB

== Summary ==
Top/bottom overlay image of the DSi XL PCB

File:Utl-cpu-01-sidea.jpg

2023-08-09T17:09:13Z

PoroCYon: DSi XL Main board (UTL-CPU-01) Side "B" (bottom, with testpoints)

== Summary ==
DSi XL Main board (UTL-CPU-01) Side "B" (bottom, with testpoints)

File:Utl-cpu-01-sideb.jpg

2023-08-09T17:08:31Z

PoroCYon: DSi XL Main board (UTL-CPU-01) Side "B" (top, with components)

== Summary ==
DSi XL Main board (UTL-CPU-01) Side "B" (top, with components)