https://dsibrew.org/w/api.php?action=feedcontributions&user=Nocash&feedformat=atomDSiBrew - User contributions [en]2024-03-28T08:46:04ZUser contributionsMediaWiki 1.35.8https://dsibrew.org/w/index.php?title=SD/MMC/SDIO_Registers&diff=2098825SD/MMC/SDIO Registers2015-09-02T12:29:07Z<p>Nocash: /* 40048FAh - Can be 0004h..0007h (nonzero, unlike SDIO) (RESERVED6) */</p>
<hr />
<div>SD_xxx is used to access onboard eMMC and external SD card slot (as selected via SD_CARD_PORT_SELECT).<br><br />
SDIO_xxx is used to access the Atheros Wifi unit.<br />
<br />
== DSi SD/MMC I/O Map ==<br />
<br />
'''ARM7 DSi SD/MMC Registers for Memory Card access (SD Card and onboard eMMC)'''<br />
4004800h 2 SD_CMD Command and Response/Data Type<br />
4004802h 2 SD_CARD_PORT_SELECT (SD/MMC:020Fh, SDIO:010Fh)<br />
4004804h 4 SD_CMD_PARAM0-1 Argument (32bit, 2 halfwords)<br />
4004808h 2 SD_STOP_INTERNAL_ACTION<br />
400480Ah 2 SD_DATA16_BLK_COUNT "Transfer Block Count"<br />
400480Ch 16 SD_RESPONSE0-7 (128bit, 8 halfwords)<br />
400481Ch 4 SD_IRQ_STATUS0-1 ;IRQ Status (0=ack, 1=req)<br />
4004820h 4 SD_IRQ_MASK0-1 ;IRQ Disable (0=enable, 1=disable)<br />
4004824h 2 SD_CARD_CLK_CTL Card Clock Control<br />
4004826h 2 SD_DATA16_BLK_LEN Memory Card Transfer Data Length<br />
4004828h 2 SD_CARD_OPTION Memory Card Option Setup (can be C0FFh)<br />
400482Ah 2 Fixed always zero?<br />
400482Ch 4 SD_ERROR_DETAIL_STATUS0-1 Error Detail Status<br />
4004830h 2 SD_DATA16_FIFO Data Port (SD_FIFO?)<br />
4004832h 2 Fixed always zero? ;(TC6371AF:BUF1 Data MSBs?)<br />
4004834h 2 ? SD_TRANSACTION_CTL Transaction Control<br />
4004836h 2 ? SD_CARD_INTERRUPT_CONTROL ;4004A36h used in SDIO IRQ handler<br />
4004838h 2 ? SD_CLK_AND_WAIT_CTL ;4004A38h used in SDIO IRQ handler<br />
400483Ah 2 Fixed always zero? ;(SDCTL_SDIO_HOST_INFORMATION)<br />
400483Ch 2 Fixed always zero? ;(SDCTL_ERROR_CONTROL)<br />
400483Eh 2 Fixed always zero? ;(TC6387XB: LED_CONTROL)<br />
4004840h 2 Fixed always 003Fh?<br />
4004842h 2 Fixed always 002Ah?<br />
4004844h 6Eh Fixed always zerofilled?<br />
40048B2h 2 Fixed always FFFFh?<br />
40048B4h 6 Fixed always zerofilled?<br />
40048BAh 2 Fixed always 0200h?<br />
40048BCh 1Ch Fixed always zerofilled?<br />
40048D8h 2 SD_DATA_CTL<br />
40048DAh 6 Fixed always zerofilled?<br />
40048E0h 2 SD_SOFT_RESET Software Reset (bit0=SRST=0=reset)<br />
40048E2h 2 Fixed always 0009h? ;(RESERVED2/9, TC6371AF:CORE_REV)<br />
40048E4h 2 Fixed always zero?<br />
40048E6h 2 Fixed always zero? ;(RESERVED3, TC6371AF:BUF_ADR)<br />
40048E8h 2 Fixed always zero? ;(TC6371AF:Resp_Header)<br />
40048EAh 6 Fixed always zerofilled?<br />
40048F0h 2 Fixed always zero? ;(RESERVED10)<br />
40048F2h 2 ? Can be 0003h<br />
40048F4h 2 ? Can be 0770h<br />
40048F6h 2 ? Firmware tests bit0 (but, always 0?) (RESERVED4)<br />
40048F8h 2 Fixed always 0004h? (nonzero, unlike SDIO) (RESERVED5)<br />
40048FAh 2 ? Can be 0004h..0007h (nonzero, unlike SDIO) (RESERVED6)<br />
40048FCh 2 ? Can be 0024h..00FFh? (RESERVED7)<br />
40048FEh 2 ? Can be 0024h..00FFh? (RESERVED8 / TC6371AF:Revision)<br />
4004900h 2 SD_DATA32_IRQ<br />
4004902h 2 Fixed always zero?<br />
4004904h 2 SD_DATA32_BLK_LEN<br />
4004906h 2 Fixed always zero?<br />
4004908h 2 SD_DATA32_BLK_COUNT<br />
400490Ah 2 Fixed always zero?<br />
400490Ch 4 SD_DATA32_FIFO<br />
4004910h F0h Fixed always zerofilled?<br />
'''ARM7 DSi SD/MMC Registers for SDIO access (for Atheros Wifi)'''<br />
4004A00h 200h SDIO_xxx (same as SD_xxx at 4004800h..40049FFh, see there)<br />
4004A02h 2 SDIO_CARD_PORT_SELECT (slightly different than 4004802h)<br />
4004AF8h 2 Fixed always zero? (unlike SD_xxx at 40048F8h) (RESERVED5)<br />
4004AFAh 2 Fixed always zero? (unlike SD_xxx at 40048FAh) (RESERVED6)<br />
<br />
== DSi SD/MMC I/O Ports: Command/Param/Response/Data ==<br />
<br />
===4004800h/4004A00h - SD_CMD - Command and Response/Data Type (R/W)===<br />
15 undoc Unknown/undoc (read/write-able)<br />
14 undoc Security Cmd? (0=Normal, 1=Whatever/Security?) (sdio?)<br />
13 undoc Data Length (0=Single Block, 1=Multiple Blocks)<br />
12 undoc Data Direction (0=Write, 1=Read)<br />
11 NTDT Data Transfer (0=No data, 1=With data)<br />
10-8 REP2-0 Response Type (0=Auto, 1..2=Unknown/Reserved, 3=None, 4=48bit,<br />
5=48bit+Busy, 6=136bit, 7=48bitOcrWithoutCRC7)<br />
7-6 CMD1-0 Command Type (0=CMD, 1=ACMD, 2..3=unknown, maybe GEN WR/RD?)<br />
5-0 CIX Command Index (0..3Fh, command index)<br />
Setting Command Type to "ACMD" is automatically sending an APP_CMD prefix prior to the command number. For Multiple Blocks, the hardware supports automatically sending STOP_TRANSMISSION after the last block.<br><br />
DSi software is usually setting Response Type to "Auto", which is causing the hardware to use the correct response/data type for standard SD/MMC commands (bit11-13 are ignored/should be zero when using "Auto"; and maybe same for bit14-15?).<br><br />
One exception is that the DSi firmware isn't using "Auto" for SDIO commands (maybe the hardware isn't aware of them; or it's unable to distinguish between read/write direction of CMD53, which would require examining the command's PARAM bits).<br><br />
There might be subtle differences between some SD and MMC commands, unknown if/how "Auto" is working in that cases; unknown if there's a SD-or-MMC mode select bit for that purpose in some configuration register.<br><br />
Invalid values can cause ILA error (particulary on setting NTDT for CMD12, or for CMD's Response=None). ILA error will also occur if an old CMD is still busy.<br />
<br />
===4004804h/4004A04h - SD_CMD_PARAM0-1 - Argument (32bit, 2 halfwords) (R/W)===<br />
31-0 Parameter value for CMD<br />
The parameter value should be written <before> sending the command via SD_CMD/SDIO_CMD.<br />
<br />
===400480Ch/4004A0Ch - SD_RESPONSE0-7 - Response (128bit, 8 halfwords) (R)===<br />
After sending a command, wait for the CMDRESPEND bit (IRQ_STATUS.bit0) to get<br />
set, then read the RESPONSE (if the command does have any response).<br />
For normal 32bit responses:<br />
31-0 Response<br />
127-32 Older Responses<br />
For CID/CSD responses:<br />
119-0 120bit Response<br />
127-120 Zero (always?)<br />
Seems to be left-shifted when receiving response bits. So, for 32bit responses, bit0-31 would contain the current response, and bit32-127 would contain older responses.<br />
<br />
===DATA16 vs DATA32===<br />
Data can be transferred in 16bit or 32bit units (as selected in DATA_CTL.bit1 and DATA32_IRQ.bit1). There are separate data, block len, and block count registers for 16bit and 32bit mode (that's probably due to some odd patchwork, where the manufacturer has added 32bit support to the original 16bit chip design).<br><br />
Naturally, a 32bit transfer is faster than two 16bit transfers. Nethertheless, the DSi firmware does use both 32bit and 16bit mode once and then; 32bit mode is required for NDMA transfers (which don't support 16bit).<br />
<br />
===40048D8h/4004AD8h - SD_DATA_CTL===<br />
15-13 Unknown (usually 0)<br />
12 Unknown (usually 1) (R?)<br />
11-6 Unknown (usually 0)<br />
5 Unknown (read/write-able) (usually 0) (R/W)<br />
4 Unknown (usually 1) (R?)<br />
3-2 Unknown (usually 0)<br />
1 Select 16bit/32bit Data Mode (0=DATA16, 1=DATA32, see 4004900h) (R/W)<br />
0 Unknown (usually 0)<br />
Known written values are 0000h and 0002h. However, known read values are 1010h and 1012h.<br><br />
DATA32 mode requires setting both 40048D8h.bit1 and 4004900h.bit1. For DATA16 mode, both bits should be zero (though DATA16 seems to be also working the same way when only either of the bits is zero).<br />
<br />
===400480Ah/4004A0Ah - SD_DATA16_BLK_COUNT - "Transfer Block Count" (R/W)===<br />
===4004908h/4004B08h - SD_DATA32_BLK_COUNT (R/W)===<br />
15-0 Number of Data Blocks for multiple read/write commands (0..FFFFh)<br />
In Data32 mode, DATA32_BLK_COUNT is decremented after each block (except after the last block, where it stays at 0001h instead of getting zero). In Data16 mode, SD_DATA16_BLK_COUNT doesn't decrease (instead, there must be some hidden internal counter register).<br><br />
If enabled in STOP_INTERNAL_ACTION.bit8, then the hardware will be automatically sending STOP_TRANSMISSION (CMD12) after the last block (otherwise the decrement occurs as described above, but the hardware keeps transferring blocks infinitely).<br />
<br />
===4004826h/4004A26h - SD_DATA16_BLK_LEN - Transfer Data Length (R/W)===<br />
===4004904h/4004B04h - SD_DATA32_BLK_LEN (R/W)===<br />
15-10 Unknown/unused (appears to be always zero)<br />
9-0 Data Block Length in bytes (for DATA16: clipped to max 0200h by hw)<br />
Should be usually 0200h (for 512-byte SD/MMC memory blocks). Other values may be needed for SDIO functions, or when accessing SSR/SCR/PWD registers via data transfers.<br><br />
DATA32_BLK_LEN can be max 3FFh (unlike DATA16_BLK_LEN which is clipped to<br />
max=200h by hardware).<br />
<br />
===4004830h/4004A30h - SD_DATA16_FIFO - Data Port (SD_FIFO?)===<br />
===400490Ch/4004B0Ch - SD_DATA32_FIFO===<br />
For Data16:<br />
15-0 Data (16bit) (...or could it be accessed as 32bit, too?)<br />
For Data32:<br />
31-0 Data (32bit) (...or could it be accessed as 16bit, too?)<br />
Transfer data here (read after RXRDY gets set, or write after TXRQ gets set).<br />
FIFO size is unknown (if there's any FIFO behind it).<br />
<br />
== DSi SD/MMC I/O Ports: Interrupt/Status ==<br />
<br />
===400481Ch/4004A1Ch - SD_IRQ_STATUS0-1 - Interrupt Status (R/ack)===<br />
===4004820h/4004A20h - SD_IRQ_MASK0-1 - Interrupt Mask (R/W)===<br />
The IRQ_STATUS registers contain acknowledge-able IRQ Flags (those bits that that are maskable in IRQ_MASK register), as well as static read-only status bits without IRQ function (eg. WRPROTECT).<br />
*IRQ Flags/Write (0=Acknowledge, 1=No change)<br />
*IRQ Flags/Read (0=No IRQ, 1=IRQ)<br />
*IRQ Mask (0=Enable, 1=Disable) (8B7F031Dh when all IRQs disabled)<br />
Bit Stat Mask Function<br />
0 SREP MREP CMDRESPEND (response end) (or R1b: busy end)<br />
1 0 0 Unknown/unused (always 0)<br />
2 SRWA MRWA DATAEND (set after (last) data block end)<br />
3 SCOT MCOT CARD_REMOVE (0=No event, 1=Is/was newly ejected) ;\<br />
4 SCIN MCIN CARD_INSERT (0=No event, 1=Is/was newly inserted) ; SD<br />
5 undoc 0 SIGSTATE (0=Ejected, 1=Inserted) (SDIO: always 1) ; Slot<br />
6 0 0 Unknown/unused (always 0) ; Sw's<br />
7 undoc 0 WRPROTECT (0=Locked/Ejected, 1=Unlocked/HalfEjected);/<br />
8 undoc undoc CARD_REMOVE_A (0=No event, 1=High-to-Low occurred) ;\SD<br />
9 undoc undoc CARD_INSERT_A (0=No event, 1=Low-to-High óccurred) ; Slot<br />
10 undoc 0 SIGSTATE_A (usually 1=High) ;also as so for SDIO ;/Data3<br />
11 0 0 Unknown/unused (always 0)<br />
12 0 0 Unknown/unused (always 0)<br />
13 0 0 Unknown/unused (always 0)<br />
14 0 0 Unknown/unused (always 0)<br />
15 0 0 Unknown/unused (always 0)<br />
16 SCIX MCIX CMD_IDX_ERR Bad CMD-index in response (RCMDE,SCMDE)<br />
17 SCRC MCRC CRCFAIL CRC response error (WCRCE,RCRCE,SCRCE,CCRCE)<br />
18 SEND MEND STOPBIT_ERR End bit error (WEBER,REBER,SEBER,CEBER)<br />
19 SDTO MDTO DATATIMEOUT Data Timeout (NRCS,NWCS,KBSY)<br />
20 SFOF MFOF RXOVERFLOW HOST tried write full<br />
21 SFUF MFUF TXUNDERRUN HOST tried read empty<br />
22 SCTO MCTO CMDTIMEOUT Response start-bit timeout (NRS,NSR)<br />
23 ??? 0 Unknown/undoc (usually set) (zero after sending TX data?)<br />
24 SBRE MBRE RXRDY (fifo not empty) (request data read)<br />
25 SBWE MBWE TXRQ (datafifoempty?) (request data write)<br />
26 0 0 Unknown/unused (always 0)<br />
27 undoc undoc Unknown/undoc (bit27 is mask-able in IRQ_MASK)<br />
28 0 0 Unknown/unused (always 0)<br />
29 undoc 0 CMD_READY? (inverse of BUSY?) (unlike toshiba ILFSL/IFSMSK)<br />
30 undoc 0 CMD_BUSY<br />
31 ILA IMSK Illegal Command Access (old CMD still busy, or wrong NTDT)<br />
Normally, IRQs should be acknowledged by writing "FLAGS=NOT X", whilst the firmware is using an unstable "FLAGS=FLAGS AND NOT X" read-modify-write function (accidentally acknowledging any IRQs that have newly occurred during that operation).<br />
<br />
===4004900h/4004B00h - SD_DATA32_IRQ===<br />
15-13 Unknown/unused (appears to be always zero)<br />
12 DATA32_BUSY IRQ Enable (0=Disable, 1=Enable) (R/W)<br />
11 DATA32_RXRDY IRQ Enable (0=Disable, 1=Enable) (R/W)<br />
10 DATA32 Abort/Flush FIFO? (0=No change, 1=Clear Bit8,9) (W)<br />
9 DATA32_BUSY IRQ Flag (auto cleared after...) (R)<br />
8 DATA32_RXRDY IRQ Flag (auto cleared after...) (R)<br />
7-2 Unknown/unused (appears to be always zero)<br />
1 Select 16bit/32bit Data Mode (0=DATA16, 1=DATA32, see 40048D8h) (R/W)<br />
0 Unknown/unused (appears to be always zero)<br />
Can be 1A02h, but changes to 1802h after reading from somewhere (maybe from DATA32_FIFO?).<br><br />
Bit8,9 are extra IRQ flags, the flags get set ONLY in DATA32 mode (not in DATA16 mode).<br />
<br />
===400482Ch/4004A2Ch - SD_ERROR_DETAIL_STATUS0-1 - Error Detail Status===<br />
This register contains extra info about the error bits in SD_IRQ_STATUS. The error bits (except bit13/always set) are automatically cleared when sending a new command by writing to SD_CMD.<br />
31-23 0 Unknown/unused (always zero)<br />
22 KBSY Timeout for CRC status busy ;\STAT.19<br />
21 NWCS Timeout for CRC status (can occur for Data Write) ; (SDTO)<br />
20 NRCS Timeout for Data start-bit, or for Post Data Busy ;/<br />
19-18 0 Unknown/unused (always zero)<br />
17 NRS Response Timeout for auto-issued CMD12 ;\STAT.22<br />
16 NCR Response Timeout for non-auto-issued CMD's ;/(SCTO)<br />
15-14 0 Unknown/unused (always zero)<br />
13 undoc Unknown/undoc (always 1) ;-Always 1<br />
12 0 Unknown/unused (always zero)<br />
11 WCRCE CRC error for Write CRC status for a write command ;\<br />
10 RCRCE CRC error for Read Data ; STAT.17<br />
9 SCRCE CRC error for a Response for auto-issued CMD12 ; (SCRC)<br />
8 CCRCE CRC error for a Response for non-auto-issued CMD's ;/<br />
5 WEBER End bit error for Write CRC status ;\<br />
4 REBER End bit error for Read Data ; STAT.18<br />
3 SEBER End bit error for Response for auto-issued CMD12 ; (SEND)<br />
2 CEBER End bit error for Response for non-auto-issued CMD's ;/<br />
1? SCMDE Bad CMD-index in Response of auto-issued CMD12 ;\STAT.16<br />
0 RCMDE Bad CMD-index in Response of non-auto-issued CMD's ;/(SCIX)<br />
Note: CMD12 is STOP_TRANSMISSION (automatically sent after BLK_COUNT blocks).<br><br />
The four "auto-issued CMD12" bits exist for SD registers only (not for SDIO, going by old toshiba datasheets; which may be wrong).<br />
SCMDE is probably in bit1 (though, official specs say bit0, which would be same as RCMDE).<br><br />
Some error bits can be intentionally provoked: Bit8=1 when programming the controller to expect GET_STATUS to return a 136bit response. Bit16=1 when sending GET_CID in "tran" state. Bit20=1 when sending GET_STATUS configured to expect a data/read reply. Bit21=1 when sending GET_STATUS configured to expect a data/write block (and with actually sending a data block to it).<br />
<br />
== DSi SD/MMC I/O Ports: Control Registers ==<br />
<br />
===4004802h/4004A02h - SD_CARD_PORT_SELECT===<br />
15-11 Unknown/unused (appears to be always zero)<br />
10 Unknown (should be set on writing) (reads as zero) (W)<br />
9-8 Unknown (Always 2 for SD/4004802h, always 1 for SDIO/4004A02h) (R)<br />
7-4 Unknown/unused (appears to be always zero)<br />
3-1 Unknown (R/W)<br />
0 Port Select (0=SD Card Slot, 1=Onboard eMMC) (for SDIO: Unknown)(R/W)<br />
<br />
===4004828h/4004A28h - SD_CARD_OPTION - Card Option Setup===<br />
15 undoc Bus Width (0=4bit, 1=1bit) (R/W)<br />
14 undoc Unknown (usually set) (R?)<br />
13-9 0 Unknown/unused (appears to be always zero)<br />
8 undoc Unknown (firmware tries to toggle this after CLK change?) (W?)<br />
7-4 RTO Data start/busy timout (2000h SHL 0..14, or 15=100h SDCLK's) (R/W)<br />
0-3 TO? Unknown (another timeout, maybe for SDIO? in 32KHz units?) (R/W)<br />
Among others, this register should contain a 4bit timeout setting, "RTO[3:0]<br />
for SD (aka TO[3:0] for SDIO) timeout period for data start/busy bits, in the<br />
form of a multiple number of the SDCLK period." Unknown which "multiple<br />
numbers" that's referring to (probably some exponential/table values).<br />
Settings spotted on DSi are 40E0h,40EEh.<br />
<br />
===4004824h/4004A24h - SD_CARD_CLK_CTL Card Clock Control===<br />
15-11 Unknown (always 0) ;unlike Toshiba: no HCLK divider-disable in bit15)<br />
10 Unknown (0=Normal, 1=Unknown, doesn't affect SDCLK output?) (R/W)<br />
9 Unknown (0=Normal, 1=Unknown, freezes SDCLK output?) (R/W)<br />
8 SDCLK Enable (0=Force SDCLK=LOW, 1=Output SDCLK=HCLK/n) (R/W)<br />
7-0 HCLK Div (0,1,2,4,8,16,32,64,128 = Div2,4,8,16,32,64,128,256,512) (R/W)<br />
The DSi uses HCLK=33.513982 MHz, the SDCLK pin can range from HCLK/512=65kHz to HCLK/2=16.757MHz, max transfer rate would be thus 8MByte/s in 4bit mode.<br><br />
Card detection should be done at a low clock rate. For SD/MMC, the DSi starts with HCLK/128, and uses the clock specified in CSD register after detection (when extracting bits from CSD: mind the different 120bit-without-CRC vs 128bit-with-CRC notations). For SDIO, the DSi starts with HCLK/256, and switches to HCLK/2 after reading SDIO Bus Speed register (Function0:00013h).<br><br />
The SDCLK pins are permanently pulsed, even for devices deselected via SD_CARD_PORT_SELECT.0, and even if no CMD or DATA is being transferred. However, the DSi firmware is usually stopping SDCLK via Bit8=0 when not accessing SD/MMC (doing so may reduce noise and power consumption).<br><br />
Trying to set bit9, or to set more than one bit in bit7-0 will freeze the SDCLK output (in this case SDCLK may get stuck HIGH or LOW, unlike Bit8=0 which forces LOW).<br />
<br />
===4004808h/4004A08h - SD_STOP_INTERNAL_ACTION===<br />
15-9 Unknown/unused (appears to be always zero)<br />
8 Auto-Stop (1=Automatically send CMD12 after BLK_COUNT blocks) (R/W)<br />
7-1 Unknown/unused (appears to be always zero)<br />
0 Unknown (R/W)<br />
Stop whatever internal action for whatever purpose in whatever situation?<br><br />
Existing code does set bit8 (prior to changing SD_DATA16_BLK_COUNT).<br><br />
Existing code does clear bit0 (alongsides with IRQ enable/acknowlege or so).<br><br />
<br />
===40048E0h/4004AE0h - SD_SOFT_RESET - Software Reset===<br />
15-3 Unknown/unused (appears to be always zero)<br />
2 Unknown (always 1) (R?)<br />
1 Unknown (always 1) (though firmware tries to toggle this bit) (R?)<br />
0 SRST Soft Reset (0=Reset, 1=Release) (R/W)<br />
Software should apply reset after sensing card insertion/removal, and (thereafter) release reset in case of card insertion. Software reset does acknowledge all IRQs (except that from SDIO /IRQ pin?), and does probably also reinitialize some other registers.<br><br />
Clearing bit0 does force following settings (while and as long as Bit0=0):<br />
SD_STOP_INTERNAL_ACTION = 0000h<br />
SD_RESPONSE0-7 = zerofilled<br />
SD_IRQ_STATUS0-1 = all IRQs flags acknowledged<br />
SD_ERROR_DETAIL_STATUS0-1 = all bits cleared (except bit13/always set)<br />
SD_CARD_CLK_CTL = bit 8 and 10 cleared<br />
SD_CARD_OPTION = 40EEh<br />
SD_CARD_INTERRUPT_CONTROL = 0000h<br />
All other registers seem to be left unaffected (including the the extra IRQ flags in 4004900h); though there may be some further hidden effects (like aborting transfers or resetting internal registers).<br><br />
Note: The DSi firmware does issue reset by toggling both bit0 and bit1, although bit1 does seem to be read-only (always 1), and trying to clear that bit doesn't seem to have any effect at all.<br />
<br />
== DSi SD/MMC I/O Ports: Unknown/Unused Registers ==<br />
<br />
===40048F6h/4004AF6h - Firmware tests bit0 (but, always 0?) (RESERVED4)===<br />
15-1 Unknown (0)<br />
0 Unknown (tested by firmware) (usually 0) (R)<br />
<br />
===4004836h/4004A36h - SD_CARD_INTERRUPT_CONTROL ---- USED by SDIO===<br />
4004A36h is used in SDIO IRQ handler.<br><br />
On DSi, this register looks as so:<br />
15-2 Unknown (0)<br />
1 Unknown (gets set automatically after 2 seconds?) (and also R/W ?)<br />
0 Unknown (usually always 0) (tested by firmware?) (R?)<br />
Whilst old toshiba datasheets specify it as so:<br />
15-13 ? Unknown (zero on DSi)<br />
12 CINT0 SDIO Interrupt Flag (0=none/ack, 1=irq) (/IRQ aka Data1 pin)<br />
11-9 ? Unknown (zero on DSi)<br />
8 CIMSK0 SDIO Interrupt Mask (0=enable, 1=disable) (/IRQ aka Data1 pin)<br />
7-0 ? Unknown (zero on DSi)<br />
Acknowledge by writing CINT0=0, or CIMSK0=1 (uh, really?), or hard reset (unlike as for other SD/MMC interrupts, soft reset does not acknowlege this interrupt type?).<br />
<br />
===4004838h/4004A38h - SDCTL_CLK_AND_WAIT_CTL ---- USED by SDIO===<br />
4004A38h is used in SDIO IRQ handler.<br><br />
On DSi, this register looks as so (usually zero):<br />
15-14 Unknown (usually 0) (R/W)<br />
13-3 Unknown (0)<br />
2-0 Unknown (usually 0) (R/W)<br />
Whilst old toshiba datasheets specify it as so:<br />
15-0 Unknown (bit8 should be set after SD_CARD_CLK_CTL change?)<br />
<br />
Below registers don't seem to be used by existing software...<br />
<br />
===4004834h/4004A34h - SD_TRANSACTION_CTL - Transaction Control===<br />
15-10 Unknown/unused (appears to be always zero)<br />
9-8 Unknown (R/W)<br />
7-3 Unknown/unused (appears to be always zero)<br />
2 Unknown (R/W)<br />
1 Unknown/unused (appears to be always zero)<br />
0 Unknown (R/W)<br />
<br />
===40048F2h/4004AF2h - Can be 0003h===<br />
15-2 Unknown (0)<br />
1-0 Unknown (0..3) (R/W)<br />
<br />
===40048F4h/4004AF4h - Can be 0770h===<br />
15-11 Unknown (0)<br />
10-8 Unknown (0..7) (R/W)<br />
7 Unknown (0)<br />
6-4 Unknown (0..7) (R/W)<br />
3-0 Unknown (0)<br />
<br />
===40048FAh - Can be 0007h (nonzero, unlike SDIO) (RESERVED6)===<br />
15-3 Unknown (0)<br />
2 Unknown (1=normal, 0=data/read from card to fifo busy?) (R)<br />
1-0 Unknown (0..3) (R/W? or rather R?)<br />
<br />
===40048FCh/4004AFCh - Can be 0024h..00FFh? (RESERVED7)===<br />
===40048FEh/4004AFEh - Can be 0024h..00FFh? (RESERVED8 / TC6371AF:Revision)===<br />
15-8 Unknown (0)<br />
7-0 Can be 24h..FFh parts (R) and parts (R/W)?<br />
<br />
===Unused Registers with Fixed value (all bits read-only, or write-only)===<br />
400482Ah/4004A2Ah 2 Fixed always zero?<br />
4004832h/4004A32h 2 Fixed always zero? ;(TC6371AF:BUF1 Data MSBs?)<br />
400483Ah/4004A3Ah 2 Fixed always zero? ;(SDCTL_SDIO_HOST_INFORMATION)<br />
400483Ch/4004A3Ch 2 Fixed always zero? ;(SDCTL_ERROR_CONTROL)<br />
400483Eh/4004A3Eh 2 Fixed always zero? ;(TC6387XB: LED_CONTROL)<br />
4004840h/4004A40h 2 Fixed always 003Fh?<br />
4004842h/4004A42h 2 Fixed always 002Ah?<br />
4004844h/4004A44h 6Eh Fixed always zerofilled?<br />
40048B2h/4004AB2h 2 Fixed always FFFFh?<br />
40048B4h/4004AB4h 6 Fixed always zerofilled?<br />
40048BAh/4004ABAh 2 Fixed always 0200h?<br />
40048BCh/4004ABCh 1Ch Fixed always zerofilled?<br />
40048DAh/4004ADAh 6 Fixed always zerofilled?<br />
40048E2h/4004AE2h 2 Fixed always 0009h? ;(RESERVED2/9, TC6371AF:CORE_REV)<br />
40048E4h/4004AE4h 2 Fixed always zero?<br />
40048E6h/4004AE6h 2 Fixed always zero? ;(RESERVED3, TC6371AF:BUF_ADR)<br />
40048E8h/4004AE8h 2 Fixed always zero? ;(TC6371AF:Resp_Header)<br />
40048EAh/4004AEAh 6 Fixed always zerofilled?<br />
40048F0h/4004AF0h 2 Fixed always zero? ;(RESERVED10)<br />
40048F8h 2 Fixed always 0004h? (unlike SDIO) (RESERVED5)<br />
4004AF8h 2 Fixed always zero? (unlike SD) (RESERVED5)<br />
4004AFAh 2 Fixed always zero? (unlike SD) (RESERVED6)<br />
4004902h/4004B02h 2 Fixed always zero?<br />
4004906h/4004B06h 2 Fixed always zero?<br />
400490Ah/4004B0Ah 2 Fixed always zero?<br />
4004910h/4004B10h F0h Fixed always zerofilled?<br />
<br />
== Links ==<br />
* [http://gbatemp.net/threads/dsi-reverse-engineering-sd-mmc-sdio-registers.395787/ DSi SD/MMC reverse engineering thread in gbatemp forum]</div>Nocashhttps://dsibrew.org/w/index.php?title=SD/MMC/SDIO_Registers&diff=2098824SD/MMC/SDIO Registers2015-09-02T10:48:32Z<p>Nocash: /* 40048E0h/4004AE0h - SD_SOFT_RESET - Software Reset */</p>
<hr />
<div>SD_xxx is used to access onboard eMMC and external SD card slot (as selected via SD_CARD_PORT_SELECT).<br><br />
SDIO_xxx is used to access the Atheros Wifi unit.<br />
<br />
== DSi SD/MMC I/O Map ==<br />
<br />
'''ARM7 DSi SD/MMC Registers for Memory Card access (SD Card and onboard eMMC)'''<br />
4004800h 2 SD_CMD Command and Response/Data Type<br />
4004802h 2 SD_CARD_PORT_SELECT (SD/MMC:020Fh, SDIO:010Fh)<br />
4004804h 4 SD_CMD_PARAM0-1 Argument (32bit, 2 halfwords)<br />
4004808h 2 SD_STOP_INTERNAL_ACTION<br />
400480Ah 2 SD_DATA16_BLK_COUNT "Transfer Block Count"<br />
400480Ch 16 SD_RESPONSE0-7 (128bit, 8 halfwords)<br />
400481Ch 4 SD_IRQ_STATUS0-1 ;IRQ Status (0=ack, 1=req)<br />
4004820h 4 SD_IRQ_MASK0-1 ;IRQ Disable (0=enable, 1=disable)<br />
4004824h 2 SD_CARD_CLK_CTL Card Clock Control<br />
4004826h 2 SD_DATA16_BLK_LEN Memory Card Transfer Data Length<br />
4004828h 2 SD_CARD_OPTION Memory Card Option Setup (can be C0FFh)<br />
400482Ah 2 Fixed always zero?<br />
400482Ch 4 SD_ERROR_DETAIL_STATUS0-1 Error Detail Status<br />
4004830h 2 SD_DATA16_FIFO Data Port (SD_FIFO?)<br />
4004832h 2 Fixed always zero? ;(TC6371AF:BUF1 Data MSBs?)<br />
4004834h 2 ? SD_TRANSACTION_CTL Transaction Control<br />
4004836h 2 ? SD_CARD_INTERRUPT_CONTROL ;4004A36h used in SDIO IRQ handler<br />
4004838h 2 ? SD_CLK_AND_WAIT_CTL ;4004A38h used in SDIO IRQ handler<br />
400483Ah 2 Fixed always zero? ;(SDCTL_SDIO_HOST_INFORMATION)<br />
400483Ch 2 Fixed always zero? ;(SDCTL_ERROR_CONTROL)<br />
400483Eh 2 Fixed always zero? ;(TC6387XB: LED_CONTROL)<br />
4004840h 2 Fixed always 003Fh?<br />
4004842h 2 Fixed always 002Ah?<br />
4004844h 6Eh Fixed always zerofilled?<br />
40048B2h 2 Fixed always FFFFh?<br />
40048B4h 6 Fixed always zerofilled?<br />
40048BAh 2 Fixed always 0200h?<br />
40048BCh 1Ch Fixed always zerofilled?<br />
40048D8h 2 SD_DATA_CTL<br />
40048DAh 6 Fixed always zerofilled?<br />
40048E0h 2 SD_SOFT_RESET Software Reset (bit0=SRST=0=reset)<br />
40048E2h 2 Fixed always 0009h? ;(RESERVED2/9, TC6371AF:CORE_REV)<br />
40048E4h 2 Fixed always zero?<br />
40048E6h 2 Fixed always zero? ;(RESERVED3, TC6371AF:BUF_ADR)<br />
40048E8h 2 Fixed always zero? ;(TC6371AF:Resp_Header)<br />
40048EAh 6 Fixed always zerofilled?<br />
40048F0h 2 Fixed always zero? ;(RESERVED10)<br />
40048F2h 2 ? Can be 0003h<br />
40048F4h 2 ? Can be 0770h<br />
40048F6h 2 ? Firmware tests bit0 (but, always 0?) (RESERVED4)<br />
40048F8h 2 Fixed always 0004h? (nonzero, unlike SDIO) (RESERVED5)<br />
40048FAh 2 ? Can be 0004h..0007h (nonzero, unlike SDIO) (RESERVED6)<br />
40048FCh 2 ? Can be 0024h..00FFh? (RESERVED7)<br />
40048FEh 2 ? Can be 0024h..00FFh? (RESERVED8 / TC6371AF:Revision)<br />
4004900h 2 SD_DATA32_IRQ<br />
4004902h 2 Fixed always zero?<br />
4004904h 2 SD_DATA32_BLK_LEN<br />
4004906h 2 Fixed always zero?<br />
4004908h 2 SD_DATA32_BLK_COUNT<br />
400490Ah 2 Fixed always zero?<br />
400490Ch 4 SD_DATA32_FIFO<br />
4004910h F0h Fixed always zerofilled?<br />
'''ARM7 DSi SD/MMC Registers for SDIO access (for Atheros Wifi)'''<br />
4004A00h 200h SDIO_xxx (same as SD_xxx at 4004800h..40049FFh, see there)<br />
4004A02h 2 SDIO_CARD_PORT_SELECT (slightly different than 4004802h)<br />
4004AF8h 2 Fixed always zero? (unlike SD_xxx at 40048F8h) (RESERVED5)<br />
4004AFAh 2 Fixed always zero? (unlike SD_xxx at 40048FAh) (RESERVED6)<br />
<br />
== DSi SD/MMC I/O Ports: Command/Param/Response/Data ==<br />
<br />
===4004800h/4004A00h - SD_CMD - Command and Response/Data Type (R/W)===<br />
15 undoc Unknown/undoc (read/write-able)<br />
14 undoc Security Cmd? (0=Normal, 1=Whatever/Security?) (sdio?)<br />
13 undoc Data Length (0=Single Block, 1=Multiple Blocks)<br />
12 undoc Data Direction (0=Write, 1=Read)<br />
11 NTDT Data Transfer (0=No data, 1=With data)<br />
10-8 REP2-0 Response Type (0=Auto, 1..2=Unknown/Reserved, 3=None, 4=48bit,<br />
5=48bit+Busy, 6=136bit, 7=48bitOcrWithoutCRC7)<br />
7-6 CMD1-0 Command Type (0=CMD, 1=ACMD, 2..3=unknown, maybe GEN WR/RD?)<br />
5-0 CIX Command Index (0..3Fh, command index)<br />
Setting Command Type to "ACMD" is automatically sending an APP_CMD prefix prior to the command number. For Multiple Blocks, the hardware supports automatically sending STOP_TRANSMISSION after the last block.<br><br />
DSi software is usually setting Response Type to "Auto", which is causing the hardware to use the correct response/data type for standard SD/MMC commands (bit11-13 are ignored/should be zero when using "Auto"; and maybe same for bit14-15?).<br><br />
One exception is that the DSi firmware isn't using "Auto" for SDIO commands (maybe the hardware isn't aware of them; or it's unable to distinguish between read/write direction of CMD53, which would require examining the command's PARAM bits).<br><br />
There might be subtle differences between some SD and MMC commands, unknown if/how "Auto" is working in that cases; unknown if there's a SD-or-MMC mode select bit for that purpose in some configuration register.<br><br />
Invalid values can cause ILA error (particulary on setting NTDT for CMD12, or for CMD's Response=None). ILA error will also occur if an old CMD is still busy.<br />
<br />
===4004804h/4004A04h - SD_CMD_PARAM0-1 - Argument (32bit, 2 halfwords) (R/W)===<br />
31-0 Parameter value for CMD<br />
The parameter value should be written <before> sending the command via SD_CMD/SDIO_CMD.<br />
<br />
===400480Ch/4004A0Ch - SD_RESPONSE0-7 - Response (128bit, 8 halfwords) (R)===<br />
After sending a command, wait for the CMDRESPEND bit (IRQ_STATUS.bit0) to get<br />
set, then read the RESPONSE (if the command does have any response).<br />
For normal 32bit responses:<br />
31-0 Response<br />
127-32 Older Responses<br />
For CID/CSD responses:<br />
119-0 120bit Response<br />
127-120 Zero (always?)<br />
Seems to be left-shifted when receiving response bits. So, for 32bit responses, bit0-31 would contain the current response, and bit32-127 would contain older responses.<br />
<br />
===DATA16 vs DATA32===<br />
Data can be transferred in 16bit or 32bit units (as selected in DATA_CTL.bit1 and DATA32_IRQ.bit1). There are separate data, block len, and block count registers for 16bit and 32bit mode (that's probably due to some odd patchwork, where the manufacturer has added 32bit support to the original 16bit chip design).<br><br />
Naturally, a 32bit transfer is faster than two 16bit transfers. Nethertheless, the DSi firmware does use both 32bit and 16bit mode once and then; 32bit mode is required for NDMA transfers (which don't support 16bit).<br />
<br />
===40048D8h/4004AD8h - SD_DATA_CTL===<br />
15-13 Unknown (usually 0)<br />
12 Unknown (usually 1) (R?)<br />
11-6 Unknown (usually 0)<br />
5 Unknown (read/write-able) (usually 0) (R/W)<br />
4 Unknown (usually 1) (R?)<br />
3-2 Unknown (usually 0)<br />
1 Select 16bit/32bit Data Mode (0=DATA16, 1=DATA32, see 4004900h) (R/W)<br />
0 Unknown (usually 0)<br />
Known written values are 0000h and 0002h. However, known read values are 1010h and 1012h.<br><br />
DATA32 mode requires setting both 40048D8h.bit1 and 4004900h.bit1. For DATA16 mode, both bits should be zero (though DATA16 seems to be also working the same way when only either of the bits is zero).<br />
<br />
===400480Ah/4004A0Ah - SD_DATA16_BLK_COUNT - "Transfer Block Count" (R/W)===<br />
===4004908h/4004B08h - SD_DATA32_BLK_COUNT (R/W)===<br />
15-0 Number of Data Blocks for multiple read/write commands (0..FFFFh)<br />
In Data32 mode, DATA32_BLK_COUNT is decremented after each block (except after the last block, where it stays at 0001h instead of getting zero). In Data16 mode, SD_DATA16_BLK_COUNT doesn't decrease (instead, there must be some hidden internal counter register).<br><br />
If enabled in STOP_INTERNAL_ACTION.bit8, then the hardware will be automatically sending STOP_TRANSMISSION (CMD12) after the last block (otherwise the decrement occurs as described above, but the hardware keeps transferring blocks infinitely).<br />
<br />
===4004826h/4004A26h - SD_DATA16_BLK_LEN - Transfer Data Length (R/W)===<br />
===4004904h/4004B04h - SD_DATA32_BLK_LEN (R/W)===<br />
15-10 Unknown/unused (appears to be always zero)<br />
9-0 Data Block Length in bytes (for DATA16: clipped to max 0200h by hw)<br />
Should be usually 0200h (for 512-byte SD/MMC memory blocks). Other values may be needed for SDIO functions, or when accessing SSR/SCR/PWD registers via data transfers.<br><br />
DATA32_BLK_LEN can be max 3FFh (unlike DATA16_BLK_LEN which is clipped to<br />
max=200h by hardware).<br />
<br />
===4004830h/4004A30h - SD_DATA16_FIFO - Data Port (SD_FIFO?)===<br />
===400490Ch/4004B0Ch - SD_DATA32_FIFO===<br />
For Data16:<br />
15-0 Data (16bit) (...or could it be accessed as 32bit, too?)<br />
For Data32:<br />
31-0 Data (32bit) (...or could it be accessed as 16bit, too?)<br />
Transfer data here (read after RXRDY gets set, or write after TXRQ gets set).<br />
FIFO size is unknown (if there's any FIFO behind it).<br />
<br />
== DSi SD/MMC I/O Ports: Interrupt/Status ==<br />
<br />
===400481Ch/4004A1Ch - SD_IRQ_STATUS0-1 - Interrupt Status (R/ack)===<br />
===4004820h/4004A20h - SD_IRQ_MASK0-1 - Interrupt Mask (R/W)===<br />
The IRQ_STATUS registers contain acknowledge-able IRQ Flags (those bits that that are maskable in IRQ_MASK register), as well as static read-only status bits without IRQ function (eg. WRPROTECT).<br />
*IRQ Flags/Write (0=Acknowledge, 1=No change)<br />
*IRQ Flags/Read (0=No IRQ, 1=IRQ)<br />
*IRQ Mask (0=Enable, 1=Disable) (8B7F031Dh when all IRQs disabled)<br />
Bit Stat Mask Function<br />
0 SREP MREP CMDRESPEND (response end) (or R1b: busy end)<br />
1 0 0 Unknown/unused (always 0)<br />
2 SRWA MRWA DATAEND (set after (last) data block end)<br />
3 SCOT MCOT CARD_REMOVE (0=No event, 1=Is/was newly ejected) ;\<br />
4 SCIN MCIN CARD_INSERT (0=No event, 1=Is/was newly inserted) ; SD<br />
5 undoc 0 SIGSTATE (0=Ejected, 1=Inserted) (SDIO: always 1) ; Slot<br />
6 0 0 Unknown/unused (always 0) ; Sw's<br />
7 undoc 0 WRPROTECT (0=Locked/Ejected, 1=Unlocked/HalfEjected);/<br />
8 undoc undoc CARD_REMOVE_A (0=No event, 1=High-to-Low occurred) ;\SD<br />
9 undoc undoc CARD_INSERT_A (0=No event, 1=Low-to-High óccurred) ; Slot<br />
10 undoc 0 SIGSTATE_A (usually 1=High) ;also as so for SDIO ;/Data3<br />
11 0 0 Unknown/unused (always 0)<br />
12 0 0 Unknown/unused (always 0)<br />
13 0 0 Unknown/unused (always 0)<br />
14 0 0 Unknown/unused (always 0)<br />
15 0 0 Unknown/unused (always 0)<br />
16 SCIX MCIX CMD_IDX_ERR Bad CMD-index in response (RCMDE,SCMDE)<br />
17 SCRC MCRC CRCFAIL CRC response error (WCRCE,RCRCE,SCRCE,CCRCE)<br />
18 SEND MEND STOPBIT_ERR End bit error (WEBER,REBER,SEBER,CEBER)<br />
19 SDTO MDTO DATATIMEOUT Data Timeout (NRCS,NWCS,KBSY)<br />
20 SFOF MFOF RXOVERFLOW HOST tried write full<br />
21 SFUF MFUF TXUNDERRUN HOST tried read empty<br />
22 SCTO MCTO CMDTIMEOUT Response start-bit timeout (NRS,NSR)<br />
23 ??? 0 Unknown/undoc (usually set) (zero after sending TX data?)<br />
24 SBRE MBRE RXRDY (fifo not empty) (request data read)<br />
25 SBWE MBWE TXRQ (datafifoempty?) (request data write)<br />
26 0 0 Unknown/unused (always 0)<br />
27 undoc undoc Unknown/undoc (bit27 is mask-able in IRQ_MASK)<br />
28 0 0 Unknown/unused (always 0)<br />
29 undoc 0 CMD_READY? (inverse of BUSY?) (unlike toshiba ILFSL/IFSMSK)<br />
30 undoc 0 CMD_BUSY<br />
31 ILA IMSK Illegal Command Access (old CMD still busy, or wrong NTDT)<br />
Normally, IRQs should be acknowledged by writing "FLAGS=NOT X", whilst the firmware is using an unstable "FLAGS=FLAGS AND NOT X" read-modify-write function (accidentally acknowledging any IRQs that have newly occurred during that operation).<br />
<br />
===4004900h/4004B00h - SD_DATA32_IRQ===<br />
15-13 Unknown/unused (appears to be always zero)<br />
12 DATA32_BUSY IRQ Enable (0=Disable, 1=Enable) (R/W)<br />
11 DATA32_RXRDY IRQ Enable (0=Disable, 1=Enable) (R/W)<br />
10 DATA32 Abort/Flush FIFO? (0=No change, 1=Clear Bit8,9) (W)<br />
9 DATA32_BUSY IRQ Flag (auto cleared after...) (R)<br />
8 DATA32_RXRDY IRQ Flag (auto cleared after...) (R)<br />
7-2 Unknown/unused (appears to be always zero)<br />
1 Select 16bit/32bit Data Mode (0=DATA16, 1=DATA32, see 40048D8h) (R/W)<br />
0 Unknown/unused (appears to be always zero)<br />
Can be 1A02h, but changes to 1802h after reading from somewhere (maybe from DATA32_FIFO?).<br><br />
Bit8,9 are extra IRQ flags, the flags get set ONLY in DATA32 mode (not in DATA16 mode).<br />
<br />
===400482Ch/4004A2Ch - SD_ERROR_DETAIL_STATUS0-1 - Error Detail Status===<br />
This register contains extra info about the error bits in SD_IRQ_STATUS. The error bits (except bit13/always set) are automatically cleared when sending a new command by writing to SD_CMD.<br />
31-23 0 Unknown/unused (always zero)<br />
22 KBSY Timeout for CRC status busy ;\STAT.19<br />
21 NWCS Timeout for CRC status (can occur for Data Write) ; (SDTO)<br />
20 NRCS Timeout for Data start-bit, or for Post Data Busy ;/<br />
19-18 0 Unknown/unused (always zero)<br />
17 NRS Response Timeout for auto-issued CMD12 ;\STAT.22<br />
16 NCR Response Timeout for non-auto-issued CMD's ;/(SCTO)<br />
15-14 0 Unknown/unused (always zero)<br />
13 undoc Unknown/undoc (always 1) ;-Always 1<br />
12 0 Unknown/unused (always zero)<br />
11 WCRCE CRC error for Write CRC status for a write command ;\<br />
10 RCRCE CRC error for Read Data ; STAT.17<br />
9 SCRCE CRC error for a Response for auto-issued CMD12 ; (SCRC)<br />
8 CCRCE CRC error for a Response for non-auto-issued CMD's ;/<br />
5 WEBER End bit error for Write CRC status ;\<br />
4 REBER End bit error for Read Data ; STAT.18<br />
3 SEBER End bit error for Response for auto-issued CMD12 ; (SEND)<br />
2 CEBER End bit error for Response for non-auto-issued CMD's ;/<br />
1? SCMDE Bad CMD-index in Response of auto-issued CMD12 ;\STAT.16<br />
0 RCMDE Bad CMD-index in Response of non-auto-issued CMD's ;/(SCIX)<br />
Note: CMD12 is STOP_TRANSMISSION (automatically sent after BLK_COUNT blocks).<br><br />
The four "auto-issued CMD12" bits exist for SD registers only (not for SDIO, going by old toshiba datasheets; which may be wrong).<br />
SCMDE is probably in bit1 (though, official specs say bit0, which would be same as RCMDE).<br><br />
Some error bits can be intentionally provoked: Bit8=1 when programming the controller to expect GET_STATUS to return a 136bit response. Bit16=1 when sending GET_CID in "tran" state. Bit20=1 when sending GET_STATUS configured to expect a data/read reply. Bit21=1 when sending GET_STATUS configured to expect a data/write block (and with actually sending a data block to it).<br />
<br />
== DSi SD/MMC I/O Ports: Control Registers ==<br />
<br />
===4004802h/4004A02h - SD_CARD_PORT_SELECT===<br />
15-11 Unknown/unused (appears to be always zero)<br />
10 Unknown (should be set on writing) (reads as zero) (W)<br />
9-8 Unknown (Always 2 for SD/4004802h, always 1 for SDIO/4004A02h) (R)<br />
7-4 Unknown/unused (appears to be always zero)<br />
3-1 Unknown (R/W)<br />
0 Port Select (0=SD Card Slot, 1=Onboard eMMC) (for SDIO: Unknown)(R/W)<br />
<br />
===4004828h/4004A28h - SD_CARD_OPTION - Card Option Setup===<br />
15 undoc Bus Width (0=4bit, 1=1bit) (R/W)<br />
14 undoc Unknown (usually set) (R?)<br />
13-9 0 Unknown/unused (appears to be always zero)<br />
8 undoc Unknown (firmware tries to toggle this after CLK change?) (W?)<br />
7-4 RTO Data start/busy timout (2000h SHL 0..14, or 15=100h SDCLK's) (R/W)<br />
0-3 TO? Unknown (another timeout, maybe for SDIO? in 32KHz units?) (R/W)<br />
Among others, this register should contain a 4bit timeout setting, "RTO[3:0]<br />
for SD (aka TO[3:0] for SDIO) timeout period for data start/busy bits, in the<br />
form of a multiple number of the SDCLK period." Unknown which "multiple<br />
numbers" that's referring to (probably some exponential/table values).<br />
Settings spotted on DSi are 40E0h,40EEh.<br />
<br />
===4004824h/4004A24h - SD_CARD_CLK_CTL Card Clock Control===<br />
15-11 Unknown (always 0) ;unlike Toshiba: no HCLK divider-disable in bit15)<br />
10 Unknown (0=Normal, 1=Unknown, doesn't affect SDCLK output?) (R/W)<br />
9 Unknown (0=Normal, 1=Unknown, freezes SDCLK output?) (R/W)<br />
8 SDCLK Enable (0=Force SDCLK=LOW, 1=Output SDCLK=HCLK/n) (R/W)<br />
7-0 HCLK Div (0,1,2,4,8,16,32,64,128 = Div2,4,8,16,32,64,128,256,512) (R/W)<br />
The DSi uses HCLK=33.513982 MHz, the SDCLK pin can range from HCLK/512=65kHz to HCLK/2=16.757MHz, max transfer rate would be thus 8MByte/s in 4bit mode.<br><br />
Card detection should be done at a low clock rate. For SD/MMC, the DSi starts with HCLK/128, and uses the clock specified in CSD register after detection (when extracting bits from CSD: mind the different 120bit-without-CRC vs 128bit-with-CRC notations). For SDIO, the DSi starts with HCLK/256, and switches to HCLK/2 after reading SDIO Bus Speed register (Function0:00013h).<br><br />
The SDCLK pins are permanently pulsed, even for devices deselected via SD_CARD_PORT_SELECT.0, and even if no CMD or DATA is being transferred. However, the DSi firmware is usually stopping SDCLK via Bit8=0 when not accessing SD/MMC (doing so may reduce noise and power consumption).<br><br />
Trying to set bit9, or to set more than one bit in bit7-0 will freeze the SDCLK output (in this case SDCLK may get stuck HIGH or LOW, unlike Bit8=0 which forces LOW).<br />
<br />
===4004808h/4004A08h - SD_STOP_INTERNAL_ACTION===<br />
15-9 Unknown/unused (appears to be always zero)<br />
8 Auto-Stop (1=Automatically send CMD12 after BLK_COUNT blocks) (R/W)<br />
7-1 Unknown/unused (appears to be always zero)<br />
0 Unknown (R/W)<br />
Stop whatever internal action for whatever purpose in whatever situation?<br><br />
Existing code does set bit8 (prior to changing SD_DATA16_BLK_COUNT).<br><br />
Existing code does clear bit0 (alongsides with IRQ enable/acknowlege or so).<br><br />
<br />
===40048E0h/4004AE0h - SD_SOFT_RESET - Software Reset===<br />
15-3 Unknown/unused (appears to be always zero)<br />
2 Unknown (always 1) (R?)<br />
1 Unknown (always 1) (though firmware tries to toggle this bit) (R?)<br />
0 SRST Soft Reset (0=Reset, 1=Release) (R/W)<br />
Software should apply reset after sensing card insertion/removal, and (thereafter) release reset in case of card insertion. Software reset does acknowledge all IRQs (except that from SDIO /IRQ pin?), and does probably also reinitialize some other registers.<br><br />
Clearing bit0 does force following settings (while and as long as Bit0=0):<br />
SD_STOP_INTERNAL_ACTION = 0000h<br />
SD_RESPONSE0-7 = zerofilled<br />
SD_IRQ_STATUS0-1 = all IRQs flags acknowledged<br />
SD_ERROR_DETAIL_STATUS0-1 = all bits cleared (except bit13/always set)<br />
SD_CARD_CLK_CTL = bit 8 and 10 cleared<br />
SD_CARD_OPTION = 40EEh<br />
SD_CARD_INTERRUPT_CONTROL = 0000h<br />
All other registers seem to be left unaffected (including the the extra IRQ flags in 4004900h); though there may be some further hidden effects (like aborting transfers or resetting internal registers).<br><br />
Note: The DSi firmware does issue reset by toggling both bit0 and bit1, although bit1 does seem to be read-only (always 1), and trying to clear that bit doesn't seem to have any effect at all.<br />
<br />
== DSi SD/MMC I/O Ports: Unknown/Unused Registers ==<br />
<br />
===40048F6h/4004AF6h - Firmware tests bit0 (but, always 0?) (RESERVED4)===<br />
15-1 Unknown (0)<br />
0 Unknown (tested by firmware) (usually 0) (R)<br />
<br />
===4004836h/4004A36h - SD_CARD_INTERRUPT_CONTROL ---- USED by SDIO===<br />
4004A36h is used in SDIO IRQ handler.<br><br />
On DSi, this register looks as so:<br />
15-2 Unknown (0)<br />
1 Unknown (gets set automatically after 2 seconds?) (and also R/W ?)<br />
0 Unknown (usually always 0) (tested by firmware?) (R?)<br />
Whilst old toshiba datasheets specify it as so:<br />
15-13 ? Unknown (zero on DSi)<br />
12 CINT0 SDIO Interrupt Flag (0=none/ack, 1=irq) (/IRQ aka Data1 pin)<br />
11-9 ? Unknown (zero on DSi)<br />
8 CIMSK0 SDIO Interrupt Mask (0=enable, 1=disable) (/IRQ aka Data1 pin)<br />
7-0 ? Unknown (zero on DSi)<br />
Acknowledge by writing CINT0=0, or CIMSK0=1 (uh, really?), or hard reset (unlike as for other SD/MMC interrupts, soft reset does not acknowlege this interrupt type?).<br />
<br />
===4004838h/4004A38h - SDCTL_CLK_AND_WAIT_CTL ---- USED by SDIO===<br />
4004A38h is used in SDIO IRQ handler.<br><br />
On DSi, this register looks as so (usually zero):<br />
15-14 Unknown (usually 0) (R/W)<br />
13-3 Unknown (0)<br />
2-0 Unknown (usually 0) (R/W)<br />
Whilst old toshiba datasheets specify it as so:<br />
15-0 Unknown (bit8 should be set after SD_CARD_CLK_CTL change?)<br />
<br />
Below registers don't seem to be used by existing software...<br />
<br />
===4004834h/4004A34h - SD_TRANSACTION_CTL - Transaction Control===<br />
15-10 Unknown/unused (appears to be always zero)<br />
9-8 Unknown (R/W)<br />
7-3 Unknown/unused (appears to be always zero)<br />
2 Unknown (R/W)<br />
1 Unknown/unused (appears to be always zero)<br />
0 Unknown (R/W)<br />
<br />
===40048F2h/4004AF2h - Can be 0003h===<br />
15-2 Unknown (0)<br />
1-0 Unknown (0..3) (R/W)<br />
<br />
===40048F4h/4004AF4h - Can be 0770h===<br />
15-11 Unknown (0)<br />
10-8 Unknown (0..7) (R/W)<br />
7 Unknown (0)<br />
6-4 Unknown (0..7) (R/W)<br />
3-0 Unknown (0)<br />
<br />
===40048FAh - Can be 0004h..0007h (nonzero, unlike SDIO) (RESERVED6)===<br />
15-3 Unknown (0)<br />
2 Unknown (usually set) (R)<br />
1-0 Unknown (0..3) (R/W? or rather R?)<br />
<br />
===40048FCh/4004AFCh - Can be 0024h..00FFh? (RESERVED7)===<br />
===40048FEh/4004AFEh - Can be 0024h..00FFh? (RESERVED8 / TC6371AF:Revision)===<br />
15-8 Unknown (0)<br />
7-0 Can be 24h..FFh parts (R) and parts (R/W)?<br />
<br />
===Unused Registers with Fixed value (all bits read-only, or write-only)===<br />
400482Ah/4004A2Ah 2 Fixed always zero?<br />
4004832h/4004A32h 2 Fixed always zero? ;(TC6371AF:BUF1 Data MSBs?)<br />
400483Ah/4004A3Ah 2 Fixed always zero? ;(SDCTL_SDIO_HOST_INFORMATION)<br />
400483Ch/4004A3Ch 2 Fixed always zero? ;(SDCTL_ERROR_CONTROL)<br />
400483Eh/4004A3Eh 2 Fixed always zero? ;(TC6387XB: LED_CONTROL)<br />
4004840h/4004A40h 2 Fixed always 003Fh?<br />
4004842h/4004A42h 2 Fixed always 002Ah?<br />
4004844h/4004A44h 6Eh Fixed always zerofilled?<br />
40048B2h/4004AB2h 2 Fixed always FFFFh?<br />
40048B4h/4004AB4h 6 Fixed always zerofilled?<br />
40048BAh/4004ABAh 2 Fixed always 0200h?<br />
40048BCh/4004ABCh 1Ch Fixed always zerofilled?<br />
40048DAh/4004ADAh 6 Fixed always zerofilled?<br />
40048E2h/4004AE2h 2 Fixed always 0009h? ;(RESERVED2/9, TC6371AF:CORE_REV)<br />
40048E4h/4004AE4h 2 Fixed always zero?<br />
40048E6h/4004AE6h 2 Fixed always zero? ;(RESERVED3, TC6371AF:BUF_ADR)<br />
40048E8h/4004AE8h 2 Fixed always zero? ;(TC6371AF:Resp_Header)<br />
40048EAh/4004AEAh 6 Fixed always zerofilled?<br />
40048F0h/4004AF0h 2 Fixed always zero? ;(RESERVED10)<br />
40048F8h 2 Fixed always 0004h? (unlike SDIO) (RESERVED5)<br />
4004AF8h 2 Fixed always zero? (unlike SD) (RESERVED5)<br />
4004AFAh 2 Fixed always zero? (unlike SD) (RESERVED6)<br />
4004902h/4004B02h 2 Fixed always zero?<br />
4004906h/4004B06h 2 Fixed always zero?<br />
400490Ah/4004B0Ah 2 Fixed always zero?<br />
4004910h/4004B10h F0h Fixed always zerofilled?<br />
<br />
== Links ==<br />
* [http://gbatemp.net/threads/dsi-reverse-engineering-sd-mmc-sdio-registers.395787/ DSi SD/MMC reverse engineering thread in gbatemp forum]</div>Nocashhttps://dsibrew.org/w/index.php?title=SD/MMC/SDIO_Registers&diff=2098823SD/MMC/SDIO Registers2015-09-02T10:47:34Z<p>Nocash: /* 4004828h/4004A28h - SD_CARD_OPTION - Card Option Setup */</p>
<hr />
<div>SD_xxx is used to access onboard eMMC and external SD card slot (as selected via SD_CARD_PORT_SELECT).<br><br />
SDIO_xxx is used to access the Atheros Wifi unit.<br />
<br />
== DSi SD/MMC I/O Map ==<br />
<br />
'''ARM7 DSi SD/MMC Registers for Memory Card access (SD Card and onboard eMMC)'''<br />
4004800h 2 SD_CMD Command and Response/Data Type<br />
4004802h 2 SD_CARD_PORT_SELECT (SD/MMC:020Fh, SDIO:010Fh)<br />
4004804h 4 SD_CMD_PARAM0-1 Argument (32bit, 2 halfwords)<br />
4004808h 2 SD_STOP_INTERNAL_ACTION<br />
400480Ah 2 SD_DATA16_BLK_COUNT "Transfer Block Count"<br />
400480Ch 16 SD_RESPONSE0-7 (128bit, 8 halfwords)<br />
400481Ch 4 SD_IRQ_STATUS0-1 ;IRQ Status (0=ack, 1=req)<br />
4004820h 4 SD_IRQ_MASK0-1 ;IRQ Disable (0=enable, 1=disable)<br />
4004824h 2 SD_CARD_CLK_CTL Card Clock Control<br />
4004826h 2 SD_DATA16_BLK_LEN Memory Card Transfer Data Length<br />
4004828h 2 SD_CARD_OPTION Memory Card Option Setup (can be C0FFh)<br />
400482Ah 2 Fixed always zero?<br />
400482Ch 4 SD_ERROR_DETAIL_STATUS0-1 Error Detail Status<br />
4004830h 2 SD_DATA16_FIFO Data Port (SD_FIFO?)<br />
4004832h 2 Fixed always zero? ;(TC6371AF:BUF1 Data MSBs?)<br />
4004834h 2 ? SD_TRANSACTION_CTL Transaction Control<br />
4004836h 2 ? SD_CARD_INTERRUPT_CONTROL ;4004A36h used in SDIO IRQ handler<br />
4004838h 2 ? SD_CLK_AND_WAIT_CTL ;4004A38h used in SDIO IRQ handler<br />
400483Ah 2 Fixed always zero? ;(SDCTL_SDIO_HOST_INFORMATION)<br />
400483Ch 2 Fixed always zero? ;(SDCTL_ERROR_CONTROL)<br />
400483Eh 2 Fixed always zero? ;(TC6387XB: LED_CONTROL)<br />
4004840h 2 Fixed always 003Fh?<br />
4004842h 2 Fixed always 002Ah?<br />
4004844h 6Eh Fixed always zerofilled?<br />
40048B2h 2 Fixed always FFFFh?<br />
40048B4h 6 Fixed always zerofilled?<br />
40048BAh 2 Fixed always 0200h?<br />
40048BCh 1Ch Fixed always zerofilled?<br />
40048D8h 2 SD_DATA_CTL<br />
40048DAh 6 Fixed always zerofilled?<br />
40048E0h 2 SD_SOFT_RESET Software Reset (bit0=SRST=0=reset)<br />
40048E2h 2 Fixed always 0009h? ;(RESERVED2/9, TC6371AF:CORE_REV)<br />
40048E4h 2 Fixed always zero?<br />
40048E6h 2 Fixed always zero? ;(RESERVED3, TC6371AF:BUF_ADR)<br />
40048E8h 2 Fixed always zero? ;(TC6371AF:Resp_Header)<br />
40048EAh 6 Fixed always zerofilled?<br />
40048F0h 2 Fixed always zero? ;(RESERVED10)<br />
40048F2h 2 ? Can be 0003h<br />
40048F4h 2 ? Can be 0770h<br />
40048F6h 2 ? Firmware tests bit0 (but, always 0?) (RESERVED4)<br />
40048F8h 2 Fixed always 0004h? (nonzero, unlike SDIO) (RESERVED5)<br />
40048FAh 2 ? Can be 0004h..0007h (nonzero, unlike SDIO) (RESERVED6)<br />
40048FCh 2 ? Can be 0024h..00FFh? (RESERVED7)<br />
40048FEh 2 ? Can be 0024h..00FFh? (RESERVED8 / TC6371AF:Revision)<br />
4004900h 2 SD_DATA32_IRQ<br />
4004902h 2 Fixed always zero?<br />
4004904h 2 SD_DATA32_BLK_LEN<br />
4004906h 2 Fixed always zero?<br />
4004908h 2 SD_DATA32_BLK_COUNT<br />
400490Ah 2 Fixed always zero?<br />
400490Ch 4 SD_DATA32_FIFO<br />
4004910h F0h Fixed always zerofilled?<br />
'''ARM7 DSi SD/MMC Registers for SDIO access (for Atheros Wifi)'''<br />
4004A00h 200h SDIO_xxx (same as SD_xxx at 4004800h..40049FFh, see there)<br />
4004A02h 2 SDIO_CARD_PORT_SELECT (slightly different than 4004802h)<br />
4004AF8h 2 Fixed always zero? (unlike SD_xxx at 40048F8h) (RESERVED5)<br />
4004AFAh 2 Fixed always zero? (unlike SD_xxx at 40048FAh) (RESERVED6)<br />
<br />
== DSi SD/MMC I/O Ports: Command/Param/Response/Data ==<br />
<br />
===4004800h/4004A00h - SD_CMD - Command and Response/Data Type (R/W)===<br />
15 undoc Unknown/undoc (read/write-able)<br />
14 undoc Security Cmd? (0=Normal, 1=Whatever/Security?) (sdio?)<br />
13 undoc Data Length (0=Single Block, 1=Multiple Blocks)<br />
12 undoc Data Direction (0=Write, 1=Read)<br />
11 NTDT Data Transfer (0=No data, 1=With data)<br />
10-8 REP2-0 Response Type (0=Auto, 1..2=Unknown/Reserved, 3=None, 4=48bit,<br />
5=48bit+Busy, 6=136bit, 7=48bitOcrWithoutCRC7)<br />
7-6 CMD1-0 Command Type (0=CMD, 1=ACMD, 2..3=unknown, maybe GEN WR/RD?)<br />
5-0 CIX Command Index (0..3Fh, command index)<br />
Setting Command Type to "ACMD" is automatically sending an APP_CMD prefix prior to the command number. For Multiple Blocks, the hardware supports automatically sending STOP_TRANSMISSION after the last block.<br><br />
DSi software is usually setting Response Type to "Auto", which is causing the hardware to use the correct response/data type for standard SD/MMC commands (bit11-13 are ignored/should be zero when using "Auto"; and maybe same for bit14-15?).<br><br />
One exception is that the DSi firmware isn't using "Auto" for SDIO commands (maybe the hardware isn't aware of them; or it's unable to distinguish between read/write direction of CMD53, which would require examining the command's PARAM bits).<br><br />
There might be subtle differences between some SD and MMC commands, unknown if/how "Auto" is working in that cases; unknown if there's a SD-or-MMC mode select bit for that purpose in some configuration register.<br><br />
Invalid values can cause ILA error (particulary on setting NTDT for CMD12, or for CMD's Response=None). ILA error will also occur if an old CMD is still busy.<br />
<br />
===4004804h/4004A04h - SD_CMD_PARAM0-1 - Argument (32bit, 2 halfwords) (R/W)===<br />
31-0 Parameter value for CMD<br />
The parameter value should be written <before> sending the command via SD_CMD/SDIO_CMD.<br />
<br />
===400480Ch/4004A0Ch - SD_RESPONSE0-7 - Response (128bit, 8 halfwords) (R)===<br />
After sending a command, wait for the CMDRESPEND bit (IRQ_STATUS.bit0) to get<br />
set, then read the RESPONSE (if the command does have any response).<br />
For normal 32bit responses:<br />
31-0 Response<br />
127-32 Older Responses<br />
For CID/CSD responses:<br />
119-0 120bit Response<br />
127-120 Zero (always?)<br />
Seems to be left-shifted when receiving response bits. So, for 32bit responses, bit0-31 would contain the current response, and bit32-127 would contain older responses.<br />
<br />
===DATA16 vs DATA32===<br />
Data can be transferred in 16bit or 32bit units (as selected in DATA_CTL.bit1 and DATA32_IRQ.bit1). There are separate data, block len, and block count registers for 16bit and 32bit mode (that's probably due to some odd patchwork, where the manufacturer has added 32bit support to the original 16bit chip design).<br><br />
Naturally, a 32bit transfer is faster than two 16bit transfers. Nethertheless, the DSi firmware does use both 32bit and 16bit mode once and then; 32bit mode is required for NDMA transfers (which don't support 16bit).<br />
<br />
===40048D8h/4004AD8h - SD_DATA_CTL===<br />
15-13 Unknown (usually 0)<br />
12 Unknown (usually 1) (R?)<br />
11-6 Unknown (usually 0)<br />
5 Unknown (read/write-able) (usually 0) (R/W)<br />
4 Unknown (usually 1) (R?)<br />
3-2 Unknown (usually 0)<br />
1 Select 16bit/32bit Data Mode (0=DATA16, 1=DATA32, see 4004900h) (R/W)<br />
0 Unknown (usually 0)<br />
Known written values are 0000h and 0002h. However, known read values are 1010h and 1012h.<br><br />
DATA32 mode requires setting both 40048D8h.bit1 and 4004900h.bit1. For DATA16 mode, both bits should be zero (though DATA16 seems to be also working the same way when only either of the bits is zero).<br />
<br />
===400480Ah/4004A0Ah - SD_DATA16_BLK_COUNT - "Transfer Block Count" (R/W)===<br />
===4004908h/4004B08h - SD_DATA32_BLK_COUNT (R/W)===<br />
15-0 Number of Data Blocks for multiple read/write commands (0..FFFFh)<br />
In Data32 mode, DATA32_BLK_COUNT is decremented after each block (except after the last block, where it stays at 0001h instead of getting zero). In Data16 mode, SD_DATA16_BLK_COUNT doesn't decrease (instead, there must be some hidden internal counter register).<br><br />
If enabled in STOP_INTERNAL_ACTION.bit8, then the hardware will be automatically sending STOP_TRANSMISSION (CMD12) after the last block (otherwise the decrement occurs as described above, but the hardware keeps transferring blocks infinitely).<br />
<br />
===4004826h/4004A26h - SD_DATA16_BLK_LEN - Transfer Data Length (R/W)===<br />
===4004904h/4004B04h - SD_DATA32_BLK_LEN (R/W)===<br />
15-10 Unknown/unused (appears to be always zero)<br />
9-0 Data Block Length in bytes (for DATA16: clipped to max 0200h by hw)<br />
Should be usually 0200h (for 512-byte SD/MMC memory blocks). Other values may be needed for SDIO functions, or when accessing SSR/SCR/PWD registers via data transfers.<br><br />
DATA32_BLK_LEN can be max 3FFh (unlike DATA16_BLK_LEN which is clipped to<br />
max=200h by hardware).<br />
<br />
===4004830h/4004A30h - SD_DATA16_FIFO - Data Port (SD_FIFO?)===<br />
===400490Ch/4004B0Ch - SD_DATA32_FIFO===<br />
For Data16:<br />
15-0 Data (16bit) (...or could it be accessed as 32bit, too?)<br />
For Data32:<br />
31-0 Data (32bit) (...or could it be accessed as 16bit, too?)<br />
Transfer data here (read after RXRDY gets set, or write after TXRQ gets set).<br />
FIFO size is unknown (if there's any FIFO behind it).<br />
<br />
== DSi SD/MMC I/O Ports: Interrupt/Status ==<br />
<br />
===400481Ch/4004A1Ch - SD_IRQ_STATUS0-1 - Interrupt Status (R/ack)===<br />
===4004820h/4004A20h - SD_IRQ_MASK0-1 - Interrupt Mask (R/W)===<br />
The IRQ_STATUS registers contain acknowledge-able IRQ Flags (those bits that that are maskable in IRQ_MASK register), as well as static read-only status bits without IRQ function (eg. WRPROTECT).<br />
*IRQ Flags/Write (0=Acknowledge, 1=No change)<br />
*IRQ Flags/Read (0=No IRQ, 1=IRQ)<br />
*IRQ Mask (0=Enable, 1=Disable) (8B7F031Dh when all IRQs disabled)<br />
Bit Stat Mask Function<br />
0 SREP MREP CMDRESPEND (response end) (or R1b: busy end)<br />
1 0 0 Unknown/unused (always 0)<br />
2 SRWA MRWA DATAEND (set after (last) data block end)<br />
3 SCOT MCOT CARD_REMOVE (0=No event, 1=Is/was newly ejected) ;\<br />
4 SCIN MCIN CARD_INSERT (0=No event, 1=Is/was newly inserted) ; SD<br />
5 undoc 0 SIGSTATE (0=Ejected, 1=Inserted) (SDIO: always 1) ; Slot<br />
6 0 0 Unknown/unused (always 0) ; Sw's<br />
7 undoc 0 WRPROTECT (0=Locked/Ejected, 1=Unlocked/HalfEjected);/<br />
8 undoc undoc CARD_REMOVE_A (0=No event, 1=High-to-Low occurred) ;\SD<br />
9 undoc undoc CARD_INSERT_A (0=No event, 1=Low-to-High óccurred) ; Slot<br />
10 undoc 0 SIGSTATE_A (usually 1=High) ;also as so for SDIO ;/Data3<br />
11 0 0 Unknown/unused (always 0)<br />
12 0 0 Unknown/unused (always 0)<br />
13 0 0 Unknown/unused (always 0)<br />
14 0 0 Unknown/unused (always 0)<br />
15 0 0 Unknown/unused (always 0)<br />
16 SCIX MCIX CMD_IDX_ERR Bad CMD-index in response (RCMDE,SCMDE)<br />
17 SCRC MCRC CRCFAIL CRC response error (WCRCE,RCRCE,SCRCE,CCRCE)<br />
18 SEND MEND STOPBIT_ERR End bit error (WEBER,REBER,SEBER,CEBER)<br />
19 SDTO MDTO DATATIMEOUT Data Timeout (NRCS,NWCS,KBSY)<br />
20 SFOF MFOF RXOVERFLOW HOST tried write full<br />
21 SFUF MFUF TXUNDERRUN HOST tried read empty<br />
22 SCTO MCTO CMDTIMEOUT Response start-bit timeout (NRS,NSR)<br />
23 ??? 0 Unknown/undoc (usually set) (zero after sending TX data?)<br />
24 SBRE MBRE RXRDY (fifo not empty) (request data read)<br />
25 SBWE MBWE TXRQ (datafifoempty?) (request data write)<br />
26 0 0 Unknown/unused (always 0)<br />
27 undoc undoc Unknown/undoc (bit27 is mask-able in IRQ_MASK)<br />
28 0 0 Unknown/unused (always 0)<br />
29 undoc 0 CMD_READY? (inverse of BUSY?) (unlike toshiba ILFSL/IFSMSK)<br />
30 undoc 0 CMD_BUSY<br />
31 ILA IMSK Illegal Command Access (old CMD still busy, or wrong NTDT)<br />
Normally, IRQs should be acknowledged by writing "FLAGS=NOT X", whilst the firmware is using an unstable "FLAGS=FLAGS AND NOT X" read-modify-write function (accidentally acknowledging any IRQs that have newly occurred during that operation).<br />
<br />
===4004900h/4004B00h - SD_DATA32_IRQ===<br />
15-13 Unknown/unused (appears to be always zero)<br />
12 DATA32_BUSY IRQ Enable (0=Disable, 1=Enable) (R/W)<br />
11 DATA32_RXRDY IRQ Enable (0=Disable, 1=Enable) (R/W)<br />
10 DATA32 Abort/Flush FIFO? (0=No change, 1=Clear Bit8,9) (W)<br />
9 DATA32_BUSY IRQ Flag (auto cleared after...) (R)<br />
8 DATA32_RXRDY IRQ Flag (auto cleared after...) (R)<br />
7-2 Unknown/unused (appears to be always zero)<br />
1 Select 16bit/32bit Data Mode (0=DATA16, 1=DATA32, see 40048D8h) (R/W)<br />
0 Unknown/unused (appears to be always zero)<br />
Can be 1A02h, but changes to 1802h after reading from somewhere (maybe from DATA32_FIFO?).<br><br />
Bit8,9 are extra IRQ flags, the flags get set ONLY in DATA32 mode (not in DATA16 mode).<br />
<br />
===400482Ch/4004A2Ch - SD_ERROR_DETAIL_STATUS0-1 - Error Detail Status===<br />
This register contains extra info about the error bits in SD_IRQ_STATUS. The error bits (except bit13/always set) are automatically cleared when sending a new command by writing to SD_CMD.<br />
31-23 0 Unknown/unused (always zero)<br />
22 KBSY Timeout for CRC status busy ;\STAT.19<br />
21 NWCS Timeout for CRC status (can occur for Data Write) ; (SDTO)<br />
20 NRCS Timeout for Data start-bit, or for Post Data Busy ;/<br />
19-18 0 Unknown/unused (always zero)<br />
17 NRS Response Timeout for auto-issued CMD12 ;\STAT.22<br />
16 NCR Response Timeout for non-auto-issued CMD's ;/(SCTO)<br />
15-14 0 Unknown/unused (always zero)<br />
13 undoc Unknown/undoc (always 1) ;-Always 1<br />
12 0 Unknown/unused (always zero)<br />
11 WCRCE CRC error for Write CRC status for a write command ;\<br />
10 RCRCE CRC error for Read Data ; STAT.17<br />
9 SCRCE CRC error for a Response for auto-issued CMD12 ; (SCRC)<br />
8 CCRCE CRC error for a Response for non-auto-issued CMD's ;/<br />
5 WEBER End bit error for Write CRC status ;\<br />
4 REBER End bit error for Read Data ; STAT.18<br />
3 SEBER End bit error for Response for auto-issued CMD12 ; (SEND)<br />
2 CEBER End bit error for Response for non-auto-issued CMD's ;/<br />
1? SCMDE Bad CMD-index in Response of auto-issued CMD12 ;\STAT.16<br />
0 RCMDE Bad CMD-index in Response of non-auto-issued CMD's ;/(SCIX)<br />
Note: CMD12 is STOP_TRANSMISSION (automatically sent after BLK_COUNT blocks).<br><br />
The four "auto-issued CMD12" bits exist for SD registers only (not for SDIO, going by old toshiba datasheets; which may be wrong).<br />
SCMDE is probably in bit1 (though, official specs say bit0, which would be same as RCMDE).<br><br />
Some error bits can be intentionally provoked: Bit8=1 when programming the controller to expect GET_STATUS to return a 136bit response. Bit16=1 when sending GET_CID in "tran" state. Bit20=1 when sending GET_STATUS configured to expect a data/read reply. Bit21=1 when sending GET_STATUS configured to expect a data/write block (and with actually sending a data block to it).<br />
<br />
== DSi SD/MMC I/O Ports: Control Registers ==<br />
<br />
===4004802h/4004A02h - SD_CARD_PORT_SELECT===<br />
15-11 Unknown/unused (appears to be always zero)<br />
10 Unknown (should be set on writing) (reads as zero) (W)<br />
9-8 Unknown (Always 2 for SD/4004802h, always 1 for SDIO/4004A02h) (R)<br />
7-4 Unknown/unused (appears to be always zero)<br />
3-1 Unknown (R/W)<br />
0 Port Select (0=SD Card Slot, 1=Onboard eMMC) (for SDIO: Unknown)(R/W)<br />
<br />
===4004828h/4004A28h - SD_CARD_OPTION - Card Option Setup===<br />
15 undoc Bus Width (0=4bit, 1=1bit) (R/W)<br />
14 undoc Unknown (usually set) (R?)<br />
13-9 0 Unknown/unused (appears to be always zero)<br />
8 undoc Unknown (firmware tries to toggle this after CLK change?) (W?)<br />
7-4 RTO Data start/busy timout (2000h SHL 0..14, or 15=100h SDCLK's) (R/W)<br />
0-3 TO? Unknown (another timeout, maybe for SDIO? in 32KHz units?) (R/W)<br />
Among others, this register should contain a 4bit timeout setting, "RTO[3:0]<br />
for SD (aka TO[3:0] for SDIO) timeout period for data start/busy bits, in the<br />
form of a multiple number of the SDCLK period." Unknown which "multiple<br />
numbers" that's referring to (probably some exponential/table values).<br />
Settings spotted on DSi are 40E0h,40EEh.<br />
<br />
===4004824h/4004A24h - SD_CARD_CLK_CTL Card Clock Control===<br />
15-11 Unknown (always 0) ;unlike Toshiba: no HCLK divider-disable in bit15)<br />
10 Unknown (0=Normal, 1=Unknown, doesn't affect SDCLK output?) (R/W)<br />
9 Unknown (0=Normal, 1=Unknown, freezes SDCLK output?) (R/W)<br />
8 SDCLK Enable (0=Force SDCLK=LOW, 1=Output SDCLK=HCLK/n) (R/W)<br />
7-0 HCLK Div (0,1,2,4,8,16,32,64,128 = Div2,4,8,16,32,64,128,256,512) (R/W)<br />
The DSi uses HCLK=33.513982 MHz, the SDCLK pin can range from HCLK/512=65kHz to HCLK/2=16.757MHz, max transfer rate would be thus 8MByte/s in 4bit mode.<br><br />
Card detection should be done at a low clock rate. For SD/MMC, the DSi starts with HCLK/128, and uses the clock specified in CSD register after detection (when extracting bits from CSD: mind the different 120bit-without-CRC vs 128bit-with-CRC notations). For SDIO, the DSi starts with HCLK/256, and switches to HCLK/2 after reading SDIO Bus Speed register (Function0:00013h).<br><br />
The SDCLK pins are permanently pulsed, even for devices deselected via SD_CARD_PORT_SELECT.0, and even if no CMD or DATA is being transferred. However, the DSi firmware is usually stopping SDCLK via Bit8=0 when not accessing SD/MMC (doing so may reduce noise and power consumption).<br><br />
Trying to set bit9, or to set more than one bit in bit7-0 will freeze the SDCLK output (in this case SDCLK may get stuck HIGH or LOW, unlike Bit8=0 which forces LOW).<br />
<br />
===4004808h/4004A08h - SD_STOP_INTERNAL_ACTION===<br />
15-9 Unknown/unused (appears to be always zero)<br />
8 Auto-Stop (1=Automatically send CMD12 after BLK_COUNT blocks) (R/W)<br />
7-1 Unknown/unused (appears to be always zero)<br />
0 Unknown (R/W)<br />
Stop whatever internal action for whatever purpose in whatever situation?<br><br />
Existing code does set bit8 (prior to changing SD_DATA16_BLK_COUNT).<br><br />
Existing code does clear bit0 (alongsides with IRQ enable/acknowlege or so).<br><br />
<br />
===40048E0h/4004AE0h - SD_SOFT_RESET - Software Reset===<br />
15-3 Unknown/unused (appears to be always zero)<br />
2 Unknown (always 1) (R?)<br />
1 Unknown (always 1) (though firmware tries to toggle this bit) (R?)<br />
0 SRST Soft Reset (0=Reset, 1=Release) (R/W)<br />
Software should apply reset after sensing card insertion/removal, and (thereafter) release reset in case of card insertion. Software reset does acknowledge all IRQs (except that from SDIO /IRQ pin?), and does probably also reinitialize some other registers.<br><br />
Clearing bit0 does force following settings (while and as long as Bit0=0):<br />
SD_STOP_INTERNAL_ACTION = 0000h<br />
SD_RESPONSE0-7 = zerofilled<br />
SD_IRQ_STATUS0-1 = all IRQs flags acknowledged<br />
SD_CARD_CLK_CTL = bit 8 and 10 cleared<br />
SD_CARD_OPTION = 40EEh<br />
SD_CARD_INTERRUPT_CONTROL = 0000h<br />
All other registers seem to be left unaffected (including the the extra IRQ flags in 4004900h); though there may be some further hidden effects (like aborting transfers or resetting internal registers).<br><br />
Note: The DSi firmware does issue reset by toggling both bit0 and bit1, although bit1 does seem to be read-only (always 1), and trying to clear that bit doesn't seem to have any effect at all.<br />
<br />
== DSi SD/MMC I/O Ports: Unknown/Unused Registers ==<br />
<br />
===40048F6h/4004AF6h - Firmware tests bit0 (but, always 0?) (RESERVED4)===<br />
15-1 Unknown (0)<br />
0 Unknown (tested by firmware) (usually 0) (R)<br />
<br />
===4004836h/4004A36h - SD_CARD_INTERRUPT_CONTROL ---- USED by SDIO===<br />
4004A36h is used in SDIO IRQ handler.<br><br />
On DSi, this register looks as so:<br />
15-2 Unknown (0)<br />
1 Unknown (gets set automatically after 2 seconds?) (and also R/W ?)<br />
0 Unknown (usually always 0) (tested by firmware?) (R?)<br />
Whilst old toshiba datasheets specify it as so:<br />
15-13 ? Unknown (zero on DSi)<br />
12 CINT0 SDIO Interrupt Flag (0=none/ack, 1=irq) (/IRQ aka Data1 pin)<br />
11-9 ? Unknown (zero on DSi)<br />
8 CIMSK0 SDIO Interrupt Mask (0=enable, 1=disable) (/IRQ aka Data1 pin)<br />
7-0 ? Unknown (zero on DSi)<br />
Acknowledge by writing CINT0=0, or CIMSK0=1 (uh, really?), or hard reset (unlike as for other SD/MMC interrupts, soft reset does not acknowlege this interrupt type?).<br />
<br />
===4004838h/4004A38h - SDCTL_CLK_AND_WAIT_CTL ---- USED by SDIO===<br />
4004A38h is used in SDIO IRQ handler.<br><br />
On DSi, this register looks as so (usually zero):<br />
15-14 Unknown (usually 0) (R/W)<br />
13-3 Unknown (0)<br />
2-0 Unknown (usually 0) (R/W)<br />
Whilst old toshiba datasheets specify it as so:<br />
15-0 Unknown (bit8 should be set after SD_CARD_CLK_CTL change?)<br />
<br />
Below registers don't seem to be used by existing software...<br />
<br />
===4004834h/4004A34h - SD_TRANSACTION_CTL - Transaction Control===<br />
15-10 Unknown/unused (appears to be always zero)<br />
9-8 Unknown (R/W)<br />
7-3 Unknown/unused (appears to be always zero)<br />
2 Unknown (R/W)<br />
1 Unknown/unused (appears to be always zero)<br />
0 Unknown (R/W)<br />
<br />
===40048F2h/4004AF2h - Can be 0003h===<br />
15-2 Unknown (0)<br />
1-0 Unknown (0..3) (R/W)<br />
<br />
===40048F4h/4004AF4h - Can be 0770h===<br />
15-11 Unknown (0)<br />
10-8 Unknown (0..7) (R/W)<br />
7 Unknown (0)<br />
6-4 Unknown (0..7) (R/W)<br />
3-0 Unknown (0)<br />
<br />
===40048FAh - Can be 0004h..0007h (nonzero, unlike SDIO) (RESERVED6)===<br />
15-3 Unknown (0)<br />
2 Unknown (usually set) (R)<br />
1-0 Unknown (0..3) (R/W? or rather R?)<br />
<br />
===40048FCh/4004AFCh - Can be 0024h..00FFh? (RESERVED7)===<br />
===40048FEh/4004AFEh - Can be 0024h..00FFh? (RESERVED8 / TC6371AF:Revision)===<br />
15-8 Unknown (0)<br />
7-0 Can be 24h..FFh parts (R) and parts (R/W)?<br />
<br />
===Unused Registers with Fixed value (all bits read-only, or write-only)===<br />
400482Ah/4004A2Ah 2 Fixed always zero?<br />
4004832h/4004A32h 2 Fixed always zero? ;(TC6371AF:BUF1 Data MSBs?)<br />
400483Ah/4004A3Ah 2 Fixed always zero? ;(SDCTL_SDIO_HOST_INFORMATION)<br />
400483Ch/4004A3Ch 2 Fixed always zero? ;(SDCTL_ERROR_CONTROL)<br />
400483Eh/4004A3Eh 2 Fixed always zero? ;(TC6387XB: LED_CONTROL)<br />
4004840h/4004A40h 2 Fixed always 003Fh?<br />
4004842h/4004A42h 2 Fixed always 002Ah?<br />
4004844h/4004A44h 6Eh Fixed always zerofilled?<br />
40048B2h/4004AB2h 2 Fixed always FFFFh?<br />
40048B4h/4004AB4h 6 Fixed always zerofilled?<br />
40048BAh/4004ABAh 2 Fixed always 0200h?<br />
40048BCh/4004ABCh 1Ch Fixed always zerofilled?<br />
40048DAh/4004ADAh 6 Fixed always zerofilled?<br />
40048E2h/4004AE2h 2 Fixed always 0009h? ;(RESERVED2/9, TC6371AF:CORE_REV)<br />
40048E4h/4004AE4h 2 Fixed always zero?<br />
40048E6h/4004AE6h 2 Fixed always zero? ;(RESERVED3, TC6371AF:BUF_ADR)<br />
40048E8h/4004AE8h 2 Fixed always zero? ;(TC6371AF:Resp_Header)<br />
40048EAh/4004AEAh 6 Fixed always zerofilled?<br />
40048F0h/4004AF0h 2 Fixed always zero? ;(RESERVED10)<br />
40048F8h 2 Fixed always 0004h? (unlike SDIO) (RESERVED5)<br />
4004AF8h 2 Fixed always zero? (unlike SD) (RESERVED5)<br />
4004AFAh 2 Fixed always zero? (unlike SD) (RESERVED6)<br />
4004902h/4004B02h 2 Fixed always zero?<br />
4004906h/4004B06h 2 Fixed always zero?<br />
400490Ah/4004B0Ah 2 Fixed always zero?<br />
4004910h/4004B10h F0h Fixed always zerofilled?<br />
<br />
== Links ==<br />
* [http://gbatemp.net/threads/dsi-reverse-engineering-sd-mmc-sdio-registers.395787/ DSi SD/MMC reverse engineering thread in gbatemp forum]</div>Nocashhttps://dsibrew.org/w/index.php?title=SD/MMC/SDIO_Registers&diff=2098822SD/MMC/SDIO Registers2015-09-02T10:46:49Z<p>Nocash: /* 4004802h/4004A02h - SD_CARD_PORT_SELECT */</p>
<hr />
<div>SD_xxx is used to access onboard eMMC and external SD card slot (as selected via SD_CARD_PORT_SELECT).<br><br />
SDIO_xxx is used to access the Atheros Wifi unit.<br />
<br />
== DSi SD/MMC I/O Map ==<br />
<br />
'''ARM7 DSi SD/MMC Registers for Memory Card access (SD Card and onboard eMMC)'''<br />
4004800h 2 SD_CMD Command and Response/Data Type<br />
4004802h 2 SD_CARD_PORT_SELECT (SD/MMC:020Fh, SDIO:010Fh)<br />
4004804h 4 SD_CMD_PARAM0-1 Argument (32bit, 2 halfwords)<br />
4004808h 2 SD_STOP_INTERNAL_ACTION<br />
400480Ah 2 SD_DATA16_BLK_COUNT "Transfer Block Count"<br />
400480Ch 16 SD_RESPONSE0-7 (128bit, 8 halfwords)<br />
400481Ch 4 SD_IRQ_STATUS0-1 ;IRQ Status (0=ack, 1=req)<br />
4004820h 4 SD_IRQ_MASK0-1 ;IRQ Disable (0=enable, 1=disable)<br />
4004824h 2 SD_CARD_CLK_CTL Card Clock Control<br />
4004826h 2 SD_DATA16_BLK_LEN Memory Card Transfer Data Length<br />
4004828h 2 SD_CARD_OPTION Memory Card Option Setup (can be C0FFh)<br />
400482Ah 2 Fixed always zero?<br />
400482Ch 4 SD_ERROR_DETAIL_STATUS0-1 Error Detail Status<br />
4004830h 2 SD_DATA16_FIFO Data Port (SD_FIFO?)<br />
4004832h 2 Fixed always zero? ;(TC6371AF:BUF1 Data MSBs?)<br />
4004834h 2 ? SD_TRANSACTION_CTL Transaction Control<br />
4004836h 2 ? SD_CARD_INTERRUPT_CONTROL ;4004A36h used in SDIO IRQ handler<br />
4004838h 2 ? SD_CLK_AND_WAIT_CTL ;4004A38h used in SDIO IRQ handler<br />
400483Ah 2 Fixed always zero? ;(SDCTL_SDIO_HOST_INFORMATION)<br />
400483Ch 2 Fixed always zero? ;(SDCTL_ERROR_CONTROL)<br />
400483Eh 2 Fixed always zero? ;(TC6387XB: LED_CONTROL)<br />
4004840h 2 Fixed always 003Fh?<br />
4004842h 2 Fixed always 002Ah?<br />
4004844h 6Eh Fixed always zerofilled?<br />
40048B2h 2 Fixed always FFFFh?<br />
40048B4h 6 Fixed always zerofilled?<br />
40048BAh 2 Fixed always 0200h?<br />
40048BCh 1Ch Fixed always zerofilled?<br />
40048D8h 2 SD_DATA_CTL<br />
40048DAh 6 Fixed always zerofilled?<br />
40048E0h 2 SD_SOFT_RESET Software Reset (bit0=SRST=0=reset)<br />
40048E2h 2 Fixed always 0009h? ;(RESERVED2/9, TC6371AF:CORE_REV)<br />
40048E4h 2 Fixed always zero?<br />
40048E6h 2 Fixed always zero? ;(RESERVED3, TC6371AF:BUF_ADR)<br />
40048E8h 2 Fixed always zero? ;(TC6371AF:Resp_Header)<br />
40048EAh 6 Fixed always zerofilled?<br />
40048F0h 2 Fixed always zero? ;(RESERVED10)<br />
40048F2h 2 ? Can be 0003h<br />
40048F4h 2 ? Can be 0770h<br />
40048F6h 2 ? Firmware tests bit0 (but, always 0?) (RESERVED4)<br />
40048F8h 2 Fixed always 0004h? (nonzero, unlike SDIO) (RESERVED5)<br />
40048FAh 2 ? Can be 0004h..0007h (nonzero, unlike SDIO) (RESERVED6)<br />
40048FCh 2 ? Can be 0024h..00FFh? (RESERVED7)<br />
40048FEh 2 ? Can be 0024h..00FFh? (RESERVED8 / TC6371AF:Revision)<br />
4004900h 2 SD_DATA32_IRQ<br />
4004902h 2 Fixed always zero?<br />
4004904h 2 SD_DATA32_BLK_LEN<br />
4004906h 2 Fixed always zero?<br />
4004908h 2 SD_DATA32_BLK_COUNT<br />
400490Ah 2 Fixed always zero?<br />
400490Ch 4 SD_DATA32_FIFO<br />
4004910h F0h Fixed always zerofilled?<br />
'''ARM7 DSi SD/MMC Registers for SDIO access (for Atheros Wifi)'''<br />
4004A00h 200h SDIO_xxx (same as SD_xxx at 4004800h..40049FFh, see there)<br />
4004A02h 2 SDIO_CARD_PORT_SELECT (slightly different than 4004802h)<br />
4004AF8h 2 Fixed always zero? (unlike SD_xxx at 40048F8h) (RESERVED5)<br />
4004AFAh 2 Fixed always zero? (unlike SD_xxx at 40048FAh) (RESERVED6)<br />
<br />
== DSi SD/MMC I/O Ports: Command/Param/Response/Data ==<br />
<br />
===4004800h/4004A00h - SD_CMD - Command and Response/Data Type (R/W)===<br />
15 undoc Unknown/undoc (read/write-able)<br />
14 undoc Security Cmd? (0=Normal, 1=Whatever/Security?) (sdio?)<br />
13 undoc Data Length (0=Single Block, 1=Multiple Blocks)<br />
12 undoc Data Direction (0=Write, 1=Read)<br />
11 NTDT Data Transfer (0=No data, 1=With data)<br />
10-8 REP2-0 Response Type (0=Auto, 1..2=Unknown/Reserved, 3=None, 4=48bit,<br />
5=48bit+Busy, 6=136bit, 7=48bitOcrWithoutCRC7)<br />
7-6 CMD1-0 Command Type (0=CMD, 1=ACMD, 2..3=unknown, maybe GEN WR/RD?)<br />
5-0 CIX Command Index (0..3Fh, command index)<br />
Setting Command Type to "ACMD" is automatically sending an APP_CMD prefix prior to the command number. For Multiple Blocks, the hardware supports automatically sending STOP_TRANSMISSION after the last block.<br><br />
DSi software is usually setting Response Type to "Auto", which is causing the hardware to use the correct response/data type for standard SD/MMC commands (bit11-13 are ignored/should be zero when using "Auto"; and maybe same for bit14-15?).<br><br />
One exception is that the DSi firmware isn't using "Auto" for SDIO commands (maybe the hardware isn't aware of them; or it's unable to distinguish between read/write direction of CMD53, which would require examining the command's PARAM bits).<br><br />
There might be subtle differences between some SD and MMC commands, unknown if/how "Auto" is working in that cases; unknown if there's a SD-or-MMC mode select bit for that purpose in some configuration register.<br><br />
Invalid values can cause ILA error (particulary on setting NTDT for CMD12, or for CMD's Response=None). ILA error will also occur if an old CMD is still busy.<br />
<br />
===4004804h/4004A04h - SD_CMD_PARAM0-1 - Argument (32bit, 2 halfwords) (R/W)===<br />
31-0 Parameter value for CMD<br />
The parameter value should be written <before> sending the command via SD_CMD/SDIO_CMD.<br />
<br />
===400480Ch/4004A0Ch - SD_RESPONSE0-7 - Response (128bit, 8 halfwords) (R)===<br />
After sending a command, wait for the CMDRESPEND bit (IRQ_STATUS.bit0) to get<br />
set, then read the RESPONSE (if the command does have any response).<br />
For normal 32bit responses:<br />
31-0 Response<br />
127-32 Older Responses<br />
For CID/CSD responses:<br />
119-0 120bit Response<br />
127-120 Zero (always?)<br />
Seems to be left-shifted when receiving response bits. So, for 32bit responses, bit0-31 would contain the current response, and bit32-127 would contain older responses.<br />
<br />
===DATA16 vs DATA32===<br />
Data can be transferred in 16bit or 32bit units (as selected in DATA_CTL.bit1 and DATA32_IRQ.bit1). There are separate data, block len, and block count registers for 16bit and 32bit mode (that's probably due to some odd patchwork, where the manufacturer has added 32bit support to the original 16bit chip design).<br><br />
Naturally, a 32bit transfer is faster than two 16bit transfers. Nethertheless, the DSi firmware does use both 32bit and 16bit mode once and then; 32bit mode is required for NDMA transfers (which don't support 16bit).<br />
<br />
===40048D8h/4004AD8h - SD_DATA_CTL===<br />
15-13 Unknown (usually 0)<br />
12 Unknown (usually 1) (R?)<br />
11-6 Unknown (usually 0)<br />
5 Unknown (read/write-able) (usually 0) (R/W)<br />
4 Unknown (usually 1) (R?)<br />
3-2 Unknown (usually 0)<br />
1 Select 16bit/32bit Data Mode (0=DATA16, 1=DATA32, see 4004900h) (R/W)<br />
0 Unknown (usually 0)<br />
Known written values are 0000h and 0002h. However, known read values are 1010h and 1012h.<br><br />
DATA32 mode requires setting both 40048D8h.bit1 and 4004900h.bit1. For DATA16 mode, both bits should be zero (though DATA16 seems to be also working the same way when only either of the bits is zero).<br />
<br />
===400480Ah/4004A0Ah - SD_DATA16_BLK_COUNT - "Transfer Block Count" (R/W)===<br />
===4004908h/4004B08h - SD_DATA32_BLK_COUNT (R/W)===<br />
15-0 Number of Data Blocks for multiple read/write commands (0..FFFFh)<br />
In Data32 mode, DATA32_BLK_COUNT is decremented after each block (except after the last block, where it stays at 0001h instead of getting zero). In Data16 mode, SD_DATA16_BLK_COUNT doesn't decrease (instead, there must be some hidden internal counter register).<br><br />
If enabled in STOP_INTERNAL_ACTION.bit8, then the hardware will be automatically sending STOP_TRANSMISSION (CMD12) after the last block (otherwise the decrement occurs as described above, but the hardware keeps transferring blocks infinitely).<br />
<br />
===4004826h/4004A26h - SD_DATA16_BLK_LEN - Transfer Data Length (R/W)===<br />
===4004904h/4004B04h - SD_DATA32_BLK_LEN (R/W)===<br />
15-10 Unknown/unused (appears to be always zero)<br />
9-0 Data Block Length in bytes (for DATA16: clipped to max 0200h by hw)<br />
Should be usually 0200h (for 512-byte SD/MMC memory blocks). Other values may be needed for SDIO functions, or when accessing SSR/SCR/PWD registers via data transfers.<br><br />
DATA32_BLK_LEN can be max 3FFh (unlike DATA16_BLK_LEN which is clipped to<br />
max=200h by hardware).<br />
<br />
===4004830h/4004A30h - SD_DATA16_FIFO - Data Port (SD_FIFO?)===<br />
===400490Ch/4004B0Ch - SD_DATA32_FIFO===<br />
For Data16:<br />
15-0 Data (16bit) (...or could it be accessed as 32bit, too?)<br />
For Data32:<br />
31-0 Data (32bit) (...or could it be accessed as 16bit, too?)<br />
Transfer data here (read after RXRDY gets set, or write after TXRQ gets set).<br />
FIFO size is unknown (if there's any FIFO behind it).<br />
<br />
== DSi SD/MMC I/O Ports: Interrupt/Status ==<br />
<br />
===400481Ch/4004A1Ch - SD_IRQ_STATUS0-1 - Interrupt Status (R/ack)===<br />
===4004820h/4004A20h - SD_IRQ_MASK0-1 - Interrupt Mask (R/W)===<br />
The IRQ_STATUS registers contain acknowledge-able IRQ Flags (those bits that that are maskable in IRQ_MASK register), as well as static read-only status bits without IRQ function (eg. WRPROTECT).<br />
*IRQ Flags/Write (0=Acknowledge, 1=No change)<br />
*IRQ Flags/Read (0=No IRQ, 1=IRQ)<br />
*IRQ Mask (0=Enable, 1=Disable) (8B7F031Dh when all IRQs disabled)<br />
Bit Stat Mask Function<br />
0 SREP MREP CMDRESPEND (response end) (or R1b: busy end)<br />
1 0 0 Unknown/unused (always 0)<br />
2 SRWA MRWA DATAEND (set after (last) data block end)<br />
3 SCOT MCOT CARD_REMOVE (0=No event, 1=Is/was newly ejected) ;\<br />
4 SCIN MCIN CARD_INSERT (0=No event, 1=Is/was newly inserted) ; SD<br />
5 undoc 0 SIGSTATE (0=Ejected, 1=Inserted) (SDIO: always 1) ; Slot<br />
6 0 0 Unknown/unused (always 0) ; Sw's<br />
7 undoc 0 WRPROTECT (0=Locked/Ejected, 1=Unlocked/HalfEjected);/<br />
8 undoc undoc CARD_REMOVE_A (0=No event, 1=High-to-Low occurred) ;\SD<br />
9 undoc undoc CARD_INSERT_A (0=No event, 1=Low-to-High óccurred) ; Slot<br />
10 undoc 0 SIGSTATE_A (usually 1=High) ;also as so for SDIO ;/Data3<br />
11 0 0 Unknown/unused (always 0)<br />
12 0 0 Unknown/unused (always 0)<br />
13 0 0 Unknown/unused (always 0)<br />
14 0 0 Unknown/unused (always 0)<br />
15 0 0 Unknown/unused (always 0)<br />
16 SCIX MCIX CMD_IDX_ERR Bad CMD-index in response (RCMDE,SCMDE)<br />
17 SCRC MCRC CRCFAIL CRC response error (WCRCE,RCRCE,SCRCE,CCRCE)<br />
18 SEND MEND STOPBIT_ERR End bit error (WEBER,REBER,SEBER,CEBER)<br />
19 SDTO MDTO DATATIMEOUT Data Timeout (NRCS,NWCS,KBSY)<br />
20 SFOF MFOF RXOVERFLOW HOST tried write full<br />
21 SFUF MFUF TXUNDERRUN HOST tried read empty<br />
22 SCTO MCTO CMDTIMEOUT Response start-bit timeout (NRS,NSR)<br />
23 ??? 0 Unknown/undoc (usually set) (zero after sending TX data?)<br />
24 SBRE MBRE RXRDY (fifo not empty) (request data read)<br />
25 SBWE MBWE TXRQ (datafifoempty?) (request data write)<br />
26 0 0 Unknown/unused (always 0)<br />
27 undoc undoc Unknown/undoc (bit27 is mask-able in IRQ_MASK)<br />
28 0 0 Unknown/unused (always 0)<br />
29 undoc 0 CMD_READY? (inverse of BUSY?) (unlike toshiba ILFSL/IFSMSK)<br />
30 undoc 0 CMD_BUSY<br />
31 ILA IMSK Illegal Command Access (old CMD still busy, or wrong NTDT)<br />
Normally, IRQs should be acknowledged by writing "FLAGS=NOT X", whilst the firmware is using an unstable "FLAGS=FLAGS AND NOT X" read-modify-write function (accidentally acknowledging any IRQs that have newly occurred during that operation).<br />
<br />
===4004900h/4004B00h - SD_DATA32_IRQ===<br />
15-13 Unknown/unused (appears to be always zero)<br />
12 DATA32_BUSY IRQ Enable (0=Disable, 1=Enable) (R/W)<br />
11 DATA32_RXRDY IRQ Enable (0=Disable, 1=Enable) (R/W)<br />
10 DATA32 Abort/Flush FIFO? (0=No change, 1=Clear Bit8,9) (W)<br />
9 DATA32_BUSY IRQ Flag (auto cleared after...) (R)<br />
8 DATA32_RXRDY IRQ Flag (auto cleared after...) (R)<br />
7-2 Unknown/unused (appears to be always zero)<br />
1 Select 16bit/32bit Data Mode (0=DATA16, 1=DATA32, see 40048D8h) (R/W)<br />
0 Unknown/unused (appears to be always zero)<br />
Can be 1A02h, but changes to 1802h after reading from somewhere (maybe from DATA32_FIFO?).<br><br />
Bit8,9 are extra IRQ flags, the flags get set ONLY in DATA32 mode (not in DATA16 mode).<br />
<br />
===400482Ch/4004A2Ch - SD_ERROR_DETAIL_STATUS0-1 - Error Detail Status===<br />
This register contains extra info about the error bits in SD_IRQ_STATUS. The error bits (except bit13/always set) are automatically cleared when sending a new command by writing to SD_CMD.<br />
31-23 0 Unknown/unused (always zero)<br />
22 KBSY Timeout for CRC status busy ;\STAT.19<br />
21 NWCS Timeout for CRC status (can occur for Data Write) ; (SDTO)<br />
20 NRCS Timeout for Data start-bit, or for Post Data Busy ;/<br />
19-18 0 Unknown/unused (always zero)<br />
17 NRS Response Timeout for auto-issued CMD12 ;\STAT.22<br />
16 NCR Response Timeout for non-auto-issued CMD's ;/(SCTO)<br />
15-14 0 Unknown/unused (always zero)<br />
13 undoc Unknown/undoc (always 1) ;-Always 1<br />
12 0 Unknown/unused (always zero)<br />
11 WCRCE CRC error for Write CRC status for a write command ;\<br />
10 RCRCE CRC error for Read Data ; STAT.17<br />
9 SCRCE CRC error for a Response for auto-issued CMD12 ; (SCRC)<br />
8 CCRCE CRC error for a Response for non-auto-issued CMD's ;/<br />
5 WEBER End bit error for Write CRC status ;\<br />
4 REBER End bit error for Read Data ; STAT.18<br />
3 SEBER End bit error for Response for auto-issued CMD12 ; (SEND)<br />
2 CEBER End bit error for Response for non-auto-issued CMD's ;/<br />
1? SCMDE Bad CMD-index in Response of auto-issued CMD12 ;\STAT.16<br />
0 RCMDE Bad CMD-index in Response of non-auto-issued CMD's ;/(SCIX)<br />
Note: CMD12 is STOP_TRANSMISSION (automatically sent after BLK_COUNT blocks).<br><br />
The four "auto-issued CMD12" bits exist for SD registers only (not for SDIO, going by old toshiba datasheets; which may be wrong).<br />
SCMDE is probably in bit1 (though, official specs say bit0, which would be same as RCMDE).<br><br />
Some error bits can be intentionally provoked: Bit8=1 when programming the controller to expect GET_STATUS to return a 136bit response. Bit16=1 when sending GET_CID in "tran" state. Bit20=1 when sending GET_STATUS configured to expect a data/read reply. Bit21=1 when sending GET_STATUS configured to expect a data/write block (and with actually sending a data block to it).<br />
<br />
== DSi SD/MMC I/O Ports: Control Registers ==<br />
<br />
===4004802h/4004A02h - SD_CARD_PORT_SELECT===<br />
15-11 Unknown/unused (appears to be always zero)<br />
10 Unknown (should be set on writing) (reads as zero) (W)<br />
9-8 Unknown (Always 2 for SD/4004802h, always 1 for SDIO/4004A02h) (R)<br />
7-4 Unknown/unused (appears to be always zero)<br />
3-1 Unknown (R/W)<br />
0 Port Select (0=SD Card Slot, 1=Onboard eMMC) (for SDIO: Unknown)(R/W)<br />
<br />
===4004828h/4004A28h - SD_CARD_OPTION - Card Option Setup===<br />
15 Bus Width (0=4bit, 1=1bit) (R/W)<br />
14 Unknown (usually set) (R?)<br />
13-9 Unknown/unused (appears to be always zero)<br />
8 Unknown (firmware toggles this after CLK change?) (W?)<br />
7-4 Unknown, maybe some 4bit timing/timeout value (R/W)<br />
0-3 Unknown, maybe another 4bit timing/timeout value (R/W)<br />
Among others, this register should contain a 4bit timeout setting, "RTO[3:0] for SD (aka TO[3:0] for SDIO) timeout period for data start/busy bits, in the form of a multiple number of the SDCLK period."<br><br />
Unknown which "multiple numbers" that's referring to (probably some exponential/table values).<br><br />
Settings spotted on DSi are 40E0h,40EEh.<br />
<br />
===4004824h/4004A24h - SD_CARD_CLK_CTL Card Clock Control===<br />
15-11 Unknown (always 0) ;unlike Toshiba: no HCLK divider-disable in bit15)<br />
10 Unknown (0=Normal, 1=Unknown, doesn't affect SDCLK output?) (R/W)<br />
9 Unknown (0=Normal, 1=Unknown, freezes SDCLK output?) (R/W)<br />
8 SDCLK Enable (0=Force SDCLK=LOW, 1=Output SDCLK=HCLK/n) (R/W)<br />
7-0 HCLK Div (0,1,2,4,8,16,32,64,128 = Div2,4,8,16,32,64,128,256,512) (R/W)<br />
The DSi uses HCLK=33.513982 MHz, the SDCLK pin can range from HCLK/512=65kHz to HCLK/2=16.757MHz, max transfer rate would be thus 8MByte/s in 4bit mode.<br><br />
Card detection should be done at a low clock rate. For SD/MMC, the DSi starts with HCLK/128, and uses the clock specified in CSD register after detection (when extracting bits from CSD: mind the different 120bit-without-CRC vs 128bit-with-CRC notations). For SDIO, the DSi starts with HCLK/256, and switches to HCLK/2 after reading SDIO Bus Speed register (Function0:00013h).<br><br />
The SDCLK pins are permanently pulsed, even for devices deselected via SD_CARD_PORT_SELECT.0, and even if no CMD or DATA is being transferred. However, the DSi firmware is usually stopping SDCLK via Bit8=0 when not accessing SD/MMC (doing so may reduce noise and power consumption).<br><br />
Trying to set bit9, or to set more than one bit in bit7-0 will freeze the SDCLK output (in this case SDCLK may get stuck HIGH or LOW, unlike Bit8=0 which forces LOW).<br />
<br />
===4004808h/4004A08h - SD_STOP_INTERNAL_ACTION===<br />
15-9 Unknown/unused (appears to be always zero)<br />
8 Auto-Stop (1=Automatically send CMD12 after BLK_COUNT blocks) (R/W)<br />
7-1 Unknown/unused (appears to be always zero)<br />
0 Unknown (R/W)<br />
Stop whatever internal action for whatever purpose in whatever situation?<br><br />
Existing code does set bit8 (prior to changing SD_DATA16_BLK_COUNT).<br><br />
Existing code does clear bit0 (alongsides with IRQ enable/acknowlege or so).<br><br />
<br />
===40048E0h/4004AE0h - SD_SOFT_RESET - Software Reset===<br />
15-3 Unknown/unused (appears to be always zero)<br />
2 Unknown (always 1) (R?)<br />
1 Unknown (always 1) (though firmware tries to toggle this bit) (R?)<br />
0 SRST Soft Reset (0=Reset, 1=Release) (R/W)<br />
Software should apply reset after sensing card insertion/removal, and (thereafter) release reset in case of card insertion. Software reset does acknowledge all IRQs (except that from SDIO /IRQ pin?), and does probably also reinitialize some other registers.<br><br />
Clearing bit0 does force following settings (while and as long as Bit0=0):<br />
SD_STOP_INTERNAL_ACTION = 0000h<br />
SD_RESPONSE0-7 = zerofilled<br />
SD_IRQ_STATUS0-1 = all IRQs flags acknowledged<br />
SD_CARD_CLK_CTL = bit 8 and 10 cleared<br />
SD_CARD_OPTION = 40EEh<br />
SD_CARD_INTERRUPT_CONTROL = 0000h<br />
All other registers seem to be left unaffected (including the the extra IRQ flags in 4004900h); though there may be some further hidden effects (like aborting transfers or resetting internal registers).<br><br />
Note: The DSi firmware does issue reset by toggling both bit0 and bit1, although bit1 does seem to be read-only (always 1), and trying to clear that bit doesn't seem to have any effect at all.<br />
<br />
== DSi SD/MMC I/O Ports: Unknown/Unused Registers ==<br />
<br />
===40048F6h/4004AF6h - Firmware tests bit0 (but, always 0?) (RESERVED4)===<br />
15-1 Unknown (0)<br />
0 Unknown (tested by firmware) (usually 0) (R)<br />
<br />
===4004836h/4004A36h - SD_CARD_INTERRUPT_CONTROL ---- USED by SDIO===<br />
4004A36h is used in SDIO IRQ handler.<br><br />
On DSi, this register looks as so:<br />
15-2 Unknown (0)<br />
1 Unknown (gets set automatically after 2 seconds?) (and also R/W ?)<br />
0 Unknown (usually always 0) (tested by firmware?) (R?)<br />
Whilst old toshiba datasheets specify it as so:<br />
15-13 ? Unknown (zero on DSi)<br />
12 CINT0 SDIO Interrupt Flag (0=none/ack, 1=irq) (/IRQ aka Data1 pin)<br />
11-9 ? Unknown (zero on DSi)<br />
8 CIMSK0 SDIO Interrupt Mask (0=enable, 1=disable) (/IRQ aka Data1 pin)<br />
7-0 ? Unknown (zero on DSi)<br />
Acknowledge by writing CINT0=0, or CIMSK0=1 (uh, really?), or hard reset (unlike as for other SD/MMC interrupts, soft reset does not acknowlege this interrupt type?).<br />
<br />
===4004838h/4004A38h - SDCTL_CLK_AND_WAIT_CTL ---- USED by SDIO===<br />
4004A38h is used in SDIO IRQ handler.<br><br />
On DSi, this register looks as so (usually zero):<br />
15-14 Unknown (usually 0) (R/W)<br />
13-3 Unknown (0)<br />
2-0 Unknown (usually 0) (R/W)<br />
Whilst old toshiba datasheets specify it as so:<br />
15-0 Unknown (bit8 should be set after SD_CARD_CLK_CTL change?)<br />
<br />
Below registers don't seem to be used by existing software...<br />
<br />
===4004834h/4004A34h - SD_TRANSACTION_CTL - Transaction Control===<br />
15-10 Unknown/unused (appears to be always zero)<br />
9-8 Unknown (R/W)<br />
7-3 Unknown/unused (appears to be always zero)<br />
2 Unknown (R/W)<br />
1 Unknown/unused (appears to be always zero)<br />
0 Unknown (R/W)<br />
<br />
===40048F2h/4004AF2h - Can be 0003h===<br />
15-2 Unknown (0)<br />
1-0 Unknown (0..3) (R/W)<br />
<br />
===40048F4h/4004AF4h - Can be 0770h===<br />
15-11 Unknown (0)<br />
10-8 Unknown (0..7) (R/W)<br />
7 Unknown (0)<br />
6-4 Unknown (0..7) (R/W)<br />
3-0 Unknown (0)<br />
<br />
===40048FAh - Can be 0004h..0007h (nonzero, unlike SDIO) (RESERVED6)===<br />
15-3 Unknown (0)<br />
2 Unknown (usually set) (R)<br />
1-0 Unknown (0..3) (R/W? or rather R?)<br />
<br />
===40048FCh/4004AFCh - Can be 0024h..00FFh? (RESERVED7)===<br />
===40048FEh/4004AFEh - Can be 0024h..00FFh? (RESERVED8 / TC6371AF:Revision)===<br />
15-8 Unknown (0)<br />
7-0 Can be 24h..FFh parts (R) and parts (R/W)?<br />
<br />
===Unused Registers with Fixed value (all bits read-only, or write-only)===<br />
400482Ah/4004A2Ah 2 Fixed always zero?<br />
4004832h/4004A32h 2 Fixed always zero? ;(TC6371AF:BUF1 Data MSBs?)<br />
400483Ah/4004A3Ah 2 Fixed always zero? ;(SDCTL_SDIO_HOST_INFORMATION)<br />
400483Ch/4004A3Ch 2 Fixed always zero? ;(SDCTL_ERROR_CONTROL)<br />
400483Eh/4004A3Eh 2 Fixed always zero? ;(TC6387XB: LED_CONTROL)<br />
4004840h/4004A40h 2 Fixed always 003Fh?<br />
4004842h/4004A42h 2 Fixed always 002Ah?<br />
4004844h/4004A44h 6Eh Fixed always zerofilled?<br />
40048B2h/4004AB2h 2 Fixed always FFFFh?<br />
40048B4h/4004AB4h 6 Fixed always zerofilled?<br />
40048BAh/4004ABAh 2 Fixed always 0200h?<br />
40048BCh/4004ABCh 1Ch Fixed always zerofilled?<br />
40048DAh/4004ADAh 6 Fixed always zerofilled?<br />
40048E2h/4004AE2h 2 Fixed always 0009h? ;(RESERVED2/9, TC6371AF:CORE_REV)<br />
40048E4h/4004AE4h 2 Fixed always zero?<br />
40048E6h/4004AE6h 2 Fixed always zero? ;(RESERVED3, TC6371AF:BUF_ADR)<br />
40048E8h/4004AE8h 2 Fixed always zero? ;(TC6371AF:Resp_Header)<br />
40048EAh/4004AEAh 6 Fixed always zerofilled?<br />
40048F0h/4004AF0h 2 Fixed always zero? ;(RESERVED10)<br />
40048F8h 2 Fixed always 0004h? (unlike SDIO) (RESERVED5)<br />
4004AF8h 2 Fixed always zero? (unlike SD) (RESERVED5)<br />
4004AFAh 2 Fixed always zero? (unlike SD) (RESERVED6)<br />
4004902h/4004B02h 2 Fixed always zero?<br />
4004906h/4004B06h 2 Fixed always zero?<br />
400490Ah/4004B0Ah 2 Fixed always zero?<br />
4004910h/4004B10h F0h Fixed always zerofilled?<br />
<br />
== Links ==<br />
* [http://gbatemp.net/threads/dsi-reverse-engineering-sd-mmc-sdio-registers.395787/ DSi SD/MMC reverse engineering thread in gbatemp forum]</div>Nocashhttps://dsibrew.org/w/index.php?title=SD/MMC/SDIO_Registers&diff=2098821SD/MMC/SDIO Registers2015-09-02T10:44:19Z<p>Nocash: /* 400482Ch/4004A2Ch - SD_ERROR_DETAIL_STATUS0-1 - Error Detail Status */</p>
<hr />
<div>SD_xxx is used to access onboard eMMC and external SD card slot (as selected via SD_CARD_PORT_SELECT).<br><br />
SDIO_xxx is used to access the Atheros Wifi unit.<br />
<br />
== DSi SD/MMC I/O Map ==<br />
<br />
'''ARM7 DSi SD/MMC Registers for Memory Card access (SD Card and onboard eMMC)'''<br />
4004800h 2 SD_CMD Command and Response/Data Type<br />
4004802h 2 SD_CARD_PORT_SELECT (SD/MMC:020Fh, SDIO:010Fh)<br />
4004804h 4 SD_CMD_PARAM0-1 Argument (32bit, 2 halfwords)<br />
4004808h 2 SD_STOP_INTERNAL_ACTION<br />
400480Ah 2 SD_DATA16_BLK_COUNT "Transfer Block Count"<br />
400480Ch 16 SD_RESPONSE0-7 (128bit, 8 halfwords)<br />
400481Ch 4 SD_IRQ_STATUS0-1 ;IRQ Status (0=ack, 1=req)<br />
4004820h 4 SD_IRQ_MASK0-1 ;IRQ Disable (0=enable, 1=disable)<br />
4004824h 2 SD_CARD_CLK_CTL Card Clock Control<br />
4004826h 2 SD_DATA16_BLK_LEN Memory Card Transfer Data Length<br />
4004828h 2 SD_CARD_OPTION Memory Card Option Setup (can be C0FFh)<br />
400482Ah 2 Fixed always zero?<br />
400482Ch 4 SD_ERROR_DETAIL_STATUS0-1 Error Detail Status<br />
4004830h 2 SD_DATA16_FIFO Data Port (SD_FIFO?)<br />
4004832h 2 Fixed always zero? ;(TC6371AF:BUF1 Data MSBs?)<br />
4004834h 2 ? SD_TRANSACTION_CTL Transaction Control<br />
4004836h 2 ? SD_CARD_INTERRUPT_CONTROL ;4004A36h used in SDIO IRQ handler<br />
4004838h 2 ? SD_CLK_AND_WAIT_CTL ;4004A38h used in SDIO IRQ handler<br />
400483Ah 2 Fixed always zero? ;(SDCTL_SDIO_HOST_INFORMATION)<br />
400483Ch 2 Fixed always zero? ;(SDCTL_ERROR_CONTROL)<br />
400483Eh 2 Fixed always zero? ;(TC6387XB: LED_CONTROL)<br />
4004840h 2 Fixed always 003Fh?<br />
4004842h 2 Fixed always 002Ah?<br />
4004844h 6Eh Fixed always zerofilled?<br />
40048B2h 2 Fixed always FFFFh?<br />
40048B4h 6 Fixed always zerofilled?<br />
40048BAh 2 Fixed always 0200h?<br />
40048BCh 1Ch Fixed always zerofilled?<br />
40048D8h 2 SD_DATA_CTL<br />
40048DAh 6 Fixed always zerofilled?<br />
40048E0h 2 SD_SOFT_RESET Software Reset (bit0=SRST=0=reset)<br />
40048E2h 2 Fixed always 0009h? ;(RESERVED2/9, TC6371AF:CORE_REV)<br />
40048E4h 2 Fixed always zero?<br />
40048E6h 2 Fixed always zero? ;(RESERVED3, TC6371AF:BUF_ADR)<br />
40048E8h 2 Fixed always zero? ;(TC6371AF:Resp_Header)<br />
40048EAh 6 Fixed always zerofilled?<br />
40048F0h 2 Fixed always zero? ;(RESERVED10)<br />
40048F2h 2 ? Can be 0003h<br />
40048F4h 2 ? Can be 0770h<br />
40048F6h 2 ? Firmware tests bit0 (but, always 0?) (RESERVED4)<br />
40048F8h 2 Fixed always 0004h? (nonzero, unlike SDIO) (RESERVED5)<br />
40048FAh 2 ? Can be 0004h..0007h (nonzero, unlike SDIO) (RESERVED6)<br />
40048FCh 2 ? Can be 0024h..00FFh? (RESERVED7)<br />
40048FEh 2 ? Can be 0024h..00FFh? (RESERVED8 / TC6371AF:Revision)<br />
4004900h 2 SD_DATA32_IRQ<br />
4004902h 2 Fixed always zero?<br />
4004904h 2 SD_DATA32_BLK_LEN<br />
4004906h 2 Fixed always zero?<br />
4004908h 2 SD_DATA32_BLK_COUNT<br />
400490Ah 2 Fixed always zero?<br />
400490Ch 4 SD_DATA32_FIFO<br />
4004910h F0h Fixed always zerofilled?<br />
'''ARM7 DSi SD/MMC Registers for SDIO access (for Atheros Wifi)'''<br />
4004A00h 200h SDIO_xxx (same as SD_xxx at 4004800h..40049FFh, see there)<br />
4004A02h 2 SDIO_CARD_PORT_SELECT (slightly different than 4004802h)<br />
4004AF8h 2 Fixed always zero? (unlike SD_xxx at 40048F8h) (RESERVED5)<br />
4004AFAh 2 Fixed always zero? (unlike SD_xxx at 40048FAh) (RESERVED6)<br />
<br />
== DSi SD/MMC I/O Ports: Command/Param/Response/Data ==<br />
<br />
===4004800h/4004A00h - SD_CMD - Command and Response/Data Type (R/W)===<br />
15 undoc Unknown/undoc (read/write-able)<br />
14 undoc Security Cmd? (0=Normal, 1=Whatever/Security?) (sdio?)<br />
13 undoc Data Length (0=Single Block, 1=Multiple Blocks)<br />
12 undoc Data Direction (0=Write, 1=Read)<br />
11 NTDT Data Transfer (0=No data, 1=With data)<br />
10-8 REP2-0 Response Type (0=Auto, 1..2=Unknown/Reserved, 3=None, 4=48bit,<br />
5=48bit+Busy, 6=136bit, 7=48bitOcrWithoutCRC7)<br />
7-6 CMD1-0 Command Type (0=CMD, 1=ACMD, 2..3=unknown, maybe GEN WR/RD?)<br />
5-0 CIX Command Index (0..3Fh, command index)<br />
Setting Command Type to "ACMD" is automatically sending an APP_CMD prefix prior to the command number. For Multiple Blocks, the hardware supports automatically sending STOP_TRANSMISSION after the last block.<br><br />
DSi software is usually setting Response Type to "Auto", which is causing the hardware to use the correct response/data type for standard SD/MMC commands (bit11-13 are ignored/should be zero when using "Auto"; and maybe same for bit14-15?).<br><br />
One exception is that the DSi firmware isn't using "Auto" for SDIO commands (maybe the hardware isn't aware of them; or it's unable to distinguish between read/write direction of CMD53, which would require examining the command's PARAM bits).<br><br />
There might be subtle differences between some SD and MMC commands, unknown if/how "Auto" is working in that cases; unknown if there's a SD-or-MMC mode select bit for that purpose in some configuration register.<br><br />
Invalid values can cause ILA error (particulary on setting NTDT for CMD12, or for CMD's Response=None). ILA error will also occur if an old CMD is still busy.<br />
<br />
===4004804h/4004A04h - SD_CMD_PARAM0-1 - Argument (32bit, 2 halfwords) (R/W)===<br />
31-0 Parameter value for CMD<br />
The parameter value should be written <before> sending the command via SD_CMD/SDIO_CMD.<br />
<br />
===400480Ch/4004A0Ch - SD_RESPONSE0-7 - Response (128bit, 8 halfwords) (R)===<br />
After sending a command, wait for the CMDRESPEND bit (IRQ_STATUS.bit0) to get<br />
set, then read the RESPONSE (if the command does have any response).<br />
For normal 32bit responses:<br />
31-0 Response<br />
127-32 Older Responses<br />
For CID/CSD responses:<br />
119-0 120bit Response<br />
127-120 Zero (always?)<br />
Seems to be left-shifted when receiving response bits. So, for 32bit responses, bit0-31 would contain the current response, and bit32-127 would contain older responses.<br />
<br />
===DATA16 vs DATA32===<br />
Data can be transferred in 16bit or 32bit units (as selected in DATA_CTL.bit1 and DATA32_IRQ.bit1). There are separate data, block len, and block count registers for 16bit and 32bit mode (that's probably due to some odd patchwork, where the manufacturer has added 32bit support to the original 16bit chip design).<br><br />
Naturally, a 32bit transfer is faster than two 16bit transfers. Nethertheless, the DSi firmware does use both 32bit and 16bit mode once and then; 32bit mode is required for NDMA transfers (which don't support 16bit).<br />
<br />
===40048D8h/4004AD8h - SD_DATA_CTL===<br />
15-13 Unknown (usually 0)<br />
12 Unknown (usually 1) (R?)<br />
11-6 Unknown (usually 0)<br />
5 Unknown (read/write-able) (usually 0) (R/W)<br />
4 Unknown (usually 1) (R?)<br />
3-2 Unknown (usually 0)<br />
1 Select 16bit/32bit Data Mode (0=DATA16, 1=DATA32, see 4004900h) (R/W)<br />
0 Unknown (usually 0)<br />
Known written values are 0000h and 0002h. However, known read values are 1010h and 1012h.<br><br />
DATA32 mode requires setting both 40048D8h.bit1 and 4004900h.bit1. For DATA16 mode, both bits should be zero (though DATA16 seems to be also working the same way when only either of the bits is zero).<br />
<br />
===400480Ah/4004A0Ah - SD_DATA16_BLK_COUNT - "Transfer Block Count" (R/W)===<br />
===4004908h/4004B08h - SD_DATA32_BLK_COUNT (R/W)===<br />
15-0 Number of Data Blocks for multiple read/write commands (0..FFFFh)<br />
In Data32 mode, DATA32_BLK_COUNT is decremented after each block (except after the last block, where it stays at 0001h instead of getting zero). In Data16 mode, SD_DATA16_BLK_COUNT doesn't decrease (instead, there must be some hidden internal counter register).<br><br />
If enabled in STOP_INTERNAL_ACTION.bit8, then the hardware will be automatically sending STOP_TRANSMISSION (CMD12) after the last block (otherwise the decrement occurs as described above, but the hardware keeps transferring blocks infinitely).<br />
<br />
===4004826h/4004A26h - SD_DATA16_BLK_LEN - Transfer Data Length (R/W)===<br />
===4004904h/4004B04h - SD_DATA32_BLK_LEN (R/W)===<br />
15-10 Unknown/unused (appears to be always zero)<br />
9-0 Data Block Length in bytes (for DATA16: clipped to max 0200h by hw)<br />
Should be usually 0200h (for 512-byte SD/MMC memory blocks). Other values may be needed for SDIO functions, or when accessing SSR/SCR/PWD registers via data transfers.<br><br />
DATA32_BLK_LEN can be max 3FFh (unlike DATA16_BLK_LEN which is clipped to<br />
max=200h by hardware).<br />
<br />
===4004830h/4004A30h - SD_DATA16_FIFO - Data Port (SD_FIFO?)===<br />
===400490Ch/4004B0Ch - SD_DATA32_FIFO===<br />
For Data16:<br />
15-0 Data (16bit) (...or could it be accessed as 32bit, too?)<br />
For Data32:<br />
31-0 Data (32bit) (...or could it be accessed as 16bit, too?)<br />
Transfer data here (read after RXRDY gets set, or write after TXRQ gets set).<br />
FIFO size is unknown (if there's any FIFO behind it).<br />
<br />
== DSi SD/MMC I/O Ports: Interrupt/Status ==<br />
<br />
===400481Ch/4004A1Ch - SD_IRQ_STATUS0-1 - Interrupt Status (R/ack)===<br />
===4004820h/4004A20h - SD_IRQ_MASK0-1 - Interrupt Mask (R/W)===<br />
The IRQ_STATUS registers contain acknowledge-able IRQ Flags (those bits that that are maskable in IRQ_MASK register), as well as static read-only status bits without IRQ function (eg. WRPROTECT).<br />
*IRQ Flags/Write (0=Acknowledge, 1=No change)<br />
*IRQ Flags/Read (0=No IRQ, 1=IRQ)<br />
*IRQ Mask (0=Enable, 1=Disable) (8B7F031Dh when all IRQs disabled)<br />
Bit Stat Mask Function<br />
0 SREP MREP CMDRESPEND (response end) (or R1b: busy end)<br />
1 0 0 Unknown/unused (always 0)<br />
2 SRWA MRWA DATAEND (set after (last) data block end)<br />
3 SCOT MCOT CARD_REMOVE (0=No event, 1=Is/was newly ejected) ;\<br />
4 SCIN MCIN CARD_INSERT (0=No event, 1=Is/was newly inserted) ; SD<br />
5 undoc 0 SIGSTATE (0=Ejected, 1=Inserted) (SDIO: always 1) ; Slot<br />
6 0 0 Unknown/unused (always 0) ; Sw's<br />
7 undoc 0 WRPROTECT (0=Locked/Ejected, 1=Unlocked/HalfEjected);/<br />
8 undoc undoc CARD_REMOVE_A (0=No event, 1=High-to-Low occurred) ;\SD<br />
9 undoc undoc CARD_INSERT_A (0=No event, 1=Low-to-High óccurred) ; Slot<br />
10 undoc 0 SIGSTATE_A (usually 1=High) ;also as so for SDIO ;/Data3<br />
11 0 0 Unknown/unused (always 0)<br />
12 0 0 Unknown/unused (always 0)<br />
13 0 0 Unknown/unused (always 0)<br />
14 0 0 Unknown/unused (always 0)<br />
15 0 0 Unknown/unused (always 0)<br />
16 SCIX MCIX CMD_IDX_ERR Bad CMD-index in response (RCMDE,SCMDE)<br />
17 SCRC MCRC CRCFAIL CRC response error (WCRCE,RCRCE,SCRCE,CCRCE)<br />
18 SEND MEND STOPBIT_ERR End bit error (WEBER,REBER,SEBER,CEBER)<br />
19 SDTO MDTO DATATIMEOUT Data Timeout (NRCS,NWCS,KBSY)<br />
20 SFOF MFOF RXOVERFLOW HOST tried write full<br />
21 SFUF MFUF TXUNDERRUN HOST tried read empty<br />
22 SCTO MCTO CMDTIMEOUT Response start-bit timeout (NRS,NSR)<br />
23 ??? 0 Unknown/undoc (usually set) (zero after sending TX data?)<br />
24 SBRE MBRE RXRDY (fifo not empty) (request data read)<br />
25 SBWE MBWE TXRQ (datafifoempty?) (request data write)<br />
26 0 0 Unknown/unused (always 0)<br />
27 undoc undoc Unknown/undoc (bit27 is mask-able in IRQ_MASK)<br />
28 0 0 Unknown/unused (always 0)<br />
29 undoc 0 CMD_READY? (inverse of BUSY?) (unlike toshiba ILFSL/IFSMSK)<br />
30 undoc 0 CMD_BUSY<br />
31 ILA IMSK Illegal Command Access (old CMD still busy, or wrong NTDT)<br />
Normally, IRQs should be acknowledged by writing "FLAGS=NOT X", whilst the firmware is using an unstable "FLAGS=FLAGS AND NOT X" read-modify-write function (accidentally acknowledging any IRQs that have newly occurred during that operation).<br />
<br />
===4004900h/4004B00h - SD_DATA32_IRQ===<br />
15-13 Unknown/unused (appears to be always zero)<br />
12 DATA32_BUSY IRQ Enable (0=Disable, 1=Enable) (R/W)<br />
11 DATA32_RXRDY IRQ Enable (0=Disable, 1=Enable) (R/W)<br />
10 DATA32 Abort/Flush FIFO? (0=No change, 1=Clear Bit8,9) (W)<br />
9 DATA32_BUSY IRQ Flag (auto cleared after...) (R)<br />
8 DATA32_RXRDY IRQ Flag (auto cleared after...) (R)<br />
7-2 Unknown/unused (appears to be always zero)<br />
1 Select 16bit/32bit Data Mode (0=DATA16, 1=DATA32, see 40048D8h) (R/W)<br />
0 Unknown/unused (appears to be always zero)<br />
Can be 1A02h, but changes to 1802h after reading from somewhere (maybe from DATA32_FIFO?).<br><br />
Bit8,9 are extra IRQ flags, the flags get set ONLY in DATA32 mode (not in DATA16 mode).<br />
<br />
===400482Ch/4004A2Ch - SD_ERROR_DETAIL_STATUS0-1 - Error Detail Status===<br />
This register contains extra info about the error bits in SD_IRQ_STATUS. The error bits (except bit13/always set) are automatically cleared when sending a new command by writing to SD_CMD.<br />
31-23 0 Unknown/unused (always zero)<br />
22 KBSY Timeout for CRC status busy ;\STAT.19<br />
21 NWCS Timeout for CRC status (can occur for Data Write) ; (SDTO)<br />
20 NRCS Timeout for Data start-bit, or for Post Data Busy ;/<br />
19-18 0 Unknown/unused (always zero)<br />
17 NRS Response Timeout for auto-issued CMD12 ;\STAT.22<br />
16 NCR Response Timeout for non-auto-issued CMD's ;/(SCTO)<br />
15-14 0 Unknown/unused (always zero)<br />
13 undoc Unknown/undoc (always 1) ;-Always 1<br />
12 0 Unknown/unused (always zero)<br />
11 WCRCE CRC error for Write CRC status for a write command ;\<br />
10 RCRCE CRC error for Read Data ; STAT.17<br />
9 SCRCE CRC error for a Response for auto-issued CMD12 ; (SCRC)<br />
8 CCRCE CRC error for a Response for non-auto-issued CMD's ;/<br />
5 WEBER End bit error for Write CRC status ;\<br />
4 REBER End bit error for Read Data ; STAT.18<br />
3 SEBER End bit error for Response for auto-issued CMD12 ; (SEND)<br />
2 CEBER End bit error for Response for non-auto-issued CMD's ;/<br />
1? SCMDE Bad CMD-index in Response of auto-issued CMD12 ;\STAT.16<br />
0 RCMDE Bad CMD-index in Response of non-auto-issued CMD's ;/(SCIX)<br />
Note: CMD12 is STOP_TRANSMISSION (automatically sent after BLK_COUNT blocks).<br><br />
The four "auto-issued CMD12" bits exist for SD registers only (not for SDIO, going by old toshiba datasheets; which may be wrong).<br />
SCMDE is probably in bit1 (though, official specs say bit0, which would be same as RCMDE).<br><br />
Some error bits can be intentionally provoked: Bit8=1 when programming the controller to expect GET_STATUS to return a 136bit response. Bit16=1 when sending GET_CID in "tran" state. Bit20=1 when sending GET_STATUS configured to expect a data/read reply. Bit21=1 when sending GET_STATUS configured to expect a data/write block (and with actually sending a data block to it).<br />
<br />
== DSi SD/MMC I/O Ports: Control Registers ==<br />
<br />
===4004802h/4004A02h - SD_CARD_PORT_SELECT===<br />
15-11 Unknown/unused (appears to be always zero)<br />
10 Unknown (write: should be 1, read: usually/always 0) (W?)<br />
9 Unknown (write: should be 0, read: usually 1 for SD) (R?)<br />
8 Unknown (write: should be 0, read: usually 1 for SDIO) (R?)<br />
7-4 Unknown/unused (appears to be always zero)<br />
3-1 Unknown (R/W)<br />
0 Port Select (0=SD Card Slot, 1=Onboard eMMC) (for SDIO: Unknown)(R/W)<br />
<br />
===4004828h/4004A28h - SD_CARD_OPTION - Card Option Setup===<br />
15 Bus Width (0=4bit, 1=1bit) (R/W)<br />
14 Unknown (usually set) (R?)<br />
13-9 Unknown/unused (appears to be always zero)<br />
8 Unknown (firmware toggles this after CLK change?) (W?)<br />
7-4 Unknown, maybe some 4bit timing/timeout value (R/W)<br />
0-3 Unknown, maybe another 4bit timing/timeout value (R/W)<br />
Among others, this register should contain a 4bit timeout setting, "RTO[3:0] for SD (aka TO[3:0] for SDIO) timeout period for data start/busy bits, in the form of a multiple number of the SDCLK period."<br><br />
Unknown which "multiple numbers" that's referring to (probably some exponential/table values).<br><br />
Settings spotted on DSi are 40E0h,40EEh.<br />
<br />
===4004824h/4004A24h - SD_CARD_CLK_CTL Card Clock Control===<br />
15-11 Unknown (always 0) ;unlike Toshiba: no HCLK divider-disable in bit15)<br />
10 Unknown (0=Normal, 1=Unknown, doesn't affect SDCLK output?) (R/W)<br />
9 Unknown (0=Normal, 1=Unknown, freezes SDCLK output?) (R/W)<br />
8 SDCLK Enable (0=Force SDCLK=LOW, 1=Output SDCLK=HCLK/n) (R/W)<br />
7-0 HCLK Div (0,1,2,4,8,16,32,64,128 = Div2,4,8,16,32,64,128,256,512) (R/W)<br />
The DSi uses HCLK=33.513982 MHz, the SDCLK pin can range from HCLK/512=65kHz to HCLK/2=16.757MHz, max transfer rate would be thus 8MByte/s in 4bit mode.<br><br />
Card detection should be done at a low clock rate. For SD/MMC, the DSi starts with HCLK/128, and uses the clock specified in CSD register after detection (when extracting bits from CSD: mind the different 120bit-without-CRC vs 128bit-with-CRC notations). For SDIO, the DSi starts with HCLK/256, and switches to HCLK/2 after reading SDIO Bus Speed register (Function0:00013h).<br><br />
The SDCLK pins are permanently pulsed, even for devices deselected via SD_CARD_PORT_SELECT.0, and even if no CMD or DATA is being transferred. However, the DSi firmware is usually stopping SDCLK via Bit8=0 when not accessing SD/MMC (doing so may reduce noise and power consumption).<br><br />
Trying to set bit9, or to set more than one bit in bit7-0 will freeze the SDCLK output (in this case SDCLK may get stuck HIGH or LOW, unlike Bit8=0 which forces LOW).<br />
<br />
===4004808h/4004A08h - SD_STOP_INTERNAL_ACTION===<br />
15-9 Unknown/unused (appears to be always zero)<br />
8 Auto-Stop (1=Automatically send CMD12 after BLK_COUNT blocks) (R/W)<br />
7-1 Unknown/unused (appears to be always zero)<br />
0 Unknown (R/W)<br />
Stop whatever internal action for whatever purpose in whatever situation?<br><br />
Existing code does set bit8 (prior to changing SD_DATA16_BLK_COUNT).<br><br />
Existing code does clear bit0 (alongsides with IRQ enable/acknowlege or so).<br><br />
<br />
===40048E0h/4004AE0h - SD_SOFT_RESET - Software Reset===<br />
15-3 Unknown/unused (appears to be always zero)<br />
2 Unknown (always 1) (R?)<br />
1 Unknown (always 1) (though firmware tries to toggle this bit) (R?)<br />
0 SRST Soft Reset (0=Reset, 1=Release) (R/W)<br />
Software should apply reset after sensing card insertion/removal, and (thereafter) release reset in case of card insertion. Software reset does acknowledge all IRQs (except that from SDIO /IRQ pin?), and does probably also reinitialize some other registers.<br><br />
Clearing bit0 does force following settings (while and as long as Bit0=0):<br />
SD_STOP_INTERNAL_ACTION = 0000h<br />
SD_RESPONSE0-7 = zerofilled<br />
SD_IRQ_STATUS0-1 = all IRQs flags acknowledged<br />
SD_CARD_CLK_CTL = bit 8 and 10 cleared<br />
SD_CARD_OPTION = 40EEh<br />
SD_CARD_INTERRUPT_CONTROL = 0000h<br />
All other registers seem to be left unaffected (including the the extra IRQ flags in 4004900h); though there may be some further hidden effects (like aborting transfers or resetting internal registers).<br><br />
Note: The DSi firmware does issue reset by toggling both bit0 and bit1, although bit1 does seem to be read-only (always 1), and trying to clear that bit doesn't seem to have any effect at all.<br />
<br />
== DSi SD/MMC I/O Ports: Unknown/Unused Registers ==<br />
<br />
===40048F6h/4004AF6h - Firmware tests bit0 (but, always 0?) (RESERVED4)===<br />
15-1 Unknown (0)<br />
0 Unknown (tested by firmware) (usually 0) (R)<br />
<br />
===4004836h/4004A36h - SD_CARD_INTERRUPT_CONTROL ---- USED by SDIO===<br />
4004A36h is used in SDIO IRQ handler.<br><br />
On DSi, this register looks as so:<br />
15-2 Unknown (0)<br />
1 Unknown (gets set automatically after 2 seconds?) (and also R/W ?)<br />
0 Unknown (usually always 0) (tested by firmware?) (R?)<br />
Whilst old toshiba datasheets specify it as so:<br />
15-13 ? Unknown (zero on DSi)<br />
12 CINT0 SDIO Interrupt Flag (0=none/ack, 1=irq) (/IRQ aka Data1 pin)<br />
11-9 ? Unknown (zero on DSi)<br />
8 CIMSK0 SDIO Interrupt Mask (0=enable, 1=disable) (/IRQ aka Data1 pin)<br />
7-0 ? Unknown (zero on DSi)<br />
Acknowledge by writing CINT0=0, or CIMSK0=1 (uh, really?), or hard reset (unlike as for other SD/MMC interrupts, soft reset does not acknowlege this interrupt type?).<br />
<br />
===4004838h/4004A38h - SDCTL_CLK_AND_WAIT_CTL ---- USED by SDIO===<br />
4004A38h is used in SDIO IRQ handler.<br><br />
On DSi, this register looks as so (usually zero):<br />
15-14 Unknown (usually 0) (R/W)<br />
13-3 Unknown (0)<br />
2-0 Unknown (usually 0) (R/W)<br />
Whilst old toshiba datasheets specify it as so:<br />
15-0 Unknown (bit8 should be set after SD_CARD_CLK_CTL change?)<br />
<br />
Below registers don't seem to be used by existing software...<br />
<br />
===4004834h/4004A34h - SD_TRANSACTION_CTL - Transaction Control===<br />
15-10 Unknown/unused (appears to be always zero)<br />
9-8 Unknown (R/W)<br />
7-3 Unknown/unused (appears to be always zero)<br />
2 Unknown (R/W)<br />
1 Unknown/unused (appears to be always zero)<br />
0 Unknown (R/W)<br />
<br />
===40048F2h/4004AF2h - Can be 0003h===<br />
15-2 Unknown (0)<br />
1-0 Unknown (0..3) (R/W)<br />
<br />
===40048F4h/4004AF4h - Can be 0770h===<br />
15-11 Unknown (0)<br />
10-8 Unknown (0..7) (R/W)<br />
7 Unknown (0)<br />
6-4 Unknown (0..7) (R/W)<br />
3-0 Unknown (0)<br />
<br />
===40048FAh - Can be 0004h..0007h (nonzero, unlike SDIO) (RESERVED6)===<br />
15-3 Unknown (0)<br />
2 Unknown (usually set) (R)<br />
1-0 Unknown (0..3) (R/W? or rather R?)<br />
<br />
===40048FCh/4004AFCh - Can be 0024h..00FFh? (RESERVED7)===<br />
===40048FEh/4004AFEh - Can be 0024h..00FFh? (RESERVED8 / TC6371AF:Revision)===<br />
15-8 Unknown (0)<br />
7-0 Can be 24h..FFh parts (R) and parts (R/W)?<br />
<br />
===Unused Registers with Fixed value (all bits read-only, or write-only)===<br />
400482Ah/4004A2Ah 2 Fixed always zero?<br />
4004832h/4004A32h 2 Fixed always zero? ;(TC6371AF:BUF1 Data MSBs?)<br />
400483Ah/4004A3Ah 2 Fixed always zero? ;(SDCTL_SDIO_HOST_INFORMATION)<br />
400483Ch/4004A3Ch 2 Fixed always zero? ;(SDCTL_ERROR_CONTROL)<br />
400483Eh/4004A3Eh 2 Fixed always zero? ;(TC6387XB: LED_CONTROL)<br />
4004840h/4004A40h 2 Fixed always 003Fh?<br />
4004842h/4004A42h 2 Fixed always 002Ah?<br />
4004844h/4004A44h 6Eh Fixed always zerofilled?<br />
40048B2h/4004AB2h 2 Fixed always FFFFh?<br />
40048B4h/4004AB4h 6 Fixed always zerofilled?<br />
40048BAh/4004ABAh 2 Fixed always 0200h?<br />
40048BCh/4004ABCh 1Ch Fixed always zerofilled?<br />
40048DAh/4004ADAh 6 Fixed always zerofilled?<br />
40048E2h/4004AE2h 2 Fixed always 0009h? ;(RESERVED2/9, TC6371AF:CORE_REV)<br />
40048E4h/4004AE4h 2 Fixed always zero?<br />
40048E6h/4004AE6h 2 Fixed always zero? ;(RESERVED3, TC6371AF:BUF_ADR)<br />
40048E8h/4004AE8h 2 Fixed always zero? ;(TC6371AF:Resp_Header)<br />
40048EAh/4004AEAh 6 Fixed always zerofilled?<br />
40048F0h/4004AF0h 2 Fixed always zero? ;(RESERVED10)<br />
40048F8h 2 Fixed always 0004h? (unlike SDIO) (RESERVED5)<br />
4004AF8h 2 Fixed always zero? (unlike SD) (RESERVED5)<br />
4004AFAh 2 Fixed always zero? (unlike SD) (RESERVED6)<br />
4004902h/4004B02h 2 Fixed always zero?<br />
4004906h/4004B06h 2 Fixed always zero?<br />
400490Ah/4004B0Ah 2 Fixed always zero?<br />
4004910h/4004B10h F0h Fixed always zerofilled?<br />
<br />
== Links ==<br />
* [http://gbatemp.net/threads/dsi-reverse-engineering-sd-mmc-sdio-registers.395787/ DSi SD/MMC reverse engineering thread in gbatemp forum]</div>Nocashhttps://dsibrew.org/w/index.php?title=SD/MMC/SDIO_Registers&diff=2098820SD/MMC/SDIO Registers2015-09-02T10:43:22Z<p>Nocash: /* 4004820h/4004A20h - SD_IRQ_MASK0-1 - Interrupt Mask (R/W) */</p>
<hr />
<div>SD_xxx is used to access onboard eMMC and external SD card slot (as selected via SD_CARD_PORT_SELECT).<br><br />
SDIO_xxx is used to access the Atheros Wifi unit.<br />
<br />
== DSi SD/MMC I/O Map ==<br />
<br />
'''ARM7 DSi SD/MMC Registers for Memory Card access (SD Card and onboard eMMC)'''<br />
4004800h 2 SD_CMD Command and Response/Data Type<br />
4004802h 2 SD_CARD_PORT_SELECT (SD/MMC:020Fh, SDIO:010Fh)<br />
4004804h 4 SD_CMD_PARAM0-1 Argument (32bit, 2 halfwords)<br />
4004808h 2 SD_STOP_INTERNAL_ACTION<br />
400480Ah 2 SD_DATA16_BLK_COUNT "Transfer Block Count"<br />
400480Ch 16 SD_RESPONSE0-7 (128bit, 8 halfwords)<br />
400481Ch 4 SD_IRQ_STATUS0-1 ;IRQ Status (0=ack, 1=req)<br />
4004820h 4 SD_IRQ_MASK0-1 ;IRQ Disable (0=enable, 1=disable)<br />
4004824h 2 SD_CARD_CLK_CTL Card Clock Control<br />
4004826h 2 SD_DATA16_BLK_LEN Memory Card Transfer Data Length<br />
4004828h 2 SD_CARD_OPTION Memory Card Option Setup (can be C0FFh)<br />
400482Ah 2 Fixed always zero?<br />
400482Ch 4 SD_ERROR_DETAIL_STATUS0-1 Error Detail Status<br />
4004830h 2 SD_DATA16_FIFO Data Port (SD_FIFO?)<br />
4004832h 2 Fixed always zero? ;(TC6371AF:BUF1 Data MSBs?)<br />
4004834h 2 ? SD_TRANSACTION_CTL Transaction Control<br />
4004836h 2 ? SD_CARD_INTERRUPT_CONTROL ;4004A36h used in SDIO IRQ handler<br />
4004838h 2 ? SD_CLK_AND_WAIT_CTL ;4004A38h used in SDIO IRQ handler<br />
400483Ah 2 Fixed always zero? ;(SDCTL_SDIO_HOST_INFORMATION)<br />
400483Ch 2 Fixed always zero? ;(SDCTL_ERROR_CONTROL)<br />
400483Eh 2 Fixed always zero? ;(TC6387XB: LED_CONTROL)<br />
4004840h 2 Fixed always 003Fh?<br />
4004842h 2 Fixed always 002Ah?<br />
4004844h 6Eh Fixed always zerofilled?<br />
40048B2h 2 Fixed always FFFFh?<br />
40048B4h 6 Fixed always zerofilled?<br />
40048BAh 2 Fixed always 0200h?<br />
40048BCh 1Ch Fixed always zerofilled?<br />
40048D8h 2 SD_DATA_CTL<br />
40048DAh 6 Fixed always zerofilled?<br />
40048E0h 2 SD_SOFT_RESET Software Reset (bit0=SRST=0=reset)<br />
40048E2h 2 Fixed always 0009h? ;(RESERVED2/9, TC6371AF:CORE_REV)<br />
40048E4h 2 Fixed always zero?<br />
40048E6h 2 Fixed always zero? ;(RESERVED3, TC6371AF:BUF_ADR)<br />
40048E8h 2 Fixed always zero? ;(TC6371AF:Resp_Header)<br />
40048EAh 6 Fixed always zerofilled?<br />
40048F0h 2 Fixed always zero? ;(RESERVED10)<br />
40048F2h 2 ? Can be 0003h<br />
40048F4h 2 ? Can be 0770h<br />
40048F6h 2 ? Firmware tests bit0 (but, always 0?) (RESERVED4)<br />
40048F8h 2 Fixed always 0004h? (nonzero, unlike SDIO) (RESERVED5)<br />
40048FAh 2 ? Can be 0004h..0007h (nonzero, unlike SDIO) (RESERVED6)<br />
40048FCh 2 ? Can be 0024h..00FFh? (RESERVED7)<br />
40048FEh 2 ? Can be 0024h..00FFh? (RESERVED8 / TC6371AF:Revision)<br />
4004900h 2 SD_DATA32_IRQ<br />
4004902h 2 Fixed always zero?<br />
4004904h 2 SD_DATA32_BLK_LEN<br />
4004906h 2 Fixed always zero?<br />
4004908h 2 SD_DATA32_BLK_COUNT<br />
400490Ah 2 Fixed always zero?<br />
400490Ch 4 SD_DATA32_FIFO<br />
4004910h F0h Fixed always zerofilled?<br />
'''ARM7 DSi SD/MMC Registers for SDIO access (for Atheros Wifi)'''<br />
4004A00h 200h SDIO_xxx (same as SD_xxx at 4004800h..40049FFh, see there)<br />
4004A02h 2 SDIO_CARD_PORT_SELECT (slightly different than 4004802h)<br />
4004AF8h 2 Fixed always zero? (unlike SD_xxx at 40048F8h) (RESERVED5)<br />
4004AFAh 2 Fixed always zero? (unlike SD_xxx at 40048FAh) (RESERVED6)<br />
<br />
== DSi SD/MMC I/O Ports: Command/Param/Response/Data ==<br />
<br />
===4004800h/4004A00h - SD_CMD - Command and Response/Data Type (R/W)===<br />
15 undoc Unknown/undoc (read/write-able)<br />
14 undoc Security Cmd? (0=Normal, 1=Whatever/Security?) (sdio?)<br />
13 undoc Data Length (0=Single Block, 1=Multiple Blocks)<br />
12 undoc Data Direction (0=Write, 1=Read)<br />
11 NTDT Data Transfer (0=No data, 1=With data)<br />
10-8 REP2-0 Response Type (0=Auto, 1..2=Unknown/Reserved, 3=None, 4=48bit,<br />
5=48bit+Busy, 6=136bit, 7=48bitOcrWithoutCRC7)<br />
7-6 CMD1-0 Command Type (0=CMD, 1=ACMD, 2..3=unknown, maybe GEN WR/RD?)<br />
5-0 CIX Command Index (0..3Fh, command index)<br />
Setting Command Type to "ACMD" is automatically sending an APP_CMD prefix prior to the command number. For Multiple Blocks, the hardware supports automatically sending STOP_TRANSMISSION after the last block.<br><br />
DSi software is usually setting Response Type to "Auto", which is causing the hardware to use the correct response/data type for standard SD/MMC commands (bit11-13 are ignored/should be zero when using "Auto"; and maybe same for bit14-15?).<br><br />
One exception is that the DSi firmware isn't using "Auto" for SDIO commands (maybe the hardware isn't aware of them; or it's unable to distinguish between read/write direction of CMD53, which would require examining the command's PARAM bits).<br><br />
There might be subtle differences between some SD and MMC commands, unknown if/how "Auto" is working in that cases; unknown if there's a SD-or-MMC mode select bit for that purpose in some configuration register.<br><br />
Invalid values can cause ILA error (particulary on setting NTDT for CMD12, or for CMD's Response=None). ILA error will also occur if an old CMD is still busy.<br />
<br />
===4004804h/4004A04h - SD_CMD_PARAM0-1 - Argument (32bit, 2 halfwords) (R/W)===<br />
31-0 Parameter value for CMD<br />
The parameter value should be written <before> sending the command via SD_CMD/SDIO_CMD.<br />
<br />
===400480Ch/4004A0Ch - SD_RESPONSE0-7 - Response (128bit, 8 halfwords) (R)===<br />
After sending a command, wait for the CMDRESPEND bit (IRQ_STATUS.bit0) to get<br />
set, then read the RESPONSE (if the command does have any response).<br />
For normal 32bit responses:<br />
31-0 Response<br />
127-32 Older Responses<br />
For CID/CSD responses:<br />
119-0 120bit Response<br />
127-120 Zero (always?)<br />
Seems to be left-shifted when receiving response bits. So, for 32bit responses, bit0-31 would contain the current response, and bit32-127 would contain older responses.<br />
<br />
===DATA16 vs DATA32===<br />
Data can be transferred in 16bit or 32bit units (as selected in DATA_CTL.bit1 and DATA32_IRQ.bit1). There are separate data, block len, and block count registers for 16bit and 32bit mode (that's probably due to some odd patchwork, where the manufacturer has added 32bit support to the original 16bit chip design).<br><br />
Naturally, a 32bit transfer is faster than two 16bit transfers. Nethertheless, the DSi firmware does use both 32bit and 16bit mode once and then; 32bit mode is required for NDMA transfers (which don't support 16bit).<br />
<br />
===40048D8h/4004AD8h - SD_DATA_CTL===<br />
15-13 Unknown (usually 0)<br />
12 Unknown (usually 1) (R?)<br />
11-6 Unknown (usually 0)<br />
5 Unknown (read/write-able) (usually 0) (R/W)<br />
4 Unknown (usually 1) (R?)<br />
3-2 Unknown (usually 0)<br />
1 Select 16bit/32bit Data Mode (0=DATA16, 1=DATA32, see 4004900h) (R/W)<br />
0 Unknown (usually 0)<br />
Known written values are 0000h and 0002h. However, known read values are 1010h and 1012h.<br><br />
DATA32 mode requires setting both 40048D8h.bit1 and 4004900h.bit1. For DATA16 mode, both bits should be zero (though DATA16 seems to be also working the same way when only either of the bits is zero).<br />
<br />
===400480Ah/4004A0Ah - SD_DATA16_BLK_COUNT - "Transfer Block Count" (R/W)===<br />
===4004908h/4004B08h - SD_DATA32_BLK_COUNT (R/W)===<br />
15-0 Number of Data Blocks for multiple read/write commands (0..FFFFh)<br />
In Data32 mode, DATA32_BLK_COUNT is decremented after each block (except after the last block, where it stays at 0001h instead of getting zero). In Data16 mode, SD_DATA16_BLK_COUNT doesn't decrease (instead, there must be some hidden internal counter register).<br><br />
If enabled in STOP_INTERNAL_ACTION.bit8, then the hardware will be automatically sending STOP_TRANSMISSION (CMD12) after the last block (otherwise the decrement occurs as described above, but the hardware keeps transferring blocks infinitely).<br />
<br />
===4004826h/4004A26h - SD_DATA16_BLK_LEN - Transfer Data Length (R/W)===<br />
===4004904h/4004B04h - SD_DATA32_BLK_LEN (R/W)===<br />
15-10 Unknown/unused (appears to be always zero)<br />
9-0 Data Block Length in bytes (for DATA16: clipped to max 0200h by hw)<br />
Should be usually 0200h (for 512-byte SD/MMC memory blocks). Other values may be needed for SDIO functions, or when accessing SSR/SCR/PWD registers via data transfers.<br><br />
DATA32_BLK_LEN can be max 3FFh (unlike DATA16_BLK_LEN which is clipped to<br />
max=200h by hardware).<br />
<br />
===4004830h/4004A30h - SD_DATA16_FIFO - Data Port (SD_FIFO?)===<br />
===400490Ch/4004B0Ch - SD_DATA32_FIFO===<br />
For Data16:<br />
15-0 Data (16bit) (...or could it be accessed as 32bit, too?)<br />
For Data32:<br />
31-0 Data (32bit) (...or could it be accessed as 16bit, too?)<br />
Transfer data here (read after RXRDY gets set, or write after TXRQ gets set).<br />
FIFO size is unknown (if there's any FIFO behind it).<br />
<br />
== DSi SD/MMC I/O Ports: Interrupt/Status ==<br />
<br />
===400481Ch/4004A1Ch - SD_IRQ_STATUS0-1 - Interrupt Status (R/ack)===<br />
===4004820h/4004A20h - SD_IRQ_MASK0-1 - Interrupt Mask (R/W)===<br />
The IRQ_STATUS registers contain acknowledge-able IRQ Flags (those bits that that are maskable in IRQ_MASK register), as well as static read-only status bits without IRQ function (eg. WRPROTECT).<br />
*IRQ Flags/Write (0=Acknowledge, 1=No change)<br />
*IRQ Flags/Read (0=No IRQ, 1=IRQ)<br />
*IRQ Mask (0=Enable, 1=Disable) (8B7F031Dh when all IRQs disabled)<br />
Bit Stat Mask Function<br />
0 SREP MREP CMDRESPEND (response end) (or R1b: busy end)<br />
1 0 0 Unknown/unused (always 0)<br />
2 SRWA MRWA DATAEND (set after (last) data block end)<br />
3 SCOT MCOT CARD_REMOVE (0=No event, 1=Is/was newly ejected) ;\<br />
4 SCIN MCIN CARD_INSERT (0=No event, 1=Is/was newly inserted) ; SD<br />
5 undoc 0 SIGSTATE (0=Ejected, 1=Inserted) (SDIO: always 1) ; Slot<br />
6 0 0 Unknown/unused (always 0) ; Sw's<br />
7 undoc 0 WRPROTECT (0=Locked/Ejected, 1=Unlocked/HalfEjected);/<br />
8 undoc undoc CARD_REMOVE_A (0=No event, 1=High-to-Low occurred) ;\SD<br />
9 undoc undoc CARD_INSERT_A (0=No event, 1=Low-to-High óccurred) ; Slot<br />
10 undoc 0 SIGSTATE_A (usually 1=High) ;also as so for SDIO ;/Data3<br />
11 0 0 Unknown/unused (always 0)<br />
12 0 0 Unknown/unused (always 0)<br />
13 0 0 Unknown/unused (always 0)<br />
14 0 0 Unknown/unused (always 0)<br />
15 0 0 Unknown/unused (always 0)<br />
16 SCIX MCIX CMD_IDX_ERR Bad CMD-index in response (RCMDE,SCMDE)<br />
17 SCRC MCRC CRCFAIL CRC response error (WCRCE,RCRCE,SCRCE,CCRCE)<br />
18 SEND MEND STOPBIT_ERR End bit error (WEBER,REBER,SEBER,CEBER)<br />
19 SDTO MDTO DATATIMEOUT Data Timeout (NRCS,NWCS,KBSY)<br />
20 SFOF MFOF RXOVERFLOW HOST tried write full<br />
21 SFUF MFUF TXUNDERRUN HOST tried read empty<br />
22 SCTO MCTO CMDTIMEOUT Response start-bit timeout (NRS,NSR)<br />
23 ??? 0 Unknown/undoc (usually set) (zero after sending TX data?)<br />
24 SBRE MBRE RXRDY (fifo not empty) (request data read)<br />
25 SBWE MBWE TXRQ (datafifoempty?) (request data write)<br />
26 0 0 Unknown/unused (always 0)<br />
27 undoc undoc Unknown/undoc (bit27 is mask-able in IRQ_MASK)<br />
28 0 0 Unknown/unused (always 0)<br />
29 undoc 0 CMD_READY? (inverse of BUSY?) (unlike toshiba ILFSL/IFSMSK)<br />
30 undoc 0 CMD_BUSY<br />
31 ILA IMSK Illegal Command Access (old CMD still busy, or wrong NTDT)<br />
Normally, IRQs should be acknowledged by writing "FLAGS=NOT X", whilst the firmware is using an unstable "FLAGS=FLAGS AND NOT X" read-modify-write function (accidentally acknowledging any IRQs that have newly occurred during that operation).<br />
<br />
===4004900h/4004B00h - SD_DATA32_IRQ===<br />
15-13 Unknown/unused (appears to be always zero)<br />
12 DATA32_BUSY IRQ Enable (0=Disable, 1=Enable) (R/W)<br />
11 DATA32_RXRDY IRQ Enable (0=Disable, 1=Enable) (R/W)<br />
10 DATA32 Abort/Flush FIFO? (0=No change, 1=Clear Bit8,9) (W)<br />
9 DATA32_BUSY IRQ Flag (auto cleared after...) (R)<br />
8 DATA32_RXRDY IRQ Flag (auto cleared after...) (R)<br />
7-2 Unknown/unused (appears to be always zero)<br />
1 Select 16bit/32bit Data Mode (0=DATA16, 1=DATA32, see 40048D8h) (R/W)<br />
0 Unknown/unused (appears to be always zero)<br />
Can be 1A02h, but changes to 1802h after reading from somewhere (maybe from DATA32_FIFO?).<br><br />
Bit8,9 are extra IRQ flags, the flags get set ONLY in DATA32 mode (not in DATA16 mode).<br />
<br />
===400482Ch/4004A2Ch - SD_ERROR_DETAIL_STATUS0-1 - Error Detail Status===<br />
31-23 ? Unknown/unused/undoc<br />
22 KBSY Timeout for CRC status busy timeout ;\STAT.19<br />
21 NWCS Timeout for CRC status timeout ; (SDTO)<br />
20 NRCS Timeout for Data start-bit, or for Post Data Busy ;/<br />
19-18 ? Unknown/unused/undoc<br />
17 NRS Response timeout for auto-issued CMD12 ;\STAT.22<br />
16 NCR Response timeout for non-auto-issued CMD's ;/(SCTO)<br />
15-14 ? Unknown/unused/undoc<br />
13 ?? Unknown/undoc (bit13 can be nonzero on DSi!) (always 1?) (R?)<br />
12 ? Unknown/unused/undoc<br />
11 WCRCE CRC error for Write CRC status for a write command ;\<br />
10 RCRCE CRC error for read data ; STAT.17<br />
9 SCRCE CRC error for a response for auto-issued CMD12 ; (SCRC)<br />
8 CCRCE CRC error for a response for non-auto-issued CMD's ;/<br />
5 WEBER End bit error for Write CRC status ;\<br />
4 REBER End bit error for read data ; STAT.18<br />
3 SEBER End bit error for response for auto-issued CMD12 ; (SEND)<br />
2 CEBER End bit error for response for non-auto-issued CMD's ;/<br />
1? SCMDE Bad CMD-index in response of auto-issued CMD12 ;\STAT.16<br />
0 RCMDE Bad CMD-index in response of non-auto-issued CMD's ;/(SCIX)<br />
Unknown if/when/how the error bits can be reset/acknowledged.<br><br />
Note: CMD12 is STOP_TRANSMISSION (maybe sent after BLK_COUNT?).<br><br />
The four "auto-issued CMD12" bits exist for SD registers only (not SDIO).<br><br />
SCMDE is probably in bit1 (though, official specs say bit0, which would be same as RCMDE).<br />
<br />
== DSi SD/MMC I/O Ports: Control Registers ==<br />
<br />
===4004802h/4004A02h - SD_CARD_PORT_SELECT===<br />
15-11 Unknown/unused (appears to be always zero)<br />
10 Unknown (write: should be 1, read: usually/always 0) (W?)<br />
9 Unknown (write: should be 0, read: usually 1 for SD) (R?)<br />
8 Unknown (write: should be 0, read: usually 1 for SDIO) (R?)<br />
7-4 Unknown/unused (appears to be always zero)<br />
3-1 Unknown (R/W)<br />
0 Port Select (0=SD Card Slot, 1=Onboard eMMC) (for SDIO: Unknown)(R/W)<br />
<br />
===4004828h/4004A28h - SD_CARD_OPTION - Card Option Setup===<br />
15 Bus Width (0=4bit, 1=1bit) (R/W)<br />
14 Unknown (usually set) (R?)<br />
13-9 Unknown/unused (appears to be always zero)<br />
8 Unknown (firmware toggles this after CLK change?) (W?)<br />
7-4 Unknown, maybe some 4bit timing/timeout value (R/W)<br />
0-3 Unknown, maybe another 4bit timing/timeout value (R/W)<br />
Among others, this register should contain a 4bit timeout setting, "RTO[3:0] for SD (aka TO[3:0] for SDIO) timeout period for data start/busy bits, in the form of a multiple number of the SDCLK period."<br><br />
Unknown which "multiple numbers" that's referring to (probably some exponential/table values).<br><br />
Settings spotted on DSi are 40E0h,40EEh.<br />
<br />
===4004824h/4004A24h - SD_CARD_CLK_CTL Card Clock Control===<br />
15-11 Unknown (always 0) ;unlike Toshiba: no HCLK divider-disable in bit15)<br />
10 Unknown (0=Normal, 1=Unknown, doesn't affect SDCLK output?) (R/W)<br />
9 Unknown (0=Normal, 1=Unknown, freezes SDCLK output?) (R/W)<br />
8 SDCLK Enable (0=Force SDCLK=LOW, 1=Output SDCLK=HCLK/n) (R/W)<br />
7-0 HCLK Div (0,1,2,4,8,16,32,64,128 = Div2,4,8,16,32,64,128,256,512) (R/W)<br />
The DSi uses HCLK=33.513982 MHz, the SDCLK pin can range from HCLK/512=65kHz to HCLK/2=16.757MHz, max transfer rate would be thus 8MByte/s in 4bit mode.<br><br />
Card detection should be done at a low clock rate. For SD/MMC, the DSi starts with HCLK/128, and uses the clock specified in CSD register after detection (when extracting bits from CSD: mind the different 120bit-without-CRC vs 128bit-with-CRC notations). For SDIO, the DSi starts with HCLK/256, and switches to HCLK/2 after reading SDIO Bus Speed register (Function0:00013h).<br><br />
The SDCLK pins are permanently pulsed, even for devices deselected via SD_CARD_PORT_SELECT.0, and even if no CMD or DATA is being transferred. However, the DSi firmware is usually stopping SDCLK via Bit8=0 when not accessing SD/MMC (doing so may reduce noise and power consumption).<br><br />
Trying to set bit9, or to set more than one bit in bit7-0 will freeze the SDCLK output (in this case SDCLK may get stuck HIGH or LOW, unlike Bit8=0 which forces LOW).<br />
<br />
===4004808h/4004A08h - SD_STOP_INTERNAL_ACTION===<br />
15-9 Unknown/unused (appears to be always zero)<br />
8 Auto-Stop (1=Automatically send CMD12 after BLK_COUNT blocks) (R/W)<br />
7-1 Unknown/unused (appears to be always zero)<br />
0 Unknown (R/W)<br />
Stop whatever internal action for whatever purpose in whatever situation?<br><br />
Existing code does set bit8 (prior to changing SD_DATA16_BLK_COUNT).<br><br />
Existing code does clear bit0 (alongsides with IRQ enable/acknowlege or so).<br><br />
<br />
===40048E0h/4004AE0h - SD_SOFT_RESET - Software Reset===<br />
15-3 Unknown/unused (appears to be always zero)<br />
2 Unknown (always 1) (R?)<br />
1 Unknown (always 1) (though firmware tries to toggle this bit) (R?)<br />
0 SRST Soft Reset (0=Reset, 1=Release) (R/W)<br />
Software should apply reset after sensing card insertion/removal, and (thereafter) release reset in case of card insertion. Software reset does acknowledge all IRQs (except that from SDIO /IRQ pin?), and does probably also reinitialize some other registers.<br><br />
Clearing bit0 does force following settings (while and as long as Bit0=0):<br />
SD_STOP_INTERNAL_ACTION = 0000h<br />
SD_RESPONSE0-7 = zerofilled<br />
SD_IRQ_STATUS0-1 = all IRQs flags acknowledged<br />
SD_CARD_CLK_CTL = bit 8 and 10 cleared<br />
SD_CARD_OPTION = 40EEh<br />
SD_CARD_INTERRUPT_CONTROL = 0000h<br />
All other registers seem to be left unaffected (including the the extra IRQ flags in 4004900h); though there may be some further hidden effects (like aborting transfers or resetting internal registers).<br><br />
Note: The DSi firmware does issue reset by toggling both bit0 and bit1, although bit1 does seem to be read-only (always 1), and trying to clear that bit doesn't seem to have any effect at all.<br />
<br />
== DSi SD/MMC I/O Ports: Unknown/Unused Registers ==<br />
<br />
===40048F6h/4004AF6h - Firmware tests bit0 (but, always 0?) (RESERVED4)===<br />
15-1 Unknown (0)<br />
0 Unknown (tested by firmware) (usually 0) (R)<br />
<br />
===4004836h/4004A36h - SD_CARD_INTERRUPT_CONTROL ---- USED by SDIO===<br />
4004A36h is used in SDIO IRQ handler.<br><br />
On DSi, this register looks as so:<br />
15-2 Unknown (0)<br />
1 Unknown (gets set automatically after 2 seconds?) (and also R/W ?)<br />
0 Unknown (usually always 0) (tested by firmware?) (R?)<br />
Whilst old toshiba datasheets specify it as so:<br />
15-13 ? Unknown (zero on DSi)<br />
12 CINT0 SDIO Interrupt Flag (0=none/ack, 1=irq) (/IRQ aka Data1 pin)<br />
11-9 ? Unknown (zero on DSi)<br />
8 CIMSK0 SDIO Interrupt Mask (0=enable, 1=disable) (/IRQ aka Data1 pin)<br />
7-0 ? Unknown (zero on DSi)<br />
Acknowledge by writing CINT0=0, or CIMSK0=1 (uh, really?), or hard reset (unlike as for other SD/MMC interrupts, soft reset does not acknowlege this interrupt type?).<br />
<br />
===4004838h/4004A38h - SDCTL_CLK_AND_WAIT_CTL ---- USED by SDIO===<br />
4004A38h is used in SDIO IRQ handler.<br><br />
On DSi, this register looks as so (usually zero):<br />
15-14 Unknown (usually 0) (R/W)<br />
13-3 Unknown (0)<br />
2-0 Unknown (usually 0) (R/W)<br />
Whilst old toshiba datasheets specify it as so:<br />
15-0 Unknown (bit8 should be set after SD_CARD_CLK_CTL change?)<br />
<br />
Below registers don't seem to be used by existing software...<br />
<br />
===4004834h/4004A34h - SD_TRANSACTION_CTL - Transaction Control===<br />
15-10 Unknown/unused (appears to be always zero)<br />
9-8 Unknown (R/W)<br />
7-3 Unknown/unused (appears to be always zero)<br />
2 Unknown (R/W)<br />
1 Unknown/unused (appears to be always zero)<br />
0 Unknown (R/W)<br />
<br />
===40048F2h/4004AF2h - Can be 0003h===<br />
15-2 Unknown (0)<br />
1-0 Unknown (0..3) (R/W)<br />
<br />
===40048F4h/4004AF4h - Can be 0770h===<br />
15-11 Unknown (0)<br />
10-8 Unknown (0..7) (R/W)<br />
7 Unknown (0)<br />
6-4 Unknown (0..7) (R/W)<br />
3-0 Unknown (0)<br />
<br />
===40048FAh - Can be 0004h..0007h (nonzero, unlike SDIO) (RESERVED6)===<br />
15-3 Unknown (0)<br />
2 Unknown (usually set) (R)<br />
1-0 Unknown (0..3) (R/W? or rather R?)<br />
<br />
===40048FCh/4004AFCh - Can be 0024h..00FFh? (RESERVED7)===<br />
===40048FEh/4004AFEh - Can be 0024h..00FFh? (RESERVED8 / TC6371AF:Revision)===<br />
15-8 Unknown (0)<br />
7-0 Can be 24h..FFh parts (R) and parts (R/W)?<br />
<br />
===Unused Registers with Fixed value (all bits read-only, or write-only)===<br />
400482Ah/4004A2Ah 2 Fixed always zero?<br />
4004832h/4004A32h 2 Fixed always zero? ;(TC6371AF:BUF1 Data MSBs?)<br />
400483Ah/4004A3Ah 2 Fixed always zero? ;(SDCTL_SDIO_HOST_INFORMATION)<br />
400483Ch/4004A3Ch 2 Fixed always zero? ;(SDCTL_ERROR_CONTROL)<br />
400483Eh/4004A3Eh 2 Fixed always zero? ;(TC6387XB: LED_CONTROL)<br />
4004840h/4004A40h 2 Fixed always 003Fh?<br />
4004842h/4004A42h 2 Fixed always 002Ah?<br />
4004844h/4004A44h 6Eh Fixed always zerofilled?<br />
40048B2h/4004AB2h 2 Fixed always FFFFh?<br />
40048B4h/4004AB4h 6 Fixed always zerofilled?<br />
40048BAh/4004ABAh 2 Fixed always 0200h?<br />
40048BCh/4004ABCh 1Ch Fixed always zerofilled?<br />
40048DAh/4004ADAh 6 Fixed always zerofilled?<br />
40048E2h/4004AE2h 2 Fixed always 0009h? ;(RESERVED2/9, TC6371AF:CORE_REV)<br />
40048E4h/4004AE4h 2 Fixed always zero?<br />
40048E6h/4004AE6h 2 Fixed always zero? ;(RESERVED3, TC6371AF:BUF_ADR)<br />
40048E8h/4004AE8h 2 Fixed always zero? ;(TC6371AF:Resp_Header)<br />
40048EAh/4004AEAh 6 Fixed always zerofilled?<br />
40048F0h/4004AF0h 2 Fixed always zero? ;(RESERVED10)<br />
40048F8h 2 Fixed always 0004h? (unlike SDIO) (RESERVED5)<br />
4004AF8h 2 Fixed always zero? (unlike SD) (RESERVED5)<br />
4004AFAh 2 Fixed always zero? (unlike SD) (RESERVED6)<br />
4004902h/4004B02h 2 Fixed always zero?<br />
4004906h/4004B06h 2 Fixed always zero?<br />
400490Ah/4004B0Ah 2 Fixed always zero?<br />
4004910h/4004B10h F0h Fixed always zerofilled?<br />
<br />
== Links ==<br />
* [http://gbatemp.net/threads/dsi-reverse-engineering-sd-mmc-sdio-registers.395787/ DSi SD/MMC reverse engineering thread in gbatemp forum]</div>Nocashhttps://dsibrew.org/w/index.php?title=SD/MMC/SDIO_Registers&diff=2098819SD/MMC/SDIO Registers2015-09-02T10:42:21Z<p>Nocash: /* 4004800h/4004A00h - SD_CMD - Command and Response/Data Type (R/W) */</p>
<hr />
<div>SD_xxx is used to access onboard eMMC and external SD card slot (as selected via SD_CARD_PORT_SELECT).<br><br />
SDIO_xxx is used to access the Atheros Wifi unit.<br />
<br />
== DSi SD/MMC I/O Map ==<br />
<br />
'''ARM7 DSi SD/MMC Registers for Memory Card access (SD Card and onboard eMMC)'''<br />
4004800h 2 SD_CMD Command and Response/Data Type<br />
4004802h 2 SD_CARD_PORT_SELECT (SD/MMC:020Fh, SDIO:010Fh)<br />
4004804h 4 SD_CMD_PARAM0-1 Argument (32bit, 2 halfwords)<br />
4004808h 2 SD_STOP_INTERNAL_ACTION<br />
400480Ah 2 SD_DATA16_BLK_COUNT "Transfer Block Count"<br />
400480Ch 16 SD_RESPONSE0-7 (128bit, 8 halfwords)<br />
400481Ch 4 SD_IRQ_STATUS0-1 ;IRQ Status (0=ack, 1=req)<br />
4004820h 4 SD_IRQ_MASK0-1 ;IRQ Disable (0=enable, 1=disable)<br />
4004824h 2 SD_CARD_CLK_CTL Card Clock Control<br />
4004826h 2 SD_DATA16_BLK_LEN Memory Card Transfer Data Length<br />
4004828h 2 SD_CARD_OPTION Memory Card Option Setup (can be C0FFh)<br />
400482Ah 2 Fixed always zero?<br />
400482Ch 4 SD_ERROR_DETAIL_STATUS0-1 Error Detail Status<br />
4004830h 2 SD_DATA16_FIFO Data Port (SD_FIFO?)<br />
4004832h 2 Fixed always zero? ;(TC6371AF:BUF1 Data MSBs?)<br />
4004834h 2 ? SD_TRANSACTION_CTL Transaction Control<br />
4004836h 2 ? SD_CARD_INTERRUPT_CONTROL ;4004A36h used in SDIO IRQ handler<br />
4004838h 2 ? SD_CLK_AND_WAIT_CTL ;4004A38h used in SDIO IRQ handler<br />
400483Ah 2 Fixed always zero? ;(SDCTL_SDIO_HOST_INFORMATION)<br />
400483Ch 2 Fixed always zero? ;(SDCTL_ERROR_CONTROL)<br />
400483Eh 2 Fixed always zero? ;(TC6387XB: LED_CONTROL)<br />
4004840h 2 Fixed always 003Fh?<br />
4004842h 2 Fixed always 002Ah?<br />
4004844h 6Eh Fixed always zerofilled?<br />
40048B2h 2 Fixed always FFFFh?<br />
40048B4h 6 Fixed always zerofilled?<br />
40048BAh 2 Fixed always 0200h?<br />
40048BCh 1Ch Fixed always zerofilled?<br />
40048D8h 2 SD_DATA_CTL<br />
40048DAh 6 Fixed always zerofilled?<br />
40048E0h 2 SD_SOFT_RESET Software Reset (bit0=SRST=0=reset)<br />
40048E2h 2 Fixed always 0009h? ;(RESERVED2/9, TC6371AF:CORE_REV)<br />
40048E4h 2 Fixed always zero?<br />
40048E6h 2 Fixed always zero? ;(RESERVED3, TC6371AF:BUF_ADR)<br />
40048E8h 2 Fixed always zero? ;(TC6371AF:Resp_Header)<br />
40048EAh 6 Fixed always zerofilled?<br />
40048F0h 2 Fixed always zero? ;(RESERVED10)<br />
40048F2h 2 ? Can be 0003h<br />
40048F4h 2 ? Can be 0770h<br />
40048F6h 2 ? Firmware tests bit0 (but, always 0?) (RESERVED4)<br />
40048F8h 2 Fixed always 0004h? (nonzero, unlike SDIO) (RESERVED5)<br />
40048FAh 2 ? Can be 0004h..0007h (nonzero, unlike SDIO) (RESERVED6)<br />
40048FCh 2 ? Can be 0024h..00FFh? (RESERVED7)<br />
40048FEh 2 ? Can be 0024h..00FFh? (RESERVED8 / TC6371AF:Revision)<br />
4004900h 2 SD_DATA32_IRQ<br />
4004902h 2 Fixed always zero?<br />
4004904h 2 SD_DATA32_BLK_LEN<br />
4004906h 2 Fixed always zero?<br />
4004908h 2 SD_DATA32_BLK_COUNT<br />
400490Ah 2 Fixed always zero?<br />
400490Ch 4 SD_DATA32_FIFO<br />
4004910h F0h Fixed always zerofilled?<br />
'''ARM7 DSi SD/MMC Registers for SDIO access (for Atheros Wifi)'''<br />
4004A00h 200h SDIO_xxx (same as SD_xxx at 4004800h..40049FFh, see there)<br />
4004A02h 2 SDIO_CARD_PORT_SELECT (slightly different than 4004802h)<br />
4004AF8h 2 Fixed always zero? (unlike SD_xxx at 40048F8h) (RESERVED5)<br />
4004AFAh 2 Fixed always zero? (unlike SD_xxx at 40048FAh) (RESERVED6)<br />
<br />
== DSi SD/MMC I/O Ports: Command/Param/Response/Data ==<br />
<br />
===4004800h/4004A00h - SD_CMD - Command and Response/Data Type (R/W)===<br />
15 undoc Unknown/undoc (read/write-able)<br />
14 undoc Security Cmd? (0=Normal, 1=Whatever/Security?) (sdio?)<br />
13 undoc Data Length (0=Single Block, 1=Multiple Blocks)<br />
12 undoc Data Direction (0=Write, 1=Read)<br />
11 NTDT Data Transfer (0=No data, 1=With data)<br />
10-8 REP2-0 Response Type (0=Auto, 1..2=Unknown/Reserved, 3=None, 4=48bit,<br />
5=48bit+Busy, 6=136bit, 7=48bitOcrWithoutCRC7)<br />
7-6 CMD1-0 Command Type (0=CMD, 1=ACMD, 2..3=unknown, maybe GEN WR/RD?)<br />
5-0 CIX Command Index (0..3Fh, command index)<br />
Setting Command Type to "ACMD" is automatically sending an APP_CMD prefix prior to the command number. For Multiple Blocks, the hardware supports automatically sending STOP_TRANSMISSION after the last block.<br><br />
DSi software is usually setting Response Type to "Auto", which is causing the hardware to use the correct response/data type for standard SD/MMC commands (bit11-13 are ignored/should be zero when using "Auto"; and maybe same for bit14-15?).<br><br />
One exception is that the DSi firmware isn't using "Auto" for SDIO commands (maybe the hardware isn't aware of them; or it's unable to distinguish between read/write direction of CMD53, which would require examining the command's PARAM bits).<br><br />
There might be subtle differences between some SD and MMC commands, unknown if/how "Auto" is working in that cases; unknown if there's a SD-or-MMC mode select bit for that purpose in some configuration register.<br><br />
Invalid values can cause ILA error (particulary on setting NTDT for CMD12, or for CMD's Response=None). ILA error will also occur if an old CMD is still busy.<br />
<br />
===4004804h/4004A04h - SD_CMD_PARAM0-1 - Argument (32bit, 2 halfwords) (R/W)===<br />
31-0 Parameter value for CMD<br />
The parameter value should be written <before> sending the command via SD_CMD/SDIO_CMD.<br />
<br />
===400480Ch/4004A0Ch - SD_RESPONSE0-7 - Response (128bit, 8 halfwords) (R)===<br />
After sending a command, wait for the CMDRESPEND bit (IRQ_STATUS.bit0) to get<br />
set, then read the RESPONSE (if the command does have any response).<br />
For normal 32bit responses:<br />
31-0 Response<br />
127-32 Older Responses<br />
For CID/CSD responses:<br />
119-0 120bit Response<br />
127-120 Zero (always?)<br />
Seems to be left-shifted when receiving response bits. So, for 32bit responses, bit0-31 would contain the current response, and bit32-127 would contain older responses.<br />
<br />
===DATA16 vs DATA32===<br />
Data can be transferred in 16bit or 32bit units (as selected in DATA_CTL.bit1 and DATA32_IRQ.bit1). There are separate data, block len, and block count registers for 16bit and 32bit mode (that's probably due to some odd patchwork, where the manufacturer has added 32bit support to the original 16bit chip design).<br><br />
Naturally, a 32bit transfer is faster than two 16bit transfers. Nethertheless, the DSi firmware does use both 32bit and 16bit mode once and then; 32bit mode is required for NDMA transfers (which don't support 16bit).<br />
<br />
===40048D8h/4004AD8h - SD_DATA_CTL===<br />
15-13 Unknown (usually 0)<br />
12 Unknown (usually 1) (R?)<br />
11-6 Unknown (usually 0)<br />
5 Unknown (read/write-able) (usually 0) (R/W)<br />
4 Unknown (usually 1) (R?)<br />
3-2 Unknown (usually 0)<br />
1 Select 16bit/32bit Data Mode (0=DATA16, 1=DATA32, see 4004900h) (R/W)<br />
0 Unknown (usually 0)<br />
Known written values are 0000h and 0002h. However, known read values are 1010h and 1012h.<br><br />
DATA32 mode requires setting both 40048D8h.bit1 and 4004900h.bit1. For DATA16 mode, both bits should be zero (though DATA16 seems to be also working the same way when only either of the bits is zero).<br />
<br />
===400480Ah/4004A0Ah - SD_DATA16_BLK_COUNT - "Transfer Block Count" (R/W)===<br />
===4004908h/4004B08h - SD_DATA32_BLK_COUNT (R/W)===<br />
15-0 Number of Data Blocks for multiple read/write commands (0..FFFFh)<br />
In Data32 mode, DATA32_BLK_COUNT is decremented after each block (except after the last block, where it stays at 0001h instead of getting zero). In Data16 mode, SD_DATA16_BLK_COUNT doesn't decrease (instead, there must be some hidden internal counter register).<br><br />
If enabled in STOP_INTERNAL_ACTION.bit8, then the hardware will be automatically sending STOP_TRANSMISSION (CMD12) after the last block (otherwise the decrement occurs as described above, but the hardware keeps transferring blocks infinitely).<br />
<br />
===4004826h/4004A26h - SD_DATA16_BLK_LEN - Transfer Data Length (R/W)===<br />
===4004904h/4004B04h - SD_DATA32_BLK_LEN (R/W)===<br />
15-10 Unknown/unused (appears to be always zero)<br />
9-0 Data Block Length in bytes (for DATA16: clipped to max 0200h by hw)<br />
Should be usually 0200h (for 512-byte SD/MMC memory blocks). Other values may be needed for SDIO functions, or when accessing SSR/SCR/PWD registers via data transfers.<br><br />
DATA32_BLK_LEN can be max 3FFh (unlike DATA16_BLK_LEN which is clipped to<br />
max=200h by hardware).<br />
<br />
===4004830h/4004A30h - SD_DATA16_FIFO - Data Port (SD_FIFO?)===<br />
===400490Ch/4004B0Ch - SD_DATA32_FIFO===<br />
For Data16:<br />
15-0 Data (16bit) (...or could it be accessed as 32bit, too?)<br />
For Data32:<br />
31-0 Data (32bit) (...or could it be accessed as 16bit, too?)<br />
Transfer data here (read after RXRDY gets set, or write after TXRQ gets set).<br />
FIFO size is unknown (if there's any FIFO behind it).<br />
<br />
== DSi SD/MMC I/O Ports: Interrupt/Status ==<br />
<br />
===400481Ch/4004A1Ch - SD_IRQ_STATUS0-1 - Interrupt Status (R/ack)===<br />
===4004820h/4004A20h - SD_IRQ_MASK0-1 - Interrupt Mask (R/W)===<br />
The IRQ_STATUS registers contain acknowledge-able IRQ Flags (those bits that that are maskable in IRQ_MASK register), as well as static read-only status bits without IRQ function (eg. WRPROTECT).<br />
*IRQ Flags/Write (0=Acknowledge, 1=No change)<br />
*IRQ Flags/Read (0=No IRQ, 1=IRQ)<br />
*IRQ Mask (0=Enable, 1=Disable) (8B7F031Dh when all IRQs disabled)<br />
Bit Stat Mask Function<br />
0 SREP MREP CMDRESPEND (response end) (or R1b: busy end)<br />
1 0 0 Unknown/unused (always 0)<br />
2 SRWA MRWA DATAEND (set after (last) data block end)<br />
3 SCOT MCOT CARD_REMOVE (0=No event, 1=Is/was newly ejected) ;\<br />
4 SCIN MCIN CARD_INSERT (0=No event, 1=Is/was newly inserted) ; SD<br />
5 undoc 0 SIGSTATE (0=Ejected, 1=Inserted) (SDIO: always 1) ; Slot<br />
6 0 0 Unknown/unused (always 0) ; Sw's<br />
7 undoc 0 WRPROTECT (0=Locked/Ejected, 1=Unlocked/HalfEjected);/<br />
8 undoc undoc CARD_REMOVE_A (0=No event, 1=High-to-Low occurred) ;\SD<br />
9 undoc undoc CARD_INSERT_A (0=No event, 1=Low-to-High óccurred) ; Slot<br />
10 undoc 0 SIGSTATE_A (usually 1=High) ;also as so for SDIO ;/Data3<br />
11 0 0 Unknown/unused (always 0)<br />
12 0 0 Unknown/unused (always 0)<br />
13 0 0 Unknown/unused (always 0)<br />
14 0 0 Unknown/unused (always 0)<br />
15 0 0 Unknown/unused (always 0)<br />
16 SCIX MCIX CMD_IDX_ERR Bad CMD-index in response (RCMDE,SCMDE)<br />
17 SCRC MCRC CRCFAIL CRC response error (WCRCE,RCRCE,SCRCE,CCRCE)<br />
18 SEND MEND STOPBIT_ERR End bit error (WEBER,REBER,SEBER,CEBER)<br />
19 SDTO MDTO DATATIMEOUT Data Timeout (NRCS,NWCS,KBSY)<br />
20 SFOF MFOF RXOVERFLOW HOST tried write full<br />
21 SFUF MFUF TXUNDERRUN HOST tried read empty<br />
22 SCTO MCTO CMDTIMEOUT Response start-bit timeout (NRS,NSR)<br />
23 1 ? 0 Unknown/undoc (usually set?)<br />
24 SBRE MBRE RXRDY (fifo not empty) (request data read)<br />
25 SBWE MBWE TXRQ (datafifoempty?) (request data write)<br />
26 0 0 Unknown/unused (always 0)<br />
27 undoc undoc Unknown/undoc (bit27 is mask-able in IRQ_MASK)<br />
28 0 0 Unknown/unused (always 0)<br />
29 undoc 0 CMD_READY? (inverse of BUSY?) (unlike toshiba ILFSL/IFSMSK)<br />
30 undoc 0 CMD_BUSY<br />
31 ILA IMSK Illegal Command Access (old CMD still busy, or wrong NTDT)<br />
Normally, IRQs should be acknowledged by writing "FLAGS=NOT X", whilst the firmware is using an unstable "FLAGS=FLAGS AND NOT X" read-modify-write function (accidentally acknowledging any IRQs that have newly occurred during that operation).<br />
<br />
===4004900h/4004B00h - SD_DATA32_IRQ===<br />
15-13 Unknown/unused (appears to be always zero)<br />
12 DATA32_BUSY IRQ Enable (0=Disable, 1=Enable) (R/W)<br />
11 DATA32_RXRDY IRQ Enable (0=Disable, 1=Enable) (R/W)<br />
10 DATA32 Abort/Flush FIFO? (0=No change, 1=Clear Bit8,9) (W)<br />
9 DATA32_BUSY IRQ Flag (auto cleared after...) (R)<br />
8 DATA32_RXRDY IRQ Flag (auto cleared after...) (R)<br />
7-2 Unknown/unused (appears to be always zero)<br />
1 Select 16bit/32bit Data Mode (0=DATA16, 1=DATA32, see 40048D8h) (R/W)<br />
0 Unknown/unused (appears to be always zero)<br />
Can be 1A02h, but changes to 1802h after reading from somewhere (maybe from DATA32_FIFO?).<br><br />
Bit8,9 are extra IRQ flags, the flags get set ONLY in DATA32 mode (not in DATA16 mode).<br />
<br />
===400482Ch/4004A2Ch - SD_ERROR_DETAIL_STATUS0-1 - Error Detail Status===<br />
31-23 ? Unknown/unused/undoc<br />
22 KBSY Timeout for CRC status busy timeout ;\STAT.19<br />
21 NWCS Timeout for CRC status timeout ; (SDTO)<br />
20 NRCS Timeout for Data start-bit, or for Post Data Busy ;/<br />
19-18 ? Unknown/unused/undoc<br />
17 NRS Response timeout for auto-issued CMD12 ;\STAT.22<br />
16 NCR Response timeout for non-auto-issued CMD's ;/(SCTO)<br />
15-14 ? Unknown/unused/undoc<br />
13 ?? Unknown/undoc (bit13 can be nonzero on DSi!) (always 1?) (R?)<br />
12 ? Unknown/unused/undoc<br />
11 WCRCE CRC error for Write CRC status for a write command ;\<br />
10 RCRCE CRC error for read data ; STAT.17<br />
9 SCRCE CRC error for a response for auto-issued CMD12 ; (SCRC)<br />
8 CCRCE CRC error for a response for non-auto-issued CMD's ;/<br />
5 WEBER End bit error for Write CRC status ;\<br />
4 REBER End bit error for read data ; STAT.18<br />
3 SEBER End bit error for response for auto-issued CMD12 ; (SEND)<br />
2 CEBER End bit error for response for non-auto-issued CMD's ;/<br />
1? SCMDE Bad CMD-index in response of auto-issued CMD12 ;\STAT.16<br />
0 RCMDE Bad CMD-index in response of non-auto-issued CMD's ;/(SCIX)<br />
Unknown if/when/how the error bits can be reset/acknowledged.<br><br />
Note: CMD12 is STOP_TRANSMISSION (maybe sent after BLK_COUNT?).<br><br />
The four "auto-issued CMD12" bits exist for SD registers only (not SDIO).<br><br />
SCMDE is probably in bit1 (though, official specs say bit0, which would be same as RCMDE).<br />
<br />
== DSi SD/MMC I/O Ports: Control Registers ==<br />
<br />
===4004802h/4004A02h - SD_CARD_PORT_SELECT===<br />
15-11 Unknown/unused (appears to be always zero)<br />
10 Unknown (write: should be 1, read: usually/always 0) (W?)<br />
9 Unknown (write: should be 0, read: usually 1 for SD) (R?)<br />
8 Unknown (write: should be 0, read: usually 1 for SDIO) (R?)<br />
7-4 Unknown/unused (appears to be always zero)<br />
3-1 Unknown (R/W)<br />
0 Port Select (0=SD Card Slot, 1=Onboard eMMC) (for SDIO: Unknown)(R/W)<br />
<br />
===4004828h/4004A28h - SD_CARD_OPTION - Card Option Setup===<br />
15 Bus Width (0=4bit, 1=1bit) (R/W)<br />
14 Unknown (usually set) (R?)<br />
13-9 Unknown/unused (appears to be always zero)<br />
8 Unknown (firmware toggles this after CLK change?) (W?)<br />
7-4 Unknown, maybe some 4bit timing/timeout value (R/W)<br />
0-3 Unknown, maybe another 4bit timing/timeout value (R/W)<br />
Among others, this register should contain a 4bit timeout setting, "RTO[3:0] for SD (aka TO[3:0] for SDIO) timeout period for data start/busy bits, in the form of a multiple number of the SDCLK period."<br><br />
Unknown which "multiple numbers" that's referring to (probably some exponential/table values).<br><br />
Settings spotted on DSi are 40E0h,40EEh.<br />
<br />
===4004824h/4004A24h - SD_CARD_CLK_CTL Card Clock Control===<br />
15-11 Unknown (always 0) ;unlike Toshiba: no HCLK divider-disable in bit15)<br />
10 Unknown (0=Normal, 1=Unknown, doesn't affect SDCLK output?) (R/W)<br />
9 Unknown (0=Normal, 1=Unknown, freezes SDCLK output?) (R/W)<br />
8 SDCLK Enable (0=Force SDCLK=LOW, 1=Output SDCLK=HCLK/n) (R/W)<br />
7-0 HCLK Div (0,1,2,4,8,16,32,64,128 = Div2,4,8,16,32,64,128,256,512) (R/W)<br />
The DSi uses HCLK=33.513982 MHz, the SDCLK pin can range from HCLK/512=65kHz to HCLK/2=16.757MHz, max transfer rate would be thus 8MByte/s in 4bit mode.<br><br />
Card detection should be done at a low clock rate. For SD/MMC, the DSi starts with HCLK/128, and uses the clock specified in CSD register after detection (when extracting bits from CSD: mind the different 120bit-without-CRC vs 128bit-with-CRC notations). For SDIO, the DSi starts with HCLK/256, and switches to HCLK/2 after reading SDIO Bus Speed register (Function0:00013h).<br><br />
The SDCLK pins are permanently pulsed, even for devices deselected via SD_CARD_PORT_SELECT.0, and even if no CMD or DATA is being transferred. However, the DSi firmware is usually stopping SDCLK via Bit8=0 when not accessing SD/MMC (doing so may reduce noise and power consumption).<br><br />
Trying to set bit9, or to set more than one bit in bit7-0 will freeze the SDCLK output (in this case SDCLK may get stuck HIGH or LOW, unlike Bit8=0 which forces LOW).<br />
<br />
===4004808h/4004A08h - SD_STOP_INTERNAL_ACTION===<br />
15-9 Unknown/unused (appears to be always zero)<br />
8 Auto-Stop (1=Automatically send CMD12 after BLK_COUNT blocks) (R/W)<br />
7-1 Unknown/unused (appears to be always zero)<br />
0 Unknown (R/W)<br />
Stop whatever internal action for whatever purpose in whatever situation?<br><br />
Existing code does set bit8 (prior to changing SD_DATA16_BLK_COUNT).<br><br />
Existing code does clear bit0 (alongsides with IRQ enable/acknowlege or so).<br><br />
<br />
===40048E0h/4004AE0h - SD_SOFT_RESET - Software Reset===<br />
15-3 Unknown/unused (appears to be always zero)<br />
2 Unknown (always 1) (R?)<br />
1 Unknown (always 1) (though firmware tries to toggle this bit) (R?)<br />
0 SRST Soft Reset (0=Reset, 1=Release) (R/W)<br />
Software should apply reset after sensing card insertion/removal, and (thereafter) release reset in case of card insertion. Software reset does acknowledge all IRQs (except that from SDIO /IRQ pin?), and does probably also reinitialize some other registers.<br><br />
Clearing bit0 does force following settings (while and as long as Bit0=0):<br />
SD_STOP_INTERNAL_ACTION = 0000h<br />
SD_RESPONSE0-7 = zerofilled<br />
SD_IRQ_STATUS0-1 = all IRQs flags acknowledged<br />
SD_CARD_CLK_CTL = bit 8 and 10 cleared<br />
SD_CARD_OPTION = 40EEh<br />
SD_CARD_INTERRUPT_CONTROL = 0000h<br />
All other registers seem to be left unaffected (including the the extra IRQ flags in 4004900h); though there may be some further hidden effects (like aborting transfers or resetting internal registers).<br><br />
Note: The DSi firmware does issue reset by toggling both bit0 and bit1, although bit1 does seem to be read-only (always 1), and trying to clear that bit doesn't seem to have any effect at all.<br />
<br />
== DSi SD/MMC I/O Ports: Unknown/Unused Registers ==<br />
<br />
===40048F6h/4004AF6h - Firmware tests bit0 (but, always 0?) (RESERVED4)===<br />
15-1 Unknown (0)<br />
0 Unknown (tested by firmware) (usually 0) (R)<br />
<br />
===4004836h/4004A36h - SD_CARD_INTERRUPT_CONTROL ---- USED by SDIO===<br />
4004A36h is used in SDIO IRQ handler.<br><br />
On DSi, this register looks as so:<br />
15-2 Unknown (0)<br />
1 Unknown (gets set automatically after 2 seconds?) (and also R/W ?)<br />
0 Unknown (usually always 0) (tested by firmware?) (R?)<br />
Whilst old toshiba datasheets specify it as so:<br />
15-13 ? Unknown (zero on DSi)<br />
12 CINT0 SDIO Interrupt Flag (0=none/ack, 1=irq) (/IRQ aka Data1 pin)<br />
11-9 ? Unknown (zero on DSi)<br />
8 CIMSK0 SDIO Interrupt Mask (0=enable, 1=disable) (/IRQ aka Data1 pin)<br />
7-0 ? Unknown (zero on DSi)<br />
Acknowledge by writing CINT0=0, or CIMSK0=1 (uh, really?), or hard reset (unlike as for other SD/MMC interrupts, soft reset does not acknowlege this interrupt type?).<br />
<br />
===4004838h/4004A38h - SDCTL_CLK_AND_WAIT_CTL ---- USED by SDIO===<br />
4004A38h is used in SDIO IRQ handler.<br><br />
On DSi, this register looks as so (usually zero):<br />
15-14 Unknown (usually 0) (R/W)<br />
13-3 Unknown (0)<br />
2-0 Unknown (usually 0) (R/W)<br />
Whilst old toshiba datasheets specify it as so:<br />
15-0 Unknown (bit8 should be set after SD_CARD_CLK_CTL change?)<br />
<br />
Below registers don't seem to be used by existing software...<br />
<br />
===4004834h/4004A34h - SD_TRANSACTION_CTL - Transaction Control===<br />
15-10 Unknown/unused (appears to be always zero)<br />
9-8 Unknown (R/W)<br />
7-3 Unknown/unused (appears to be always zero)<br />
2 Unknown (R/W)<br />
1 Unknown/unused (appears to be always zero)<br />
0 Unknown (R/W)<br />
<br />
===40048F2h/4004AF2h - Can be 0003h===<br />
15-2 Unknown (0)<br />
1-0 Unknown (0..3) (R/W)<br />
<br />
===40048F4h/4004AF4h - Can be 0770h===<br />
15-11 Unknown (0)<br />
10-8 Unknown (0..7) (R/W)<br />
7 Unknown (0)<br />
6-4 Unknown (0..7) (R/W)<br />
3-0 Unknown (0)<br />
<br />
===40048FAh - Can be 0004h..0007h (nonzero, unlike SDIO) (RESERVED6)===<br />
15-3 Unknown (0)<br />
2 Unknown (usually set) (R)<br />
1-0 Unknown (0..3) (R/W? or rather R?)<br />
<br />
===40048FCh/4004AFCh - Can be 0024h..00FFh? (RESERVED7)===<br />
===40048FEh/4004AFEh - Can be 0024h..00FFh? (RESERVED8 / TC6371AF:Revision)===<br />
15-8 Unknown (0)<br />
7-0 Can be 24h..FFh parts (R) and parts (R/W)?<br />
<br />
===Unused Registers with Fixed value (all bits read-only, or write-only)===<br />
400482Ah/4004A2Ah 2 Fixed always zero?<br />
4004832h/4004A32h 2 Fixed always zero? ;(TC6371AF:BUF1 Data MSBs?)<br />
400483Ah/4004A3Ah 2 Fixed always zero? ;(SDCTL_SDIO_HOST_INFORMATION)<br />
400483Ch/4004A3Ch 2 Fixed always zero? ;(SDCTL_ERROR_CONTROL)<br />
400483Eh/4004A3Eh 2 Fixed always zero? ;(TC6387XB: LED_CONTROL)<br />
4004840h/4004A40h 2 Fixed always 003Fh?<br />
4004842h/4004A42h 2 Fixed always 002Ah?<br />
4004844h/4004A44h 6Eh Fixed always zerofilled?<br />
40048B2h/4004AB2h 2 Fixed always FFFFh?<br />
40048B4h/4004AB4h 6 Fixed always zerofilled?<br />
40048BAh/4004ABAh 2 Fixed always 0200h?<br />
40048BCh/4004ABCh 1Ch Fixed always zerofilled?<br />
40048DAh/4004ADAh 6 Fixed always zerofilled?<br />
40048E2h/4004AE2h 2 Fixed always 0009h? ;(RESERVED2/9, TC6371AF:CORE_REV)<br />
40048E4h/4004AE4h 2 Fixed always zero?<br />
40048E6h/4004AE6h 2 Fixed always zero? ;(RESERVED3, TC6371AF:BUF_ADR)<br />
40048E8h/4004AE8h 2 Fixed always zero? ;(TC6371AF:Resp_Header)<br />
40048EAh/4004AEAh 6 Fixed always zerofilled?<br />
40048F0h/4004AF0h 2 Fixed always zero? ;(RESERVED10)<br />
40048F8h 2 Fixed always 0004h? (unlike SDIO) (RESERVED5)<br />
4004AF8h 2 Fixed always zero? (unlike SD) (RESERVED5)<br />
4004AFAh 2 Fixed always zero? (unlike SD) (RESERVED6)<br />
4004902h/4004B02h 2 Fixed always zero?<br />
4004906h/4004B06h 2 Fixed always zero?<br />
400490Ah/4004B0Ah 2 Fixed always zero?<br />
4004910h/4004B10h F0h Fixed always zerofilled?<br />
<br />
== Links ==<br />
* [http://gbatemp.net/threads/dsi-reverse-engineering-sd-mmc-sdio-registers.395787/ DSi SD/MMC reverse engineering thread in gbatemp forum]</div>Nocashhttps://dsibrew.org/w/index.php?title=SD/MMC/SDIO_Registers&diff=2098818SD/MMC/SDIO Registers2015-08-31T10:37:55Z<p>Nocash: </p>
<hr />
<div>SD_xxx is used to access onboard eMMC and external SD card slot (as selected via SD_CARD_PORT_SELECT).<br><br />
SDIO_xxx is used to access the Atheros Wifi unit.<br />
<br />
== DSi SD/MMC I/O Map ==<br />
<br />
'''ARM7 DSi SD/MMC Registers for Memory Card access (SD Card and onboard eMMC)'''<br />
4004800h 2 SD_CMD Command and Response/Data Type<br />
4004802h 2 SD_CARD_PORT_SELECT (SD/MMC:020Fh, SDIO:010Fh)<br />
4004804h 4 SD_CMD_PARAM0-1 Argument (32bit, 2 halfwords)<br />
4004808h 2 SD_STOP_INTERNAL_ACTION<br />
400480Ah 2 SD_DATA16_BLK_COUNT "Transfer Block Count"<br />
400480Ch 16 SD_RESPONSE0-7 (128bit, 8 halfwords)<br />
400481Ch 4 SD_IRQ_STATUS0-1 ;IRQ Status (0=ack, 1=req)<br />
4004820h 4 SD_IRQ_MASK0-1 ;IRQ Disable (0=enable, 1=disable)<br />
4004824h 2 SD_CARD_CLK_CTL Card Clock Control<br />
4004826h 2 SD_DATA16_BLK_LEN Memory Card Transfer Data Length<br />
4004828h 2 SD_CARD_OPTION Memory Card Option Setup (can be C0FFh)<br />
400482Ah 2 Fixed always zero?<br />
400482Ch 4 SD_ERROR_DETAIL_STATUS0-1 Error Detail Status<br />
4004830h 2 SD_DATA16_FIFO Data Port (SD_FIFO?)<br />
4004832h 2 Fixed always zero? ;(TC6371AF:BUF1 Data MSBs?)<br />
4004834h 2 ? SD_TRANSACTION_CTL Transaction Control<br />
4004836h 2 ? SD_CARD_INTERRUPT_CONTROL ;4004A36h used in SDIO IRQ handler<br />
4004838h 2 ? SD_CLK_AND_WAIT_CTL ;4004A38h used in SDIO IRQ handler<br />
400483Ah 2 Fixed always zero? ;(SDCTL_SDIO_HOST_INFORMATION)<br />
400483Ch 2 Fixed always zero? ;(SDCTL_ERROR_CONTROL)<br />
400483Eh 2 Fixed always zero? ;(TC6387XB: LED_CONTROL)<br />
4004840h 2 Fixed always 003Fh?<br />
4004842h 2 Fixed always 002Ah?<br />
4004844h 6Eh Fixed always zerofilled?<br />
40048B2h 2 Fixed always FFFFh?<br />
40048B4h 6 Fixed always zerofilled?<br />
40048BAh 2 Fixed always 0200h?<br />
40048BCh 1Ch Fixed always zerofilled?<br />
40048D8h 2 SD_DATA_CTL<br />
40048DAh 6 Fixed always zerofilled?<br />
40048E0h 2 SD_SOFT_RESET Software Reset (bit0=SRST=0=reset)<br />
40048E2h 2 Fixed always 0009h? ;(RESERVED2/9, TC6371AF:CORE_REV)<br />
40048E4h 2 Fixed always zero?<br />
40048E6h 2 Fixed always zero? ;(RESERVED3, TC6371AF:BUF_ADR)<br />
40048E8h 2 Fixed always zero? ;(TC6371AF:Resp_Header)<br />
40048EAh 6 Fixed always zerofilled?<br />
40048F0h 2 Fixed always zero? ;(RESERVED10)<br />
40048F2h 2 ? Can be 0003h<br />
40048F4h 2 ? Can be 0770h<br />
40048F6h 2 ? Firmware tests bit0 (but, always 0?) (RESERVED4)<br />
40048F8h 2 Fixed always 0004h? (nonzero, unlike SDIO) (RESERVED5)<br />
40048FAh 2 ? Can be 0004h..0007h (nonzero, unlike SDIO) (RESERVED6)<br />
40048FCh 2 ? Can be 0024h..00FFh? (RESERVED7)<br />
40048FEh 2 ? Can be 0024h..00FFh? (RESERVED8 / TC6371AF:Revision)<br />
4004900h 2 SD_DATA32_IRQ<br />
4004902h 2 Fixed always zero?<br />
4004904h 2 SD_DATA32_BLK_LEN<br />
4004906h 2 Fixed always zero?<br />
4004908h 2 SD_DATA32_BLK_COUNT<br />
400490Ah 2 Fixed always zero?<br />
400490Ch 4 SD_DATA32_FIFO<br />
4004910h F0h Fixed always zerofilled?<br />
'''ARM7 DSi SD/MMC Registers for SDIO access (for Atheros Wifi)'''<br />
4004A00h 200h SDIO_xxx (same as SD_xxx at 4004800h..40049FFh, see there)<br />
4004A02h 2 SDIO_CARD_PORT_SELECT (slightly different than 4004802h)<br />
4004AF8h 2 Fixed always zero? (unlike SD_xxx at 40048F8h) (RESERVED5)<br />
4004AFAh 2 Fixed always zero? (unlike SD_xxx at 40048FAh) (RESERVED6)<br />
<br />
== DSi SD/MMC I/O Ports: Command/Param/Response/Data ==<br />
<br />
===4004800h/4004A00h - SD_CMD - Command and Response/Data Type (R/W)===<br />
15 undoc Unknown/undoc (read/write-able)<br />
14 undoc Security Cmd (0=Normal, 1=Whatever/Security) (sdio?)<br />
13 undoc Data Length (0=Single Block, 1=Multiple Blocks)<br />
12 undoc Data Direction (0=Write, 1=Read)<br />
11 NTDT Data Transfer (0=No data, 1=With data)<br />
10-8 REP2-0 Response Type (0..2=Unknown/Reserved, 3=None, 4=48bit,<br />
5=48bit+Busy, 6=136bit, 7=48bitOcrWithoutCRC7)<br />
7-6 CMD1-0 Command Type (0=CMD, 1=ACMD, 2..3=unknown, maybe GEN WR/RD?)<br />
5-0 CIX Command Index (0..3Fh, command index)<br />
Invalid values can cause ILA error (particulary on setting NTDT for CMD12, or for CMD's Response=None). ILA error will also occur if an old CMD is still busy.<br><br />
DSi software is always writing just ZERO to bit11-6 though? Maybe the hardware does automatically know which SD/MMC CMDs and ACMDs have data? Or maybe data is always automatically transferred when receiving a data-startbit, or when writing to data register - and bits like NTDT would be needed only for things like proper data timeout handling?<br />
<br />
===4004804h/4004A04h - SD_CMD_PARAM0-1 - Argument (32bit, 2 halfwords) (R/W)===<br />
31-0 Parameter value for CMD<br />
The parameter value should be written <before> sending the command via SD_CMD/SDIO_CMD.<br />
<br />
===400480Ch/4004A0Ch - SD_RESPONSE0-7 - Response (128bit, 8 halfwords) (R)===<br />
After sending a command, wait for the CMDRESPEND bit (IRQ_STATUS.bit0) to get<br />
set, then read the RESPONSE (if the command does have any response).<br />
For normal 32bit responses:<br />
31-0 Response<br />
127-32 Older Responses<br />
For CID/CSD responses:<br />
119-0 120bit Response<br />
127-120 Zero (always?)<br />
Seems to be left-shifted when receiving response bits. So, for 32bit responses, bit0-31 would contain the current response, and bit32-127 would contain older responses.<br />
<br />
===DATA16 vs DATA32===<br />
Data can be transferred in 16bit or 32bit units (as selected in DATA_CTL.bit1 and DATA32_IRQ.bit1). There are separate data, block len, and block count registers for 16bit and 32bit mode (that's probably due to some odd patchwork, where the manufacturer has added 32bit support to the original 16bit chip design).<br><br />
Naturally, a 32bit transfer is faster than two 16bit transfers. Nethertheless, the DSi firmware does use both 32bit and 16bit mode once and then; 32bit mode is required for NDMA transfers (which don't support 16bit).<br />
<br />
===40048D8h/4004AD8h - SD_DATA_CTL===<br />
15-13 Unknown (usually 0)<br />
12 Unknown (usually 1) (R?)<br />
11-6 Unknown (usually 0)<br />
5 Unknown (read/write-able) (usually 0) (R/W)<br />
4 Unknown (usually 1) (R?)<br />
3-2 Unknown (usually 0)<br />
1 Select 16bit/32bit Data Mode (0=DATA16, 1=DATA32, see 4004900h) (R/W)<br />
0 Unknown (usually 0)<br />
Known written values are 0000h and 0002h. However, known read values are 1010h and 1012h.<br><br />
DATA32 mode requires setting both 40048D8h.bit1 and 4004900h.bit1. For DATA16 mode, both bits should be zero (though DATA16 seems to be also working the same way when only either of the bits is zero).<br />
<br />
===400480Ah/4004A0Ah - SD_DATA16_BLK_COUNT - "Transfer Block Count" (R/W)===<br />
===4004908h/4004B08h - SD_DATA32_BLK_COUNT (R/W)===<br />
15-0 Number of Data Blocks for multiple read/write commands (0..FFFFh)<br />
In Data32 mode, DATA32_BLK_COUNT is decremented after each block (except after the last block, where it stays at 0001h instead of getting zero). In Data16 mode, SD_DATA16_BLK_COUNT doesn't decrease (instead, there must be some hidden internal counter register).<br><br />
If enabled in STOP_INTERNAL_ACTION.bit8, then the hardware will be automatically sending STOP_TRANSMISSION (CMD12) after the last block (otherwise the decrement occurs as described above, but the hardware keeps transferring blocks infinitely).<br />
<br />
===4004826h/4004A26h - SD_DATA16_BLK_LEN - Transfer Data Length (R/W)===<br />
===4004904h/4004B04h - SD_DATA32_BLK_LEN (R/W)===<br />
15-10 Unknown/unused (appears to be always zero)<br />
9-0 Data Block Length in bytes (for DATA16: clipped to max 0200h by hw)<br />
Should be usually 0200h (for 512-byte SD/MMC memory blocks). Other values may be needed for SDIO functions, or when accessing SSR/SCR/PWD registers via data transfers.<br><br />
DATA32_BLK_LEN can be max 3FFh (unlike DATA16_BLK_LEN which is clipped to<br />
max=200h by hardware).<br />
<br />
===4004830h/4004A30h - SD_DATA16_FIFO - Data Port (SD_FIFO?)===<br />
===400490Ch/4004B0Ch - SD_DATA32_FIFO===<br />
For Data16:<br />
15-0 Data (16bit) (...or could it be accessed as 32bit, too?)<br />
For Data32:<br />
31-0 Data (32bit) (...or could it be accessed as 16bit, too?)<br />
Transfer data here (read after RXRDY gets set, or write after TXRQ gets set).<br />
FIFO size is unknown (if there's any FIFO behind it).<br />
<br />
== DSi SD/MMC I/O Ports: Interrupt/Status ==<br />
<br />
===400481Ch/4004A1Ch - SD_IRQ_STATUS0-1 - Interrupt Status (R/ack)===<br />
===4004820h/4004A20h - SD_IRQ_MASK0-1 - Interrupt Mask (R/W)===<br />
The IRQ_STATUS registers contain acknowledge-able IRQ Flags (those bits that that are maskable in IRQ_MASK register), as well as static read-only status bits without IRQ function (eg. WRPROTECT).<br />
*IRQ Flags/Write (0=Acknowledge, 1=No change)<br />
*IRQ Flags/Read (0=No IRQ, 1=IRQ)<br />
*IRQ Mask (0=Enable, 1=Disable) (8B7F031Dh when all IRQs disabled)<br />
Bit Stat Mask Function<br />
0 SREP MREP CMDRESPEND (response end) (or R1b: busy end)<br />
1 0 0 Unknown/unused (always 0)<br />
2 SRWA MRWA DATAEND (set after (last) data block end)<br />
3 SCOT MCOT CARD_REMOVE (0=No event, 1=Is/was newly ejected) ;\<br />
4 SCIN MCIN CARD_INSERT (0=No event, 1=Is/was newly inserted) ; SD<br />
5 undoc 0 SIGSTATE (0=Ejected, 1=Inserted) (SDIO: always 1) ; Slot<br />
6 0 0 Unknown/unused (always 0) ; Sw's<br />
7 undoc 0 WRPROTECT (0=Locked/Ejected, 1=Unlocked/HalfEjected);/<br />
8 undoc undoc CARD_REMOVE_A (0=No event, 1=High-to-Low occurred) ;\SD<br />
9 undoc undoc CARD_INSERT_A (0=No event, 1=Low-to-High óccurred) ; Slot<br />
10 undoc 0 SIGSTATE_A (usually 1=High) ;also as so for SDIO ;/Data3<br />
11 0 0 Unknown/unused (always 0)<br />
12 0 0 Unknown/unused (always 0)<br />
13 0 0 Unknown/unused (always 0)<br />
14 0 0 Unknown/unused (always 0)<br />
15 0 0 Unknown/unused (always 0)<br />
16 SCIX MCIX CMD_IDX_ERR Bad CMD-index in response (RCMDE,SCMDE)<br />
17 SCRC MCRC CRCFAIL CRC response error (WCRCE,RCRCE,SCRCE,CCRCE)<br />
18 SEND MEND STOPBIT_ERR End bit error (WEBER,REBER,SEBER,CEBER)<br />
19 SDTO MDTO DATATIMEOUT Data Timeout (NRCS,NWCS,KBSY)<br />
20 SFOF MFOF RXOVERFLOW HOST tried write full<br />
21 SFUF MFUF TXUNDERRUN HOST tried read empty<br />
22 SCTO MCTO CMDTIMEOUT Response start-bit timeout (NRS,NSR)<br />
23 1 ? 0 Unknown/undoc (usually set?)<br />
24 SBRE MBRE RXRDY (fifo not empty) (request data read)<br />
25 SBWE MBWE TXRQ (datafifoempty?) (request data write)<br />
26 0 0 Unknown/unused (always 0)<br />
27 undoc undoc Unknown/undoc (bit27 is mask-able in IRQ_MASK)<br />
28 0 0 Unknown/unused (always 0)<br />
29 undoc 0 CMD_READY? (inverse of BUSY?) (unlike toshiba ILFSL/IFSMSK)<br />
30 undoc 0 CMD_BUSY<br />
31 ILA IMSK Illegal Command Access (old CMD still busy, or wrong NTDT)<br />
Normally, IRQs should be acknowledged by writing "FLAGS=NOT X", whilst the firmware is using an unstable "FLAGS=FLAGS AND NOT X" read-modify-write function (accidentally acknowledging any IRQs that have newly occurred during that operation).<br />
<br />
===4004900h/4004B00h - SD_DATA32_IRQ===<br />
15-13 Unknown/unused (appears to be always zero)<br />
12 DATA32_BUSY IRQ Enable (0=Disable, 1=Enable) (R/W)<br />
11 DATA32_RXRDY IRQ Enable (0=Disable, 1=Enable) (R/W)<br />
10 DATA32 Abort/Flush FIFO? (0=No change, 1=Clear Bit8,9) (W)<br />
9 DATA32_BUSY IRQ Flag (auto cleared after...) (R)<br />
8 DATA32_RXRDY IRQ Flag (auto cleared after...) (R)<br />
7-2 Unknown/unused (appears to be always zero)<br />
1 Select 16bit/32bit Data Mode (0=DATA16, 1=DATA32, see 40048D8h) (R/W)<br />
0 Unknown/unused (appears to be always zero)<br />
Can be 1A02h, but changes to 1802h after reading from somewhere (maybe from DATA32_FIFO?).<br><br />
Bit8,9 are extra IRQ flags, the flags get set ONLY in DATA32 mode (not in DATA16 mode).<br />
<br />
===400482Ch/4004A2Ch - SD_ERROR_DETAIL_STATUS0-1 - Error Detail Status===<br />
31-23 ? Unknown/unused/undoc<br />
22 KBSY Timeout for CRC status busy timeout ;\STAT.19<br />
21 NWCS Timeout for CRC status timeout ; (SDTO)<br />
20 NRCS Timeout for Data start-bit, or for Post Data Busy ;/<br />
19-18 ? Unknown/unused/undoc<br />
17 NRS Response timeout for auto-issued CMD12 ;\STAT.22<br />
16 NCR Response timeout for non-auto-issued CMD's ;/(SCTO)<br />
15-14 ? Unknown/unused/undoc<br />
13 ?? Unknown/undoc (bit13 can be nonzero on DSi!) (always 1?) (R?)<br />
12 ? Unknown/unused/undoc<br />
11 WCRCE CRC error for Write CRC status for a write command ;\<br />
10 RCRCE CRC error for read data ; STAT.17<br />
9 SCRCE CRC error for a response for auto-issued CMD12 ; (SCRC)<br />
8 CCRCE CRC error for a response for non-auto-issued CMD's ;/<br />
5 WEBER End bit error for Write CRC status ;\<br />
4 REBER End bit error for read data ; STAT.18<br />
3 SEBER End bit error for response for auto-issued CMD12 ; (SEND)<br />
2 CEBER End bit error for response for non-auto-issued CMD's ;/<br />
1? SCMDE Bad CMD-index in response of auto-issued CMD12 ;\STAT.16<br />
0 RCMDE Bad CMD-index in response of non-auto-issued CMD's ;/(SCIX)<br />
Unknown if/when/how the error bits can be reset/acknowledged.<br><br />
Note: CMD12 is STOP_TRANSMISSION (maybe sent after BLK_COUNT?).<br><br />
The four "auto-issued CMD12" bits exist for SD registers only (not SDIO).<br><br />
SCMDE is probably in bit1 (though, official specs say bit0, which would be same as RCMDE).<br />
<br />
== DSi SD/MMC I/O Ports: Control Registers ==<br />
<br />
===4004802h/4004A02h - SD_CARD_PORT_SELECT===<br />
15-11 Unknown/unused (appears to be always zero)<br />
10 Unknown (write: should be 1, read: usually/always 0) (W?)<br />
9 Unknown (write: should be 0, read: usually 1 for SD) (R?)<br />
8 Unknown (write: should be 0, read: usually 1 for SDIO) (R?)<br />
7-4 Unknown/unused (appears to be always zero)<br />
3-1 Unknown (R/W)<br />
0 Port Select (0=SD Card Slot, 1=Onboard eMMC) (for SDIO: Unknown)(R/W)<br />
<br />
===4004828h/4004A28h - SD_CARD_OPTION - Card Option Setup===<br />
15 Bus Width (0=4bit, 1=1bit) (R/W)<br />
14 Unknown (usually set) (R?)<br />
13-9 Unknown/unused (appears to be always zero)<br />
8 Unknown (firmware toggles this after CLK change?) (W?)<br />
7-4 Unknown, maybe some 4bit timing/timeout value (R/W)<br />
0-3 Unknown, maybe another 4bit timing/timeout value (R/W)<br />
Among others, this register should contain a 4bit timeout setting, "RTO[3:0] for SD (aka TO[3:0] for SDIO) timeout period for data start/busy bits, in the form of a multiple number of the SDCLK period."<br><br />
Unknown which "multiple numbers" that's referring to (probably some exponential/table values).<br><br />
Settings spotted on DSi are 40E0h,40EEh.<br />
<br />
===4004824h/4004A24h - SD_CARD_CLK_CTL Card Clock Control===<br />
15-11 Unknown (always 0) ;unlike Toshiba: no HCLK divider-disable in bit15)<br />
10 Unknown (0=Normal, 1=Unknown, doesn't affect SDCLK output?) (R/W)<br />
9 Unknown (0=Normal, 1=Unknown, freezes SDCLK output?) (R/W)<br />
8 SDCLK Enable (0=Force SDCLK=LOW, 1=Output SDCLK=HCLK/n) (R/W)<br />
7-0 HCLK Div (0,1,2,4,8,16,32,64,128 = Div2,4,8,16,32,64,128,256,512) (R/W)<br />
The DSi uses HCLK=33.513982 MHz, the SDCLK pin can range from HCLK/512=65kHz to HCLK/2=16.757MHz, max transfer rate would be thus 8MByte/s in 4bit mode.<br><br />
Card detection should be done at a low clock rate. For SD/MMC, the DSi starts with HCLK/128, and uses the clock specified in CSD register after detection (when extracting bits from CSD: mind the different 120bit-without-CRC vs 128bit-with-CRC notations). For SDIO, the DSi starts with HCLK/256, and switches to HCLK/2 after reading SDIO Bus Speed register (Function0:00013h).<br><br />
The SDCLK pins are permanently pulsed, even for devices deselected via SD_CARD_PORT_SELECT.0, and even if no CMD or DATA is being transferred. However, the DSi firmware is usually stopping SDCLK via Bit8=0 when not accessing SD/MMC (doing so may reduce noise and power consumption).<br><br />
Trying to set bit9, or to set more than one bit in bit7-0 will freeze the SDCLK output (in this case SDCLK may get stuck HIGH or LOW, unlike Bit8=0 which forces LOW).<br />
<br />
===4004808h/4004A08h - SD_STOP_INTERNAL_ACTION===<br />
15-9 Unknown/unused (appears to be always zero)<br />
8 Auto-Stop (1=Automatically send CMD12 after BLK_COUNT blocks) (R/W)<br />
7-1 Unknown/unused (appears to be always zero)<br />
0 Unknown (R/W)<br />
Stop whatever internal action for whatever purpose in whatever situation?<br><br />
Existing code does set bit8 (prior to changing SD_DATA16_BLK_COUNT).<br><br />
Existing code does clear bit0 (alongsides with IRQ enable/acknowlege or so).<br><br />
<br />
===40048E0h/4004AE0h - SD_SOFT_RESET - Software Reset===<br />
15-3 Unknown/unused (appears to be always zero)<br />
2 Unknown (always 1) (R?)<br />
1 Unknown (always 1) (though firmware tries to toggle this bit) (R?)<br />
0 SRST Soft Reset (0=Reset, 1=Release) (R/W)<br />
Software should apply reset after sensing card insertion/removal, and (thereafter) release reset in case of card insertion. Software reset does acknowledge all IRQs (except that from SDIO /IRQ pin?), and does probably also reinitialize some other registers.<br><br />
Clearing bit0 does force following settings (while and as long as Bit0=0):<br />
SD_STOP_INTERNAL_ACTION = 0000h<br />
SD_RESPONSE0-7 = zerofilled<br />
SD_IRQ_STATUS0-1 = all IRQs flags acknowledged<br />
SD_CARD_CLK_CTL = bit 8 and 10 cleared<br />
SD_CARD_OPTION = 40EEh<br />
SD_CARD_INTERRUPT_CONTROL = 0000h<br />
All other registers seem to be left unaffected (including the the extra IRQ flags in 4004900h); though there may be some further hidden effects (like aborting transfers or resetting internal registers).<br><br />
Note: The DSi firmware does issue reset by toggling both bit0 and bit1, although bit1 does seem to be read-only (always 1), and trying to clear that bit doesn't seem to have any effect at all.<br />
<br />
== DSi SD/MMC I/O Ports: Unknown/Unused Registers ==<br />
<br />
===40048F6h/4004AF6h - Firmware tests bit0 (but, always 0?) (RESERVED4)===<br />
15-1 Unknown (0)<br />
0 Unknown (tested by firmware) (usually 0) (R)<br />
<br />
===4004836h/4004A36h - SD_CARD_INTERRUPT_CONTROL ---- USED by SDIO===<br />
4004A36h is used in SDIO IRQ handler.<br><br />
On DSi, this register looks as so:<br />
15-2 Unknown (0)<br />
1 Unknown (gets set automatically after 2 seconds?) (and also R/W ?)<br />
0 Unknown (usually always 0) (tested by firmware?) (R?)<br />
Whilst old toshiba datasheets specify it as so:<br />
15-13 ? Unknown (zero on DSi)<br />
12 CINT0 SDIO Interrupt Flag (0=none/ack, 1=irq) (/IRQ aka Data1 pin)<br />
11-9 ? Unknown (zero on DSi)<br />
8 CIMSK0 SDIO Interrupt Mask (0=enable, 1=disable) (/IRQ aka Data1 pin)<br />
7-0 ? Unknown (zero on DSi)<br />
Acknowledge by writing CINT0=0, or CIMSK0=1 (uh, really?), or hard reset (unlike as for other SD/MMC interrupts, soft reset does not acknowlege this interrupt type?).<br />
<br />
===4004838h/4004A38h - SDCTL_CLK_AND_WAIT_CTL ---- USED by SDIO===<br />
4004A38h is used in SDIO IRQ handler.<br><br />
On DSi, this register looks as so (usually zero):<br />
15-14 Unknown (usually 0) (R/W)<br />
13-3 Unknown (0)<br />
2-0 Unknown (usually 0) (R/W)<br />
Whilst old toshiba datasheets specify it as so:<br />
15-0 Unknown (bit8 should be set after SD_CARD_CLK_CTL change?)<br />
<br />
Below registers don't seem to be used by existing software...<br />
<br />
===4004834h/4004A34h - SD_TRANSACTION_CTL - Transaction Control===<br />
15-10 Unknown/unused (appears to be always zero)<br />
9-8 Unknown (R/W)<br />
7-3 Unknown/unused (appears to be always zero)<br />
2 Unknown (R/W)<br />
1 Unknown/unused (appears to be always zero)<br />
0 Unknown (R/W)<br />
<br />
===40048F2h/4004AF2h - Can be 0003h===<br />
15-2 Unknown (0)<br />
1-0 Unknown (0..3) (R/W)<br />
<br />
===40048F4h/4004AF4h - Can be 0770h===<br />
15-11 Unknown (0)<br />
10-8 Unknown (0..7) (R/W)<br />
7 Unknown (0)<br />
6-4 Unknown (0..7) (R/W)<br />
3-0 Unknown (0)<br />
<br />
===40048FAh - Can be 0004h..0007h (nonzero, unlike SDIO) (RESERVED6)===<br />
15-3 Unknown (0)<br />
2 Unknown (usually set) (R)<br />
1-0 Unknown (0..3) (R/W? or rather R?)<br />
<br />
===40048FCh/4004AFCh - Can be 0024h..00FFh? (RESERVED7)===<br />
===40048FEh/4004AFEh - Can be 0024h..00FFh? (RESERVED8 / TC6371AF:Revision)===<br />
15-8 Unknown (0)<br />
7-0 Can be 24h..FFh parts (R) and parts (R/W)?<br />
<br />
===Unused Registers with Fixed value (all bits read-only, or write-only)===<br />
400482Ah/4004A2Ah 2 Fixed always zero?<br />
4004832h/4004A32h 2 Fixed always zero? ;(TC6371AF:BUF1 Data MSBs?)<br />
400483Ah/4004A3Ah 2 Fixed always zero? ;(SDCTL_SDIO_HOST_INFORMATION)<br />
400483Ch/4004A3Ch 2 Fixed always zero? ;(SDCTL_ERROR_CONTROL)<br />
400483Eh/4004A3Eh 2 Fixed always zero? ;(TC6387XB: LED_CONTROL)<br />
4004840h/4004A40h 2 Fixed always 003Fh?<br />
4004842h/4004A42h 2 Fixed always 002Ah?<br />
4004844h/4004A44h 6Eh Fixed always zerofilled?<br />
40048B2h/4004AB2h 2 Fixed always FFFFh?<br />
40048B4h/4004AB4h 6 Fixed always zerofilled?<br />
40048BAh/4004ABAh 2 Fixed always 0200h?<br />
40048BCh/4004ABCh 1Ch Fixed always zerofilled?<br />
40048DAh/4004ADAh 6 Fixed always zerofilled?<br />
40048E2h/4004AE2h 2 Fixed always 0009h? ;(RESERVED2/9, TC6371AF:CORE_REV)<br />
40048E4h/4004AE4h 2 Fixed always zero?<br />
40048E6h/4004AE6h 2 Fixed always zero? ;(RESERVED3, TC6371AF:BUF_ADR)<br />
40048E8h/4004AE8h 2 Fixed always zero? ;(TC6371AF:Resp_Header)<br />
40048EAh/4004AEAh 6 Fixed always zerofilled?<br />
40048F0h/4004AF0h 2 Fixed always zero? ;(RESERVED10)<br />
40048F8h 2 Fixed always 0004h? (unlike SDIO) (RESERVED5)<br />
4004AF8h 2 Fixed always zero? (unlike SD) (RESERVED5)<br />
4004AFAh 2 Fixed always zero? (unlike SD) (RESERVED6)<br />
4004902h/4004B02h 2 Fixed always zero?<br />
4004906h/4004B06h 2 Fixed always zero?<br />
400490Ah/4004B0Ah 2 Fixed always zero?<br />
4004910h/4004B10h F0h Fixed always zerofilled?<br />
<br />
== Links ==<br />
* [http://gbatemp.net/threads/dsi-reverse-engineering-sd-mmc-sdio-registers.395787/ DSi SD/MMC reverse engineering thread in gbatemp forum]</div>Nocashhttps://dsibrew.org/w/index.php?title=SD/MMC/SDIO_Registers&diff=2098817SD/MMC/SDIO Registers2015-08-31T10:31:37Z<p>Nocash: </p>
<hr />
<div>SD_xxx is used to access onboard eMMC and external SD card slot (as selected via SD_CARD_PORT_SELECT).<br><br />
SDIO_xxx is used to access the Atheros Wifi unit.<br />
<br />
== DSi SD/MMC I/O Map ==<br />
<br />
'''ARM7 DSi SD/MMC Registers for Memory Card access (SD Card and onboard eMMC)'''<br />
4004800h 2 SD_CMD Command and Response/Data Type<br />
4004802h 2 SD_CARD_PORT_SELECT (SD/MMC:020Fh, SDIO:010Fh)<br />
4004804h 4 SD_CMD_PARAM0-1 Argument (32bit, 2 halfwords)<br />
4004808h 2 SD_STOP_INTERNAL_ACTION<br />
400480Ah 2 SD_DATA16_BLK_COUNT "Transfer Block Count"<br />
400480Ch 16 SD_RESPONSE0-7 (128bit, 8 halfwords)<br />
400481Ch 4 SD_IRQ_STATUS0-1 ;IRQ Status (0=ack, 1=req)<br />
4004820h 4 SD_IRQ_MASK0-1 ;IRQ Disable (0=enable, 1=disable)<br />
4004824h 2 SD_CARD_CLK_CTL Card Clock Control<br />
4004826h 2 SD_DATA16_BLK_LEN Memory Card Transfer Data Length<br />
4004828h 2 SD_CARD_OPTION Memory Card Option Setup (can be C0FFh)<br />
400482Ah 2 Fixed always zero?<br />
400482Ch 4 SD_ERROR_DETAIL_STATUS0-1 Error Detail Status<br />
4004830h 2 SD_DATA16_FIFO Data Port (SD_FIFO?)<br />
4004832h 2 Fixed always zero? ;(TC6371AF:BUF1 Data MSBs?)<br />
4004834h 2 ? SD_TRANSACTION_CTL Transaction Control<br />
4004836h 2 ? SD_CARD_INTERRUPT_CONTROL ;4004A36h used in SDIO IRQ handler<br />
4004838h 2 ? SD_CLK_AND_WAIT_CTL ;4004A38h used in SDIO IRQ handler<br />
400483Ah 2 Fixed always zero? ;(SDCTL_SDIO_HOST_INFORMATION)<br />
400483Ch 2 Fixed always zero? ;(SDCTL_ERROR_CONTROL)<br />
400483Eh 2 Fixed always zero? ;(TC6387XB: LED_CONTROL)<br />
4004840h 2 Fixed always 003Fh?<br />
4004842h 2 Fixed always 002Ah?<br />
4004844h 6Eh Fixed always zerofilled?<br />
40048B2h 2 Fixed always FFFFh?<br />
40048B4h 6 Fixed always zerofilled?<br />
40048BAh 2 Fixed always 0200h?<br />
40048BCh 1Ch Fixed always zerofilled?<br />
40048D8h 2 SD_DATA_CTL<br />
40048DAh 6 Fixed always zerofilled?<br />
40048E0h 2 SD_SOFT_RESET Software Reset (bit0=SRST=0=reset)<br />
40048E2h 2 Fixed always 0009h? ;(RESERVED2/9, TC6371AF:CORE_REV)<br />
40048E4h 2 Fixed always zero?<br />
40048E6h 2 Fixed always zero? ;(RESERVED3, TC6371AF:BUF_ADR)<br />
40048E8h 2 Fixed always zero? ;(TC6371AF:Resp_Header)<br />
40048EAh 6 Fixed always zerofilled?<br />
40048F0h 2 Fixed always zero? ;(RESERVED10)<br />
40048F2h 2 ? Can be 0003h<br />
40048F4h 2 ? Can be 0770h<br />
40048F6h 2 ? Firmware tests bit0 (but, always 0?) (RESERVED4)<br />
40048F8h 2 Fixed always 0004h? (nonzero, unlike SDIO) (RESERVED5)<br />
40048FAh 2 ? Can be 0004h..0007h (nonzero, unlike SDIO) (RESERVED6)<br />
40048FCh 2 ? Can be 0024h..00FFh? (RESERVED7)<br />
40048FEh 2 ? Can be 0024h..00FFh? (RESERVED8 / TC6371AF:Revision)<br />
4004900h 2 SD_DATA32_IRQ<br />
4004902h 2 Fixed always zero?<br />
4004904h 2 SD_DATA32_BLK_LEN<br />
4004906h 2 Fixed always zero?<br />
4004908h 2 SD_DATA32_BLK_COUNT<br />
400490Ah 2 Fixed always zero?<br />
400490Ch 4 SD_DATA32_FIFO<br />
4004910h F0h Fixed always zerofilled?<br />
'''ARM7 DSi SD/MMC Registers for SDIO access (for Atheros Wifi)'''<br />
4004A00h 200h SDIO_xxx (same as SD_xxx at 4004800h..40049FFh, see there)<br />
4004A02h 2 SDIO_CARD_PORT_SELECT (slightly different than 4004802h)<br />
4004AF8h 2 Fixed always zero? (unlike SD_xxx at 40048F8h) (RESERVED5)<br />
4004AFAh 2 Fixed always zero? (unlike SD_xxx at 40048FAh) (RESERVED6)<br />
<br />
== DSi SD/MMC I/O Ports: Command/Param/Response/Data ==<br />
<br />
===4004800h/4004A00h - SD_CMD - Command and Response/Data Type (R/W)===<br />
15 undoc Unknown/undoc (read/write-able)<br />
14 undoc Security Cmd (0=Normal, 1=Whatever/Security) (sdio?)<br />
13 undoc Data Length (0=Single Block, 1=Multiple Blocks)<br />
12 undoc Data Direction (0=Write, 1=Read)<br />
11 NTDT Data Transfer (0=No data, 1=With data)<br />
10-8 REP2-0 Response Type (0..2=Unknown/Reserved, 3=None, 4=48bit,<br />
5=48bit+Busy, 6=136bit, 7=48bitOcrWithoutCRC7)<br />
7-6 CMD1-0 Command Type (0=CMD, 1=ACMD, 2..3=unknown, maybe GEN WR/RD?)<br />
5-0 CIX Command Index (0..3Fh, command index)<br />
Invalid values can cause ILA error (particulary on setting NTDT for CMD12, or for CMD's Response=None). ILA error will also occur if an old CMD is still busy.<br><br />
DSi software is always writing just ZERO to bit11-6 though? Maybe the hardware does automatically know which SD/MMC CMDs and ACMDs have data? Or maybe data is always automatically transferred when receiving a data-startbit, or when writing to data register - and bits like NTDT would be needed only for things like proper data timeout handling?<br />
<br />
===4004804h/4004A04h - SD_CMD_PARAM0-1 - Argument (32bit, 2 halfwords) (R/W)===<br />
31-0 Parameter value for CMD<br />
The parameter value should be written <before> sending the command via SD_CMD/SDIO_CMD.<br />
<br />
===400480Ch/4004A0Ch - SD_RESPONSE0-7 - Response (128bit, 8 halfwords) (R)===<br />
After sending a command, wait for the CMDRESPEND bit (IRQ_STATUS.bit0) to get<br />
set, then read the RESPONSE (if the command does have any response).<br />
For normal 32bit responses:<br />
31-0 Response<br />
127-32 Older Responses<br />
For CID/CSD responses:<br />
119-0 120bit Response<br />
127-120 Zero (always?)<br />
Seems to be left-shifted when receiving response bits. So, for 32bit responses, bit0-31 would contain the current response, and bit32-127 would contain older responses.<br />
<br />
===DATA16 vs DATA32===<br />
Data can be transferred in 16bit or 32bit units (as selected in DATA_CTL.bit1 and DATA32_IRQ.bit1). There are separate data, block len, and block count registers for 16bit and 32bit mode (that's probably due to some odd patchwork, where the manufacturer has added 32bit support to the original 16bit chip design).<br><br />
Naturally, a 32bit transfer is faster than two 16bit transfers. Nethertheless, the DSi firmware does use both 32bit and 16bit mode once and then; 32bit mode is required for NDMA transfers (which don't support 16bit).<br />
<br />
===40048D8h/4004AD8h - SD_DATA_CTL===<br />
15-13 Unknown (usually 0)<br />
12 Unknown (usually 1) (R?)<br />
11-6 Unknown (usually 0)<br />
5 Unknown (read/write-able) (usually 0) (R/W)<br />
4 Unknown (usually 1) (R?)<br />
3-2 Unknown (usually 0)<br />
1 Select 16bit/32bit Data Mode (0=DATA16, 1=DATA32, see 4004900h) (R/W)<br />
0 Unknown (usually 0)<br />
Known written values are 0000h and 0002h. However, known read values are 1010h and 1012h.<br><br />
DATA32 mode requires setting both 40048D8h.bit1 and 4004900h.bit1. For DATA16 mode, both bits should be zero (though DATA16 seems to be also working the same way when only either of the bits is zero).<br />
<br />
===400480Ah/4004A0Ah - SD_DATA16_BLK_COUNT - "Transfer Block Count" (R/W)===<br />
===4004908h/4004B08h - SD_DATA32_BLK_COUNT (R/W)===<br />
15-0 Number of Data Blocks for multiple read/write commands (0..FFFFh)<br />
In Data32 mode, DATA32_BLK_COUNT is decremented after each block (except after the last block, where it stays at 0001h instead of getting zero). In Data16 mode, SD_DATA16_BLK_COUNT doesn't decrease (instead, there must be some hidden internal counter register).<br><br />
If enabled in STOP_INTERNAL_ACTION.bit8, then the hardware will be automatically sending STOP_TRANSMISSION (CMD12) after the last block (otherwise the decrement occurs as described above, but the hardware keeps transferring blocks infinitely).<br />
<br />
===4004826h/4004A26h - SD_DATA16_BLK_LEN - Transfer Data Length (R/W)===<br />
===4004904h/4004B04h - SD_DATA32_BLK_LEN (R/W)===<br />
15-10 Unknown/unused (appears to be always zero)<br />
9-0 Data Block Length in bytes (for DATA16: clipped to max 0200h by hw)<br />
Should be usually 0200h (for 512-byte SD/MMC memory blocks). Other values may be needed for SDIO functions, or when accessing SSR/SCR/PWD registers via data transfers.<br><br />
DATA32_BLK_LEN can be max 3FFh (unlike DATA16_BLK_LEN which is clipped to<br />
max=200h by hardware).<br />
<br />
===4004830h/4004A30h - SD_DATA16_FIFO - Data Port (SD_FIFO?)===<br />
===400490Ch/4004B0Ch - SD_DATA32_FIFO===<br />
For Data16:<br />
15-0 Data (16bit) (...or could it be accessed as 32bit, too?)<br />
For Data32:<br />
31-0 Data (32bit) (...or could it be accessed as 16bit, too?)<br />
Transfer data here (read after RXRDY gets set, or write after TXRQ gets set).<br />
FIFO size is unknown (if there's any FIFO behind it).<br />
<br />
== DSi SD/MMC I/O Ports: Interrupt/Status ==<br />
<br />
===400481Ch/4004A1Ch - SD_IRQ_STATUS0-1 - Interrupt Status (R/ack)===<br />
===4004820h/4004A20h - SD_IRQ_MASK0-1 - Interrupt Mask (R/W)===<br />
The IRQ_STATUS registers contain acknowledge-able IRQ Flags (those bits that that are maskable in IRQ_MASK register), as well as static read-only status bits without IRQ function (eg. WRPROTECT).<br />
*IRQ Flags/Write (0=Acknowledge, 1=No change)<br />
*IRQ Flags/Read (0=No IRQ, 1=IRQ)<br />
*IRQ Mask (0=Enable, 1=Disable) (8B7F031Dh when all IRQs disabled)<br />
Bit Stat Mask Function<br />
0 SREP MREP CMDRESPEND (response end) (or R1b: busy end)<br />
1 0 0 Unknown/unused (always 0)<br />
2 SRWA MRWA DATAEND (set after (last) data block end)<br />
3 SCOT MCOT CARD_REMOVE (0=No event, 1=Is/was newly ejected) ;\<br />
4 SCIN MCIN CARD_INSERT (0=No event, 1=Is/was newly inserted) ; SD<br />
5 undoc 0 SIGSTATE (0=Ejected, 1=Inserted) (SDIO: always 1) ; Slot<br />
6 0 0 Unknown/unused (always 0) ; Sw's<br />
7 undoc 0 WRPROTECT (0=Locked/Ejected, 1=Unlocked/HalfEjected);/<br />
8 undoc undoc CARD_REMOVE_A (0=No event, 1=High-to-Low occurred) ;\SD<br />
9 undoc undoc CARD_INSERT_A (0=No event, 1=Low-to-High óccurred) ; Slot<br />
10 undoc 0 SIGSTATE_A (usually 1=High) ;also as so for SDIO ;/Data3<br />
11 0 0 Unknown/unused (always 0)<br />
12 0 0 Unknown/unused (always 0)<br />
13 0 0 Unknown/unused (always 0)<br />
14 0 0 Unknown/unused (always 0)<br />
15 0 0 Unknown/unused (always 0)<br />
16 SCIX MCIX CMD_IDX_ERR Bad CMD-index in response (RCMDE,SCMDE)<br />
17 SCRC MCRC CRCFAIL CRC response error (WCRCE,RCRCE,SCRCE,CCRCE)<br />
18 SEND MEND STOPBIT_ERR End bit error (WEBER,REBER,SEBER,CEBER)<br />
19 SDTO MDTO DATATIMEOUT Data Timeout (NRCS,NWCS,KBSY)<br />
20 SFOF MFOF RXOVERFLOW HOST tried write full<br />
21 SFUF MFUF TXUNDERRUN HOST tried read empty<br />
22 SCTO MCTO CMDTIMEOUT Response start-bit timeout (NRS,NSR)<br />
23 1 ? 0 Unknown/undoc (usually set?)<br />
24 SBRE MBRE RXRDY (fifo not empty) (request data read)<br />
25 SBWE MBWE TXRQ (datafifoempty?) (request data write)<br />
26 0 0 Unknown/unused (always 0)<br />
27 undoc undoc Unknown/undoc (bit27 is mask-able in IRQ_MASK)<br />
28 0 0 Unknown/unused (always 0)<br />
29 undoc 0 CMD_READY? (inverse of BUSY?) (unlike toshiba ILFSL/IFSMSK)<br />
30 undoc 0 CMD_BUSY<br />
31 ILA IMSK Illegal Command Access (old CMD still busy, or wrong NTDT)<br />
Normally, IRQs should be acknowledged by writing "FLAGS=NOT X", whilst the firmware is using an unstable "FLAGS=FLAGS AND NOT X" read-modify-write function (accidentally acknowledging any IRQs that have newly occurred during that operation).<br />
<br />
===4004900h/4004B00h - SD_DATA32_IRQ===<br />
15-13 Unknown/unused (appears to be always zero)<br />
12 DATA32_BUSY IRQ Enable (0=Disable, 1=Enable) (R/W)<br />
11 DATA32_RXRDY IRQ Enable (0=Disable, 1=Enable) (R/W)<br />
10 DATA32 Abort/Flush FIFO? (0=No change, 1=Clear Bit8,9) (W)<br />
9 DATA32_BUSY IRQ Flag (auto cleared after...) (R)<br />
8 DATA32_RXRDY IRQ Flag (auto cleared after...) (R)<br />
7-2 Unknown/unused (appears to be always zero)<br />
1 Select 16bit/32bit Data Mode (0=DATA16, 1=DATA32, see 40048D8h) (R/W)<br />
0 Unknown/unused (appears to be always zero)<br />
Can be 1A02h, but changes to 1802h after reading from somewhere (maybe from DATA32_FIFO?).<br><br />
Bit8,9 are extra IRQ flags, the flags get set ONLY in DATA32 mode (not in DATA16 mode).<br />
<br />
===400482Ch/4004A2Ch - SD_ERROR_DETAIL_STATUS0-1 - Error Detail Status===<br />
31-23 ? Unknown/unused/undoc<br />
22 KBSY Timeout for CRC status busy timeout ;\STAT.19<br />
21 NWCS Timeout for CRC status timeout ; (SDTO)<br />
20 NRCS Timeout for Data start-bit, or for Post Data Busy ;/<br />
19-18 ? Unknown/unused/undoc<br />
17 NRS Response timeout for auto-issued CMD12 ;\STAT.22<br />
16 NCR Response timeout for non-auto-issued CMD's ;/(SCTO)<br />
15-14 ? Unknown/unused/undoc<br />
13 ?? Unknown/undoc (bit13 can be nonzero on DSi!) (always 1?) (R?)<br />
12 ? Unknown/unused/undoc<br />
11 WCRCE CRC error for Write CRC status for a write command ;\<br />
10 RCRCE CRC error for read data ; STAT.17<br />
9 SCRCE CRC error for a response for auto-issued CMD12 ; (SCRC)<br />
8 CCRCE CRC error for a response for non-auto-issued CMD's ;/<br />
5 WEBER End bit error for Write CRC status ;\<br />
4 REBER End bit error for read data ; STAT.18<br />
3 SEBER End bit error for response for auto-issued CMD12 ; (SEND)<br />
2 CEBER End bit error for response for non-auto-issued CMD's ;/<br />
1? SCMDE Bad CMD-index in response of auto-issued CMD12 ;\STAT.16<br />
0 RCMDE Bad CMD-index in response of non-auto-issued CMD's ;/(SCIX)<br />
Unknown if/when/how the error bits can be reset/acknowledged.<br><br />
Note: CMD12 is STOP_TRANSMISSION (maybe sent after BLK_COUNT?).<br><br />
The four "auto-issued CMD12" bits exist for SD registers only (not SDIO).<br><br />
SCMDE is probably in bit1 (though, official specs say bit0, which would be same as RCMDE).<br />
<br />
== DSi SD/MMC I/O Ports: Control Registers ==<br />
<br />
===4004802h/4004A02h - SD_CARD_PORT_SELECT===<br />
15-11 Unknown/unused (appears to be always zero)<br />
10 Unknown (write: should be 1, read: usually/always 0) (W?)<br />
9 Unknown (write: should be 0, read: usually 1 for SD) (R?)<br />
8 Unknown (write: should be 0, read: usually 1 for SDIO) (R?)<br />
7-4 Unknown/unused (appears to be always zero)<br />
3-1 Unknown (R/W)<br />
0 Port Select (0=SD Card Slot, 1=Onboard eMMC) (for SDIO: Unknown)(R/W)<br />
<br />
===4004828h/4004A28h - SD_CARD_OPTION - Card Option Setup===<br />
15 Bus Width (0=4bit, 1=1bit) (R/W)<br />
14 Unknown (usually set) (R?)<br />
13-9 Unknown/unused (appears to be always zero)<br />
8 Unknown (firmware toggles this after CLK change?) (W?)<br />
7-4 Unknown, maybe some 4bit timing/timeout value (R/W)<br />
0-3 Unknown, maybe another 4bit timing/timeout value (R/W)<br />
Among others, this register should contain a 4bit timeout setting, "RTO[3:0] for SD (aka TO[3:0] for SDIO) timeout period for data start/busy bits, in the form of a multiple number of the SDCLK period."<br><br />
Unknown which "multiple numbers" that's referring to (probably some exponential/table values).<br><br />
Settings spotted on DSi are 40E0h,40EEh.<br />
<br />
===4004824h/4004A24h - SD_CARD_CLK_CTL Card Clock Control===<br />
15-11 Unknown (always 0) ;unlike Toshiba: no HCLK divider-disable in bit15)<br />
10 Unknown (0=Normal, 1=Unknown, doesn't affect SDCLK output?) (R/W)<br />
9 Unknown (0=Normal, 1=Unknown, freezes SDCLK output?) (R/W)<br />
8 SDCLK Enable (0=Force SDCLK=LOW, 1=Output SDCLK=HCLK/n) (R/W)<br />
7-0 HCLK Div (0,1,2,4,8,16,32,64,128 = Div2,4,8,16,32,64,128,256,512) (R/W)<br />
The DSi uses HCLK=33.513982 MHz, the SDCLK pin can range from HCLK/512=65kHz to HCLK/2=16.757MHz, max transfer rate would be thus 8MByte/s in 4bit mode.<br><br />
Card detection should be done at a low clock rate. For SD/MMC, the DSi starts with HCLK/128, and uses the clock specified in CSD register after detection (when extracting bits from CSD: mind the different 120bit-without-CRC vs 128bit-with-CRC notations). For SDIO, the DSi starts with HCLK/256, and switches to HCLK/2 after reading SDIO Bus Speed register (Function0:00013h).<br><br />
The SDCLK pins are permanently pulsed, even for devices deselected via SD_CARD_PORT_SELECT.0, and even if no CMD or DATA is being transferred. However, the DSi firmware is usually stopping SDCLK via Bit8=0 when not accessing SD/MMC (doing so may reduce noise and power consumption).<br><br />
Trying to set bit9, or to set more than one bit in bit7-0 will freeze the SDCLK output (in this case SDCLK may get stuck HIGH or LOW, unlike Bit8=0 which forces LOW).<br />
<br />
===4004808h/4004A08h - SD_STOP_INTERNAL_ACTION===<br />
15-9 Unknown/unused (appears to be always zero)<br />
8 Auto-Stop (1=Automatically send CMD12 after BLK_COUNT blocks) (R/W)<br />
7-1 Unknown/unused (appears to be always zero)<br />
0 Unknown (R/W)<br />
Stop whatever internal action for whatever purpose in whatever situation?<br><br />
Existing code does set bit8 (prior to changing SD_DATA16_BLK_COUNT).<br><br />
Existing code does clear bit0 (alongsides with IRQ enable/acknowlege or so).<br><br />
<br />
===40048E0h/4004AE0h - SD_SOFT_RESET - Software Reset===<br />
15-3 Unknown/unused (appears to be always zero)<br />
2 Unknown (always 1) (R?)<br />
1 Unknown (always 1) (though firmware tries to toggle this bit) (R?)<br />
0 SRST Soft Reset (0=Reset, 1=Release) (R/W)<br />
Software should apply reset after sensing card insertion/removal, and (thereafter) release reset in case of card insertion. Software reset does acknowledge all IRQs (except that from SDIO /IRQ pin?), and does probably also reinitialize some other registers.<br><br />
Clearing bit0 does force following settings (while and as long as Bit0=0):<br />
SD_STOP_INTERNAL_ACTION = 0000h<br />
SD_RESPONSE0-7 = zerofilled<br />
SD_IRQ_STATUS0-1 = all IRQs flags acknowledged<br />
SD_CARD_CLK_CTL = bit 8 and 10 cleared<br />
SD_CARD_OPTION = 40EEh<br />
SD_CARD_INTERRUPT_CONTROL = 0000h<br />
All other registers seem to be left unaffected (including the the extra IRQ flags in 4004900h); though there may be some further hidden effects (like aborting transfers or resetting internal registers).<br><br />
Note: The DSi firmware does issue reset by toggling both bit0 and bit1, although bit1 does seem to be read-only (always 1), and trying to clear that bit doesn't seem to have any effect at all.<br />
<br />
== DSi SD/MMC I/O Ports: Unknown/Unused Registers ==<br />
<br />
===40048F6h/4004AF6h - Firmware tests bit0 (but, always 0?) (RESERVED4)===<br />
15-1 Unknown (0)<br />
0 Unknown (tested by firmware) (usually 0) (R)<br />
<br />
===4004836h/4004A36h - SD_CARD_INTERRUPT_CONTROL ---- USED by SDIO===<br />
4004A36h is used in SDIO IRQ handler.<br><br />
On DSi, this register looks as so:<br />
15-2 Unknown (0)<br />
1 Unknown (gets set automatically after 2 seconds?) (and also R/W ?)<br />
0 Unknown (usually always 0) (tested by firmware?) (R?)<br />
Whilst old toshiba datasheets specify it as so:<br />
15-13 ? Unknown (zero on DSi)<br />
12 CINT0 SDIO Interrupt Flag (0=none/ack, 1=irq) (/IRQ aka Data1 pin)<br />
11-9 ? Unknown (zero on DSi)<br />
8 CIMSK0 SDIO Interrupt Mask (0=enable, 1=disable) (/IRQ aka Data1 pin)<br />
7-0 ? Unknown (zero on DSi)<br />
Acknowledge by writing CINT0=0, or CIMSK0=1 (uh, really?), or hard reset (unlike as for other SD/MMC interrupts, soft reset does not acknowlege this interrupt type?).<br />
<br />
===4004838h/4004A38h - SDCTL_CLK_AND_WAIT_CTL ---- USED by SDIO===<br />
4004A38h is used in SDIO IRQ handler.<br><br />
On DSi, this register looks as so (usually zero):<br />
15-14 Unknown (usually 0) (R/W)<br />
13-3 Unknown (0)<br />
2-0 Unknown (usually 0) (R/W)<br />
Whilst old toshiba datasheets specify it as so:<br />
15-0 Unknown (bit8 should be set after SD_CARD_CLK_CTL change?)<br />
<br />
Below registers don't seem to be used by existing software...<br />
<br />
===4004834h/4004A34h - SD_TRANSACTION_CTL - Transaction Control===<br />
15-10 Unknown/unused (appears to be always zero)<br />
9-8 Unknown (R/W)<br />
7-3 Unknown/unused (appears to be always zero)<br />
2 Unknown (R/W)<br />
1 Unknown/unused (appears to be always zero)<br />
0 Unknown (R/W)<br />
<br />
===40048F2h/4004AF2h - Can be 0003h===<br />
15-2 Unknown (0)<br />
1-0 Unknown (0..3) (R/W)<br />
<br />
===40048F4h/4004AF4h - Can be 0770h===<br />
15-11 Unknown (0)<br />
10-8 Unknown (0..7) (R/W)<br />
7 Unknown (0)<br />
6-4 Unknown (0..7) (R/W)<br />
3-0 Unknown (0)<br />
<br />
===40048FAh - Can be 0004h..0007h (nonzero, unlike SDIO) (RESERVED6)===<br />
15-3 Unknown (0)<br />
2 Unknown (usually set) (R)<br />
1-0 Unknown (0..3) (R/W? or rather R?)<br />
<br />
===40048FCh/4004AFCh - Can be 0024h..00FFh? (RESERVED7)===<br />
===40048FEh/4004AFEh - Can be 0024h..00FFh? (RESERVED8 / TC6371AF:Revision)===<br />
15-8 Unknown (0)<br />
7-0 Can be 24h..FFh parts (R) and parts (R/W)?<br />
<br />
===Unused Registers with Fixed value (all bits read-only, or write-only)===<br />
400482Ah/4004A2Ah 2 Fixed always zero?<br />
4004832h/4004A32h 2 Fixed always zero? ;(TC6371AF:BUF1 Data MSBs?)<br />
400483Ah/4004A3Ah 2 Fixed always zero? ;(SDCTL_SDIO_HOST_INFORMATION)<br />
400483Ch/4004A3Ch 2 Fixed always zero? ;(SDCTL_ERROR_CONTROL)<br />
400483Eh/4004A3Eh 2 Fixed always zero? ;(TC6387XB: LED_CONTROL)<br />
4004840h/4004A40h 2 Fixed always 003Fh?<br />
4004842h/4004A42h 2 Fixed always 002Ah?<br />
4004844h/4004A44h 6Eh Fixed always zerofilled?<br />
40048B2h/4004AB2h 2 Fixed always FFFFh?<br />
40048B4h/4004AB4h 6 Fixed always zerofilled?<br />
40048BAh/4004ABAh 2 Fixed always 0200h?<br />
40048BCh/4004ABCh 1Ch Fixed always zerofilled?<br />
40048DAh/4004ADAh 6 Fixed always zerofilled?<br />
40048E2h/4004AE2h 2 Fixed always 0009h? ;(RESERVED2/9, TC6371AF:CORE_REV)<br />
40048E4h/4004AE4h 2 Fixed always zero?<br />
40048E6h/4004AE6h 2 Fixed always zero? ;(RESERVED3, TC6371AF:BUF_ADR)<br />
40048E8h/4004AE8h 2 Fixed always zero? ;(TC6371AF:Resp_Header)<br />
40048EAh/4004AEAh 6 Fixed always zerofilled?<br />
40048F0h/4004AF0h 2 Fixed always zero? ;(RESERVED10)<br />
40048F8h 2 Fixed always 0004h? (unlike SDIO) (RESERVED5)<br />
4004AF8h 2 Fixed always zero? (unlike SD) (RESERVED5)<br />
4004AFAh 2 Fixed always zero? (unlike SD) (RESERVED6)<br />
4004902h/4004B02h 2 Fixed always zero?<br />
4004906h/4004B06h 2 Fixed always zero?<br />
400490Ah/4004B0Ah 2 Fixed always zero?<br />
4004910h/4004B10h F0h Fixed always zerofilled?</div>Nocashhttps://dsibrew.org/w/index.php?title=SD/MMC/SDIO_Registers&diff=2098816SD/MMC/SDIO Registers2015-08-31T10:29:00Z<p>Nocash: /* DSi SD/MMC I/O Ports: Control */</p>
<hr />
<div>SD_xxx is used to access onboard eMMC and external SD card slot (as selected via SD_CARD_PORT_SELECT).<br><br />
SDIO_xxx is used to access the Atheros Wifi unit.<br />
<br />
== DSi SD/MMC I/O Map ==<br />
<br />
'''ARM7 DSi SD/MMC Registers for Memory Card access (SD Card and onboard eMMC)'''<br />
4004800h 2 SD_CMD Command and Response/Data Type<br />
4004802h 2 SD_CARD_PORT_SELECT (SD/MMC:020Fh, SDIO:010Fh)<br />
4004804h 4 SD_CMD_PARAM0-1 Argument (32bit, 2 halfwords)<br />
4004808h 2 SD_STOP_INTERNAL_ACTION<br />
400480Ah 2 SD_DATA16_BLK_COUNT "Transfer Block Count"<br />
400480Ch 16 SD_RESPONSE0-7 (128bit, 8 halfwords)<br />
400481Ch 4 SD_IRQ_STATUS0-1 ;IRQ Status (0=ack, 1=req)<br />
4004820h 4 SD_IRQ_MASK0-1 ;IRQ Disable (0=enable, 1=disable)<br />
4004824h 2 SD_CARD_CLK_CTL Card Clock Control<br />
4004826h 2 SD_DATA16_BLK_LEN Memory Card Transfer Data Length<br />
4004828h 2 SD_CARD_OPTION Memory Card Option Setup (can be C0FFh)<br />
400482Ah 2 Fixed always zero?<br />
400482Ch 4 SD_ERROR_DETAIL_STATUS0-1 Error Detail Status<br />
4004830h 2 SD_DATA16_FIFO Data Port (SD_FIFO?)<br />
4004832h 2 Fixed always zero? ;(TC6371AF:BUF1 Data MSBs?)<br />
4004834h 2 ? SD_TRANSACTION_CTL Transaction Control<br />
4004836h 2 ? SD_CARD_INTERRUPT_CONTROL ;4004A36h used in SDIO IRQ handler<br />
4004838h 2 ? SD_CLK_AND_WAIT_CTL ;4004A38h used in SDIO IRQ handler<br />
400483Ah 2 Fixed always zero? ;(SDCTL_SDIO_HOST_INFORMATION)<br />
400483Ch 2 Fixed always zero? ;(SDCTL_ERROR_CONTROL)<br />
400483Eh 2 Fixed always zero? ;(TC6387XB: LED_CONTROL)<br />
4004840h 2 Fixed always 003Fh?<br />
4004842h 2 Fixed always 002Ah?<br />
4004844h 6Eh Fixed always zerofilled?<br />
40048B2h 2 Fixed always FFFFh?<br />
40048B4h 6 Fixed always zerofilled?<br />
40048BAh 2 Fixed always 0200h?<br />
40048BCh 1Ch Fixed always zerofilled?<br />
40048D8h 2 SD_DATA_CTL<br />
40048DAh 6 Fixed always zerofilled?<br />
40048E0h 2 SD_SOFT_RESET Software Reset (bit0=SRST=0=reset)<br />
40048E2h 2 Fixed always 0009h? ;(RESERVED2/9, TC6371AF:CORE_REV)<br />
40048E4h 2 Fixed always zero?<br />
40048E6h 2 Fixed always zero? ;(RESERVED3, TC6371AF:BUF_ADR)<br />
40048E8h 2 Fixed always zero? ;(TC6371AF:Resp_Header)<br />
40048EAh 6 Fixed always zerofilled?<br />
40048F0h 2 Fixed always zero? ;(RESERVED10)<br />
40048F2h 2 ? Can be 0003h<br />
40048F4h 2 ? Can be 0770h<br />
40048F6h 2 ? Firmware tests bit0 (but, always 0?) (RESERVED4)<br />
40048F8h 2 Fixed always 0004h? (nonzero, unlike SDIO) (RESERVED5)<br />
40048FAh 2 ? Can be 0004h..0007h (nonzero, unlike SDIO) (RESERVED6)<br />
40048FCh 2 ? Can be 0024h..00FFh? (RESERVED7)<br />
40048FEh 2 ? Can be 0024h..00FFh? (RESERVED8 / TC6371AF:Revision)<br />
4004900h 2 SD_DATA32_IRQ<br />
4004902h 2 Fixed always zero?<br />
4004904h 2 SD_DATA32_BLK_LEN<br />
4004906h 2 Fixed always zero?<br />
4004908h 2 SD_DATA32_BLK_COUNT<br />
400490Ah 2 Fixed always zero?<br />
400490Ch 4 SD_DATA32_FIFO<br />
4004910h F0h Fixed always zerofilled?<br />
'''ARM7 DSi SD/MMC Registers for SDIO access (for Atheros Wifi)'''<br />
4004A00h 200h SDIO_xxx (same as SD_xxx at 4004800h..40049FFh, see there)<br />
4004A02h 2 SDIO_CARD_PORT_SELECT (slightly different than 4004802h)<br />
4004AF8h 2 Fixed always zero? (unlike SD_xxx at 40048F8h) (RESERVED5)<br />
4004AFAh 2 Fixed always zero? (unlike SD_xxx at 40048FAh) (RESERVED6)<br />
<br />
== DSi SD/MMC I/O Ports: Command/Param/Response/Data ==<br />
<br />
===4004800h/4004A00h - SD_CMD - Command and Response/Data Type (R/W)===<br />
15 undoc Unknown/undoc (read/write-able)<br />
14 undoc Security Cmd (0=Normal, 1=Whatever/Security) (sdio?)<br />
13 undoc Data Length (0=Single Block, 1=Multiple Blocks)<br />
12 undoc Data Direction (0=Write, 1=Read)<br />
11 NTDT Data Transfer (0=No data, 1=With data)<br />
10-8 REP2-0 Response Type (0..2=Unknown/Reserved, 3=None, 4=48bit,<br />
5=48bit+Busy, 6=136bit, 7=48bitOcrWithoutCRC7)<br />
7-6 CMD1-0 Command Type (0=CMD, 1=ACMD, 2..3=unknown, maybe GEN WR/RD?)<br />
5-0 CIX Command Index (0..3Fh, command index)<br />
Invalid values can cause ILA error (particulary on setting NTDT for CMD12, or for CMD's Response=None). ILA error will also occur if an old CMD is still busy.<br><br />
DSi software is always writing just ZERO to bit11-6 though? Maybe the hardware does automatically know which SD/MMC CMDs and ACMDs have data? Or maybe data is always automatically transferred when receiving a data-startbit, or when writing to data register - and bits like NTDT would be needed only for things like proper data timeout handling?<br />
<br />
===4004804h/4004A04h - SD_CMD_PARAM0-1 - Argument (32bit, 2 halfwords) (R/W)===<br />
31-0 Parameter value for CMD<br />
The parameter value should be written <before> sending the command via SD_CMD/SDIO_CMD.<br />
<br />
===400480Ch/4004A0Ch - SD_RESPONSE0-7 - Response (128bit, 8 halfwords) (R)===<br />
After sending a command, wait for the CMDRESPEND bit (IRQ_STATUS.bit0) to get<br />
set, then read the RESPONSE (if the command does have any response).<br />
For normal 32bit responses:<br />
31-0 Response<br />
127-32 Older Responses<br />
For CID/CSD responses:<br />
119-0 120bit Response<br />
127-120 Zero (always?)<br />
Seems to be left-shifted when receiving response bits. So, for 32bit responses, bit0-31 would contain the current response, and bit32-127 would contain older responses.<br />
<br />
===DATA16 vs DATA32===<br />
Data can be transferred in 16bit or 32bit units (as selected in DATA_CTL.bit1 and DATA32_IRQ.bit1). There are separate data, block len, and block count registers for 16bit and 32bit mode (that's probably due to some odd patchwork, where the manufacturer has added 32bit support to the original 16bit chip design).<br><br />
Naturally, a 32bit transfer is faster than two 16bit transfers. Nethertheless, the DSi firmware does use both 32bit and 16bit mode once and then; 32bit mode is required for NDMA transfers (which don't support 16bit).<br />
<br />
===40048D8h/4004AD8h - SD_DATA_CTL===<br />
15-13 Unknown (usually 0)<br />
12 Unknown (usually 1) (R?)<br />
11-6 Unknown (usually 0)<br />
5 Unknown (read/write-able) (usually 0) (R/W)<br />
4 Unknown (usually 1) (R?)<br />
3-2 Unknown (usually 0)<br />
1 Select 16bit/32bit Data Mode (0=DATA16, 1=DATA32, see 4004900h) (R/W)<br />
0 Unknown (usually 0)<br />
Known written values are 0000h and 0002h. However, known read values are 1010h and 1012h.<br><br />
DATA32 mode requires setting both 40048D8h.bit1 and 4004900h.bit1. For DATA16 mode, both bits should be zero (though DATA16 seems to be also working the same way when only either of the bits is zero).<br />
<br />
===400480Ah/4004A0Ah - SD_DATA16_BLK_COUNT - "Transfer Block Count" (R/W)===<br />
===4004908h/4004B08h - SD_DATA32_BLK_COUNT (R/W)===<br />
15-0 Number of Data Blocks for multiple read/write commands (0..FFFFh)<br />
In Data32 mode, DATA32_BLK_COUNT is decremented after each block (except after the last block, where it stays at 0001h instead of getting zero). In Data16 mode, SD_DATA16_BLK_COUNT doesn't decrease (instead, there must be some hidden internal counter register).<br><br />
If enabled in STOP_INTERNAL_ACTION.bit8, then the hardware will be automatically sending STOP_TRANSMISSION (CMD12) after the last block (otherwise the decrement occurs as described above, but the hardware keeps transferring blocks infinitely).<br />
<br />
===4004826h/4004A26h - SD_DATA16_BLK_LEN - Transfer Data Length (R/W)===<br />
===4004904h/4004B04h - SD_DATA32_BLK_LEN (R/W)===<br />
15-10 Unknown/unused (appears to be always zero)<br />
9-0 Data Block Length in bytes (for DATA16: clipped to max 0200h by hw)<br />
Should be usually 0200h (for 512-byte SD/MMC memory blocks). Other values may be needed for SDIO functions, or when accessing SSR/SCR/PWD registers via data transfers.<br><br />
DATA32_BLK_LEN can be max 3FFh (unlike DATA16_BLK_LEN which is clipped to<br />
max=200h by hardware).<br />
<br />
===4004830h/4004A30h - SD_DATA16_FIFO - Data Port (SD_FIFO?)===<br />
===400490Ch/4004B0Ch - SD_DATA32_FIFO===<br />
For Data16:<br />
15-0 Data (16bit) (...or could it be accessed as 32bit, too?)<br />
For Data32:<br />
31-0 Data (32bit) (...or could it be accessed as 16bit, too?)<br />
Transfer data here (read after RXRDY gets set, or write after TXRQ gets set).<br />
FIFO size is unknown (if there's any FIFO behind it).<br />
<br />
== DSi SD/MMC I/O Ports: Interrupt/Status ==<br />
<br />
===400481Ch/4004A1Ch - SD_IRQ_STATUS0-1 - Interrupt Status (R/ack)===<br />
===4004820h/4004A20h - SD_IRQ_MASK0-1 - Interrupt Mask (R/W)===<br />
The IRQ_STATUS registers contain acknowledge-able IRQ Flags (those bits that that are maskable in IRQ_MASK register), as well as static read-only status bits without IRQ function (eg. WRPROTECT).<br />
*IRQ Flags/Write (0=Acknowledge, 1=No change)<br />
*IRQ Flags/Read (0=No IRQ, 1=IRQ)<br />
*IRQ Mask (0=Enable, 1=Disable) (8B7F031Dh when all IRQs disabled)<br />
Bit Stat Mask Function<br />
0 SREP MREP CMDRESPEND (response end) (or R1b: busy end)<br />
1 0 0 Unknown/unused (always 0)<br />
2 SRWA MRWA DATAEND (set after (last) data block end)<br />
3 SCOT MCOT CARD_REMOVE (0=No event, 1=Is/was newly ejected) ;\<br />
4 SCIN MCIN CARD_INSERT (0=No event, 1=Is/was newly inserted) ; SD<br />
5 undoc 0 SIGSTATE (0=Ejected, 1=Inserted) (SDIO: always 1) ; Slot<br />
6 0 0 Unknown/unused (always 0) ; Sw's<br />
7 undoc 0 WRPROTECT (0=Locked/Ejected, 1=Unlocked/HalfEjected);/<br />
8 undoc undoc CARD_REMOVE_A (0=No event, 1=High-to-Low occurred) ;\SD<br />
9 undoc undoc CARD_INSERT_A (0=No event, 1=Low-to-High óccurred) ; Slot<br />
10 undoc 0 SIGSTATE_A (usually 1=High) ;also as so for SDIO ;/Data3<br />
11 0 0 Unknown/unused (always 0)<br />
12 0 0 Unknown/unused (always 0)<br />
13 0 0 Unknown/unused (always 0)<br />
14 0 0 Unknown/unused (always 0)<br />
15 0 0 Unknown/unused (always 0)<br />
16 SCIX MCIX CMD_IDX_ERR Bad CMD-index in response (RCMDE,SCMDE)<br />
17 SCRC MCRC CRCFAIL CRC response error (WCRCE,RCRCE,SCRCE,CCRCE)<br />
18 SEND MEND STOPBIT_ERR End bit error (WEBER,REBER,SEBER,CEBER)<br />
19 SDTO MDTO DATATIMEOUT Data Timeout (NRCS,NWCS,KBSY)<br />
20 SFOF MFOF RXOVERFLOW HOST tried write full<br />
21 SFUF MFUF TXUNDERRUN HOST tried read empty<br />
22 SCTO MCTO CMDTIMEOUT Response start-bit timeout (NRS,NSR)<br />
23 1 ? 0 Unknown/undoc (usually set?)<br />
24 SBRE MBRE RXRDY (fifo not empty) (request data read)<br />
25 SBWE MBWE TXRQ (datafifoempty?) (request data write)<br />
26 0 0 Unknown/unused (always 0)<br />
27 undoc undoc Unknown/undoc (bit27 is mask-able in IRQ_MASK)<br />
28 0 0 Unknown/unused (always 0)<br />
29 undoc 0 CMD_READY? (inverse of BUSY?) (unlike toshiba ILFSL/IFSMSK)<br />
30 undoc 0 CMD_BUSY<br />
31 ILA IMSK Illegal Command Access (old CMD still busy, or wrong NTDT)<br />
Normally, IRQs should be acknowledged by writing "FLAGS=NOT X", whilst the firmware is using an unstable "FLAGS=FLAGS AND NOT X" read-modify-write function (accidentally acknowledging any IRQs that have newly occurred during that operation).<br />
<br />
===4004900h/4004B00h - SD_DATA32_IRQ===<br />
15-13 Unknown/unused (appears to be always zero)<br />
12 DATA32_BUSY IRQ Enable (0=Disable, 1=Enable) (R/W)<br />
11 DATA32_RXRDY IRQ Enable (0=Disable, 1=Enable) (R/W)<br />
10 DATA32 Abort/Flush FIFO? (0=No change, 1=Clear Bit8,9) (W)<br />
9 DATA32_BUSY IRQ Flag (auto cleared after...) (R)<br />
8 DATA32_RXRDY IRQ Flag (auto cleared after...) (R)<br />
7-2 Unknown/unused (appears to be always zero)<br />
1 Select 16bit/32bit Data Mode (0=DATA16, 1=DATA32, see 40048D8h) (R/W)<br />
0 Unknown/unused (appears to be always zero)<br />
Can be 1A02h, but changes to 1802h after reading from somewhere (maybe from DATA32_FIFO?).<br><br />
Bit8,9 are extra IRQ flags, the flags get set ONLY in DATA32 mode (not in DATA16 mode).<br />
<br />
===400482Ch/4004A2Ch - SD_ERROR_DETAIL_STATUS0-1 - Error Detail Status===<br />
31-23 ? Unknown/unused/undoc<br />
22 KBSY Timeout for CRC status busy timeout ;\STAT.19<br />
21 NWCS Timeout for CRC status timeout ; (SDTO)<br />
20 NRCS Timeout for Data start-bit, or for Post Data Busy ;/<br />
19-18 ? Unknown/unused/undoc<br />
17 NRS Response timeout for auto-issued CMD12 ;\STAT.22<br />
16 NCR Response timeout for non-auto-issued CMD's ;/(SCTO)<br />
15-14 ? Unknown/unused/undoc<br />
13 ?? Unknown/undoc (bit13 can be nonzero on DSi!) (always 1?) (R?)<br />
12 ? Unknown/unused/undoc<br />
11 WCRCE CRC error for Write CRC status for a write command ;\<br />
10 RCRCE CRC error for read data ; STAT.17<br />
9 SCRCE CRC error for a response for auto-issued CMD12 ; (SCRC)<br />
8 CCRCE CRC error for a response for non-auto-issued CMD's ;/<br />
5 WEBER End bit error for Write CRC status ;\<br />
4 REBER End bit error for read data ; STAT.18<br />
3 SEBER End bit error for response for auto-issued CMD12 ; (SEND)<br />
2 CEBER End bit error for response for non-auto-issued CMD's ;/<br />
1? SCMDE Bad CMD-index in response of auto-issued CMD12 ;\STAT.16<br />
0 RCMDE Bad CMD-index in response of non-auto-issued CMD's ;/(SCIX)<br />
Unknown if/when/how the error bits can be reset/acknowledged.<br><br />
Note: CMD12 is STOP_TRANSMISSION (maybe sent after BLK_COUNT?).<br><br />
The four "auto-issued CMD12" bits exist for SD registers only (not SDIO).<br><br />
SCMDE is probably in bit1 (though, official specs say bit0, which would be same as RCMDE).<br />
<br />
== DSi SD/MMC I/O Ports: Control Registers ==<br />
<br />
===4004802h/4004A02h - SD_CARD_PORT_SELECT===<br />
15-11 Unknown/unused (appears to be always zero)<br />
10 Unknown (write: should be 1, read: usually/always 0) (W?)<br />
9 Unknown (write: should be 0, read: usually 1 for SD) (R?)<br />
8 Unknown (write: should be 0, read: usually 1 for SDIO) (R?)<br />
7-4 Unknown/unused (appears to be always zero)<br />
3-1 Unknown (R/W)<br />
0 Port Select (0=SD Card Slot, 1=Onboard eMMC) (for SDIO: Unknown)(R/W)<br />
<br />
===4004828h/4004A28h - SD_CARD_OPTION - Card Option Setup===<br />
15 Bus Width (0=4bit, 1=1bit) (R/W)<br />
14 Unknown (usually set) (R?)<br />
13-9 Unknown/unused (appears to be always zero)<br />
8 Unknown (firmware toggles this after CLK change?) (W?)<br />
7-4 Unknown, maybe some 4bit timing/timeout value (R/W)<br />
0-3 Unknown, maybe another 4bit timing/timeout value (R/W)<br />
Among others, this register should contain a 4bit timeout setting, "RTO[3:0] for SD (aka TO[3:0] for SDIO) timeout period for data start/busy bits, in the form of a multiple number of the SDCLK period."<br><br />
Unknown which "multiple numbers" that's referring to (probably some exponential/table values).<br><br />
Settings spotted on DSi are 40E0h,40EEh.<br />
<br />
===4004824h/4004A24h - SD_CARD_CLK_CTL Card Clock Control===<br />
15-11 Unknown (always 0) ;unlike Toshiba: no HCLK divider-disable in bit15)<br />
10 Unknown (0=Normal, 1=Unknown, doesn't affect SDCLK output?) (R/W)<br />
9 Unknown (0=Normal, 1=Unknown, freezes SDCLK output?) (R/W)<br />
8 SDCLK Enable (0=Force SDCLK=LOW, 1=Output SDCLK=HCLK/n) (R/W)<br />
7-0 HCLK Div (0,1,2,4,8,16,32,64,128 = Div2,4,8,16,32,64,128,256,512) (R/W)<br />
The DSi uses HCLK=33.513982 MHz, the SDCLK pin can range from HCLK/512=65kHz to HCLK/2=16.757MHz, max transfer rate would be thus 8MByte/s in 4bit mode.<br><br />
Card detection should be done at a low clock rate. For SD/MMC, the DSi starts with HCLK/128, and uses the clock specified in CSD register after detection (when extracting bits from CSD: mind the different 120bit-without-CRC vs 128bit-with-CRC notations). For SDIO, the DSi starts with HCLK/256, and switches to HCLK/2 after reading SDIO Bus Speed register (Function0:00013h).<br><br />
The SDCLK pins are permanently pulsed, even for devices deselected via SD_CARD_PORT_SELECT.0, and even if no CMD or DATA is being transferred. However, the DSi firmware is usually stopping SDCLK via Bit8=0 when not accessing SD/MMC (doing so may reduce noise and power consumption).<br><br />
Trying to set bit9, or to set more than one bit in bit7-0 will freeze the SDCLK output (in this case SDCLK may get stuck HIGH or LOW, unlike Bit8=0 which forces LOW).<br />
<br />
===4004808h/4004A08h - SD_STOP_INTERNAL_ACTION===<br />
15-9 Unknown/unused (appears to be always zero)<br />
8 Auto-Stop (1=Automatically send CMD12 after BLK_COUNT blocks) (R/W)<br />
7-1 Unknown/unused (appears to be always zero)<br />
0 Unknown (R/W)<br />
Stop whatever internal action for whatever purpose in whatever situation?<br><br />
Existing code does set bit8 (prior to changing SD_DATA16_BLK_COUNT).<br><br />
Existing code does clear bit0 (alongsides with IRQ enable/acknowlege or so).<br><br />
<br />
===40048E0h/4004AE0h - SD_SOFT_RESET - Software Reset===<br />
15-3 Unknown/unused (appears to be always zero)<br />
2 Unknown (always 1) (R?)<br />
1 Unknown (always 1) (though firmware tries to toggle this bit) (R?)<br />
0 SRST Soft Reset (0=Reset, 1=Release) (R/W)<br />
Software should apply reset after sensing card insertion/removal, and (thereafter) release reset in case of card insertion. Software reset does acknowledge all IRQs (except that from SDIO /IRQ pin?), and does probably also reinitialize some other registers.<br><br />
Clearing bit0 does force following settings (while and as long as Bit0=0):<br />
SD_STOP_INTERNAL_ACTION = 0000h<br />
SD_RESPONSE0-7 = zerofilled<br />
SD_IRQ_STATUS0-1 = all IRQs flags acknowledged<br />
SD_CARD_CLK_CTL = bit 8 and 10 cleared<br />
SD_CARD_OPTION = 40EEh<br />
SD_CARD_INTERRUPT_CONTROL = 0000h<br />
All other registers seem to be left unaffected (including the the extra IRQ flags in 4004900h); though there may be some further hidden effects (like aborting transfers or resetting internal registers).<br><br />
Note: The DSi firmware does issue reset by toggling both bit0 and bit1, although bit1 does seem to be read-only (always 1), and trying to clear that bit doesn't seem to have any effect at all.</div>Nocashhttps://dsibrew.org/w/index.php?title=SD/MMC/SDIO_Registers&diff=2098815SD/MMC/SDIO Registers2015-08-31T10:26:22Z<p>Nocash: /* DSi SD/MMC I/O Ports: Interrupt/Status */</p>
<hr />
<div>SD_xxx is used to access onboard eMMC and external SD card slot (as selected via SD_CARD_PORT_SELECT).<br><br />
SDIO_xxx is used to access the Atheros Wifi unit.<br />
<br />
== DSi SD/MMC I/O Map ==<br />
<br />
'''ARM7 DSi SD/MMC Registers for Memory Card access (SD Card and onboard eMMC)'''<br />
4004800h 2 SD_CMD Command and Response/Data Type<br />
4004802h 2 SD_CARD_PORT_SELECT (SD/MMC:020Fh, SDIO:010Fh)<br />
4004804h 4 SD_CMD_PARAM0-1 Argument (32bit, 2 halfwords)<br />
4004808h 2 SD_STOP_INTERNAL_ACTION<br />
400480Ah 2 SD_DATA16_BLK_COUNT "Transfer Block Count"<br />
400480Ch 16 SD_RESPONSE0-7 (128bit, 8 halfwords)<br />
400481Ch 4 SD_IRQ_STATUS0-1 ;IRQ Status (0=ack, 1=req)<br />
4004820h 4 SD_IRQ_MASK0-1 ;IRQ Disable (0=enable, 1=disable)<br />
4004824h 2 SD_CARD_CLK_CTL Card Clock Control<br />
4004826h 2 SD_DATA16_BLK_LEN Memory Card Transfer Data Length<br />
4004828h 2 SD_CARD_OPTION Memory Card Option Setup (can be C0FFh)<br />
400482Ah 2 Fixed always zero?<br />
400482Ch 4 SD_ERROR_DETAIL_STATUS0-1 Error Detail Status<br />
4004830h 2 SD_DATA16_FIFO Data Port (SD_FIFO?)<br />
4004832h 2 Fixed always zero? ;(TC6371AF:BUF1 Data MSBs?)<br />
4004834h 2 ? SD_TRANSACTION_CTL Transaction Control<br />
4004836h 2 ? SD_CARD_INTERRUPT_CONTROL ;4004A36h used in SDIO IRQ handler<br />
4004838h 2 ? SD_CLK_AND_WAIT_CTL ;4004A38h used in SDIO IRQ handler<br />
400483Ah 2 Fixed always zero? ;(SDCTL_SDIO_HOST_INFORMATION)<br />
400483Ch 2 Fixed always zero? ;(SDCTL_ERROR_CONTROL)<br />
400483Eh 2 Fixed always zero? ;(TC6387XB: LED_CONTROL)<br />
4004840h 2 Fixed always 003Fh?<br />
4004842h 2 Fixed always 002Ah?<br />
4004844h 6Eh Fixed always zerofilled?<br />
40048B2h 2 Fixed always FFFFh?<br />
40048B4h 6 Fixed always zerofilled?<br />
40048BAh 2 Fixed always 0200h?<br />
40048BCh 1Ch Fixed always zerofilled?<br />
40048D8h 2 SD_DATA_CTL<br />
40048DAh 6 Fixed always zerofilled?<br />
40048E0h 2 SD_SOFT_RESET Software Reset (bit0=SRST=0=reset)<br />
40048E2h 2 Fixed always 0009h? ;(RESERVED2/9, TC6371AF:CORE_REV)<br />
40048E4h 2 Fixed always zero?<br />
40048E6h 2 Fixed always zero? ;(RESERVED3, TC6371AF:BUF_ADR)<br />
40048E8h 2 Fixed always zero? ;(TC6371AF:Resp_Header)<br />
40048EAh 6 Fixed always zerofilled?<br />
40048F0h 2 Fixed always zero? ;(RESERVED10)<br />
40048F2h 2 ? Can be 0003h<br />
40048F4h 2 ? Can be 0770h<br />
40048F6h 2 ? Firmware tests bit0 (but, always 0?) (RESERVED4)<br />
40048F8h 2 Fixed always 0004h? (nonzero, unlike SDIO) (RESERVED5)<br />
40048FAh 2 ? Can be 0004h..0007h (nonzero, unlike SDIO) (RESERVED6)<br />
40048FCh 2 ? Can be 0024h..00FFh? (RESERVED7)<br />
40048FEh 2 ? Can be 0024h..00FFh? (RESERVED8 / TC6371AF:Revision)<br />
4004900h 2 SD_DATA32_IRQ<br />
4004902h 2 Fixed always zero?<br />
4004904h 2 SD_DATA32_BLK_LEN<br />
4004906h 2 Fixed always zero?<br />
4004908h 2 SD_DATA32_BLK_COUNT<br />
400490Ah 2 Fixed always zero?<br />
400490Ch 4 SD_DATA32_FIFO<br />
4004910h F0h Fixed always zerofilled?<br />
'''ARM7 DSi SD/MMC Registers for SDIO access (for Atheros Wifi)'''<br />
4004A00h 200h SDIO_xxx (same as SD_xxx at 4004800h..40049FFh, see there)<br />
4004A02h 2 SDIO_CARD_PORT_SELECT (slightly different than 4004802h)<br />
4004AF8h 2 Fixed always zero? (unlike SD_xxx at 40048F8h) (RESERVED5)<br />
4004AFAh 2 Fixed always zero? (unlike SD_xxx at 40048FAh) (RESERVED6)<br />
<br />
== DSi SD/MMC I/O Ports: Command/Param/Response/Data ==<br />
<br />
===4004800h/4004A00h - SD_CMD - Command and Response/Data Type (R/W)===<br />
15 undoc Unknown/undoc (read/write-able)<br />
14 undoc Security Cmd (0=Normal, 1=Whatever/Security) (sdio?)<br />
13 undoc Data Length (0=Single Block, 1=Multiple Blocks)<br />
12 undoc Data Direction (0=Write, 1=Read)<br />
11 NTDT Data Transfer (0=No data, 1=With data)<br />
10-8 REP2-0 Response Type (0..2=Unknown/Reserved, 3=None, 4=48bit,<br />
5=48bit+Busy, 6=136bit, 7=48bitOcrWithoutCRC7)<br />
7-6 CMD1-0 Command Type (0=CMD, 1=ACMD, 2..3=unknown, maybe GEN WR/RD?)<br />
5-0 CIX Command Index (0..3Fh, command index)<br />
Invalid values can cause ILA error (particulary on setting NTDT for CMD12, or for CMD's Response=None). ILA error will also occur if an old CMD is still busy.<br><br />
DSi software is always writing just ZERO to bit11-6 though? Maybe the hardware does automatically know which SD/MMC CMDs and ACMDs have data? Or maybe data is always automatically transferred when receiving a data-startbit, or when writing to data register - and bits like NTDT would be needed only for things like proper data timeout handling?<br />
<br />
===4004804h/4004A04h - SD_CMD_PARAM0-1 - Argument (32bit, 2 halfwords) (R/W)===<br />
31-0 Parameter value for CMD<br />
The parameter value should be written <before> sending the command via SD_CMD/SDIO_CMD.<br />
<br />
===400480Ch/4004A0Ch - SD_RESPONSE0-7 - Response (128bit, 8 halfwords) (R)===<br />
After sending a command, wait for the CMDRESPEND bit (IRQ_STATUS.bit0) to get<br />
set, then read the RESPONSE (if the command does have any response).<br />
For normal 32bit responses:<br />
31-0 Response<br />
127-32 Older Responses<br />
For CID/CSD responses:<br />
119-0 120bit Response<br />
127-120 Zero (always?)<br />
Seems to be left-shifted when receiving response bits. So, for 32bit responses, bit0-31 would contain the current response, and bit32-127 would contain older responses.<br />
<br />
===DATA16 vs DATA32===<br />
Data can be transferred in 16bit or 32bit units (as selected in DATA_CTL.bit1 and DATA32_IRQ.bit1). There are separate data, block len, and block count registers for 16bit and 32bit mode (that's probably due to some odd patchwork, where the manufacturer has added 32bit support to the original 16bit chip design).<br><br />
Naturally, a 32bit transfer is faster than two 16bit transfers. Nethertheless, the DSi firmware does use both 32bit and 16bit mode once and then; 32bit mode is required for NDMA transfers (which don't support 16bit).<br />
<br />
===40048D8h/4004AD8h - SD_DATA_CTL===<br />
15-13 Unknown (usually 0)<br />
12 Unknown (usually 1) (R?)<br />
11-6 Unknown (usually 0)<br />
5 Unknown (read/write-able) (usually 0) (R/W)<br />
4 Unknown (usually 1) (R?)<br />
3-2 Unknown (usually 0)<br />
1 Select 16bit/32bit Data Mode (0=DATA16, 1=DATA32, see 4004900h) (R/W)<br />
0 Unknown (usually 0)<br />
Known written values are 0000h and 0002h. However, known read values are 1010h and 1012h.<br><br />
DATA32 mode requires setting both 40048D8h.bit1 and 4004900h.bit1. For DATA16 mode, both bits should be zero (though DATA16 seems to be also working the same way when only either of the bits is zero).<br />
<br />
===400480Ah/4004A0Ah - SD_DATA16_BLK_COUNT - "Transfer Block Count" (R/W)===<br />
===4004908h/4004B08h - SD_DATA32_BLK_COUNT (R/W)===<br />
15-0 Number of Data Blocks for multiple read/write commands (0..FFFFh)<br />
In Data32 mode, DATA32_BLK_COUNT is decremented after each block (except after the last block, where it stays at 0001h instead of getting zero). In Data16 mode, SD_DATA16_BLK_COUNT doesn't decrease (instead, there must be some hidden internal counter register).<br><br />
If enabled in STOP_INTERNAL_ACTION.bit8, then the hardware will be automatically sending STOP_TRANSMISSION (CMD12) after the last block (otherwise the decrement occurs as described above, but the hardware keeps transferring blocks infinitely).<br />
<br />
===4004826h/4004A26h - SD_DATA16_BLK_LEN - Transfer Data Length (R/W)===<br />
===4004904h/4004B04h - SD_DATA32_BLK_LEN (R/W)===<br />
15-10 Unknown/unused (appears to be always zero)<br />
9-0 Data Block Length in bytes (for DATA16: clipped to max 0200h by hw)<br />
Should be usually 0200h (for 512-byte SD/MMC memory blocks). Other values may be needed for SDIO functions, or when accessing SSR/SCR/PWD registers via data transfers.<br><br />
DATA32_BLK_LEN can be max 3FFh (unlike DATA16_BLK_LEN which is clipped to<br />
max=200h by hardware).<br />
<br />
===4004830h/4004A30h - SD_DATA16_FIFO - Data Port (SD_FIFO?)===<br />
===400490Ch/4004B0Ch - SD_DATA32_FIFO===<br />
For Data16:<br />
15-0 Data (16bit) (...or could it be accessed as 32bit, too?)<br />
For Data32:<br />
31-0 Data (32bit) (...or could it be accessed as 16bit, too?)<br />
Transfer data here (read after RXRDY gets set, or write after TXRQ gets set).<br />
FIFO size is unknown (if there's any FIFO behind it).<br />
<br />
== DSi SD/MMC I/O Ports: Interrupt/Status ==<br />
<br />
===400481Ch/4004A1Ch - SD_IRQ_STATUS0-1 - Interrupt Status (R/ack)===<br />
===4004820h/4004A20h - SD_IRQ_MASK0-1 - Interrupt Mask (R/W)===<br />
The IRQ_STATUS registers contain acknowledge-able IRQ Flags (those bits that that are maskable in IRQ_MASK register), as well as static read-only status bits without IRQ function (eg. WRPROTECT).<br />
*IRQ Flags/Write (0=Acknowledge, 1=No change)<br />
*IRQ Flags/Read (0=No IRQ, 1=IRQ)<br />
*IRQ Mask (0=Enable, 1=Disable) (8B7F031Dh when all IRQs disabled)<br />
Bit Stat Mask Function<br />
0 SREP MREP CMDRESPEND (response end) (or R1b: busy end)<br />
1 0 0 Unknown/unused (always 0)<br />
2 SRWA MRWA DATAEND (set after (last) data block end)<br />
3 SCOT MCOT CARD_REMOVE (0=No event, 1=Is/was newly ejected) ;\<br />
4 SCIN MCIN CARD_INSERT (0=No event, 1=Is/was newly inserted) ; SD<br />
5 undoc 0 SIGSTATE (0=Ejected, 1=Inserted) (SDIO: always 1) ; Slot<br />
6 0 0 Unknown/unused (always 0) ; Sw's<br />
7 undoc 0 WRPROTECT (0=Locked/Ejected, 1=Unlocked/HalfEjected);/<br />
8 undoc undoc CARD_REMOVE_A (0=No event, 1=High-to-Low occurred) ;\SD<br />
9 undoc undoc CARD_INSERT_A (0=No event, 1=Low-to-High óccurred) ; Slot<br />
10 undoc 0 SIGSTATE_A (usually 1=High) ;also as so for SDIO ;/Data3<br />
11 0 0 Unknown/unused (always 0)<br />
12 0 0 Unknown/unused (always 0)<br />
13 0 0 Unknown/unused (always 0)<br />
14 0 0 Unknown/unused (always 0)<br />
15 0 0 Unknown/unused (always 0)<br />
16 SCIX MCIX CMD_IDX_ERR Bad CMD-index in response (RCMDE,SCMDE)<br />
17 SCRC MCRC CRCFAIL CRC response error (WCRCE,RCRCE,SCRCE,CCRCE)<br />
18 SEND MEND STOPBIT_ERR End bit error (WEBER,REBER,SEBER,CEBER)<br />
19 SDTO MDTO DATATIMEOUT Data Timeout (NRCS,NWCS,KBSY)<br />
20 SFOF MFOF RXOVERFLOW HOST tried write full<br />
21 SFUF MFUF TXUNDERRUN HOST tried read empty<br />
22 SCTO MCTO CMDTIMEOUT Response start-bit timeout (NRS,NSR)<br />
23 1 ? 0 Unknown/undoc (usually set?)<br />
24 SBRE MBRE RXRDY (fifo not empty) (request data read)<br />
25 SBWE MBWE TXRQ (datafifoempty?) (request data write)<br />
26 0 0 Unknown/unused (always 0)<br />
27 undoc undoc Unknown/undoc (bit27 is mask-able in IRQ_MASK)<br />
28 0 0 Unknown/unused (always 0)<br />
29 undoc 0 CMD_READY? (inverse of BUSY?) (unlike toshiba ILFSL/IFSMSK)<br />
30 undoc 0 CMD_BUSY<br />
31 ILA IMSK Illegal Command Access (old CMD still busy, or wrong NTDT)<br />
Normally, IRQs should be acknowledged by writing "FLAGS=NOT X", whilst the firmware is using an unstable "FLAGS=FLAGS AND NOT X" read-modify-write function (accidentally acknowledging any IRQs that have newly occurred during that operation).<br />
<br />
===4004900h/4004B00h - SD_DATA32_IRQ===<br />
15-13 Unknown/unused (appears to be always zero)<br />
12 DATA32_BUSY IRQ Enable (0=Disable, 1=Enable) (R/W)<br />
11 DATA32_RXRDY IRQ Enable (0=Disable, 1=Enable) (R/W)<br />
10 DATA32 Abort/Flush FIFO? (0=No change, 1=Clear Bit8,9) (W)<br />
9 DATA32_BUSY IRQ Flag (auto cleared after...) (R)<br />
8 DATA32_RXRDY IRQ Flag (auto cleared after...) (R)<br />
7-2 Unknown/unused (appears to be always zero)<br />
1 Select 16bit/32bit Data Mode (0=DATA16, 1=DATA32, see 40048D8h) (R/W)<br />
0 Unknown/unused (appears to be always zero)<br />
Can be 1A02h, but changes to 1802h after reading from somewhere (maybe from DATA32_FIFO?).<br><br />
Bit8,9 are extra IRQ flags, the flags get set ONLY in DATA32 mode (not in DATA16 mode).<br />
<br />
===400482Ch/4004A2Ch - SD_ERROR_DETAIL_STATUS0-1 - Error Detail Status===<br />
31-23 ? Unknown/unused/undoc<br />
22 KBSY Timeout for CRC status busy timeout ;\STAT.19<br />
21 NWCS Timeout for CRC status timeout ; (SDTO)<br />
20 NRCS Timeout for Data start-bit, or for Post Data Busy ;/<br />
19-18 ? Unknown/unused/undoc<br />
17 NRS Response timeout for auto-issued CMD12 ;\STAT.22<br />
16 NCR Response timeout for non-auto-issued CMD's ;/(SCTO)<br />
15-14 ? Unknown/unused/undoc<br />
13 ?? Unknown/undoc (bit13 can be nonzero on DSi!) (always 1?) (R?)<br />
12 ? Unknown/unused/undoc<br />
11 WCRCE CRC error for Write CRC status for a write command ;\<br />
10 RCRCE CRC error for read data ; STAT.17<br />
9 SCRCE CRC error for a response for auto-issued CMD12 ; (SCRC)<br />
8 CCRCE CRC error for a response for non-auto-issued CMD's ;/<br />
5 WEBER End bit error for Write CRC status ;\<br />
4 REBER End bit error for read data ; STAT.18<br />
3 SEBER End bit error for response for auto-issued CMD12 ; (SEND)<br />
2 CEBER End bit error for response for non-auto-issued CMD's ;/<br />
1? SCMDE Bad CMD-index in response of auto-issued CMD12 ;\STAT.16<br />
0 RCMDE Bad CMD-index in response of non-auto-issued CMD's ;/(SCIX)<br />
Unknown if/when/how the error bits can be reset/acknowledged.<br><br />
Note: CMD12 is STOP_TRANSMISSION (maybe sent after BLK_COUNT?).<br><br />
The four "auto-issued CMD12" bits exist for SD registers only (not SDIO).<br><br />
SCMDE is probably in bit1 (though, official specs say bit0, which would be same as RCMDE).<br />
<br />
== DSi SD/MMC I/O Ports: Control ==<br />
<br />
'''4004802h - SD_CARD_PORT_SELECT (0201h)'''<br><br />
'''4004A02h - SDIO_CARD_PORT_SELECT (0100h)'''<br><br />
15-11 Unknown/unused (appears to be always zero)<br />
10 Unknown (write: should be 1, read: usually/always 0) (W?)<br />
9 Unknown (write: should be 0, read: usually 1 for SD)<br />
8 Unknown (write: should be 0, read: usually 1 for SDIO)<br />
7-4 Unknown/unused (appears to be always zero)<br />
3-1 Unknown (R/W)<br />
0 Port Select (0=SD Card Slot, 1=Onboard eMMC) (for SDIO: Unknown)<br />
Known written values are 0400h and 0401h (SD). However known read values are<br />
0201h (SD) and 0100h (SDIO).<br />
<br />
<br />
'''4004828h - DSi: 40E0 - SD_CARD_OPTION - Memory Card Option Setup'''<br><br />
'''4004A28h - DSi: 40EE - SDIO_CARD_OPTION - Card Option Setup'''<br><br />
15 Bus Width (0=4bit, 1=1bit)<br />
14 Unknown (usually set)<br />
13-8 Unknown/unused (appears to be always zero)<br />
7-4 Unknown, maybe some 4bit timing/timeout value<br />
0-3 Unknown, maybe another 4bit timing/timeout value<br />
Settings spotted on DSi are 40E0h,40EEh.<br><br />
Among others, this register should contain a 4bit timeout setting, "RTO[3:0]<br />
for SD (aka TO[3:0] for SDIO) timeout period for data start/busy bits, in the<br />
form of a multiple number of the SDCLK period."<br><br />
Maybe also selects transfer CLK rate, or whatever.<br />
<br />
<br />
'''4004834h - DSi: 0000 - SD_TRANSACTION_CTL - Transaction Control'''<br><br />
'''4004A34h - DSi: 0000 - SDIO_TRANSACTION_CTL - Transaction Control'''<br><br />
15-10 Unknown/unused (appears to be always zero)<br />
9-8 Unknown<br />
7-3 Unknown/unused (appears to be always zero)<br />
2 Unknown<br />
1 Unknown/unused (appears to be always zero)<br />
0 Unknown<br />
Maybe also selects transfer CLK rate, or whatever.<br />
<br />
<br />
'''40048E0h - DSi: 0007 - SD_SOFT_RESET - Software Reset'''<br><br />
'''4004AE0h - DSi: 0006 - SDIO_SOFT_RESET - Software Reset'''<br><br />
15-3 Unknown/unused (appears to be always zero)<br />
2 ? Unknown (can be nonzero on DSi)<br />
1 ? Unknown (can be nonzero on DSi)<br />
0 SRST Soft Reset (0=Reset, 1=Release)<br />
Software should apply reset after sensing card insertion/removal, and<br />
(thereafter) release reset in case of card insertion. Software reset does<br />
acknowledge all IRQs (except that from SDIO /IRQ pin?), and does probably also<br />
reinitialize some other registers.<br />
<br />
<br />
'''4004808h - DSi: 0100 - SDCTL_STOP_INTERNAL_ACTION'''<br><br />
15-9 Unknown/unused (appears to be always zero)<br />
8 Unknown (1=Enable automatic sending of CMD12 after BLK_COUNT blocks?)<br />
7-1 Unknown/unused (appears to be always zero)<br />
0 Unknown<br />
Stop whatever internal action for whatever purpose in whatever situation?<br><br />
Existing code does set bit8 (prior to changing SD_DATA16_BLK_COUNT).<br><br />
Existing code does clear bit0 (alongsides with IRQ enable/acknowlege or so).<br />
<br />
<br />
'''4004824h - DSi: 0000 - DSi: Used? - SDCTL_CARD_CLK_CTL Card Clock Control'''<br><br />
Can be max 07FFh on DSi... ie. bit15 CANNOT be set?<br />
15 Disable HCLK divider (0=SDCLK selected via bit7-0, 1=SDCLK=HCLK)<br />
14-10 Unknown (zero on DSi)<br />
9 Unknown (set in some cases on DSi)<br />
8 Unknown (1=Start Clock, or Apply Clock Change, or so?)<br />
7-0 HCLK Div (0,1,2,4,8,10h,20h,40h,80h = Div2,4,8,16,32,64,128,256,512)<br />
Clock supply to SD Card<br><br />
The SDCLK signal is used for a provision of SD Memory Card or SDIO Card. Please<br />
refer to the following setting for enabling the SDCLK output.<br />
(1) Set Stop Clock Control Register (Config Offset:40h) to 1Fh.<br />
(2) Set D0 of SD Software Reset Register (Offset:0E0h) to 1b.<br />
(3) Set D7-0 of SD Card Clock Control Register (Offset:024h). These bits<br />
are used for setting the frequency of SDCLK.<br />
80h : SDCLK=HCLK/512<br />
40h : SDCLK=HCLK/256<br />
20h : SDCLK=HCLK/128<br />
10h : SDCLK=HCLK/64<br />
08h : SDCLK=HCLK/32<br />
04h : SDCLK=HCLK/16<br />
02h : SDCLK=HCLK/8<br />
01h : SDCLK=HCLK/4<br />
00h : SDCLK=HCLK/2<br />
In addition, TC6387XB holds a function that SDCLK can have same<br />
frequency as HCLK. In this case, D7-0 settings of SD Card Clock Control<br />
Register (Offset:024h) becomes invalid setting.<br />
* Set D0 of Clock Mode Register (Config Offset:42h) to 1b.<br />
* Set D15 of SD Card Clock Control Register (Offset:024h) to 1b.<br />
Please attend that the specification of SDCLK is max.25MHz at the case<br />
of SD Card and is max.20MHz at the case of MultiMedia Card.<br />
(4) D8 of SD Card Clock Control Register (Offset:024h) to 1b.<br />
(5) D8 of Clock & Wait Control Register (Offset:138h) to 1b.<br />
On the DSi, HCLK seems to be 33.513982 MHz.<br />
<br />
<br />
'''4004x38h - DSi: 0000 - SDCTL_CLK_AND_WAIT_CTL'''<br><br />
15-0 Unknown (zero on DSi)<br />
Maybe transfer CLK rate, or some master clock control for the clock input.<br />
<br />
<br />
'''4004x3Ah - DSi: 0000 - SDCTL_SDIO_HOST_INFORMATION'''<br><br />
'''4004x3Ch - DSi: 0000 - SDCTL_ERROR_CONTROL'''<br><br />
'''4004x3Eh - DSi: 0000 - SDCTL_SDLED_CONTROL - LED Control (TC6387XB only)'''<br><br />
15-0 Unknown (zero on DSi)<br />
<br />
<br />
'''40048E2h - DSi: 0009 - SDCTL_RESERVED2 (TC6371AF:CORE_REV)'''<br><br />
'''40048E6h - DSi: 0000 - SDCTL_RESERVED3 (TC6371AF:BUF_ADR)'''<br><br />
'''40048E8h - DSi: 0000 - UNDOC/UNUSED (TC6371AF:Resp_Header)'''<br><br />
'''40048F6h - DSi: 0000 - SDCTL_RESERVED4 --- used by DSi !!!'''<br><br />
'''40048F8h - DSi: 0004 - SDCTL_RESERVED5 <-- DSi: SD only (not SDIO)'''<br><br />
'''40048FAh - DSi: 0007 - SDCTL_RESERVED6 <-- DSi: SD only (not SDIO)'''<br><br />
'''40048FCh - DSi: 00FC - SDCTL_RESERVED7'''<br><br />
'''40048FEh - DSi: 00FF - SDCTL_RESERVED8 (TC6371AF:Revision)'''<br><br />
'''4004xE2h - DSi: 0000 - SDCTL_RESERVED9'''<br><br />
'''4004xF0h - DSi: 0000 - SDCTL_RESERVED10'''<br><br />
'''4004836h - DSi: 0002 - UNDOC! (bit1 can be set, other bits always 0)'''<br><br />
15-0 Unknown<br />
<br />
<br />
'''4004838h/4004A38h - DSi: C007 - UNDOC!'''<br><br />
'''4004840h/4004A40h - DSi: 003F - UNDOC?'''<br><br />
'''4004842h/4004A42h - DSi: 002A - UNDOC?'''<br><br />
'''40048B2h/4004AB2h - DSi: FFFF - UNDOC?'''<br><br />
'''40048BAh/4004ABAh - DSi: 0200 - UNDOC?'''<br><br />
'''40048F4h/4004AF4h - DSi: 0700 - UNDOC!'''<br><br />
15-0 Unknown</div>Nocashhttps://dsibrew.org/w/index.php?title=SD/MMC/SDIO_Registers&diff=2098814SD/MMC/SDIO Registers2015-08-31T10:24:04Z<p>Nocash: /* DSi SD/MMC I/O Ports: Command/Param/Response/Data */</p>
<hr />
<div>SD_xxx is used to access onboard eMMC and external SD card slot (as selected via SD_CARD_PORT_SELECT).<br><br />
SDIO_xxx is used to access the Atheros Wifi unit.<br />
<br />
== DSi SD/MMC I/O Map ==<br />
<br />
'''ARM7 DSi SD/MMC Registers for Memory Card access (SD Card and onboard eMMC)'''<br />
4004800h 2 SD_CMD Command and Response/Data Type<br />
4004802h 2 SD_CARD_PORT_SELECT (SD/MMC:020Fh, SDIO:010Fh)<br />
4004804h 4 SD_CMD_PARAM0-1 Argument (32bit, 2 halfwords)<br />
4004808h 2 SD_STOP_INTERNAL_ACTION<br />
400480Ah 2 SD_DATA16_BLK_COUNT "Transfer Block Count"<br />
400480Ch 16 SD_RESPONSE0-7 (128bit, 8 halfwords)<br />
400481Ch 4 SD_IRQ_STATUS0-1 ;IRQ Status (0=ack, 1=req)<br />
4004820h 4 SD_IRQ_MASK0-1 ;IRQ Disable (0=enable, 1=disable)<br />
4004824h 2 SD_CARD_CLK_CTL Card Clock Control<br />
4004826h 2 SD_DATA16_BLK_LEN Memory Card Transfer Data Length<br />
4004828h 2 SD_CARD_OPTION Memory Card Option Setup (can be C0FFh)<br />
400482Ah 2 Fixed always zero?<br />
400482Ch 4 SD_ERROR_DETAIL_STATUS0-1 Error Detail Status<br />
4004830h 2 SD_DATA16_FIFO Data Port (SD_FIFO?)<br />
4004832h 2 Fixed always zero? ;(TC6371AF:BUF1 Data MSBs?)<br />
4004834h 2 ? SD_TRANSACTION_CTL Transaction Control<br />
4004836h 2 ? SD_CARD_INTERRUPT_CONTROL ;4004A36h used in SDIO IRQ handler<br />
4004838h 2 ? SD_CLK_AND_WAIT_CTL ;4004A38h used in SDIO IRQ handler<br />
400483Ah 2 Fixed always zero? ;(SDCTL_SDIO_HOST_INFORMATION)<br />
400483Ch 2 Fixed always zero? ;(SDCTL_ERROR_CONTROL)<br />
400483Eh 2 Fixed always zero? ;(TC6387XB: LED_CONTROL)<br />
4004840h 2 Fixed always 003Fh?<br />
4004842h 2 Fixed always 002Ah?<br />
4004844h 6Eh Fixed always zerofilled?<br />
40048B2h 2 Fixed always FFFFh?<br />
40048B4h 6 Fixed always zerofilled?<br />
40048BAh 2 Fixed always 0200h?<br />
40048BCh 1Ch Fixed always zerofilled?<br />
40048D8h 2 SD_DATA_CTL<br />
40048DAh 6 Fixed always zerofilled?<br />
40048E0h 2 SD_SOFT_RESET Software Reset (bit0=SRST=0=reset)<br />
40048E2h 2 Fixed always 0009h? ;(RESERVED2/9, TC6371AF:CORE_REV)<br />
40048E4h 2 Fixed always zero?<br />
40048E6h 2 Fixed always zero? ;(RESERVED3, TC6371AF:BUF_ADR)<br />
40048E8h 2 Fixed always zero? ;(TC6371AF:Resp_Header)<br />
40048EAh 6 Fixed always zerofilled?<br />
40048F0h 2 Fixed always zero? ;(RESERVED10)<br />
40048F2h 2 ? Can be 0003h<br />
40048F4h 2 ? Can be 0770h<br />
40048F6h 2 ? Firmware tests bit0 (but, always 0?) (RESERVED4)<br />
40048F8h 2 Fixed always 0004h? (nonzero, unlike SDIO) (RESERVED5)<br />
40048FAh 2 ? Can be 0004h..0007h (nonzero, unlike SDIO) (RESERVED6)<br />
40048FCh 2 ? Can be 0024h..00FFh? (RESERVED7)<br />
40048FEh 2 ? Can be 0024h..00FFh? (RESERVED8 / TC6371AF:Revision)<br />
4004900h 2 SD_DATA32_IRQ<br />
4004902h 2 Fixed always zero?<br />
4004904h 2 SD_DATA32_BLK_LEN<br />
4004906h 2 Fixed always zero?<br />
4004908h 2 SD_DATA32_BLK_COUNT<br />
400490Ah 2 Fixed always zero?<br />
400490Ch 4 SD_DATA32_FIFO<br />
4004910h F0h Fixed always zerofilled?<br />
'''ARM7 DSi SD/MMC Registers for SDIO access (for Atheros Wifi)'''<br />
4004A00h 200h SDIO_xxx (same as SD_xxx at 4004800h..40049FFh, see there)<br />
4004A02h 2 SDIO_CARD_PORT_SELECT (slightly different than 4004802h)<br />
4004AF8h 2 Fixed always zero? (unlike SD_xxx at 40048F8h) (RESERVED5)<br />
4004AFAh 2 Fixed always zero? (unlike SD_xxx at 40048FAh) (RESERVED6)<br />
<br />
== DSi SD/MMC I/O Ports: Command/Param/Response/Data ==<br />
<br />
===4004800h/4004A00h - SD_CMD - Command and Response/Data Type (R/W)===<br />
15 undoc Unknown/undoc (read/write-able)<br />
14 undoc Security Cmd (0=Normal, 1=Whatever/Security) (sdio?)<br />
13 undoc Data Length (0=Single Block, 1=Multiple Blocks)<br />
12 undoc Data Direction (0=Write, 1=Read)<br />
11 NTDT Data Transfer (0=No data, 1=With data)<br />
10-8 REP2-0 Response Type (0..2=Unknown/Reserved, 3=None, 4=48bit,<br />
5=48bit+Busy, 6=136bit, 7=48bitOcrWithoutCRC7)<br />
7-6 CMD1-0 Command Type (0=CMD, 1=ACMD, 2..3=unknown, maybe GEN WR/RD?)<br />
5-0 CIX Command Index (0..3Fh, command index)<br />
Invalid values can cause ILA error (particulary on setting NTDT for CMD12, or for CMD's Response=None). ILA error will also occur if an old CMD is still busy.<br><br />
DSi software is always writing just ZERO to bit11-6 though? Maybe the hardware does automatically know which SD/MMC CMDs and ACMDs have data? Or maybe data is always automatically transferred when receiving a data-startbit, or when writing to data register - and bits like NTDT would be needed only for things like proper data timeout handling?<br />
<br />
===4004804h/4004A04h - SD_CMD_PARAM0-1 - Argument (32bit, 2 halfwords) (R/W)===<br />
31-0 Parameter value for CMD<br />
The parameter value should be written <before> sending the command via SD_CMD/SDIO_CMD.<br />
<br />
===400480Ch/4004A0Ch - SD_RESPONSE0-7 - Response (128bit, 8 halfwords) (R)===<br />
After sending a command, wait for the CMDRESPEND bit (IRQ_STATUS.bit0) to get<br />
set, then read the RESPONSE (if the command does have any response).<br />
For normal 32bit responses:<br />
31-0 Response<br />
127-32 Older Responses<br />
For CID/CSD responses:<br />
119-0 120bit Response<br />
127-120 Zero (always?)<br />
Seems to be left-shifted when receiving response bits. So, for 32bit responses, bit0-31 would contain the current response, and bit32-127 would contain older responses.<br />
<br />
===DATA16 vs DATA32===<br />
Data can be transferred in 16bit or 32bit units (as selected in DATA_CTL.bit1 and DATA32_IRQ.bit1). There are separate data, block len, and block count registers for 16bit and 32bit mode (that's probably due to some odd patchwork, where the manufacturer has added 32bit support to the original 16bit chip design).<br><br />
Naturally, a 32bit transfer is faster than two 16bit transfers. Nethertheless, the DSi firmware does use both 32bit and 16bit mode once and then; 32bit mode is required for NDMA transfers (which don't support 16bit).<br />
<br />
===40048D8h/4004AD8h - SD_DATA_CTL===<br />
15-13 Unknown (usually 0)<br />
12 Unknown (usually 1) (R?)<br />
11-6 Unknown (usually 0)<br />
5 Unknown (read/write-able) (usually 0) (R/W)<br />
4 Unknown (usually 1) (R?)<br />
3-2 Unknown (usually 0)<br />
1 Select 16bit/32bit Data Mode (0=DATA16, 1=DATA32, see 4004900h) (R/W)<br />
0 Unknown (usually 0)<br />
Known written values are 0000h and 0002h. However, known read values are 1010h and 1012h.<br><br />
DATA32 mode requires setting both 40048D8h.bit1 and 4004900h.bit1. For DATA16 mode, both bits should be zero (though DATA16 seems to be also working the same way when only either of the bits is zero).<br />
<br />
===400480Ah/4004A0Ah - SD_DATA16_BLK_COUNT - "Transfer Block Count" (R/W)===<br />
===4004908h/4004B08h - SD_DATA32_BLK_COUNT (R/W)===<br />
15-0 Number of Data Blocks for multiple read/write commands (0..FFFFh)<br />
In Data32 mode, DATA32_BLK_COUNT is decremented after each block (except after the last block, where it stays at 0001h instead of getting zero). In Data16 mode, SD_DATA16_BLK_COUNT doesn't decrease (instead, there must be some hidden internal counter register).<br><br />
If enabled in STOP_INTERNAL_ACTION.bit8, then the hardware will be automatically sending STOP_TRANSMISSION (CMD12) after the last block (otherwise the decrement occurs as described above, but the hardware keeps transferring blocks infinitely).<br />
<br />
===4004826h/4004A26h - SD_DATA16_BLK_LEN - Transfer Data Length (R/W)===<br />
===4004904h/4004B04h - SD_DATA32_BLK_LEN (R/W)===<br />
15-10 Unknown/unused (appears to be always zero)<br />
9-0 Data Block Length in bytes (for DATA16: clipped to max 0200h by hw)<br />
Should be usually 0200h (for 512-byte SD/MMC memory blocks). Other values may be needed for SDIO functions, or when accessing SSR/SCR/PWD registers via data transfers.<br><br />
DATA32_BLK_LEN can be max 3FFh (unlike DATA16_BLK_LEN which is clipped to<br />
max=200h by hardware).<br />
<br />
===4004830h/4004A30h - SD_DATA16_FIFO - Data Port (SD_FIFO?)===<br />
===400490Ch/4004B0Ch - SD_DATA32_FIFO===<br />
For Data16:<br />
15-0 Data (16bit) (...or could it be accessed as 32bit, too?)<br />
For Data32:<br />
31-0 Data (32bit) (...or could it be accessed as 16bit, too?)<br />
Transfer data here (read after RXRDY gets set, or write after TXRQ gets set).<br />
FIFO size is unknown (if there's any FIFO behind it).<br />
<br />
== DSi SD/MMC I/O Ports: Interrupt/Status ==<br />
<br />
'''400481Ch - SD_IRQ_STATUS0-1 - Interrupt Status (R/ack)'''<br><br />
'''4004A1Ch - SDIO_IRQ_STATUS0-1 - Interrupt Status (R/ack)'''<br><br />
'''4004820h - SD_IRQ_MASK0-1 - Interrupt Mask (R/W)'''<br><br />
'''4004A20h - SDIO_IRQ_MASK0-1 - Interrupt Mask (R/W)'''<br><br />
The IRQ_STATUS registers contain acknowledge-able IRQ Flags (those bits that<br />
that are maskable in IRQ_MASK register), as well as static read-only status<br />
bits without IRQ function (eg. WRPROTECT).<br />
* IRQ Flags/Write (0=Acknowledge, 1=No change)<br />
* IRQ Flags/Read (0=No IRQ, 1=IRQ)<br />
* IRQ Mask (0=Enable, 1=Disable) (8B7F031Dh when all IRQs disabled)<br />
Bit Stat Mask Function<br />
0 SREP MREP CMDRESPEND (response end) (or R1b: busy end)<br />
1 0 0 Unknown/unused (always 0)<br />
2 SRWA MRWA DATAEND (is NOT set? after data read/write end bit)<br />
3 SCOT MCOT CARD_REMOVE (0=No event, 1=Is/was newly ejected) ;\DSi<br />
4 SCIN MCIN CARD_INSERT (0=No event, 1=Is/was newly inserted) ; SD<br />
5 undoc 0 SIGSTATE (0=Ejected, 1=Inserted) (SDIO: always 1) ; Card<br />
6 0 0 Unknown/unused (always 0) ; Slot<br />
7 undoc 0 WRPROTECT (0=Locked/Ejected, 1=Unlocked/HalfEjected);/<br />
8 undoc undoc CARD_REMOVE_A (always 0) ;\maybe fixed state for<br />
9 undoc undoc CARD_INSERT_A (always 0) ; DSi's onboard eMMC chip<br />
10 undoc 0 SIGSTATE_A (always 1) ;/(also fixed as so for SDIO)<br />
11 0 0 Unknown/unused (always 0)<br />
12 0 0 Unknown/unused (always 0)<br />
13 0 0 Unknown/unused (always 0)<br />
14 0 0 Unknown/unused (always 0)<br />
15 0 0 Unknown/unused (always 0)<br />
16 SCIX MCIX CMD_IDX_ERR Bad CMD-index in response (RCMDE,SCMDE)<br />
17 SCRC MCRC CRCFAIL CRC response error (WCRCE,RCRCE,SCRCE,CCRCE)<br />
18 SEND MEND STOPBIT_ERR End bit error (WEBER,REBER,SEBER,CEBER)<br />
19 SDTO MDTO DATATIMEOUT Data Timeout (NRCS,NWCS,KBSY)<br />
20 SFOF MFOF RXOVERFLOW HOST tried write full<br />
21 SFUF MFUF TXUNDERRUN HOST tried read empty<br />
22 SCTO MCTO CMDTIMEOUT Response start-bit timeout (NRS,NSR)<br />
23 1 ? 0 Unknown/undoc (usually set?)<br />
24 SBRE MBRE RXRDY (fifo not empty) (request data read)<br />
25 SBWE MBWE TXRQ (datafifoempty?) (request data write)<br />
26 0 0 Unknown/unused (always 0)<br />
27 undoc undoc Unknown/undoc (bit27 is mask-able in IRQ_MASK)<br />
28 0 0 Unknown/unused (always 0)<br />
29 1 ? 0 Unknown/undoc (usually set?) (unlike toshiba ILFSL/IFSMSK)<br />
30 undoc 0 CMD_BUSY<br />
31 ILA IMSK Illegal Command Access (old CMD still busy, or wrong NTDT)<br />
Acknowledge by STAT=0, or by MASK=1 (uh, really?), or by soft reset (SRST=0) or<br />
hard reset.<br />
<br />
<br />
'''4004900h - SD_DATA32_IRQ'''<br><br />
'''4004B00h - SDIO_DATA32_IRQ'''<br><br />
15-13 Unknown/unused (appears to be always zero)<br />
12 Unknown (paired with bit9) (can be set) IRQ enable ?! (R/W?)<br />
11 Unknown (paired with bit8) (can be set) IRQ enable ?! (R/W?)<br />
10 Unknown (read=0) write: (0=No change, 1=Clear Bit8,9) ? (W?)<br />
9 Unknown (paired with bit12) (automatically cleared after...) (R?)<br />
8 Unknown (paired with bit11) (R?)<br />
7-2 Unknown (0)<br />
1 Unknown (can be set) (autoclear bit8,9 on xfer end?) (R/W?)<br />
0 Unknown (0)<br />
Can be 1A02h, but changes to 1802h after reading from somewhere (maybe from<br />
DATA32_FIFO?).<br><br />
Bit8,9 seem to be whatever extra IRQ flags, the flags get set ONLY in DATA32<br />
mode (not in DATA16 mode).<br />
<br />
<br />
'''400482Ch - SD_ERROR_DETAIL_STATUS0-1 - Error Detail Status'''<br><br />
'''4004A2Ch - SDIO_ERROR_DETAIL_STATUS0-1 - Error Detail Status'''<br><br />
31-23 ? Unknown/unused/undoc<br />
22 KBSY Timeout for CRC status busy timeout ;\STAT.19<br />
21 NWCS Timeout for CRC status timeout ; (SDTO)<br />
20 NRCS Timeout for Data start-bit, or for Post Data Busy ;/<br />
19-18 ? Unknown/unused/undoc<br />
17 NRS Response timeout for auto-issued CMD12 ;\STAT.22<br />
16 NCR Response timeout for non-auto-issued CMD's ;/(SCTO)<br />
15-14 ? Unknown/unused/undoc<br />
13 ?? Unknown/undoc (bit13 can be nonzero on DSi!)<br />
12 ? Unknown/unused/undoc<br />
11 WCRCE CRC error for Write CRC status for a write command ;\<br />
10 RCRCE CRC error for read data ; STAT.17<br />
9 SCRCE CRC error for a response for auto-issued CMD12 ; (SCRC)<br />
8 CCRCE CRC error for a response for non-auto-issued CMD's ;/<br />
5 WEBER End bit error for Write CRC status ;\<br />
4 REBER End bit error for read data ; STAT.18<br />
3 SEBER End bit error for response for auto-issued CMD12 ; (SEND)<br />
2 CEBER End bit error for response for non-auto-issued CMD's ;/<br />
1? SCMDE Bad CMD-index in response of auto-issued CMD12 ;\STAT.16<br />
0 RCMDE Bad CMD-index in response of non-auto-issued CMD's ;/(SCIX)<br />
Unknown if/when/how the error bits can be reset/acknowledged.<br><br />
Note: CMD12 is STOP_TRANSMISSION (maybe sent after BLK_COUNT?).<br><br />
The four "auto-issued CMD12" bits exist for SD registers only (not SDIO).<br />
SCMDE is probably in bit1 (though, official specs say bit0, which would be same<br />
as RCMDE).<br />
<br />
<br />
'''4004A36h - DSi: 0000 - SDCTL_CARD_INTERRUPT_CONTROL'''<br><br />
This does NOT seem to be implemented as described below on DSi.<br />
4004A36h does seem to behave more like 4004836h, see there.<br />
15-13 ? Unknown (zero on DSi)<br />
12 CINT0 SDIO Interrupt Flag (0=none, 1=irq) (/IRQ aka Data1 pin)<br />
11-9 ? Unknown (zero on DSi)<br />
8 CIMSK0 SDIO Interrupt Mask (0=enable, 1=disable) (/IRQ aka Data1 pin)<br />
7-0 ? Unknown (zero on DSi)<br />
Acknowledge by writing CINT0=0, or CIMSK0=1, or hard reset (unlike as for other<br />
SD/MMC interrupts, soft reset does not acknowlege this interrupt type?).<br />
<br />
== DSi SD/MMC I/O Ports: Control ==<br />
<br />
'''4004802h - SD_CARD_PORT_SELECT (0201h)'''<br><br />
'''4004A02h - SDIO_CARD_PORT_SELECT (0100h)'''<br><br />
15-11 Unknown/unused (appears to be always zero)<br />
10 Unknown (write: should be 1, read: usually/always 0) (W?)<br />
9 Unknown (write: should be 0, read: usually 1 for SD)<br />
8 Unknown (write: should be 0, read: usually 1 for SDIO)<br />
7-4 Unknown/unused (appears to be always zero)<br />
3-1 Unknown (R/W)<br />
0 Port Select (0=SD Card Slot, 1=Onboard eMMC) (for SDIO: Unknown)<br />
Known written values are 0400h and 0401h (SD). However known read values are<br />
0201h (SD) and 0100h (SDIO).<br />
<br />
<br />
'''4004828h - DSi: 40E0 - SD_CARD_OPTION - Memory Card Option Setup'''<br><br />
'''4004A28h - DSi: 40EE - SDIO_CARD_OPTION - Card Option Setup'''<br><br />
15 Bus Width (0=4bit, 1=1bit)<br />
14 Unknown (usually set)<br />
13-8 Unknown/unused (appears to be always zero)<br />
7-4 Unknown, maybe some 4bit timing/timeout value<br />
0-3 Unknown, maybe another 4bit timing/timeout value<br />
Settings spotted on DSi are 40E0h,40EEh.<br><br />
Among others, this register should contain a 4bit timeout setting, "RTO[3:0]<br />
for SD (aka TO[3:0] for SDIO) timeout period for data start/busy bits, in the<br />
form of a multiple number of the SDCLK period."<br><br />
Maybe also selects transfer CLK rate, or whatever.<br />
<br />
<br />
'''4004834h - DSi: 0000 - SD_TRANSACTION_CTL - Transaction Control'''<br><br />
'''4004A34h - DSi: 0000 - SDIO_TRANSACTION_CTL - Transaction Control'''<br><br />
15-10 Unknown/unused (appears to be always zero)<br />
9-8 Unknown<br />
7-3 Unknown/unused (appears to be always zero)<br />
2 Unknown<br />
1 Unknown/unused (appears to be always zero)<br />
0 Unknown<br />
Maybe also selects transfer CLK rate, or whatever.<br />
<br />
<br />
'''40048E0h - DSi: 0007 - SD_SOFT_RESET - Software Reset'''<br><br />
'''4004AE0h - DSi: 0006 - SDIO_SOFT_RESET - Software Reset'''<br><br />
15-3 Unknown/unused (appears to be always zero)<br />
2 ? Unknown (can be nonzero on DSi)<br />
1 ? Unknown (can be nonzero on DSi)<br />
0 SRST Soft Reset (0=Reset, 1=Release)<br />
Software should apply reset after sensing card insertion/removal, and<br />
(thereafter) release reset in case of card insertion. Software reset does<br />
acknowledge all IRQs (except that from SDIO /IRQ pin?), and does probably also<br />
reinitialize some other registers.<br />
<br />
<br />
'''4004808h - DSi: 0100 - SDCTL_STOP_INTERNAL_ACTION'''<br><br />
15-9 Unknown/unused (appears to be always zero)<br />
8 Unknown (1=Enable automatic sending of CMD12 after BLK_COUNT blocks?)<br />
7-1 Unknown/unused (appears to be always zero)<br />
0 Unknown<br />
Stop whatever internal action for whatever purpose in whatever situation?<br><br />
Existing code does set bit8 (prior to changing SD_DATA16_BLK_COUNT).<br><br />
Existing code does clear bit0 (alongsides with IRQ enable/acknowlege or so).<br />
<br />
<br />
'''4004824h - DSi: 0000 - DSi: Used? - SDCTL_CARD_CLK_CTL Card Clock Control'''<br><br />
Can be max 07FFh on DSi... ie. bit15 CANNOT be set?<br />
15 Disable HCLK divider (0=SDCLK selected via bit7-0, 1=SDCLK=HCLK)<br />
14-10 Unknown (zero on DSi)<br />
9 Unknown (set in some cases on DSi)<br />
8 Unknown (1=Start Clock, or Apply Clock Change, or so?)<br />
7-0 HCLK Div (0,1,2,4,8,10h,20h,40h,80h = Div2,4,8,16,32,64,128,256,512)<br />
Clock supply to SD Card<br><br />
The SDCLK signal is used for a provision of SD Memory Card or SDIO Card. Please<br />
refer to the following setting for enabling the SDCLK output.<br />
(1) Set Stop Clock Control Register (Config Offset:40h) to 1Fh.<br />
(2) Set D0 of SD Software Reset Register (Offset:0E0h) to 1b.<br />
(3) Set D7-0 of SD Card Clock Control Register (Offset:024h). These bits<br />
are used for setting the frequency of SDCLK.<br />
80h : SDCLK=HCLK/512<br />
40h : SDCLK=HCLK/256<br />
20h : SDCLK=HCLK/128<br />
10h : SDCLK=HCLK/64<br />
08h : SDCLK=HCLK/32<br />
04h : SDCLK=HCLK/16<br />
02h : SDCLK=HCLK/8<br />
01h : SDCLK=HCLK/4<br />
00h : SDCLK=HCLK/2<br />
In addition, TC6387XB holds a function that SDCLK can have same<br />
frequency as HCLK. In this case, D7-0 settings of SD Card Clock Control<br />
Register (Offset:024h) becomes invalid setting.<br />
* Set D0 of Clock Mode Register (Config Offset:42h) to 1b.<br />
* Set D15 of SD Card Clock Control Register (Offset:024h) to 1b.<br />
Please attend that the specification of SDCLK is max.25MHz at the case<br />
of SD Card and is max.20MHz at the case of MultiMedia Card.<br />
(4) D8 of SD Card Clock Control Register (Offset:024h) to 1b.<br />
(5) D8 of Clock & Wait Control Register (Offset:138h) to 1b.<br />
On the DSi, HCLK seems to be 33.513982 MHz.<br />
<br />
<br />
'''4004x38h - DSi: 0000 - SDCTL_CLK_AND_WAIT_CTL'''<br><br />
15-0 Unknown (zero on DSi)<br />
Maybe transfer CLK rate, or some master clock control for the clock input.<br />
<br />
<br />
'''4004x3Ah - DSi: 0000 - SDCTL_SDIO_HOST_INFORMATION'''<br><br />
'''4004x3Ch - DSi: 0000 - SDCTL_ERROR_CONTROL'''<br><br />
'''4004x3Eh - DSi: 0000 - SDCTL_SDLED_CONTROL - LED Control (TC6387XB only)'''<br><br />
15-0 Unknown (zero on DSi)<br />
<br />
<br />
'''40048E2h - DSi: 0009 - SDCTL_RESERVED2 (TC6371AF:CORE_REV)'''<br><br />
'''40048E6h - DSi: 0000 - SDCTL_RESERVED3 (TC6371AF:BUF_ADR)'''<br><br />
'''40048E8h - DSi: 0000 - UNDOC/UNUSED (TC6371AF:Resp_Header)'''<br><br />
'''40048F6h - DSi: 0000 - SDCTL_RESERVED4 --- used by DSi !!!'''<br><br />
'''40048F8h - DSi: 0004 - SDCTL_RESERVED5 <-- DSi: SD only (not SDIO)'''<br><br />
'''40048FAh - DSi: 0007 - SDCTL_RESERVED6 <-- DSi: SD only (not SDIO)'''<br><br />
'''40048FCh - DSi: 00FC - SDCTL_RESERVED7'''<br><br />
'''40048FEh - DSi: 00FF - SDCTL_RESERVED8 (TC6371AF:Revision)'''<br><br />
'''4004xE2h - DSi: 0000 - SDCTL_RESERVED9'''<br><br />
'''4004xF0h - DSi: 0000 - SDCTL_RESERVED10'''<br><br />
'''4004836h - DSi: 0002 - UNDOC! (bit1 can be set, other bits always 0)'''<br><br />
15-0 Unknown<br />
<br />
<br />
'''4004838h/4004A38h - DSi: C007 - UNDOC!'''<br><br />
'''4004840h/4004A40h - DSi: 003F - UNDOC?'''<br><br />
'''4004842h/4004A42h - DSi: 002A - UNDOC?'''<br><br />
'''40048B2h/4004AB2h - DSi: FFFF - UNDOC?'''<br><br />
'''40048BAh/4004ABAh - DSi: 0200 - UNDOC?'''<br><br />
'''40048F4h/4004AF4h - DSi: 0700 - UNDOC!'''<br><br />
15-0 Unknown</div>Nocashhttps://dsibrew.org/w/index.php?title=SD/MMC/SDIO_Registers&diff=2098813SD/MMC/SDIO Registers2015-08-31T10:22:16Z<p>Nocash: /* DSi SD/MMC I/O Ports: Command/Param/Response/Data */</p>
<hr />
<div>SD_xxx is used to access onboard eMMC and external SD card slot (as selected via SD_CARD_PORT_SELECT).<br><br />
SDIO_xxx is used to access the Atheros Wifi unit.<br />
<br />
== DSi SD/MMC I/O Map ==<br />
<br />
'''ARM7 DSi SD/MMC Registers for Memory Card access (SD Card and onboard eMMC)'''<br />
4004800h 2 SD_CMD Command and Response/Data Type<br />
4004802h 2 SD_CARD_PORT_SELECT (SD/MMC:020Fh, SDIO:010Fh)<br />
4004804h 4 SD_CMD_PARAM0-1 Argument (32bit, 2 halfwords)<br />
4004808h 2 SD_STOP_INTERNAL_ACTION<br />
400480Ah 2 SD_DATA16_BLK_COUNT "Transfer Block Count"<br />
400480Ch 16 SD_RESPONSE0-7 (128bit, 8 halfwords)<br />
400481Ch 4 SD_IRQ_STATUS0-1 ;IRQ Status (0=ack, 1=req)<br />
4004820h 4 SD_IRQ_MASK0-1 ;IRQ Disable (0=enable, 1=disable)<br />
4004824h 2 SD_CARD_CLK_CTL Card Clock Control<br />
4004826h 2 SD_DATA16_BLK_LEN Memory Card Transfer Data Length<br />
4004828h 2 SD_CARD_OPTION Memory Card Option Setup (can be C0FFh)<br />
400482Ah 2 Fixed always zero?<br />
400482Ch 4 SD_ERROR_DETAIL_STATUS0-1 Error Detail Status<br />
4004830h 2 SD_DATA16_FIFO Data Port (SD_FIFO?)<br />
4004832h 2 Fixed always zero? ;(TC6371AF:BUF1 Data MSBs?)<br />
4004834h 2 ? SD_TRANSACTION_CTL Transaction Control<br />
4004836h 2 ? SD_CARD_INTERRUPT_CONTROL ;4004A36h used in SDIO IRQ handler<br />
4004838h 2 ? SD_CLK_AND_WAIT_CTL ;4004A38h used in SDIO IRQ handler<br />
400483Ah 2 Fixed always zero? ;(SDCTL_SDIO_HOST_INFORMATION)<br />
400483Ch 2 Fixed always zero? ;(SDCTL_ERROR_CONTROL)<br />
400483Eh 2 Fixed always zero? ;(TC6387XB: LED_CONTROL)<br />
4004840h 2 Fixed always 003Fh?<br />
4004842h 2 Fixed always 002Ah?<br />
4004844h 6Eh Fixed always zerofilled?<br />
40048B2h 2 Fixed always FFFFh?<br />
40048B4h 6 Fixed always zerofilled?<br />
40048BAh 2 Fixed always 0200h?<br />
40048BCh 1Ch Fixed always zerofilled?<br />
40048D8h 2 SD_DATA_CTL<br />
40048DAh 6 Fixed always zerofilled?<br />
40048E0h 2 SD_SOFT_RESET Software Reset (bit0=SRST=0=reset)<br />
40048E2h 2 Fixed always 0009h? ;(RESERVED2/9, TC6371AF:CORE_REV)<br />
40048E4h 2 Fixed always zero?<br />
40048E6h 2 Fixed always zero? ;(RESERVED3, TC6371AF:BUF_ADR)<br />
40048E8h 2 Fixed always zero? ;(TC6371AF:Resp_Header)<br />
40048EAh 6 Fixed always zerofilled?<br />
40048F0h 2 Fixed always zero? ;(RESERVED10)<br />
40048F2h 2 ? Can be 0003h<br />
40048F4h 2 ? Can be 0770h<br />
40048F6h 2 ? Firmware tests bit0 (but, always 0?) (RESERVED4)<br />
40048F8h 2 Fixed always 0004h? (nonzero, unlike SDIO) (RESERVED5)<br />
40048FAh 2 ? Can be 0004h..0007h (nonzero, unlike SDIO) (RESERVED6)<br />
40048FCh 2 ? Can be 0024h..00FFh? (RESERVED7)<br />
40048FEh 2 ? Can be 0024h..00FFh? (RESERVED8 / TC6371AF:Revision)<br />
4004900h 2 SD_DATA32_IRQ<br />
4004902h 2 Fixed always zero?<br />
4004904h 2 SD_DATA32_BLK_LEN<br />
4004906h 2 Fixed always zero?<br />
4004908h 2 SD_DATA32_BLK_COUNT<br />
400490Ah 2 Fixed always zero?<br />
400490Ch 4 SD_DATA32_FIFO<br />
4004910h F0h Fixed always zerofilled?<br />
'''ARM7 DSi SD/MMC Registers for SDIO access (for Atheros Wifi)'''<br />
4004A00h 200h SDIO_xxx (same as SD_xxx at 4004800h..40049FFh, see there)<br />
4004A02h 2 SDIO_CARD_PORT_SELECT (slightly different than 4004802h)<br />
4004AF8h 2 Fixed always zero? (unlike SD_xxx at 40048F8h) (RESERVED5)<br />
4004AFAh 2 Fixed always zero? (unlike SD_xxx at 40048FAh) (RESERVED6)<br />
<br />
== DSi SD/MMC I/O Ports: Command/Param/Response/Data ==<br />
<br />
===4004800h/4004A00h - SD_CMD - Command and Response/Data Type (R/W)===<br />
15 undoc Unknown/undoc (read/write-able)<br />
14 undoc Security Cmd (0=Normal, 1=Whatever/Security) (sdio?)<br />
13 undoc Data Length (0=Single Block, 1=Multiple Blocks)<br />
12 undoc Data Direction (0=Write, 1=Read)<br />
11 NTDT Data Transfer (0=No data, 1=With data)<br />
10-8 REP2-0 Response Type (0..2=Unknown/Reserved, 3=None, 4=48bit,<br />
5=48bit+Busy, 6=136bit, 7=48bitOcrWithoutCRC7)<br />
7-6 CMD1-0 Command Type (0=CMD, 1=ACMD, 2..3=unknown, maybe GEN WR/RD?)<br />
5-0 CIX Command Index (0..3Fh, command index)<br />
Invalid values can cause ILA error (particulary on setting NTDT for CMD12, or for CMD's Response=None). ILA error will also occur if an old CMD is still busy.<br><br />
DSi software is always writing just ZERO to bit11-6 though? Maybe the hardware does automatically know which SD/MMC CMDs and ACMDs have data? Or maybe data is always automatically transferred when receiving a data-startbit, or when writing to data register - and bits like NTDT would be needed only for things like proper data timeout handling?<br />
<br />
===4004804h/4004A04h - SD_CMD_PARAM0-1 - Argument (32bit, 2 halfwords) (R/W)===<br />
31-0 Parameter value for CMD<br />
The parameter value should be written <before> sending the command via SD_CMD/SDIO_CMD.<br />
<br />
===400480Ch/4004A0Ch - SD_RESPONSE0-7 - Response (128bit, 8 halfwords) (R)===<br />
After sending a command, wait for the CMDRESPEND bit (IRQ_STATUS.bit0) to get<br />
set, then read the RESPONSE (if the command does have any response).<br />
For normal 32bit responses:<br />
31-0 Response<br />
127-32 Older Responses<br />
For CID/CSD responses:<br />
119-0 120bit Response<br />
127-120 Zero (always?)<br />
Seems to be left-shifted when receiving response bits. So, for 32bit responses, bit0-31 would contain the current response, and bit32-127 would contain older responses.<br />
<br />
===DATA16 vs DATA32===<br />
Data can be transferred in 16bit or 32bit units (as selected in DATA_CTL.bit1 and DATA32_IRQ.bit1). There are separate data, block len, and block count registers for 16bit and 32bit mode (that's probably due to some odd patchwork, where the manufacturer has added 32bit support to the original 16bit chip design).<br><br />
Naturally, a 32bit transfer is faster than two 16bit transfers. Nethertheless, the DSi firmware does use both 32bit and 16bit mode once and then; 32bit mode is required for NDMA transfers (which don't support 16bit).<br />
<br />
===40048D8h/4004AD8h - SD_DATA_CTL===<br />
15-13 Unknown (usually 0)<br />
12 Unknown (usually 1) (R?)<br />
11-6 Unknown (usually 0)<br />
5 Unknown (read/write-able) (usually 0) (R/W)<br />
4 Unknown (usually 1) (R?)<br />
3-2 Unknown (usually 0)<br />
1 Select 16bit/32bit Data Mode (0=DATA16, 1=DATA32, see 4004900h) (R/W)<br />
0 Unknown (usually 0)<br />
Known written values are 0000h and 0002h. However, known read values are 1010h and 1012h.<br><br />
DATA32 mode requires setting both 40048D8h.bit1 and 4004900h.bit1. For DATA16 mode, both bits should be zero (though DATA16 seems to be also working the same way when only either of the bits is zero).<br />
<br />
===400480Ah/4004A0Ah - SD_DATA16_BLK_COUNT - "Transfer Block Count" (R/W)<br><br />
4004908h/4004B08h - SD_DATA32_BLK_COUNT (R/W)===<br />
15-0 Number of Data Blocks for multiple read/write commands (0..FFFFh)<br />
In Data32 mode, DATA32_BLK_COUNT is decremented after each block (except after the last block, where it stays at 0001h instead of getting zero). In Data16 mode, SD_DATA16_BLK_COUNT doesn't decrease (instead, there must be some hidden internal counter register).<br><br />
If enabled in STOP_INTERNAL_ACTION.bit8, then the hardware will be automatically sending STOP_TRANSMISSION (CMD12) after the last block (otherwise the decrement occurs as described above, but the hardware keeps transferring blocks infinitely).<br />
<br />
===4004826h/4004A26h - SD_DATA16_BLK_LEN - Transfer Data Length (R/W)===<br />
===4004904h/4004B04h - SD_DATA32_BLK_LEN (R/W)===<br />
15-10 Unknown/unused (appears to be always zero)<br />
9-0 Data Block Length in bytes (for DATA16: clipped to max 0200h by hw)<br />
Should be usually 0200h (for 512-byte SD/MMC memory blocks). Other values may be needed for SDIO functions, or when accessing SSR/SCR/PWD registers via data transfers.<br><br />
DATA32_BLK_LEN can be max 3FFh (unlike DATA16_BLK_LEN which is clipped to<br />
max=200h by hardware).<br />
<br />
===4004830h/4004A30h - SD_DATA16_FIFO - Data Port (SD_FIFO?)===<br />
===400490Ch/4004B0Ch - SD_DATA32_FIFO===<br />
For Data16:<br />
15-0 Data (16bit) (...or could it be accessed as 32bit, too?)<br />
For Data32:<br />
31-0 Data (32bit) (...or could it be accessed as 16bit, too?)<br />
Transfer data here (read after RXRDY gets set, or write after TXRQ gets set).<br />
FIFO size is unknown (if there's any FIFO behind it).<br />
<br />
== DSi SD/MMC I/O Ports: Interrupt/Status ==<br />
<br />
'''400481Ch - SD_IRQ_STATUS0-1 - Interrupt Status (R/ack)'''<br><br />
'''4004A1Ch - SDIO_IRQ_STATUS0-1 - Interrupt Status (R/ack)'''<br><br />
'''4004820h - SD_IRQ_MASK0-1 - Interrupt Mask (R/W)'''<br><br />
'''4004A20h - SDIO_IRQ_MASK0-1 - Interrupt Mask (R/W)'''<br><br />
The IRQ_STATUS registers contain acknowledge-able IRQ Flags (those bits that<br />
that are maskable in IRQ_MASK register), as well as static read-only status<br />
bits without IRQ function (eg. WRPROTECT).<br />
* IRQ Flags/Write (0=Acknowledge, 1=No change)<br />
* IRQ Flags/Read (0=No IRQ, 1=IRQ)<br />
* IRQ Mask (0=Enable, 1=Disable) (8B7F031Dh when all IRQs disabled)<br />
Bit Stat Mask Function<br />
0 SREP MREP CMDRESPEND (response end) (or R1b: busy end)<br />
1 0 0 Unknown/unused (always 0)<br />
2 SRWA MRWA DATAEND (is NOT set? after data read/write end bit)<br />
3 SCOT MCOT CARD_REMOVE (0=No event, 1=Is/was newly ejected) ;\DSi<br />
4 SCIN MCIN CARD_INSERT (0=No event, 1=Is/was newly inserted) ; SD<br />
5 undoc 0 SIGSTATE (0=Ejected, 1=Inserted) (SDIO: always 1) ; Card<br />
6 0 0 Unknown/unused (always 0) ; Slot<br />
7 undoc 0 WRPROTECT (0=Locked/Ejected, 1=Unlocked/HalfEjected);/<br />
8 undoc undoc CARD_REMOVE_A (always 0) ;\maybe fixed state for<br />
9 undoc undoc CARD_INSERT_A (always 0) ; DSi's onboard eMMC chip<br />
10 undoc 0 SIGSTATE_A (always 1) ;/(also fixed as so for SDIO)<br />
11 0 0 Unknown/unused (always 0)<br />
12 0 0 Unknown/unused (always 0)<br />
13 0 0 Unknown/unused (always 0)<br />
14 0 0 Unknown/unused (always 0)<br />
15 0 0 Unknown/unused (always 0)<br />
16 SCIX MCIX CMD_IDX_ERR Bad CMD-index in response (RCMDE,SCMDE)<br />
17 SCRC MCRC CRCFAIL CRC response error (WCRCE,RCRCE,SCRCE,CCRCE)<br />
18 SEND MEND STOPBIT_ERR End bit error (WEBER,REBER,SEBER,CEBER)<br />
19 SDTO MDTO DATATIMEOUT Data Timeout (NRCS,NWCS,KBSY)<br />
20 SFOF MFOF RXOVERFLOW HOST tried write full<br />
21 SFUF MFUF TXUNDERRUN HOST tried read empty<br />
22 SCTO MCTO CMDTIMEOUT Response start-bit timeout (NRS,NSR)<br />
23 1 ? 0 Unknown/undoc (usually set?)<br />
24 SBRE MBRE RXRDY (fifo not empty) (request data read)<br />
25 SBWE MBWE TXRQ (datafifoempty?) (request data write)<br />
26 0 0 Unknown/unused (always 0)<br />
27 undoc undoc Unknown/undoc (bit27 is mask-able in IRQ_MASK)<br />
28 0 0 Unknown/unused (always 0)<br />
29 1 ? 0 Unknown/undoc (usually set?) (unlike toshiba ILFSL/IFSMSK)<br />
30 undoc 0 CMD_BUSY<br />
31 ILA IMSK Illegal Command Access (old CMD still busy, or wrong NTDT)<br />
Acknowledge by STAT=0, or by MASK=1 (uh, really?), or by soft reset (SRST=0) or<br />
hard reset.<br />
<br />
<br />
'''4004900h - SD_DATA32_IRQ'''<br><br />
'''4004B00h - SDIO_DATA32_IRQ'''<br><br />
15-13 Unknown/unused (appears to be always zero)<br />
12 Unknown (paired with bit9) (can be set) IRQ enable ?! (R/W?)<br />
11 Unknown (paired with bit8) (can be set) IRQ enable ?! (R/W?)<br />
10 Unknown (read=0) write: (0=No change, 1=Clear Bit8,9) ? (W?)<br />
9 Unknown (paired with bit12) (automatically cleared after...) (R?)<br />
8 Unknown (paired with bit11) (R?)<br />
7-2 Unknown (0)<br />
1 Unknown (can be set) (autoclear bit8,9 on xfer end?) (R/W?)<br />
0 Unknown (0)<br />
Can be 1A02h, but changes to 1802h after reading from somewhere (maybe from<br />
DATA32_FIFO?).<br><br />
Bit8,9 seem to be whatever extra IRQ flags, the flags get set ONLY in DATA32<br />
mode (not in DATA16 mode).<br />
<br />
<br />
'''400482Ch - SD_ERROR_DETAIL_STATUS0-1 - Error Detail Status'''<br><br />
'''4004A2Ch - SDIO_ERROR_DETAIL_STATUS0-1 - Error Detail Status'''<br><br />
31-23 ? Unknown/unused/undoc<br />
22 KBSY Timeout for CRC status busy timeout ;\STAT.19<br />
21 NWCS Timeout for CRC status timeout ; (SDTO)<br />
20 NRCS Timeout for Data start-bit, or for Post Data Busy ;/<br />
19-18 ? Unknown/unused/undoc<br />
17 NRS Response timeout for auto-issued CMD12 ;\STAT.22<br />
16 NCR Response timeout for non-auto-issued CMD's ;/(SCTO)<br />
15-14 ? Unknown/unused/undoc<br />
13 ?? Unknown/undoc (bit13 can be nonzero on DSi!)<br />
12 ? Unknown/unused/undoc<br />
11 WCRCE CRC error for Write CRC status for a write command ;\<br />
10 RCRCE CRC error for read data ; STAT.17<br />
9 SCRCE CRC error for a response for auto-issued CMD12 ; (SCRC)<br />
8 CCRCE CRC error for a response for non-auto-issued CMD's ;/<br />
5 WEBER End bit error for Write CRC status ;\<br />
4 REBER End bit error for read data ; STAT.18<br />
3 SEBER End bit error for response for auto-issued CMD12 ; (SEND)<br />
2 CEBER End bit error for response for non-auto-issued CMD's ;/<br />
1? SCMDE Bad CMD-index in response of auto-issued CMD12 ;\STAT.16<br />
0 RCMDE Bad CMD-index in response of non-auto-issued CMD's ;/(SCIX)<br />
Unknown if/when/how the error bits can be reset/acknowledged.<br><br />
Note: CMD12 is STOP_TRANSMISSION (maybe sent after BLK_COUNT?).<br><br />
The four "auto-issued CMD12" bits exist for SD registers only (not SDIO).<br />
SCMDE is probably in bit1 (though, official specs say bit0, which would be same<br />
as RCMDE).<br />
<br />
<br />
'''4004A36h - DSi: 0000 - SDCTL_CARD_INTERRUPT_CONTROL'''<br><br />
This does NOT seem to be implemented as described below on DSi.<br />
4004A36h does seem to behave more like 4004836h, see there.<br />
15-13 ? Unknown (zero on DSi)<br />
12 CINT0 SDIO Interrupt Flag (0=none, 1=irq) (/IRQ aka Data1 pin)<br />
11-9 ? Unknown (zero on DSi)<br />
8 CIMSK0 SDIO Interrupt Mask (0=enable, 1=disable) (/IRQ aka Data1 pin)<br />
7-0 ? Unknown (zero on DSi)<br />
Acknowledge by writing CINT0=0, or CIMSK0=1, or hard reset (unlike as for other<br />
SD/MMC interrupts, soft reset does not acknowlege this interrupt type?).<br />
<br />
== DSi SD/MMC I/O Ports: Control ==<br />
<br />
'''4004802h - SD_CARD_PORT_SELECT (0201h)'''<br><br />
'''4004A02h - SDIO_CARD_PORT_SELECT (0100h)'''<br><br />
15-11 Unknown/unused (appears to be always zero)<br />
10 Unknown (write: should be 1, read: usually/always 0) (W?)<br />
9 Unknown (write: should be 0, read: usually 1 for SD)<br />
8 Unknown (write: should be 0, read: usually 1 for SDIO)<br />
7-4 Unknown/unused (appears to be always zero)<br />
3-1 Unknown (R/W)<br />
0 Port Select (0=SD Card Slot, 1=Onboard eMMC) (for SDIO: Unknown)<br />
Known written values are 0400h and 0401h (SD). However known read values are<br />
0201h (SD) and 0100h (SDIO).<br />
<br />
<br />
'''4004828h - DSi: 40E0 - SD_CARD_OPTION - Memory Card Option Setup'''<br><br />
'''4004A28h - DSi: 40EE - SDIO_CARD_OPTION - Card Option Setup'''<br><br />
15 Bus Width (0=4bit, 1=1bit)<br />
14 Unknown (usually set)<br />
13-8 Unknown/unused (appears to be always zero)<br />
7-4 Unknown, maybe some 4bit timing/timeout value<br />
0-3 Unknown, maybe another 4bit timing/timeout value<br />
Settings spotted on DSi are 40E0h,40EEh.<br><br />
Among others, this register should contain a 4bit timeout setting, "RTO[3:0]<br />
for SD (aka TO[3:0] for SDIO) timeout period for data start/busy bits, in the<br />
form of a multiple number of the SDCLK period."<br><br />
Maybe also selects transfer CLK rate, or whatever.<br />
<br />
<br />
'''4004834h - DSi: 0000 - SD_TRANSACTION_CTL - Transaction Control'''<br><br />
'''4004A34h - DSi: 0000 - SDIO_TRANSACTION_CTL - Transaction Control'''<br><br />
15-10 Unknown/unused (appears to be always zero)<br />
9-8 Unknown<br />
7-3 Unknown/unused (appears to be always zero)<br />
2 Unknown<br />
1 Unknown/unused (appears to be always zero)<br />
0 Unknown<br />
Maybe also selects transfer CLK rate, or whatever.<br />
<br />
<br />
'''40048E0h - DSi: 0007 - SD_SOFT_RESET - Software Reset'''<br><br />
'''4004AE0h - DSi: 0006 - SDIO_SOFT_RESET - Software Reset'''<br><br />
15-3 Unknown/unused (appears to be always zero)<br />
2 ? Unknown (can be nonzero on DSi)<br />
1 ? Unknown (can be nonzero on DSi)<br />
0 SRST Soft Reset (0=Reset, 1=Release)<br />
Software should apply reset after sensing card insertion/removal, and<br />
(thereafter) release reset in case of card insertion. Software reset does<br />
acknowledge all IRQs (except that from SDIO /IRQ pin?), and does probably also<br />
reinitialize some other registers.<br />
<br />
<br />
'''4004808h - DSi: 0100 - SDCTL_STOP_INTERNAL_ACTION'''<br><br />
15-9 Unknown/unused (appears to be always zero)<br />
8 Unknown (1=Enable automatic sending of CMD12 after BLK_COUNT blocks?)<br />
7-1 Unknown/unused (appears to be always zero)<br />
0 Unknown<br />
Stop whatever internal action for whatever purpose in whatever situation?<br><br />
Existing code does set bit8 (prior to changing SD_DATA16_BLK_COUNT).<br><br />
Existing code does clear bit0 (alongsides with IRQ enable/acknowlege or so).<br />
<br />
<br />
'''4004824h - DSi: 0000 - DSi: Used? - SDCTL_CARD_CLK_CTL Card Clock Control'''<br><br />
Can be max 07FFh on DSi... ie. bit15 CANNOT be set?<br />
15 Disable HCLK divider (0=SDCLK selected via bit7-0, 1=SDCLK=HCLK)<br />
14-10 Unknown (zero on DSi)<br />
9 Unknown (set in some cases on DSi)<br />
8 Unknown (1=Start Clock, or Apply Clock Change, or so?)<br />
7-0 HCLK Div (0,1,2,4,8,10h,20h,40h,80h = Div2,4,8,16,32,64,128,256,512)<br />
Clock supply to SD Card<br><br />
The SDCLK signal is used for a provision of SD Memory Card or SDIO Card. Please<br />
refer to the following setting for enabling the SDCLK output.<br />
(1) Set Stop Clock Control Register (Config Offset:40h) to 1Fh.<br />
(2) Set D0 of SD Software Reset Register (Offset:0E0h) to 1b.<br />
(3) Set D7-0 of SD Card Clock Control Register (Offset:024h). These bits<br />
are used for setting the frequency of SDCLK.<br />
80h : SDCLK=HCLK/512<br />
40h : SDCLK=HCLK/256<br />
20h : SDCLK=HCLK/128<br />
10h : SDCLK=HCLK/64<br />
08h : SDCLK=HCLK/32<br />
04h : SDCLK=HCLK/16<br />
02h : SDCLK=HCLK/8<br />
01h : SDCLK=HCLK/4<br />
00h : SDCLK=HCLK/2<br />
In addition, TC6387XB holds a function that SDCLK can have same<br />
frequency as HCLK. In this case, D7-0 settings of SD Card Clock Control<br />
Register (Offset:024h) becomes invalid setting.<br />
* Set D0 of Clock Mode Register (Config Offset:42h) to 1b.<br />
* Set D15 of SD Card Clock Control Register (Offset:024h) to 1b.<br />
Please attend that the specification of SDCLK is max.25MHz at the case<br />
of SD Card and is max.20MHz at the case of MultiMedia Card.<br />
(4) D8 of SD Card Clock Control Register (Offset:024h) to 1b.<br />
(5) D8 of Clock & Wait Control Register (Offset:138h) to 1b.<br />
On the DSi, HCLK seems to be 33.513982 MHz.<br />
<br />
<br />
'''4004x38h - DSi: 0000 - SDCTL_CLK_AND_WAIT_CTL'''<br><br />
15-0 Unknown (zero on DSi)<br />
Maybe transfer CLK rate, or some master clock control for the clock input.<br />
<br />
<br />
'''4004x3Ah - DSi: 0000 - SDCTL_SDIO_HOST_INFORMATION'''<br><br />
'''4004x3Ch - DSi: 0000 - SDCTL_ERROR_CONTROL'''<br><br />
'''4004x3Eh - DSi: 0000 - SDCTL_SDLED_CONTROL - LED Control (TC6387XB only)'''<br><br />
15-0 Unknown (zero on DSi)<br />
<br />
<br />
'''40048E2h - DSi: 0009 - SDCTL_RESERVED2 (TC6371AF:CORE_REV)'''<br><br />
'''40048E6h - DSi: 0000 - SDCTL_RESERVED3 (TC6371AF:BUF_ADR)'''<br><br />
'''40048E8h - DSi: 0000 - UNDOC/UNUSED (TC6371AF:Resp_Header)'''<br><br />
'''40048F6h - DSi: 0000 - SDCTL_RESERVED4 --- used by DSi !!!'''<br><br />
'''40048F8h - DSi: 0004 - SDCTL_RESERVED5 <-- DSi: SD only (not SDIO)'''<br><br />
'''40048FAh - DSi: 0007 - SDCTL_RESERVED6 <-- DSi: SD only (not SDIO)'''<br><br />
'''40048FCh - DSi: 00FC - SDCTL_RESERVED7'''<br><br />
'''40048FEh - DSi: 00FF - SDCTL_RESERVED8 (TC6371AF:Revision)'''<br><br />
'''4004xE2h - DSi: 0000 - SDCTL_RESERVED9'''<br><br />
'''4004xF0h - DSi: 0000 - SDCTL_RESERVED10'''<br><br />
'''4004836h - DSi: 0002 - UNDOC! (bit1 can be set, other bits always 0)'''<br><br />
15-0 Unknown<br />
<br />
<br />
'''4004838h/4004A38h - DSi: C007 - UNDOC!'''<br><br />
'''4004840h/4004A40h - DSi: 003F - UNDOC?'''<br><br />
'''4004842h/4004A42h - DSi: 002A - UNDOC?'''<br><br />
'''40048B2h/4004AB2h - DSi: FFFF - UNDOC?'''<br><br />
'''40048BAh/4004ABAh - DSi: 0200 - UNDOC?'''<br><br />
'''40048F4h/4004AF4h - DSi: 0700 - UNDOC!'''<br><br />
15-0 Unknown</div>Nocashhttps://dsibrew.org/w/index.php?title=SD/MMC/SDIO_Registers&diff=2098812SD/MMC/SDIO Registers2015-08-31T10:20:14Z<p>Nocash: /* DSi SD/MMC I/O Ports: Command/Param/Response/Data */</p>
<hr />
<div>SD_xxx is used to access onboard eMMC and external SD card slot (as selected via SD_CARD_PORT_SELECT).<br><br />
SDIO_xxx is used to access the Atheros Wifi unit.<br />
<br />
== DSi SD/MMC I/O Map ==<br />
<br />
'''ARM7 DSi SD/MMC Registers for Memory Card access (SD Card and onboard eMMC)'''<br />
4004800h 2 SD_CMD Command and Response/Data Type<br />
4004802h 2 SD_CARD_PORT_SELECT (SD/MMC:020Fh, SDIO:010Fh)<br />
4004804h 4 SD_CMD_PARAM0-1 Argument (32bit, 2 halfwords)<br />
4004808h 2 SD_STOP_INTERNAL_ACTION<br />
400480Ah 2 SD_DATA16_BLK_COUNT "Transfer Block Count"<br />
400480Ch 16 SD_RESPONSE0-7 (128bit, 8 halfwords)<br />
400481Ch 4 SD_IRQ_STATUS0-1 ;IRQ Status (0=ack, 1=req)<br />
4004820h 4 SD_IRQ_MASK0-1 ;IRQ Disable (0=enable, 1=disable)<br />
4004824h 2 SD_CARD_CLK_CTL Card Clock Control<br />
4004826h 2 SD_DATA16_BLK_LEN Memory Card Transfer Data Length<br />
4004828h 2 SD_CARD_OPTION Memory Card Option Setup (can be C0FFh)<br />
400482Ah 2 Fixed always zero?<br />
400482Ch 4 SD_ERROR_DETAIL_STATUS0-1 Error Detail Status<br />
4004830h 2 SD_DATA16_FIFO Data Port (SD_FIFO?)<br />
4004832h 2 Fixed always zero? ;(TC6371AF:BUF1 Data MSBs?)<br />
4004834h 2 ? SD_TRANSACTION_CTL Transaction Control<br />
4004836h 2 ? SD_CARD_INTERRUPT_CONTROL ;4004A36h used in SDIO IRQ handler<br />
4004838h 2 ? SD_CLK_AND_WAIT_CTL ;4004A38h used in SDIO IRQ handler<br />
400483Ah 2 Fixed always zero? ;(SDCTL_SDIO_HOST_INFORMATION)<br />
400483Ch 2 Fixed always zero? ;(SDCTL_ERROR_CONTROL)<br />
400483Eh 2 Fixed always zero? ;(TC6387XB: LED_CONTROL)<br />
4004840h 2 Fixed always 003Fh?<br />
4004842h 2 Fixed always 002Ah?<br />
4004844h 6Eh Fixed always zerofilled?<br />
40048B2h 2 Fixed always FFFFh?<br />
40048B4h 6 Fixed always zerofilled?<br />
40048BAh 2 Fixed always 0200h?<br />
40048BCh 1Ch Fixed always zerofilled?<br />
40048D8h 2 SD_DATA_CTL<br />
40048DAh 6 Fixed always zerofilled?<br />
40048E0h 2 SD_SOFT_RESET Software Reset (bit0=SRST=0=reset)<br />
40048E2h 2 Fixed always 0009h? ;(RESERVED2/9, TC6371AF:CORE_REV)<br />
40048E4h 2 Fixed always zero?<br />
40048E6h 2 Fixed always zero? ;(RESERVED3, TC6371AF:BUF_ADR)<br />
40048E8h 2 Fixed always zero? ;(TC6371AF:Resp_Header)<br />
40048EAh 6 Fixed always zerofilled?<br />
40048F0h 2 Fixed always zero? ;(RESERVED10)<br />
40048F2h 2 ? Can be 0003h<br />
40048F4h 2 ? Can be 0770h<br />
40048F6h 2 ? Firmware tests bit0 (but, always 0?) (RESERVED4)<br />
40048F8h 2 Fixed always 0004h? (nonzero, unlike SDIO) (RESERVED5)<br />
40048FAh 2 ? Can be 0004h..0007h (nonzero, unlike SDIO) (RESERVED6)<br />
40048FCh 2 ? Can be 0024h..00FFh? (RESERVED7)<br />
40048FEh 2 ? Can be 0024h..00FFh? (RESERVED8 / TC6371AF:Revision)<br />
4004900h 2 SD_DATA32_IRQ<br />
4004902h 2 Fixed always zero?<br />
4004904h 2 SD_DATA32_BLK_LEN<br />
4004906h 2 Fixed always zero?<br />
4004908h 2 SD_DATA32_BLK_COUNT<br />
400490Ah 2 Fixed always zero?<br />
400490Ch 4 SD_DATA32_FIFO<br />
4004910h F0h Fixed always zerofilled?<br />
'''ARM7 DSi SD/MMC Registers for SDIO access (for Atheros Wifi)'''<br />
4004A00h 200h SDIO_xxx (same as SD_xxx at 4004800h..40049FFh, see there)<br />
4004A02h 2 SDIO_CARD_PORT_SELECT (slightly different than 4004802h)<br />
4004AF8h 2 Fixed always zero? (unlike SD_xxx at 40048F8h) (RESERVED5)<br />
4004AFAh 2 Fixed always zero? (unlike SD_xxx at 40048FAh) (RESERVED6)<br />
<br />
== DSi SD/MMC I/O Ports: Command/Param/Response/Data ==<br />
<br />
===4004800h/4004A00h - SD_CMD - Command and Response/Data Type (R/W)===<br />
15 undoc Unknown/undoc (read/write-able)<br />
14 undoc Security Cmd (0=Normal, 1=Whatever/Security) (sdio?)<br />
13 undoc Data Length (0=Single Block, 1=Multiple Blocks)<br />
12 undoc Data Direction (0=Write, 1=Read)<br />
11 NTDT Data Transfer (0=No data, 1=With data)<br />
10-8 REP2-0 Response Type (0..2=Unknown/Reserved, 3=None, 4=48bit,<br />
5=48bit+Busy, 6=136bit, 7=48bitOcrWithoutCRC7)<br />
7-6 CMD1-0 Command Type (0=CMD, 1=ACMD, 2..3=unknown, maybe GEN WR/RD?)<br />
5-0 CIX Command Index (0..3Fh, command index)<br />
Invalid values can cause ILA error (particulary on setting NTDT for CMD12, or for CMD's Response=None). ILA error will also occur if an old CMD is still busy.<br><br />
DSi software is always writing just ZERO to bit11-6 though? Maybe the hardware does automatically know which SD/MMC CMDs and ACMDs have data? Or maybe data is always automatically transferred when receiving a data-startbit, or when writing to data register - and bits like NTDT would be needed only for things like proper data timeout handling?<br />
<br />
===4004804h/4004A04h - SD_CMD_PARAM0-1 - Argument (32bit, 2 halfwords) (R/W)===<br />
31-0 Parameter value for CMD<br />
The parameter value should be written <before> sending the command via SD_CMD/SDIO_CMD.<br />
<br />
===400480Ch/4004A0Ch - SD_RESPONSE0-7 - Response (128bit, 8 halfwords) (R)===<br />
After sending a command, wait for the CMDRESPEND bit (IRQ_STATUS.bit0) to get<br />
set, then read the RESPONSE (if the command does have any response).<br />
For normal 32bit responses:<br />
31-0 Response<br />
127-32 Older Responses<br />
For CID/CSD responses:<br />
119-0 120bit Response<br />
127-120 Zero (always?)<br />
Seems to be left-shifted when receiving response bits. So, for 32bit responses, bit0-31 would contain the current response, and bit32-127 would contain older responses.<br />
<br />
===DATA16 vs DATA32===<br />
Data can be transferred in 16bit or 32bit units (as selected in DATA_CTL.bit1 and DATA32_IRQ.bit1). There are separate data, block len, and block count registers for 16bit and 32bit mode (that's probably due to some odd patchwork, where the manufacturer has added 32bit support to the original 16bit chip design).<br><br />
Naturally, a 32bit transfer is faster than two 16bit transfers. Nethertheless, the DSi firmware does use both 32bit and 16bit mode once and then; 32bit mode is required for NDMA transfers (which don't support 16bit).<br />
<br />
===40048D8h/4004AD8h - SD_DATA_CTL===<br />
15-13 Unknown (usually 0)<br />
12 Unknown (usually 1) (R?)<br />
11-6 Unknown (usually 0)<br />
5 Unknown (read/write-able) (usually 0) (R/W)<br />
4 Unknown (usually 1) (R?)<br />
3-2 Unknown (usually 0)<br />
1 Select 16bit/32bit Data Mode (0=DATA16, 1=DATA32, see 4004900h) (R/W)<br />
0 Unknown (usually 0)<br />
Known written values are 0000h and 0002h. However, known read values are 1010h and 1012h.<br><br />
DATA32 mode requires setting both 40048D8h.bit1 and 4004900h.bit1. For DATA16 mode, both bits should be zero (though DATA16 seems to be also working the same way when only either of the bits is zero).<br />
<br />
===400480Ah/4004A0Ah - SD_DATA16_BLK_COUNT - "Transfer Block Count" (R/W)===<br />
===4004908h/4004B08h - SD_DATA32_BLK_COUNT (R/W)===<br />
15-0 Number of Data Blocks for multiple read/write commands (0..FFFFh)<br />
In Data32 mode, DATA32_BLK_COUNT is decremented after each block (except after the last block, where it stays at 0001h instead of getting zero). In Data16 mode, SD_DATA16_BLK_COUNT doesn't decrease (instead, there must be some hidden internal counter register).<br><br />
If enabled in STOP_INTERNAL_ACTION.bit8, then the hardware will be automatically sending STOP_TRANSMISSION (CMD12) after the last block (otherwise the decrement occurs as described above, but the hardware keeps transferring blocks infinitely).<br />
<br />
===4004826h/4004A26h - SD_DATA16_BLK_LEN - Transfer Data Length (R/W)===<br />
===4004904h/4004B04h - SD_DATA32_BLK_LEN (R/W)===<br />
15-10 Unknown/unused (appears to be always zero)<br />
9-0 Data Block Length in bytes (for DATA16: clipped to max 0200h by hw)<br />
Should be usually 0200h (for 512-byte SD/MMC memory blocks). Other values may be needed for SDIO functions, or when accessing SSR/SCR/PWD registers via data transfers.<br><br />
DATA32_BLK_LEN can be max 3FFh (unlike DATA16_BLK_LEN which is clipped to<br />
max=200h by hardware).<br />
<br />
===4004830h/4004A30h - SD_DATA16_FIFO - Data Port (SD_FIFO?)===<br />
===400490Ch/4004B0Ch - SD_DATA32_FIFO===<br />
For Data16:<br />
15-0 Data (16bit) (...or could it be accessed as 32bit, too?)<br />
For Data32:<br />
31-0 Data (32bit) (...or could it be accessed as 16bit, too?)<br />
Transfer data here (read after RXRDY gets set, or write after TXRQ gets set).<br />
FIFO size is unknown (if there's any FIFO behind it).<br />
<br />
== DSi SD/MMC I/O Ports: Interrupt/Status ==<br />
<br />
'''400481Ch - SD_IRQ_STATUS0-1 - Interrupt Status (R/ack)'''<br><br />
'''4004A1Ch - SDIO_IRQ_STATUS0-1 - Interrupt Status (R/ack)'''<br><br />
'''4004820h - SD_IRQ_MASK0-1 - Interrupt Mask (R/W)'''<br><br />
'''4004A20h - SDIO_IRQ_MASK0-1 - Interrupt Mask (R/W)'''<br><br />
The IRQ_STATUS registers contain acknowledge-able IRQ Flags (those bits that<br />
that are maskable in IRQ_MASK register), as well as static read-only status<br />
bits without IRQ function (eg. WRPROTECT).<br />
* IRQ Flags/Write (0=Acknowledge, 1=No change)<br />
* IRQ Flags/Read (0=No IRQ, 1=IRQ)<br />
* IRQ Mask (0=Enable, 1=Disable) (8B7F031Dh when all IRQs disabled)<br />
Bit Stat Mask Function<br />
0 SREP MREP CMDRESPEND (response end) (or R1b: busy end)<br />
1 0 0 Unknown/unused (always 0)<br />
2 SRWA MRWA DATAEND (is NOT set? after data read/write end bit)<br />
3 SCOT MCOT CARD_REMOVE (0=No event, 1=Is/was newly ejected) ;\DSi<br />
4 SCIN MCIN CARD_INSERT (0=No event, 1=Is/was newly inserted) ; SD<br />
5 undoc 0 SIGSTATE (0=Ejected, 1=Inserted) (SDIO: always 1) ; Card<br />
6 0 0 Unknown/unused (always 0) ; Slot<br />
7 undoc 0 WRPROTECT (0=Locked/Ejected, 1=Unlocked/HalfEjected);/<br />
8 undoc undoc CARD_REMOVE_A (always 0) ;\maybe fixed state for<br />
9 undoc undoc CARD_INSERT_A (always 0) ; DSi's onboard eMMC chip<br />
10 undoc 0 SIGSTATE_A (always 1) ;/(also fixed as so for SDIO)<br />
11 0 0 Unknown/unused (always 0)<br />
12 0 0 Unknown/unused (always 0)<br />
13 0 0 Unknown/unused (always 0)<br />
14 0 0 Unknown/unused (always 0)<br />
15 0 0 Unknown/unused (always 0)<br />
16 SCIX MCIX CMD_IDX_ERR Bad CMD-index in response (RCMDE,SCMDE)<br />
17 SCRC MCRC CRCFAIL CRC response error (WCRCE,RCRCE,SCRCE,CCRCE)<br />
18 SEND MEND STOPBIT_ERR End bit error (WEBER,REBER,SEBER,CEBER)<br />
19 SDTO MDTO DATATIMEOUT Data Timeout (NRCS,NWCS,KBSY)<br />
20 SFOF MFOF RXOVERFLOW HOST tried write full<br />
21 SFUF MFUF TXUNDERRUN HOST tried read empty<br />
22 SCTO MCTO CMDTIMEOUT Response start-bit timeout (NRS,NSR)<br />
23 1 ? 0 Unknown/undoc (usually set?)<br />
24 SBRE MBRE RXRDY (fifo not empty) (request data read)<br />
25 SBWE MBWE TXRQ (datafifoempty?) (request data write)<br />
26 0 0 Unknown/unused (always 0)<br />
27 undoc undoc Unknown/undoc (bit27 is mask-able in IRQ_MASK)<br />
28 0 0 Unknown/unused (always 0)<br />
29 1 ? 0 Unknown/undoc (usually set?) (unlike toshiba ILFSL/IFSMSK)<br />
30 undoc 0 CMD_BUSY<br />
31 ILA IMSK Illegal Command Access (old CMD still busy, or wrong NTDT)<br />
Acknowledge by STAT=0, or by MASK=1 (uh, really?), or by soft reset (SRST=0) or<br />
hard reset.<br />
<br />
<br />
'''4004900h - SD_DATA32_IRQ'''<br><br />
'''4004B00h - SDIO_DATA32_IRQ'''<br><br />
15-13 Unknown/unused (appears to be always zero)<br />
12 Unknown (paired with bit9) (can be set) IRQ enable ?! (R/W?)<br />
11 Unknown (paired with bit8) (can be set) IRQ enable ?! (R/W?)<br />
10 Unknown (read=0) write: (0=No change, 1=Clear Bit8,9) ? (W?)<br />
9 Unknown (paired with bit12) (automatically cleared after...) (R?)<br />
8 Unknown (paired with bit11) (R?)<br />
7-2 Unknown (0)<br />
1 Unknown (can be set) (autoclear bit8,9 on xfer end?) (R/W?)<br />
0 Unknown (0)<br />
Can be 1A02h, but changes to 1802h after reading from somewhere (maybe from<br />
DATA32_FIFO?).<br><br />
Bit8,9 seem to be whatever extra IRQ flags, the flags get set ONLY in DATA32<br />
mode (not in DATA16 mode).<br />
<br />
<br />
'''400482Ch - SD_ERROR_DETAIL_STATUS0-1 - Error Detail Status'''<br><br />
'''4004A2Ch - SDIO_ERROR_DETAIL_STATUS0-1 - Error Detail Status'''<br><br />
31-23 ? Unknown/unused/undoc<br />
22 KBSY Timeout for CRC status busy timeout ;\STAT.19<br />
21 NWCS Timeout for CRC status timeout ; (SDTO)<br />
20 NRCS Timeout for Data start-bit, or for Post Data Busy ;/<br />
19-18 ? Unknown/unused/undoc<br />
17 NRS Response timeout for auto-issued CMD12 ;\STAT.22<br />
16 NCR Response timeout for non-auto-issued CMD's ;/(SCTO)<br />
15-14 ? Unknown/unused/undoc<br />
13 ?? Unknown/undoc (bit13 can be nonzero on DSi!)<br />
12 ? Unknown/unused/undoc<br />
11 WCRCE CRC error for Write CRC status for a write command ;\<br />
10 RCRCE CRC error for read data ; STAT.17<br />
9 SCRCE CRC error for a response for auto-issued CMD12 ; (SCRC)<br />
8 CCRCE CRC error for a response for non-auto-issued CMD's ;/<br />
5 WEBER End bit error for Write CRC status ;\<br />
4 REBER End bit error for read data ; STAT.18<br />
3 SEBER End bit error for response for auto-issued CMD12 ; (SEND)<br />
2 CEBER End bit error for response for non-auto-issued CMD's ;/<br />
1? SCMDE Bad CMD-index in response of auto-issued CMD12 ;\STAT.16<br />
0 RCMDE Bad CMD-index in response of non-auto-issued CMD's ;/(SCIX)<br />
Unknown if/when/how the error bits can be reset/acknowledged.<br><br />
Note: CMD12 is STOP_TRANSMISSION (maybe sent after BLK_COUNT?).<br><br />
The four "auto-issued CMD12" bits exist for SD registers only (not SDIO).<br />
SCMDE is probably in bit1 (though, official specs say bit0, which would be same<br />
as RCMDE).<br />
<br />
<br />
'''4004A36h - DSi: 0000 - SDCTL_CARD_INTERRUPT_CONTROL'''<br><br />
This does NOT seem to be implemented as described below on DSi.<br />
4004A36h does seem to behave more like 4004836h, see there.<br />
15-13 ? Unknown (zero on DSi)<br />
12 CINT0 SDIO Interrupt Flag (0=none, 1=irq) (/IRQ aka Data1 pin)<br />
11-9 ? Unknown (zero on DSi)<br />
8 CIMSK0 SDIO Interrupt Mask (0=enable, 1=disable) (/IRQ aka Data1 pin)<br />
7-0 ? Unknown (zero on DSi)<br />
Acknowledge by writing CINT0=0, or CIMSK0=1, or hard reset (unlike as for other<br />
SD/MMC interrupts, soft reset does not acknowlege this interrupt type?).<br />
<br />
== DSi SD/MMC I/O Ports: Control ==<br />
<br />
'''4004802h - SD_CARD_PORT_SELECT (0201h)'''<br><br />
'''4004A02h - SDIO_CARD_PORT_SELECT (0100h)'''<br><br />
15-11 Unknown/unused (appears to be always zero)<br />
10 Unknown (write: should be 1, read: usually/always 0) (W?)<br />
9 Unknown (write: should be 0, read: usually 1 for SD)<br />
8 Unknown (write: should be 0, read: usually 1 for SDIO)<br />
7-4 Unknown/unused (appears to be always zero)<br />
3-1 Unknown (R/W)<br />
0 Port Select (0=SD Card Slot, 1=Onboard eMMC) (for SDIO: Unknown)<br />
Known written values are 0400h and 0401h (SD). However known read values are<br />
0201h (SD) and 0100h (SDIO).<br />
<br />
<br />
'''4004828h - DSi: 40E0 - SD_CARD_OPTION - Memory Card Option Setup'''<br><br />
'''4004A28h - DSi: 40EE - SDIO_CARD_OPTION - Card Option Setup'''<br><br />
15 Bus Width (0=4bit, 1=1bit)<br />
14 Unknown (usually set)<br />
13-8 Unknown/unused (appears to be always zero)<br />
7-4 Unknown, maybe some 4bit timing/timeout value<br />
0-3 Unknown, maybe another 4bit timing/timeout value<br />
Settings spotted on DSi are 40E0h,40EEh.<br><br />
Among others, this register should contain a 4bit timeout setting, "RTO[3:0]<br />
for SD (aka TO[3:0] for SDIO) timeout period for data start/busy bits, in the<br />
form of a multiple number of the SDCLK period."<br><br />
Maybe also selects transfer CLK rate, or whatever.<br />
<br />
<br />
'''4004834h - DSi: 0000 - SD_TRANSACTION_CTL - Transaction Control'''<br><br />
'''4004A34h - DSi: 0000 - SDIO_TRANSACTION_CTL - Transaction Control'''<br><br />
15-10 Unknown/unused (appears to be always zero)<br />
9-8 Unknown<br />
7-3 Unknown/unused (appears to be always zero)<br />
2 Unknown<br />
1 Unknown/unused (appears to be always zero)<br />
0 Unknown<br />
Maybe also selects transfer CLK rate, or whatever.<br />
<br />
<br />
'''40048E0h - DSi: 0007 - SD_SOFT_RESET - Software Reset'''<br><br />
'''4004AE0h - DSi: 0006 - SDIO_SOFT_RESET - Software Reset'''<br><br />
15-3 Unknown/unused (appears to be always zero)<br />
2 ? Unknown (can be nonzero on DSi)<br />
1 ? Unknown (can be nonzero on DSi)<br />
0 SRST Soft Reset (0=Reset, 1=Release)<br />
Software should apply reset after sensing card insertion/removal, and<br />
(thereafter) release reset in case of card insertion. Software reset does<br />
acknowledge all IRQs (except that from SDIO /IRQ pin?), and does probably also<br />
reinitialize some other registers.<br />
<br />
<br />
'''4004808h - DSi: 0100 - SDCTL_STOP_INTERNAL_ACTION'''<br><br />
15-9 Unknown/unused (appears to be always zero)<br />
8 Unknown (1=Enable automatic sending of CMD12 after BLK_COUNT blocks?)<br />
7-1 Unknown/unused (appears to be always zero)<br />
0 Unknown<br />
Stop whatever internal action for whatever purpose in whatever situation?<br><br />
Existing code does set bit8 (prior to changing SD_DATA16_BLK_COUNT).<br><br />
Existing code does clear bit0 (alongsides with IRQ enable/acknowlege or so).<br />
<br />
<br />
'''4004824h - DSi: 0000 - DSi: Used? - SDCTL_CARD_CLK_CTL Card Clock Control'''<br><br />
Can be max 07FFh on DSi... ie. bit15 CANNOT be set?<br />
15 Disable HCLK divider (0=SDCLK selected via bit7-0, 1=SDCLK=HCLK)<br />
14-10 Unknown (zero on DSi)<br />
9 Unknown (set in some cases on DSi)<br />
8 Unknown (1=Start Clock, or Apply Clock Change, or so?)<br />
7-0 HCLK Div (0,1,2,4,8,10h,20h,40h,80h = Div2,4,8,16,32,64,128,256,512)<br />
Clock supply to SD Card<br><br />
The SDCLK signal is used for a provision of SD Memory Card or SDIO Card. Please<br />
refer to the following setting for enabling the SDCLK output.<br />
(1) Set Stop Clock Control Register (Config Offset:40h) to 1Fh.<br />
(2) Set D0 of SD Software Reset Register (Offset:0E0h) to 1b.<br />
(3) Set D7-0 of SD Card Clock Control Register (Offset:024h). These bits<br />
are used for setting the frequency of SDCLK.<br />
80h : SDCLK=HCLK/512<br />
40h : SDCLK=HCLK/256<br />
20h : SDCLK=HCLK/128<br />
10h : SDCLK=HCLK/64<br />
08h : SDCLK=HCLK/32<br />
04h : SDCLK=HCLK/16<br />
02h : SDCLK=HCLK/8<br />
01h : SDCLK=HCLK/4<br />
00h : SDCLK=HCLK/2<br />
In addition, TC6387XB holds a function that SDCLK can have same<br />
frequency as HCLK. In this case, D7-0 settings of SD Card Clock Control<br />
Register (Offset:024h) becomes invalid setting.<br />
* Set D0 of Clock Mode Register (Config Offset:42h) to 1b.<br />
* Set D15 of SD Card Clock Control Register (Offset:024h) to 1b.<br />
Please attend that the specification of SDCLK is max.25MHz at the case<br />
of SD Card and is max.20MHz at the case of MultiMedia Card.<br />
(4) D8 of SD Card Clock Control Register (Offset:024h) to 1b.<br />
(5) D8 of Clock & Wait Control Register (Offset:138h) to 1b.<br />
On the DSi, HCLK seems to be 33.513982 MHz.<br />
<br />
<br />
'''4004x38h - DSi: 0000 - SDCTL_CLK_AND_WAIT_CTL'''<br><br />
15-0 Unknown (zero on DSi)<br />
Maybe transfer CLK rate, or some master clock control for the clock input.<br />
<br />
<br />
'''4004x3Ah - DSi: 0000 - SDCTL_SDIO_HOST_INFORMATION'''<br><br />
'''4004x3Ch - DSi: 0000 - SDCTL_ERROR_CONTROL'''<br><br />
'''4004x3Eh - DSi: 0000 - SDCTL_SDLED_CONTROL - LED Control (TC6387XB only)'''<br><br />
15-0 Unknown (zero on DSi)<br />
<br />
<br />
'''40048E2h - DSi: 0009 - SDCTL_RESERVED2 (TC6371AF:CORE_REV)'''<br><br />
'''40048E6h - DSi: 0000 - SDCTL_RESERVED3 (TC6371AF:BUF_ADR)'''<br><br />
'''40048E8h - DSi: 0000 - UNDOC/UNUSED (TC6371AF:Resp_Header)'''<br><br />
'''40048F6h - DSi: 0000 - SDCTL_RESERVED4 --- used by DSi !!!'''<br><br />
'''40048F8h - DSi: 0004 - SDCTL_RESERVED5 <-- DSi: SD only (not SDIO)'''<br><br />
'''40048FAh - DSi: 0007 - SDCTL_RESERVED6 <-- DSi: SD only (not SDIO)'''<br><br />
'''40048FCh - DSi: 00FC - SDCTL_RESERVED7'''<br><br />
'''40048FEh - DSi: 00FF - SDCTL_RESERVED8 (TC6371AF:Revision)'''<br><br />
'''4004xE2h - DSi: 0000 - SDCTL_RESERVED9'''<br><br />
'''4004xF0h - DSi: 0000 - SDCTL_RESERVED10'''<br><br />
'''4004836h - DSi: 0002 - UNDOC! (bit1 can be set, other bits always 0)'''<br><br />
15-0 Unknown<br />
<br />
<br />
'''4004838h/4004A38h - DSi: C007 - UNDOC!'''<br><br />
'''4004840h/4004A40h - DSi: 003F - UNDOC?'''<br><br />
'''4004842h/4004A42h - DSi: 002A - UNDOC?'''<br><br />
'''40048B2h/4004AB2h - DSi: FFFF - UNDOC?'''<br><br />
'''40048BAh/4004ABAh - DSi: 0200 - UNDOC?'''<br><br />
'''40048F4h/4004AF4h - DSi: 0700 - UNDOC!'''<br><br />
15-0 Unknown</div>Nocashhttps://dsibrew.org/w/index.php?title=SD/MMC/SDIO_Registers&diff=2098811SD/MMC/SDIO Registers2015-08-30T22:59:29Z<p>Nocash: </p>
<hr />
<div>SD_xxx is used to access onboard eMMC and external SD card slot (as selected via SD_CARD_PORT_SELECT).<br><br />
SDIO_xxx is used to access the Atheros Wifi unit.<br />
<br />
== DSi SD/MMC I/O Map ==<br />
<br />
'''ARM7 DSi SD/MMC Registers for Memory Card access (SD Card and onboard eMMC)'''<br />
4004800h 2 SD_CMD Command and Response/Data Type<br />
4004802h 2 SD_CARD_PORT_SELECT (SD/MMC:020Fh, SDIO:010Fh)<br />
4004804h 4 SD_CMD_PARAM0-1 Argument (32bit, 2 halfwords)<br />
4004808h 2 SD_STOP_INTERNAL_ACTION<br />
400480Ah 2 SD_DATA16_BLK_COUNT "Transfer Block Count"<br />
400480Ch 16 SD_RESPONSE0-7 (128bit, 8 halfwords)<br />
400481Ch 4 SD_IRQ_STATUS0-1 ;IRQ Status (0=ack, 1=req)<br />
4004820h 4 SD_IRQ_MASK0-1 ;IRQ Disable (0=enable, 1=disable)<br />
4004824h 2 SD_CARD_CLK_CTL Card Clock Control<br />
4004826h 2 SD_DATA16_BLK_LEN Memory Card Transfer Data Length<br />
4004828h 2 SD_CARD_OPTION Memory Card Option Setup (can be C0FFh)<br />
400482Ah 2 Fixed always zero?<br />
400482Ch 4 SD_ERROR_DETAIL_STATUS0-1 Error Detail Status<br />
4004830h 2 SD_DATA16_FIFO Data Port (SD_FIFO?)<br />
4004832h 2 Fixed always zero? ;(TC6371AF:BUF1 Data MSBs?)<br />
4004834h 2 ? SD_TRANSACTION_CTL Transaction Control<br />
4004836h 2 ? SD_CARD_INTERRUPT_CONTROL ;4004A36h used in SDIO IRQ handler<br />
4004838h 2 ? SD_CLK_AND_WAIT_CTL ;4004A38h used in SDIO IRQ handler<br />
400483Ah 2 Fixed always zero? ;(SDCTL_SDIO_HOST_INFORMATION)<br />
400483Ch 2 Fixed always zero? ;(SDCTL_ERROR_CONTROL)<br />
400483Eh 2 Fixed always zero? ;(TC6387XB: LED_CONTROL)<br />
4004840h 2 Fixed always 003Fh?<br />
4004842h 2 Fixed always 002Ah?<br />
4004844h 6Eh Fixed always zerofilled?<br />
40048B2h 2 Fixed always FFFFh?<br />
40048B4h 6 Fixed always zerofilled?<br />
40048BAh 2 Fixed always 0200h?<br />
40048BCh 1Ch Fixed always zerofilled?<br />
40048D8h 2 SD_DATA_CTL<br />
40048DAh 6 Fixed always zerofilled?<br />
40048E0h 2 SD_SOFT_RESET Software Reset (bit0=SRST=0=reset)<br />
40048E2h 2 Fixed always 0009h? ;(RESERVED2/9, TC6371AF:CORE_REV)<br />
40048E4h 2 Fixed always zero?<br />
40048E6h 2 Fixed always zero? ;(RESERVED3, TC6371AF:BUF_ADR)<br />
40048E8h 2 Fixed always zero? ;(TC6371AF:Resp_Header)<br />
40048EAh 6 Fixed always zerofilled?<br />
40048F0h 2 Fixed always zero? ;(RESERVED10)<br />
40048F2h 2 ? Can be 0003h<br />
40048F4h 2 ? Can be 0770h<br />
40048F6h 2 ? Firmware tests bit0 (but, always 0?) (RESERVED4)<br />
40048F8h 2 Fixed always 0004h? (nonzero, unlike SDIO) (RESERVED5)<br />
40048FAh 2 ? Can be 0004h..0007h (nonzero, unlike SDIO) (RESERVED6)<br />
40048FCh 2 ? Can be 0024h..00FFh? (RESERVED7)<br />
40048FEh 2 ? Can be 0024h..00FFh? (RESERVED8 / TC6371AF:Revision)<br />
4004900h 2 SD_DATA32_IRQ<br />
4004902h 2 Fixed always zero?<br />
4004904h 2 SD_DATA32_BLK_LEN<br />
4004906h 2 Fixed always zero?<br />
4004908h 2 SD_DATA32_BLK_COUNT<br />
400490Ah 2 Fixed always zero?<br />
400490Ch 4 SD_DATA32_FIFO<br />
4004910h F0h Fixed always zerofilled?<br />
'''ARM7 DSi SD/MMC Registers for SDIO access (for Atheros Wifi)'''<br />
4004A00h 200h SDIO_xxx (same as SD_xxx at 4004800h..40049FFh, see there)<br />
4004A02h 2 SDIO_CARD_PORT_SELECT (slightly different than 4004802h)<br />
4004AF8h 2 Fixed always zero? (unlike SD_xxx at 40048F8h) (RESERVED5)<br />
4004AFAh 2 Fixed always zero? (unlike SD_xxx at 40048FAh) (RESERVED6)<br />
<br />
== DSi SD/MMC I/O Ports: Command/Param/Response/Data ==<br />
<br />
'''4004800h - SD_CMD - Command and Response/Data Type (R/W)'''<br><br />
'''4004A00h - SDIO_CMD - Command and Response/Data Type (R/W)'''<br><br />
15 undoc Unknown/undoc (read/write-able)<br />
14 undoc Security Cmd (0=Normal, 1=Whatever/Security) (sdio?)<br />
13 undoc Data Length (0=Single Block, 1=Multiple Blocks)<br />
12 undoc Data Direction (0=Write, 1=Read)<br />
11 NTDT Data Transfer (0=No data, 1=With data)<br />
10-8 REP2-0 Response Type (0..2=Unknown/Reserved, 3=None, 4=48bit,<br />
5=48bit+Busy, 6=136bit, 7=48bitOcrWithoutCRC7)<br />
7-6 CMD1-0 Command Type (0=CMD, 1=ACMD, 2..3=unknown, maybe GEN WR/RD?)<br />
5-0 CIX Command Index (0..3Fh, command index)<br />
Invalid values can cause ILA error (particulary on setting NTDT for CMD12, or<br />
for CMD's Response=None). ILA error will also occur if an old CMD is still<br />
busy.<br />
DSi software is always writing just ZERO to bit11-6 though? Maybe the hardware<br />
does automatically know which SD/MMC CMDs and ACMDs have data? Or maybe data is<br />
always automatically transferred when receiving a data-startbit, or when<br />
writing to data register - and bits like NTDT would be needed only for things<br />
like proper data timeout handling?<br />
<br />
<br />
'''4004804h - SD_CMD_PARAM0-1 - Argument (32bit, 2 halfwords) (R/W)'''<br><br />
'''4004A04h - SDIO_CMD_PARAM0-1 - Argument (32bit, 2 halfwords) (R/W)'''<br><br />
31-0 Parameter value for CMD<br />
The parameter value should be written <before> sending the command via<br />
SD_CMD/SDIO_CMD.<br />
<br />
<br />
'''400480Ch - SD_RESPONSE0-7 - Response (128bit, 8 halfwords) (R)'''<br><br />
'''4004A0Ch - SDIO_RESPONSE0-7 - Response (128bit, 8 halfwords) (R)'''<br><br />
After sending a command, wait for the CMDRESPEND bit (IRQ_STATUS.bit0) to get<br />
set, then read the RESPONSE (if the command does have any response).<br />
For normal 32bit responses:<br />
31-0 Response<br />
127-32 Older Responses<br />
For CID/CSD responses:<br />
119-0 120bit Response<br />
127-120 Zero (always?)<br />
Seems to be left-shifted when receiving response bits. So, for 32bit responses,<br />
bit0-31 would contain the current response, and bit32-127 would contain older<br />
responses.<br />
<br />
<br />
'''DATA16 vs DATA32'''<br><br />
Data can be transferred in 16bit or 32bit units (as selected in DATA_CTL.bit1).<br />
There are separate data, block len, and block count registers for 16bit and<br />
32bit mode (that's probably due to some odd patchwork, where the manufacturer<br />
has added 32bit support to the original 16bit chip design).<br />
Naturally, a 32bit transfer is faster than two 16bit transfers. Nethertheless,<br />
the DSi firmware does use both 32bit and 16bit mode once and then; 32bit mode<br />
is required for NDMA transfers (which don't support 16bit).<br />
<br />
'''40048D8h - SD_DATA_CTL'''<br><br />
'''4004AD8h - SDIO_DATA_CTL'''<br><br />
15-13 Unknown (usually 0)<br />
12 Unknown (usually 1) (R?)<br />
11-6 Unknown (usually 0)<br />
5 Unknown (R/W?) (R/W?)<br />
4 Unknown (usually 1) (R?)<br />
3-2 Unknown (usually 0)<br />
1 Select 16bit/32bit Data Mode (0=DATA16, 1=DATA32) (R/W?)<br />
0 Unknown (usually 0)<br />
Known written values are 0000h and 0002h. However, known read values are 1010h<br />
and 1012h.<br />
<br />
<br />
'''400480Ah - SD_DATA16_BLK_COUNT - "Transfer Sector Count" (R/W)'''<br><br />
'''4004908h - SD_DATA32_BLK_COUNT (R/W)'''<br><br />
'''4004A0Ah - SDIO_DATA16_BLK_COUNT - "Transfer Block Count" (R/W)'''<br><br />
'''4004B08h - SDIO_DATA32_BLK_COUNT (R/W)'''<br><br />
15-0 Number of Data Blocks for multiple read/write commands<br />
Can be max FFFFh. The DATA32_BLK_COUNT value decreases after reading from<br />
somewhere (maybe from DATA32_FIFO?).<br />
<br />
<br />
'''4004826h - SD_DATA16_BLK_LEN - Memory Card Transfer Data Length (R/W)'''<br><br />
'''4004904h - SD_DATA32_BLK_LEN (R/W)'''<br><br />
'''4004A26h - SDIO_DATA16_BLK_LEN - Card Transfer Data Length (R/W)'''<br><br />
'''4004B04h - SDIO_DATA32_BLK_LEN (R/W)'''<br><br />
15-10 Unknown/unused (appears to be always zero)<br />
9-0 Data Block Length in bytes (for DATA16: clipped to max 0200h by hw)<br />
Should be usually 0200h (for 512-byte SD/MMC memory blocks). Other values may<br />
be needed for SDIO functions, or when accessing SSR/SCR/PWD registers via data<br />
transfers.<br />
DATA32_BLK_LEN can be max 3FFh (unlike DATA16_BLK_LEN which is clipped to<br />
max=200h by hardware).<br />
<br />
<br />
'''4004830h - SD_DATA16_FIFO - Data Port (SD_FIFO?)'''<br><br />
'''400490Ch - SD_DATA32_FIFO'''<br><br />
'''4004A30h - SDIO_DATA16_FIFO - Data Port (SD_FIFO?)'''<br><br />
'''4004B0Ch - SDIO_DATA32_FIFO'''<br><br />
For Data16:<br />
15-0 Data (16bit) (...or could it be accessed as 32bit, too?)<br />
For Data32:<br />
31-0 Data (32bit) (...or could it be accessed as 16bit, too?)<br />
Transfer data here (read after RXRDY gets set, or write after TXRQ gets set).<br />
FIFO size is unknown (if there's any FIFO behind it).<br />
<br />
<br />
== DSi SD/MMC I/O Ports: Interrupt/Status ==<br />
<br />
'''400481Ch - SD_IRQ_STATUS0-1 - Interrupt Status (R/ack)'''<br><br />
'''4004A1Ch - SDIO_IRQ_STATUS0-1 - Interrupt Status (R/ack)'''<br><br />
'''4004820h - SD_IRQ_MASK0-1 - Interrupt Mask (R/W)'''<br><br />
'''4004A20h - SDIO_IRQ_MASK0-1 - Interrupt Mask (R/W)'''<br><br />
The IRQ_STATUS registers contain acknowledge-able IRQ Flags (those bits that<br />
that are maskable in IRQ_MASK register), as well as static read-only status<br />
bits without IRQ function (eg. WRPROTECT).<br />
* IRQ Flags/Write (0=Acknowledge, 1=No change)<br />
* IRQ Flags/Read (0=No IRQ, 1=IRQ)<br />
* IRQ Mask (0=Enable, 1=Disable) (8B7F031Dh when all IRQs disabled)<br />
Bit Stat Mask Function<br />
0 SREP MREP CMDRESPEND (response end) (or R1b: busy end)<br />
1 0 0 Unknown/unused (always 0)<br />
2 SRWA MRWA DATAEND (is NOT set? after data read/write end bit)<br />
3 SCOT MCOT CARD_REMOVE (0=No event, 1=Is/was newly ejected) ;\DSi<br />
4 SCIN MCIN CARD_INSERT (0=No event, 1=Is/was newly inserted) ; SD<br />
5 undoc 0 SIGSTATE (0=Ejected, 1=Inserted) (SDIO: always 1) ; Card<br />
6 0 0 Unknown/unused (always 0) ; Slot<br />
7 undoc 0 WRPROTECT (0=Locked/Ejected, 1=Unlocked/HalfEjected);/<br />
8 undoc undoc CARD_REMOVE_A (always 0) ;\maybe fixed state for<br />
9 undoc undoc CARD_INSERT_A (always 0) ; DSi's onboard eMMC chip<br />
10 undoc 0 SIGSTATE_A (always 1) ;/(also fixed as so for SDIO)<br />
11 0 0 Unknown/unused (always 0)<br />
12 0 0 Unknown/unused (always 0)<br />
13 0 0 Unknown/unused (always 0)<br />
14 0 0 Unknown/unused (always 0)<br />
15 0 0 Unknown/unused (always 0)<br />
16 SCIX MCIX CMD_IDX_ERR Bad CMD-index in response (RCMDE,SCMDE)<br />
17 SCRC MCRC CRCFAIL CRC response error (WCRCE,RCRCE,SCRCE,CCRCE)<br />
18 SEND MEND STOPBIT_ERR End bit error (WEBER,REBER,SEBER,CEBER)<br />
19 SDTO MDTO DATATIMEOUT Data Timeout (NRCS,NWCS,KBSY)<br />
20 SFOF MFOF RXOVERFLOW HOST tried write full<br />
21 SFUF MFUF TXUNDERRUN HOST tried read empty<br />
22 SCTO MCTO CMDTIMEOUT Response start-bit timeout (NRS,NSR)<br />
23 1 ? 0 Unknown/undoc (usually set?)<br />
24 SBRE MBRE RXRDY (fifo not empty) (request data read)<br />
25 SBWE MBWE TXRQ (datafifoempty?) (request data write)<br />
26 0 0 Unknown/unused (always 0)<br />
27 undoc undoc Unknown/undoc (bit27 is mask-able in IRQ_MASK)<br />
28 0 0 Unknown/unused (always 0)<br />
29 1 ? 0 Unknown/undoc (usually set?) (unlike toshiba ILFSL/IFSMSK)<br />
30 undoc 0 CMD_BUSY<br />
31 ILA IMSK Illegal Command Access (old CMD still busy, or wrong NTDT)<br />
Acknowledge by STAT=0, or by MASK=1 (uh, really?), or by soft reset (SRST=0) or<br />
hard reset.<br />
<br />
<br />
'''4004900h - SD_DATA32_IRQ'''<br><br />
'''4004B00h - SDIO_DATA32_IRQ'''<br><br />
15-13 Unknown/unused (appears to be always zero)<br />
12 Unknown (paired with bit9) (can be set) IRQ enable ?! (R/W?)<br />
11 Unknown (paired with bit8) (can be set) IRQ enable ?! (R/W?)<br />
10 Unknown (read=0) write: (0=No change, 1=Clear Bit8,9) ? (W?)<br />
9 Unknown (paired with bit12) (automatically cleared after...) (R?)<br />
8 Unknown (paired with bit11) (R?)<br />
7-2 Unknown (0)<br />
1 Unknown (can be set) (autoclear bit8,9 on xfer end?) (R/W?)<br />
0 Unknown (0)<br />
Can be 1A02h, but changes to 1802h after reading from somewhere (maybe from<br />
DATA32_FIFO?).<br><br />
Bit8,9 seem to be whatever extra IRQ flags, the flags get set ONLY in DATA32<br />
mode (not in DATA16 mode).<br />
<br />
<br />
'''400482Ch - SD_ERROR_DETAIL_STATUS0-1 - Error Detail Status'''<br><br />
'''4004A2Ch - SDIO_ERROR_DETAIL_STATUS0-1 - Error Detail Status'''<br><br />
31-23 ? Unknown/unused/undoc<br />
22 KBSY Timeout for CRC status busy timeout ;\STAT.19<br />
21 NWCS Timeout for CRC status timeout ; (SDTO)<br />
20 NRCS Timeout for Data start-bit, or for Post Data Busy ;/<br />
19-18 ? Unknown/unused/undoc<br />
17 NRS Response timeout for auto-issued CMD12 ;\STAT.22<br />
16 NCR Response timeout for non-auto-issued CMD's ;/(SCTO)<br />
15-14 ? Unknown/unused/undoc<br />
13 ?? Unknown/undoc (bit13 can be nonzero on DSi!)<br />
12 ? Unknown/unused/undoc<br />
11 WCRCE CRC error for Write CRC status for a write command ;\<br />
10 RCRCE CRC error for read data ; STAT.17<br />
9 SCRCE CRC error for a response for auto-issued CMD12 ; (SCRC)<br />
8 CCRCE CRC error for a response for non-auto-issued CMD's ;/<br />
5 WEBER End bit error for Write CRC status ;\<br />
4 REBER End bit error for read data ; STAT.18<br />
3 SEBER End bit error for response for auto-issued CMD12 ; (SEND)<br />
2 CEBER End bit error for response for non-auto-issued CMD's ;/<br />
1? SCMDE Bad CMD-index in response of auto-issued CMD12 ;\STAT.16<br />
0 RCMDE Bad CMD-index in response of non-auto-issued CMD's ;/(SCIX)<br />
Unknown if/when/how the error bits can be reset/acknowledged.<br><br />
Note: CMD12 is STOP_TRANSMISSION (maybe sent after BLK_COUNT?).<br><br />
The four "auto-issued CMD12" bits exist for SD registers only (not SDIO).<br />
SCMDE is probably in bit1 (though, official specs say bit0, which would be same<br />
as RCMDE).<br />
<br />
<br />
'''4004A36h - DSi: 0000 - SDCTL_CARD_INTERRUPT_CONTROL'''<br><br />
This does NOT seem to be implemented as described below on DSi.<br />
4004A36h does seem to behave more like 4004836h, see there.<br />
15-13 ? Unknown (zero on DSi)<br />
12 CINT0 SDIO Interrupt Flag (0=none, 1=irq) (/IRQ aka Data1 pin)<br />
11-9 ? Unknown (zero on DSi)<br />
8 CIMSK0 SDIO Interrupt Mask (0=enable, 1=disable) (/IRQ aka Data1 pin)<br />
7-0 ? Unknown (zero on DSi)<br />
Acknowledge by writing CINT0=0, or CIMSK0=1, or hard reset (unlike as for other<br />
SD/MMC interrupts, soft reset does not acknowlege this interrupt type?).<br />
<br />
== DSi SD/MMC I/O Ports: Control ==<br />
<br />
'''4004802h - SD_CARD_PORT_SELECT (0201h)'''<br><br />
'''4004A02h - SDIO_CARD_PORT_SELECT (0100h)'''<br><br />
15-11 Unknown/unused (appears to be always zero)<br />
10 Unknown (write: should be 1, read: usually/always 0) (W?)<br />
9 Unknown (write: should be 0, read: usually 1 for SD)<br />
8 Unknown (write: should be 0, read: usually 1 for SDIO)<br />
7-4 Unknown/unused (appears to be always zero)<br />
3-1 Unknown (R/W)<br />
0 Port Select (0=SD Card Slot, 1=Onboard eMMC) (for SDIO: Unknown)<br />
Known written values are 0400h and 0401h (SD). However known read values are<br />
0201h (SD) and 0100h (SDIO).<br />
<br />
<br />
'''4004828h - DSi: 40E0 - SD_CARD_OPTION - Memory Card Option Setup'''<br><br />
'''4004A28h - DSi: 40EE - SDIO_CARD_OPTION - Card Option Setup'''<br><br />
15 Bus Width (0=4bit, 1=1bit)<br />
14 Unknown (usually set)<br />
13-8 Unknown/unused (appears to be always zero)<br />
7-4 Unknown, maybe some 4bit timing/timeout value<br />
0-3 Unknown, maybe another 4bit timing/timeout value<br />
Settings spotted on DSi are 40E0h,40EEh.<br><br />
Among others, this register should contain a 4bit timeout setting, "RTO[3:0]<br />
for SD (aka TO[3:0] for SDIO) timeout period for data start/busy bits, in the<br />
form of a multiple number of the SDCLK period."<br><br />
Maybe also selects transfer CLK rate, or whatever.<br />
<br />
<br />
'''4004834h - DSi: 0000 - SD_TRANSACTION_CTL - Transaction Control'''<br><br />
'''4004A34h - DSi: 0000 - SDIO_TRANSACTION_CTL - Transaction Control'''<br><br />
15-10 Unknown/unused (appears to be always zero)<br />
9-8 Unknown<br />
7-3 Unknown/unused (appears to be always zero)<br />
2 Unknown<br />
1 Unknown/unused (appears to be always zero)<br />
0 Unknown<br />
Maybe also selects transfer CLK rate, or whatever.<br />
<br />
<br />
'''40048E0h - DSi: 0007 - SD_SOFT_RESET - Software Reset'''<br><br />
'''4004AE0h - DSi: 0006 - SDIO_SOFT_RESET - Software Reset'''<br><br />
15-3 Unknown/unused (appears to be always zero)<br />
2 ? Unknown (can be nonzero on DSi)<br />
1 ? Unknown (can be nonzero on DSi)<br />
0 SRST Soft Reset (0=Reset, 1=Release)<br />
Software should apply reset after sensing card insertion/removal, and<br />
(thereafter) release reset in case of card insertion. Software reset does<br />
acknowledge all IRQs (except that from SDIO /IRQ pin?), and does probably also<br />
reinitialize some other registers.<br />
<br />
<br />
'''4004808h - DSi: 0100 - SDCTL_STOP_INTERNAL_ACTION'''<br><br />
15-9 Unknown/unused (appears to be always zero)<br />
8 Unknown (1=Enable automatic sending of CMD12 after BLK_COUNT blocks?)<br />
7-1 Unknown/unused (appears to be always zero)<br />
0 Unknown<br />
Stop whatever internal action for whatever purpose in whatever situation?<br><br />
Existing code does set bit8 (prior to changing SD_DATA16_BLK_COUNT).<br><br />
Existing code does clear bit0 (alongsides with IRQ enable/acknowlege or so).<br />
<br />
<br />
'''4004824h - DSi: 0000 - DSi: Used? - SDCTL_CARD_CLK_CTL Card Clock Control'''<br><br />
Can be max 07FFh on DSi... ie. bit15 CANNOT be set?<br />
15 Disable HCLK divider (0=SDCLK selected via bit7-0, 1=SDCLK=HCLK)<br />
14-10 Unknown (zero on DSi)<br />
9 Unknown (set in some cases on DSi)<br />
8 Unknown (1=Start Clock, or Apply Clock Change, or so?)<br />
7-0 HCLK Div (0,1,2,4,8,10h,20h,40h,80h = Div2,4,8,16,32,64,128,256,512)<br />
Clock supply to SD Card<br><br />
The SDCLK signal is used for a provision of SD Memory Card or SDIO Card. Please<br />
refer to the following setting for enabling the SDCLK output.<br />
(1) Set Stop Clock Control Register (Config Offset:40h) to 1Fh.<br />
(2) Set D0 of SD Software Reset Register (Offset:0E0h) to 1b.<br />
(3) Set D7-0 of SD Card Clock Control Register (Offset:024h). These bits<br />
are used for setting the frequency of SDCLK.<br />
80h : SDCLK=HCLK/512<br />
40h : SDCLK=HCLK/256<br />
20h : SDCLK=HCLK/128<br />
10h : SDCLK=HCLK/64<br />
08h : SDCLK=HCLK/32<br />
04h : SDCLK=HCLK/16<br />
02h : SDCLK=HCLK/8<br />
01h : SDCLK=HCLK/4<br />
00h : SDCLK=HCLK/2<br />
In addition, TC6387XB holds a function that SDCLK can have same<br />
frequency as HCLK. In this case, D7-0 settings of SD Card Clock Control<br />
Register (Offset:024h) becomes invalid setting.<br />
* Set D0 of Clock Mode Register (Config Offset:42h) to 1b.<br />
* Set D15 of SD Card Clock Control Register (Offset:024h) to 1b.<br />
Please attend that the specification of SDCLK is max.25MHz at the case<br />
of SD Card and is max.20MHz at the case of MultiMedia Card.<br />
(4) D8 of SD Card Clock Control Register (Offset:024h) to 1b.<br />
(5) D8 of Clock & Wait Control Register (Offset:138h) to 1b.<br />
On the DSi, HCLK seems to be 33.513982 MHz.<br />
<br />
<br />
'''4004x38h - DSi: 0000 - SDCTL_CLK_AND_WAIT_CTL'''<br><br />
15-0 Unknown (zero on DSi)<br />
Maybe transfer CLK rate, or some master clock control for the clock input.<br />
<br />
<br />
'''4004x3Ah - DSi: 0000 - SDCTL_SDIO_HOST_INFORMATION'''<br><br />
'''4004x3Ch - DSi: 0000 - SDCTL_ERROR_CONTROL'''<br><br />
'''4004x3Eh - DSi: 0000 - SDCTL_SDLED_CONTROL - LED Control (TC6387XB only)'''<br><br />
15-0 Unknown (zero on DSi)<br />
<br />
<br />
'''40048E2h - DSi: 0009 - SDCTL_RESERVED2 (TC6371AF:CORE_REV)'''<br><br />
'''40048E6h - DSi: 0000 - SDCTL_RESERVED3 (TC6371AF:BUF_ADR)'''<br><br />
'''40048E8h - DSi: 0000 - UNDOC/UNUSED (TC6371AF:Resp_Header)'''<br><br />
'''40048F6h - DSi: 0000 - SDCTL_RESERVED4 --- used by DSi !!!'''<br><br />
'''40048F8h - DSi: 0004 - SDCTL_RESERVED5 <-- DSi: SD only (not SDIO)'''<br><br />
'''40048FAh - DSi: 0007 - SDCTL_RESERVED6 <-- DSi: SD only (not SDIO)'''<br><br />
'''40048FCh - DSi: 00FC - SDCTL_RESERVED7'''<br><br />
'''40048FEh - DSi: 00FF - SDCTL_RESERVED8 (TC6371AF:Revision)'''<br><br />
'''4004xE2h - DSi: 0000 - SDCTL_RESERVED9'''<br><br />
'''4004xF0h - DSi: 0000 - SDCTL_RESERVED10'''<br><br />
'''4004836h - DSi: 0002 - UNDOC! (bit1 can be set, other bits always 0)'''<br><br />
15-0 Unknown<br />
<br />
<br />
'''4004838h/4004A38h - DSi: C007 - UNDOC!'''<br><br />
'''4004840h/4004A40h - DSi: 003F - UNDOC?'''<br><br />
'''4004842h/4004A42h - DSi: 002A - UNDOC?'''<br><br />
'''40048B2h/4004AB2h - DSi: FFFF - UNDOC?'''<br><br />
'''40048BAh/4004ABAh - DSi: 0200 - UNDOC?'''<br><br />
'''40048F4h/4004AF4h - DSi: 0700 - UNDOC!'''<br><br />
15-0 Unknown</div>Nocashhttps://dsibrew.org/w/index.php?title=Main_Page/Current_events&diff=2098810Main Page/Current events2015-08-30T02:31:46Z<p>Nocash: </p>
<hr />
<div>{{Main page box|Latest news|Main Page/Current events}}<br />
<div style="margin: -.3em -1em -1em -1em;"><br />
{| width="100%" bgcolor="#fff" border="0" cellpadding="2px" cellspacing="2px" style="margin:auto;"<br />
|- valign="top" align="left" style="background: #F5FAFF;"<br />
| {{:DSiBrew:News}} <br />
|- class="plainlinks" style="background: #e7eef6; text-align: center;"<br />
| [[Image:view_more.png|link=DSiBrew:News/Archive]] [[DSiBrew:News/Archive|Archive]]<br />
|}<br />
</div><br />
This wiki has information about the DSi's [[IO Map]] and [[SD/MMC/SDIO Registers]] and [[Interrupts]] and other things.<br />
Could somebody unlock [[Main Page/Navigation]], so one won't need to link that kind of stuff in [[Main Page/Current events]]?<br />
{{box-footer-empty}}</div>Nocashhttps://dsibrew.org/w/index.php?title=Main_Page/Current_events&diff=2098809Main Page/Current events2015-08-30T02:27:53Z<p>Nocash: </p>
<hr />
<div>{{Main page box|Latest news|Main Page/Current events}}<br />
<div style="margin: -.3em -1em -1em -1em;"><br />
{| width="100%" bgcolor="#fff" border="0" cellpadding="2px" cellspacing="2px" style="margin:auto;"<br />
|- valign="top" align="left" style="background: #F5FAFF;"<br />
| {{:DSiBrew:News}} <br />
|- class="plainlinks" style="background: #e7eef6; text-align: center;"<br />
| [[Image:view_more.png|link=DSiBrew:News/Archive]] [[DSiBrew:News/Archive|Archive]]<br />
|}<br />
</div><br />
This wiki has information about the DSi's [[IO Map]] and [[SD/MMC/SDIO Registers]] and other things.<br />
Could somebody unlock [[Main Page/Navigation]], so one won't need to link that kind of stuff in [[Main Page/Current events]]?<br />
{{box-footer-empty}}</div>Nocashhttps://dsibrew.org/w/index.php?title=SD/MMC/SDIO_Registers&diff=2098808SD/MMC/SDIO Registers2015-08-26T19:57:32Z<p>Nocash: /* DSi SD/MMC I/O Ports: Control */</p>
<hr />
<div>SD_xxx is used to access onboard eMMC and external SD card slot (as selected via SD_CARD_PORT_SELECT).<br><br />
SDIO_xxx is used to access the Atheros Wifi unit.<br />
<br />
== DSi SD/MMC I/O Ports: Command/Param/Response/Data ==<br />
<br />
'''4004800h - SD_CMD - Command and Response/Data Type (R/W)'''<br><br />
'''4004A00h - SDIO_CMD - Command and Response/Data Type (R/W)'''<br><br />
15 undoc Unknown/undoc (read/write-able)<br />
14 undoc Security Cmd (0=Normal, 1=Whatever/Security) (sdio?)<br />
13 undoc Data Length (0=Single Block, 1=Multiple Blocks)<br />
12 undoc Data Direction (0=Write, 1=Read)<br />
11 NTDT Data Transfer (0=No data, 1=With data)<br />
10-8 REP2-0 Response Type (0..2=Unknown/Reserved, 3=None, 4=48bit,<br />
5=48bit+Busy, 6=136bit, 7=48bitOcrWithoutCRC7)<br />
7-6 CMD1-0 Command Type (0=CMD, 1=ACMD, 2..3=unknown, maybe GEN WR/RD?)<br />
5-0 CIX Command Index (0..3Fh, command index)<br />
Invalid values can cause ILA error (particulary on setting NTDT for CMD12, or<br />
for CMD's Response=None). ILA error will also occur if an old CMD is still<br />
busy.<br />
DSi software is always writing just ZERO to bit11-6 though? Maybe the hardware<br />
does automatically know which SD/MMC CMDs and ACMDs have data? Or maybe data is<br />
always automatically transferred when receiving a data-startbit, or when<br />
writing to data register - and bits like NTDT would be needed only for things<br />
like proper data timeout handling?<br />
<br />
<br />
'''4004804h - SD_CMD_PARAM0-1 - Argument (32bit, 2 halfwords) (R/W)'''<br><br />
'''4004A04h - SDIO_CMD_PARAM0-1 - Argument (32bit, 2 halfwords) (R/W)'''<br><br />
31-0 Parameter value for CMD<br />
The parameter value should be written <before> sending the command via<br />
SD_CMD/SDIO_CMD.<br />
<br />
<br />
'''400480Ch - SD_RESPONSE0-7 - Response (128bit, 8 halfwords) (R)'''<br><br />
'''4004A0Ch - SDIO_RESPONSE0-7 - Response (128bit, 8 halfwords) (R)'''<br><br />
After sending a command, wait for the CMDRESPEND bit (IRQ_STATUS.bit0) to get<br />
set, then read the RESPONSE (if the command does have any response).<br />
For normal 32bit responses:<br />
31-0 Response<br />
127-32 Older Responses<br />
For CID/CSD responses:<br />
119-0 120bit Response<br />
127-120 Zero (always?)<br />
Seems to be left-shifted when receiving response bits. So, for 32bit responses,<br />
bit0-31 would contain the current response, and bit32-127 would contain older<br />
responses.<br />
<br />
<br />
'''DATA16 vs DATA32'''<br><br />
Data can be transferred in 16bit or 32bit units (as selected in DATA_CTL.bit1).<br />
There are separate data, block len, and block count registers for 16bit and<br />
32bit mode (that's probably due to some odd patchwork, where the manufacturer<br />
has added 32bit support to the original 16bit chip design).<br />
Naturally, a 32bit transfer is faster than two 16bit transfers. Nethertheless,<br />
the DSi firmware does use both 32bit and 16bit mode once and then; 32bit mode<br />
is required for NDMA transfers (which don't support 16bit).<br />
<br />
'''40048D8h - SD_DATA_CTL'''<br><br />
'''4004AD8h - SDIO_DATA_CTL'''<br><br />
15-13 Unknown (usually 0)<br />
12 Unknown (usually 1) (R?)<br />
11-6 Unknown (usually 0)<br />
5 Unknown (R/W?) (R/W?)<br />
4 Unknown (usually 1) (R?)<br />
3-2 Unknown (usually 0)<br />
1 Select 16bit/32bit Data Mode (0=DATA16, 1=DATA32) (R/W?)<br />
0 Unknown (usually 0)<br />
Known written values are 0000h and 0002h. However, known read values are 1010h<br />
and 1012h.<br />
<br />
<br />
'''400480Ah - SD_DATA16_BLK_COUNT - "Transfer Sector Count" (R/W)'''<br><br />
'''4004908h - SD_DATA32_BLK_COUNT (R/W)'''<br><br />
'''4004A0Ah - SDIO_DATA16_BLK_COUNT - "Transfer Block Count" (R/W)'''<br><br />
'''4004B08h - SDIO_DATA32_BLK_COUNT (R/W)'''<br><br />
15-0 Number of Data Blocks for multiple read/write commands<br />
Can be max FFFFh. The DATA32_BLK_COUNT value decreases after reading from<br />
somewhere (maybe from DATA32_FIFO?).<br />
<br />
<br />
'''4004826h - SD_DATA16_BLK_LEN - Memory Card Transfer Data Length (R/W)'''<br><br />
'''4004904h - SD_DATA32_BLK_LEN (R/W)'''<br><br />
'''4004A26h - SDIO_DATA16_BLK_LEN - Card Transfer Data Length (R/W)'''<br><br />
'''4004B04h - SDIO_DATA32_BLK_LEN (R/W)'''<br><br />
15-10 Unknown/unused (appears to be always zero)<br />
9-0 Data Block Length in bytes (for DATA16: clipped to max 0200h by hw)<br />
Should be usually 0200h (for 512-byte SD/MMC memory blocks). Other values may<br />
be needed for SDIO functions, or when accessing SSR/SCR/PWD registers via data<br />
transfers.<br />
DATA32_BLK_LEN can be max 3FFh (unlike DATA16_BLK_LEN which is clipped to<br />
max=200h by hardware).<br />
<br />
<br />
'''4004830h - SD_DATA16_FIFO - Data Port (SD_FIFO?)'''<br><br />
'''400490Ch - SD_DATA32_FIFO'''<br><br />
'''4004A30h - SDIO_DATA16_FIFO - Data Port (SD_FIFO?)'''<br><br />
'''4004B0Ch - SDIO_DATA32_FIFO'''<br><br />
For Data16:<br />
15-0 Data (16bit) (...or could it be accessed as 32bit, too?)<br />
For Data32:<br />
31-0 Data (32bit) (...or could it be accessed as 16bit, too?)<br />
Transfer data here (read after RXRDY gets set, or write after TXRQ gets set).<br />
FIFO size is unknown (if there's any FIFO behind it).<br />
<br />
<br />
== DSi SD/MMC I/O Ports: Interrupt/Status ==<br />
<br />
'''400481Ch - SD_IRQ_STATUS0-1 - Interrupt Status (R/ack)'''<br><br />
'''4004A1Ch - SDIO_IRQ_STATUS0-1 - Interrupt Status (R/ack)'''<br><br />
'''4004820h - SD_IRQ_MASK0-1 - Interrupt Mask (R/W)'''<br><br />
'''4004A20h - SDIO_IRQ_MASK0-1 - Interrupt Mask (R/W)'''<br><br />
The IRQ_STATUS registers contain acknowledge-able IRQ Flags (those bits that<br />
that are maskable in IRQ_MASK register), as well as static read-only status<br />
bits without IRQ function (eg. WRPROTECT).<br />
* IRQ Flags/Write (0=Acknowledge, 1=No change)<br />
* IRQ Flags/Read (0=No IRQ, 1=IRQ)<br />
* IRQ Mask (0=Enable, 1=Disable) (8B7F031Dh when all IRQs disabled)<br />
Bit Stat Mask Function<br />
0 SREP MREP CMDRESPEND (response end) (or R1b: busy end)<br />
1 0 0 Unknown/unused (always 0)<br />
2 SRWA MRWA DATAEND (is NOT set? after data read/write end bit)<br />
3 SCOT MCOT CARD_REMOVE (0=No event, 1=Is/was newly ejected) ;\DSi<br />
4 SCIN MCIN CARD_INSERT (0=No event, 1=Is/was newly inserted) ; SD<br />
5 undoc 0 SIGSTATE (0=Ejected, 1=Inserted) (SDIO: always 1) ; Card<br />
6 0 0 Unknown/unused (always 0) ; Slot<br />
7 undoc 0 WRPROTECT (0=Locked/Ejected, 1=Unlocked/HalfEjected);/<br />
8 undoc undoc CARD_REMOVE_A (always 0) ;\maybe fixed state for<br />
9 undoc undoc CARD_INSERT_A (always 0) ; DSi's onboard eMMC chip<br />
10 undoc 0 SIGSTATE_A (always 1) ;/(also fixed as so for SDIO)<br />
11 0 0 Unknown/unused (always 0)<br />
12 0 0 Unknown/unused (always 0)<br />
13 0 0 Unknown/unused (always 0)<br />
14 0 0 Unknown/unused (always 0)<br />
15 0 0 Unknown/unused (always 0)<br />
16 SCIX MCIX CMD_IDX_ERR Bad CMD-index in response (RCMDE,SCMDE)<br />
17 SCRC MCRC CRCFAIL CRC response error (WCRCE,RCRCE,SCRCE,CCRCE)<br />
18 SEND MEND STOPBIT_ERR End bit error (WEBER,REBER,SEBER,CEBER)<br />
19 SDTO MDTO DATATIMEOUT Data Timeout (NRCS,NWCS,KBSY)<br />
20 SFOF MFOF RXOVERFLOW HOST tried write full<br />
21 SFUF MFUF TXUNDERRUN HOST tried read empty<br />
22 SCTO MCTO CMDTIMEOUT Response start-bit timeout (NRS,NSR)<br />
23 1 ? 0 Unknown/undoc (usually set?)<br />
24 SBRE MBRE RXRDY (fifo not empty) (request data read)<br />
25 SBWE MBWE TXRQ (datafifoempty?) (request data write)<br />
26 0 0 Unknown/unused (always 0)<br />
27 undoc undoc Unknown/undoc (bit27 is mask-able in IRQ_MASK)<br />
28 0 0 Unknown/unused (always 0)<br />
29 1 ? 0 Unknown/undoc (usually set?) (unlike toshiba ILFSL/IFSMSK)<br />
30 undoc 0 CMD_BUSY<br />
31 ILA IMSK Illegal Command Access (old CMD still busy, or wrong NTDT)<br />
Acknowledge by STAT=0, or by MASK=1 (uh, really?), or by soft reset (SRST=0) or<br />
hard reset.<br />
<br />
<br />
'''4004900h - SD_DATA32_IRQ'''<br><br />
'''4004B00h - SDIO_DATA32_IRQ'''<br><br />
15-13 Unknown/unused (appears to be always zero)<br />
12 Unknown (paired with bit9) (can be set) IRQ enable ?! (R/W?)<br />
11 Unknown (paired with bit8) (can be set) IRQ enable ?! (R/W?)<br />
10 Unknown (read=0) write: (0=No change, 1=Clear Bit8,9) ? (W?)<br />
9 Unknown (paired with bit12) (automatically cleared after...) (R?)<br />
8 Unknown (paired with bit11) (R?)<br />
7-2 Unknown (0)<br />
1 Unknown (can be set) (autoclear bit8,9 on xfer end?) (R/W?)<br />
0 Unknown (0)<br />
Can be 1A02h, but changes to 1802h after reading from somewhere (maybe from<br />
DATA32_FIFO?).<br><br />
Bit8,9 seem to be whatever extra IRQ flags, the flags get set ONLY in DATA32<br />
mode (not in DATA16 mode).<br />
<br />
<br />
'''400482Ch - SD_ERROR_DETAIL_STATUS0-1 - Error Detail Status'''<br><br />
'''4004A2Ch - SDIO_ERROR_DETAIL_STATUS0-1 - Error Detail Status'''<br><br />
31-23 ? Unknown/unused/undoc<br />
22 KBSY Timeout for CRC status busy timeout ;\STAT.19<br />
21 NWCS Timeout for CRC status timeout ; (SDTO)<br />
20 NRCS Timeout for Data start-bit, or for Post Data Busy ;/<br />
19-18 ? Unknown/unused/undoc<br />
17 NRS Response timeout for auto-issued CMD12 ;\STAT.22<br />
16 NCR Response timeout for non-auto-issued CMD's ;/(SCTO)<br />
15-14 ? Unknown/unused/undoc<br />
13 ?? Unknown/undoc (bit13 can be nonzero on DSi!)<br />
12 ? Unknown/unused/undoc<br />
11 WCRCE CRC error for Write CRC status for a write command ;\<br />
10 RCRCE CRC error for read data ; STAT.17<br />
9 SCRCE CRC error for a response for auto-issued CMD12 ; (SCRC)<br />
8 CCRCE CRC error for a response for non-auto-issued CMD's ;/<br />
5 WEBER End bit error for Write CRC status ;\<br />
4 REBER End bit error for read data ; STAT.18<br />
3 SEBER End bit error for response for auto-issued CMD12 ; (SEND)<br />
2 CEBER End bit error for response for non-auto-issued CMD's ;/<br />
1? SCMDE Bad CMD-index in response of auto-issued CMD12 ;\STAT.16<br />
0 RCMDE Bad CMD-index in response of non-auto-issued CMD's ;/(SCIX)<br />
Unknown if/when/how the error bits can be reset/acknowledged.<br><br />
Note: CMD12 is STOP_TRANSMISSION (maybe sent after BLK_COUNT?).<br><br />
The four "auto-issued CMD12" bits exist for SD registers only (not SDIO).<br />
SCMDE is probably in bit1 (though, official specs say bit0, which would be same<br />
as RCMDE).<br />
<br />
<br />
'''4004A36h - DSi: 0000 - SDCTL_CARD_INTERRUPT_CONTROL'''<br><br />
This does NOT seem to be implemented as described below on DSi.<br />
4004A36h does seem to behave more like 4004836h, see there.<br />
15-13 ? Unknown (zero on DSi)<br />
12 CINT0 SDIO Interrupt Flag (0=none, 1=irq) (/IRQ aka Data1 pin)<br />
11-9 ? Unknown (zero on DSi)<br />
8 CIMSK0 SDIO Interrupt Mask (0=enable, 1=disable) (/IRQ aka Data1 pin)<br />
7-0 ? Unknown (zero on DSi)<br />
Acknowledge by writing CINT0=0, or CIMSK0=1, or hard reset (unlike as for other<br />
SD/MMC interrupts, soft reset does not acknowlege this interrupt type?).<br />
<br />
== DSi SD/MMC I/O Ports: Control ==<br />
<br />
'''4004802h - SD_CARD_PORT_SELECT (0201h)'''<br><br />
'''4004A02h - SDIO_CARD_PORT_SELECT (0100h)'''<br><br />
15-11 Unknown/unused (appears to be always zero)<br />
10 Unknown (write: should be 1, read: usually/always 0) (W?)<br />
9 Unknown (write: should be 0, read: usually 1 for SD)<br />
8 Unknown (write: should be 0, read: usually 1 for SDIO)<br />
7-4 Unknown/unused (appears to be always zero)<br />
3-1 Unknown (R/W)<br />
0 Port Select (0=SD Card Slot, 1=Onboard eMMC) (for SDIO: Unknown)<br />
Known written values are 0400h and 0401h (SD). However known read values are<br />
0201h (SD) and 0100h (SDIO).<br />
<br />
<br />
'''4004828h - DSi: 40E0 - SD_CARD_OPTION - Memory Card Option Setup'''<br><br />
'''4004A28h - DSi: 40EE - SDIO_CARD_OPTION - Card Option Setup'''<br><br />
15 Bus Width (0=4bit, 1=1bit)<br />
14 Unknown (usually set)<br />
13-8 Unknown/unused (appears to be always zero)<br />
7-4 Unknown, maybe some 4bit timing/timeout value<br />
0-3 Unknown, maybe another 4bit timing/timeout value<br />
Settings spotted on DSi are 40E0h,40EEh.<br><br />
Among others, this register should contain a 4bit timeout setting, "RTO[3:0]<br />
for SD (aka TO[3:0] for SDIO) timeout period for data start/busy bits, in the<br />
form of a multiple number of the SDCLK period."<br><br />
Maybe also selects transfer CLK rate, or whatever.<br />
<br />
<br />
'''4004834h - DSi: 0000 - SD_TRANSACTION_CTL - Transaction Control'''<br><br />
'''4004A34h - DSi: 0000 - SDIO_TRANSACTION_CTL - Transaction Control'''<br><br />
15-10 Unknown/unused (appears to be always zero)<br />
9-8 Unknown<br />
7-3 Unknown/unused (appears to be always zero)<br />
2 Unknown<br />
1 Unknown/unused (appears to be always zero)<br />
0 Unknown<br />
Maybe also selects transfer CLK rate, or whatever.<br />
<br />
<br />
'''40048E0h - DSi: 0007 - SD_SOFT_RESET - Software Reset'''<br><br />
'''4004AE0h - DSi: 0006 - SDIO_SOFT_RESET - Software Reset'''<br><br />
15-3 Unknown/unused (appears to be always zero)<br />
2 ? Unknown (can be nonzero on DSi)<br />
1 ? Unknown (can be nonzero on DSi)<br />
0 SRST Soft Reset (0=Reset, 1=Release)<br />
Software should apply reset after sensing card insertion/removal, and<br />
(thereafter) release reset in case of card insertion. Software reset does<br />
acknowledge all IRQs (except that from SDIO /IRQ pin?), and does probably also<br />
reinitialize some other registers.<br />
<br />
<br />
'''4004808h - DSi: 0100 - SDCTL_STOP_INTERNAL_ACTION'''<br><br />
15-9 Unknown/unused (appears to be always zero)<br />
8 Unknown (1=Enable automatic sending of CMD12 after BLK_COUNT blocks?)<br />
7-1 Unknown/unused (appears to be always zero)<br />
0 Unknown<br />
Stop whatever internal action for whatever purpose in whatever situation?<br><br />
Existing code does set bit8 (prior to changing SD_DATA16_BLK_COUNT).<br><br />
Existing code does clear bit0 (alongsides with IRQ enable/acknowlege or so).<br />
<br />
<br />
'''4004824h - DSi: 0000 - DSi: Used? - SDCTL_CARD_CLK_CTL Card Clock Control'''<br><br />
Can be max 07FFh on DSi... ie. bit15 CANNOT be set?<br />
15 Disable HCLK divider (0=SDCLK selected via bit7-0, 1=SDCLK=HCLK)<br />
14-10 Unknown (zero on DSi)<br />
9 Unknown (set in some cases on DSi)<br />
8 Unknown (1=Start Clock, or Apply Clock Change, or so?)<br />
7-0 HCLK Div (0,1,2,4,8,10h,20h,40h,80h = Div2,4,8,16,32,64,128,256,512)<br />
Clock supply to SD Card<br><br />
The SDCLK signal is used for a provision of SD Memory Card or SDIO Card. Please<br />
refer to the following setting for enabling the SDCLK output.<br />
(1) Set Stop Clock Control Register (Config Offset:40h) to 1Fh.<br />
(2) Set D0 of SD Software Reset Register (Offset:0E0h) to 1b.<br />
(3) Set D7-0 of SD Card Clock Control Register (Offset:024h). These bits<br />
are used for setting the frequency of SDCLK.<br />
80h : SDCLK=HCLK/512<br />
40h : SDCLK=HCLK/256<br />
20h : SDCLK=HCLK/128<br />
10h : SDCLK=HCLK/64<br />
08h : SDCLK=HCLK/32<br />
04h : SDCLK=HCLK/16<br />
02h : SDCLK=HCLK/8<br />
01h : SDCLK=HCLK/4<br />
00h : SDCLK=HCLK/2<br />
In addition, TC6387XB holds a function that SDCLK can have same<br />
frequency as HCLK. In this case, D7-0 settings of SD Card Clock Control<br />
Register (Offset:024h) becomes invalid setting.<br />
* Set D0 of Clock Mode Register (Config Offset:42h) to 1b.<br />
* Set D15 of SD Card Clock Control Register (Offset:024h) to 1b.<br />
Please attend that the specification of SDCLK is max.25MHz at the case<br />
of SD Card and is max.20MHz at the case of MultiMedia Card.<br />
(4) D8 of SD Card Clock Control Register (Offset:024h) to 1b.<br />
(5) D8 of Clock & Wait Control Register (Offset:138h) to 1b.<br />
On the DSi, HCLK seems to be 33.513982 MHz.<br />
<br />
<br />
'''4004x38h - DSi: 0000 - SDCTL_CLK_AND_WAIT_CTL'''<br><br />
15-0 Unknown (zero on DSi)<br />
Maybe transfer CLK rate, or some master clock control for the clock input.<br />
<br />
<br />
'''4004x3Ah - DSi: 0000 - SDCTL_SDIO_HOST_INFORMATION'''<br><br />
'''4004x3Ch - DSi: 0000 - SDCTL_ERROR_CONTROL'''<br><br />
'''4004x3Eh - DSi: 0000 - SDCTL_SDLED_CONTROL - LED Control (TC6387XB only)'''<br><br />
15-0 Unknown (zero on DSi)<br />
<br />
<br />
'''40048E2h - DSi: 0009 - SDCTL_RESERVED2 (TC6371AF:CORE_REV)'''<br><br />
'''40048E6h - DSi: 0000 - SDCTL_RESERVED3 (TC6371AF:BUF_ADR)'''<br><br />
'''40048E8h - DSi: 0000 - UNDOC/UNUSED (TC6371AF:Resp_Header)'''<br><br />
'''40048F6h - DSi: 0000 - SDCTL_RESERVED4 --- used by DSi !!!'''<br><br />
'''40048F8h - DSi: 0004 - SDCTL_RESERVED5 <-- DSi: SD only (not SDIO)'''<br><br />
'''40048FAh - DSi: 0007 - SDCTL_RESERVED6 <-- DSi: SD only (not SDIO)'''<br><br />
'''40048FCh - DSi: 00FC - SDCTL_RESERVED7'''<br><br />
'''40048FEh - DSi: 00FF - SDCTL_RESERVED8 (TC6371AF:Revision)'''<br><br />
'''4004xE2h - DSi: 0000 - SDCTL_RESERVED9'''<br><br />
'''4004xF0h - DSi: 0000 - SDCTL_RESERVED10'''<br><br />
'''4004836h - DSi: 0002 - UNDOC! (bit1 can be set, other bits always 0)'''<br><br />
15-0 Unknown<br />
<br />
<br />
'''4004838h/4004A38h - DSi: C007 - UNDOC!'''<br><br />
'''4004840h/4004A40h - DSi: 003F - UNDOC?'''<br><br />
'''4004842h/4004A42h - DSi: 002A - UNDOC?'''<br><br />
'''40048B2h/4004AB2h - DSi: FFFF - UNDOC?'''<br><br />
'''40048BAh/4004ABAh - DSi: 0200 - UNDOC?'''<br><br />
'''40048F4h/4004AF4h - DSi: 0700 - UNDOC!'''<br><br />
15-0 Unknown</div>Nocashhttps://dsibrew.org/w/index.php?title=SD/MMC/SDIO_Registers&diff=2098807SD/MMC/SDIO Registers2015-08-25T23:23:11Z<p>Nocash: /* DSi SD/MMC I/O Ports: Interrupt/Status */</p>
<hr />
<div>SD_xxx is used to access onboard eMMC and external SD card slot (as selected via SD_CARD_PORT_SELECT).<br><br />
SDIO_xxx is used to access the Atheros Wifi unit.<br />
<br />
== DSi SD/MMC I/O Ports: Command/Param/Response/Data ==<br />
<br />
'''4004800h - SD_CMD - Command and Response/Data Type (R/W)'''<br><br />
'''4004A00h - SDIO_CMD - Command and Response/Data Type (R/W)'''<br><br />
15 undoc Unknown/undoc (read/write-able)<br />
14 undoc Security Cmd (0=Normal, 1=Whatever/Security) (sdio?)<br />
13 undoc Data Length (0=Single Block, 1=Multiple Blocks)<br />
12 undoc Data Direction (0=Write, 1=Read)<br />
11 NTDT Data Transfer (0=No data, 1=With data)<br />
10-8 REP2-0 Response Type (0..2=Unknown/Reserved, 3=None, 4=48bit,<br />
5=48bit+Busy, 6=136bit, 7=48bitOcrWithoutCRC7)<br />
7-6 CMD1-0 Command Type (0=CMD, 1=ACMD, 2..3=unknown, maybe GEN WR/RD?)<br />
5-0 CIX Command Index (0..3Fh, command index)<br />
Invalid values can cause ILA error (particulary on setting NTDT for CMD12, or<br />
for CMD's Response=None). ILA error will also occur if an old CMD is still<br />
busy.<br />
DSi software is always writing just ZERO to bit11-6 though? Maybe the hardware<br />
does automatically know which SD/MMC CMDs and ACMDs have data? Or maybe data is<br />
always automatically transferred when receiving a data-startbit, or when<br />
writing to data register - and bits like NTDT would be needed only for things<br />
like proper data timeout handling?<br />
<br />
<br />
'''4004804h - SD_CMD_PARAM0-1 - Argument (32bit, 2 halfwords) (R/W)'''<br><br />
'''4004A04h - SDIO_CMD_PARAM0-1 - Argument (32bit, 2 halfwords) (R/W)'''<br><br />
31-0 Parameter value for CMD<br />
The parameter value should be written <before> sending the command via<br />
SD_CMD/SDIO_CMD.<br />
<br />
<br />
'''400480Ch - SD_RESPONSE0-7 - Response (128bit, 8 halfwords) (R)'''<br><br />
'''4004A0Ch - SDIO_RESPONSE0-7 - Response (128bit, 8 halfwords) (R)'''<br><br />
After sending a command, wait for the CMDRESPEND bit (IRQ_STATUS.bit0) to get<br />
set, then read the RESPONSE (if the command does have any response).<br />
For normal 32bit responses:<br />
31-0 Response<br />
127-32 Older Responses<br />
For CID/CSD responses:<br />
119-0 120bit Response<br />
127-120 Zero (always?)<br />
Seems to be left-shifted when receiving response bits. So, for 32bit responses,<br />
bit0-31 would contain the current response, and bit32-127 would contain older<br />
responses.<br />
<br />
<br />
'''DATA16 vs DATA32'''<br><br />
Data can be transferred in 16bit or 32bit units (as selected in DATA_CTL.bit1).<br />
There are separate data, block len, and block count registers for 16bit and<br />
32bit mode (that's probably due to some odd patchwork, where the manufacturer<br />
has added 32bit support to the original 16bit chip design).<br />
Naturally, a 32bit transfer is faster than two 16bit transfers. Nethertheless,<br />
the DSi firmware does use both 32bit and 16bit mode once and then; 32bit mode<br />
is required for NDMA transfers (which don't support 16bit).<br />
<br />
'''40048D8h - SD_DATA_CTL'''<br><br />
'''4004AD8h - SDIO_DATA_CTL'''<br><br />
15-13 Unknown (usually 0)<br />
12 Unknown (usually 1) (R?)<br />
11-6 Unknown (usually 0)<br />
5 Unknown (R/W?) (R/W?)<br />
4 Unknown (usually 1) (R?)<br />
3-2 Unknown (usually 0)<br />
1 Select 16bit/32bit Data Mode (0=DATA16, 1=DATA32) (R/W?)<br />
0 Unknown (usually 0)<br />
Known written values are 0000h and 0002h. However, known read values are 1010h<br />
and 1012h.<br />
<br />
<br />
'''400480Ah - SD_DATA16_BLK_COUNT - "Transfer Sector Count" (R/W)'''<br><br />
'''4004908h - SD_DATA32_BLK_COUNT (R/W)'''<br><br />
'''4004A0Ah - SDIO_DATA16_BLK_COUNT - "Transfer Block Count" (R/W)'''<br><br />
'''4004B08h - SDIO_DATA32_BLK_COUNT (R/W)'''<br><br />
15-0 Number of Data Blocks for multiple read/write commands<br />
Can be max FFFFh. The DATA32_BLK_COUNT value decreases after reading from<br />
somewhere (maybe from DATA32_FIFO?).<br />
<br />
<br />
'''4004826h - SD_DATA16_BLK_LEN - Memory Card Transfer Data Length (R/W)'''<br><br />
'''4004904h - SD_DATA32_BLK_LEN (R/W)'''<br><br />
'''4004A26h - SDIO_DATA16_BLK_LEN - Card Transfer Data Length (R/W)'''<br><br />
'''4004B04h - SDIO_DATA32_BLK_LEN (R/W)'''<br><br />
15-10 Unknown/unused (appears to be always zero)<br />
9-0 Data Block Length in bytes (for DATA16: clipped to max 0200h by hw)<br />
Should be usually 0200h (for 512-byte SD/MMC memory blocks). Other values may<br />
be needed for SDIO functions, or when accessing SSR/SCR/PWD registers via data<br />
transfers.<br />
DATA32_BLK_LEN can be max 3FFh (unlike DATA16_BLK_LEN which is clipped to<br />
max=200h by hardware).<br />
<br />
<br />
'''4004830h - SD_DATA16_FIFO - Data Port (SD_FIFO?)'''<br><br />
'''400490Ch - SD_DATA32_FIFO'''<br><br />
'''4004A30h - SDIO_DATA16_FIFO - Data Port (SD_FIFO?)'''<br><br />
'''4004B0Ch - SDIO_DATA32_FIFO'''<br><br />
For Data16:<br />
15-0 Data (16bit) (...or could it be accessed as 32bit, too?)<br />
For Data32:<br />
31-0 Data (32bit) (...or could it be accessed as 16bit, too?)<br />
Transfer data here (read after RXRDY gets set, or write after TXRQ gets set).<br />
FIFO size is unknown (if there's any FIFO behind it).<br />
<br />
<br />
== DSi SD/MMC I/O Ports: Interrupt/Status ==<br />
<br />
'''400481Ch - SD_IRQ_STATUS0-1 - Interrupt Status (R/ack)'''<br><br />
'''4004A1Ch - SDIO_IRQ_STATUS0-1 - Interrupt Status (R/ack)'''<br><br />
'''4004820h - SD_IRQ_MASK0-1 - Interrupt Mask (R/W)'''<br><br />
'''4004A20h - SDIO_IRQ_MASK0-1 - Interrupt Mask (R/W)'''<br><br />
The IRQ_STATUS registers contain acknowledge-able IRQ Flags (those bits that<br />
that are maskable in IRQ_MASK register), as well as static read-only status<br />
bits without IRQ function (eg. WRPROTECT).<br />
* IRQ Flags/Write (0=Acknowledge, 1=No change)<br />
* IRQ Flags/Read (0=No IRQ, 1=IRQ)<br />
* IRQ Mask (0=Enable, 1=Disable) (8B7F031Dh when all IRQs disabled)<br />
Bit Stat Mask Function<br />
0 SREP MREP CMDRESPEND (response end) (or R1b: busy end)<br />
1 0 0 Unknown/unused (always 0)<br />
2 SRWA MRWA DATAEND (is NOT set? after data read/write end bit)<br />
3 SCOT MCOT CARD_REMOVE (0=No event, 1=Is/was newly ejected) ;\DSi<br />
4 SCIN MCIN CARD_INSERT (0=No event, 1=Is/was newly inserted) ; SD<br />
5 undoc 0 SIGSTATE (0=Ejected, 1=Inserted) (SDIO: always 1) ; Card<br />
6 0 0 Unknown/unused (always 0) ; Slot<br />
7 undoc 0 WRPROTECT (0=Locked/Ejected, 1=Unlocked/HalfEjected);/<br />
8 undoc undoc CARD_REMOVE_A (always 0) ;\maybe fixed state for<br />
9 undoc undoc CARD_INSERT_A (always 0) ; DSi's onboard eMMC chip<br />
10 undoc 0 SIGSTATE_A (always 1) ;/(also fixed as so for SDIO)<br />
11 0 0 Unknown/unused (always 0)<br />
12 0 0 Unknown/unused (always 0)<br />
13 0 0 Unknown/unused (always 0)<br />
14 0 0 Unknown/unused (always 0)<br />
15 0 0 Unknown/unused (always 0)<br />
16 SCIX MCIX CMD_IDX_ERR Bad CMD-index in response (RCMDE,SCMDE)<br />
17 SCRC MCRC CRCFAIL CRC response error (WCRCE,RCRCE,SCRCE,CCRCE)<br />
18 SEND MEND STOPBIT_ERR End bit error (WEBER,REBER,SEBER,CEBER)<br />
19 SDTO MDTO DATATIMEOUT Data Timeout (NRCS,NWCS,KBSY)<br />
20 SFOF MFOF RXOVERFLOW HOST tried write full<br />
21 SFUF MFUF TXUNDERRUN HOST tried read empty<br />
22 SCTO MCTO CMDTIMEOUT Response start-bit timeout (NRS,NSR)<br />
23 1 ? 0 Unknown/undoc (usually set?)<br />
24 SBRE MBRE RXRDY (fifo not empty) (request data read)<br />
25 SBWE MBWE TXRQ (datafifoempty?) (request data write)<br />
26 0 0 Unknown/unused (always 0)<br />
27 undoc undoc Unknown/undoc (bit27 is mask-able in IRQ_MASK)<br />
28 0 0 Unknown/unused (always 0)<br />
29 1 ? 0 Unknown/undoc (usually set?) (unlike toshiba ILFSL/IFSMSK)<br />
30 undoc 0 CMD_BUSY<br />
31 ILA IMSK Illegal Command Access (old CMD still busy, or wrong NTDT)<br />
Acknowledge by STAT=0, or by MASK=1 (uh, really?), or by soft reset (SRST=0) or<br />
hard reset.<br />
<br />
<br />
'''4004900h - SD_DATA32_IRQ'''<br><br />
'''4004B00h - SDIO_DATA32_IRQ'''<br><br />
15-13 Unknown/unused (appears to be always zero)<br />
12 Unknown (paired with bit9) (can be set) IRQ enable ?! (R/W?)<br />
11 Unknown (paired with bit8) (can be set) IRQ enable ?! (R/W?)<br />
10 Unknown (read=0) write: (0=No change, 1=Clear Bit8,9) ? (W?)<br />
9 Unknown (paired with bit12) (automatically cleared after...) (R?)<br />
8 Unknown (paired with bit11) (R?)<br />
7-2 Unknown (0)<br />
1 Unknown (can be set) (autoclear bit8,9 on xfer end?) (R/W?)<br />
0 Unknown (0)<br />
Can be 1A02h, but changes to 1802h after reading from somewhere (maybe from<br />
DATA32_FIFO?).<br><br />
Bit8,9 seem to be whatever extra IRQ flags, the flags get set ONLY in DATA32<br />
mode (not in DATA16 mode).<br />
<br />
<br />
'''400482Ch - SD_ERROR_DETAIL_STATUS0-1 - Error Detail Status'''<br><br />
'''4004A2Ch - SDIO_ERROR_DETAIL_STATUS0-1 - Error Detail Status'''<br><br />
31-23 ? Unknown/unused/undoc<br />
22 KBSY Timeout for CRC status busy timeout ;\STAT.19<br />
21 NWCS Timeout for CRC status timeout ; (SDTO)<br />
20 NRCS Timeout for Data start-bit, or for Post Data Busy ;/<br />
19-18 ? Unknown/unused/undoc<br />
17 NRS Response timeout for auto-issued CMD12 ;\STAT.22<br />
16 NCR Response timeout for non-auto-issued CMD's ;/(SCTO)<br />
15-14 ? Unknown/unused/undoc<br />
13 ?? Unknown/undoc (bit13 can be nonzero on DSi!)<br />
12 ? Unknown/unused/undoc<br />
11 WCRCE CRC error for Write CRC status for a write command ;\<br />
10 RCRCE CRC error for read data ; STAT.17<br />
9 SCRCE CRC error for a response for auto-issued CMD12 ; (SCRC)<br />
8 CCRCE CRC error for a response for non-auto-issued CMD's ;/<br />
5 WEBER End bit error for Write CRC status ;\<br />
4 REBER End bit error for read data ; STAT.18<br />
3 SEBER End bit error for response for auto-issued CMD12 ; (SEND)<br />
2 CEBER End bit error for response for non-auto-issued CMD's ;/<br />
1? SCMDE Bad CMD-index in response of auto-issued CMD12 ;\STAT.16<br />
0 RCMDE Bad CMD-index in response of non-auto-issued CMD's ;/(SCIX)<br />
Unknown if/when/how the error bits can be reset/acknowledged.<br><br />
Note: CMD12 is STOP_TRANSMISSION (maybe sent after BLK_COUNT?).<br><br />
The four "auto-issued CMD12" bits exist for SD registers only (not SDIO).<br />
SCMDE is probably in bit1 (though, official specs say bit0, which would be same<br />
as RCMDE).<br />
<br />
<br />
'''4004A36h - DSi: 0000 - SDCTL_CARD_INTERRUPT_CONTROL'''<br><br />
This does NOT seem to be implemented as described below on DSi.<br />
4004A36h does seem to behave more like 4004836h, see there.<br />
15-13 ? Unknown (zero on DSi)<br />
12 CINT0 SDIO Interrupt Flag (0=none, 1=irq) (/IRQ aka Data1 pin)<br />
11-9 ? Unknown (zero on DSi)<br />
8 CIMSK0 SDIO Interrupt Mask (0=enable, 1=disable) (/IRQ aka Data1 pin)<br />
7-0 ? Unknown (zero on DSi)<br />
Acknowledge by writing CINT0=0, or CIMSK0=1, or hard reset (unlike as for other<br />
SD/MMC interrupts, soft reset does not acknowlege this interrupt type?).<br />
<br />
== DSi SD/MMC I/O Ports: Control ==<br />
<br />
'''4004802h - SD_CARD_PORT_SELECT (0201h)'''<br><br />
'''4004A02h - SDIO_CARD_PORT_SELECT (0100h)'''<br><br />
15-11 Unknown/unused (appears to be always zero)<br />
10 Unknown (write: should be 1, read: usually/always 0) (W?)<br />
9 Unknown (write: should be 0, read: usually 1 for SD)<br />
8 Unknown (write: should be 0, read: usually 1 for SDIO)<br />
7-4 Unknown/unused (appears to be always zero)<br />
3-1 Unknown (R/W)<br />
0 Port Select (0=SD Card Slot, 1=Onboard eMMC) (for SDIO: Unknown)<br />
Known written values are 0400h and 0401h (SD). However known read values are<br />
0201h (SD) and 0100h (SDIO).<br />
<br />
<br />
'''4004828h - DSi: 40E0 - SD_CARD_OPTION - Memory Card Option Setup'''<br><br />
'''4004A28h - DSi: 40EE - SDIO_CARD_OPTION - Card Option Setup'''<br><br />
15 Bus Width (0=4bit, 1=1bit)<br />
14 Unknown (usually set)<br />
13-8 Unknown/unused (appears to be always zero)<br />
7-4 Unknown, maybe some 4bit timing/timeout value<br />
0-3 Unknown, maybe another 4bit timing/timeout value<br />
Settings spotted on DSi are 40E0h,40EEh.<br><br />
Among others, this register should contain a 4bit timeout setting, "RTO[3:0]<br />
for SD (aka TO[3:0] for SDIO) timeout period for data start/busy bits, in the<br />
form of a multiple number of the SDCLK period."<br><br />
Maybe also selects transfer CLK rate, or whatever.<br />
<br />
<br />
'''4004834h - DSi: 0000 - SD_TRANSACTION_CTL - Transaction Control'''<br><br />
'''4004A34h - DSi: 0000 - SDIO_TRANSACTION_CTL - Transaction Control'''<br><br />
15-10 Unknown/unused (appears to be always zero)<br />
9-8 Unknown<br />
7-3 Unknown/unused (appears to be always zero)<br />
2 Unknown<br />
1 Unknown/unused (appears to be always zero)<br />
0 Unknown<br />
Maybe also selects transfer CLK rate, or whatever.<br />
<br />
<br />
'''40048E0h - DSi: 0007 - SD_SOFT_RESET - Software Reset'''<br><br />
'''4004AE0h - DSi: 0006 - SDIO_SOFT_RESET - Software Reset'''<br><br />
15-3 Unknown/unused (appears to be always zero)<br />
2 ? Unknown (can be nonzero on DSi)<br />
1 ? Unknown (can be nonzero on DSi)<br />
0 SRST Soft Reset (0=Reset, 1=Release)<br />
Software should apply reset after sensing card insertion/removal, and<br />
(thereafter) release reset in case of card insertion. Software reset does<br />
acknowledge all IRQs (except that from SDIO /IRQ pin?), and does probably also<br />
reinitialize some other registers.<br />
<br />
<br />
'''4004808h - DSi: 0100 - SDCTL_STOP_INTERNAL_ACTION'''<br><br />
15-9 Unknown/unused (appears to be always zero)<br />
8 Unknown<br />
7-1 Unknown/unused (appears to be always zero)<br />
0 Unknown<br />
Stop whatever internal action for whatever purpose in whatever situation?<br><br />
Existing code does set bit8 (prior to changing SD_DATA16_BLK_COUNT).<br><br />
Existing code does clear bit0 (alongsides with IRQ enable/acknowlege or so).<br />
<br />
<br />
'''4004824h - DSi: 0000 - DSi: Used? - SDCTL_CARD_CLK_CTL Card Clock Control'''<br><br />
Can be max 07FFh on DSi... ie. bit15 CANNOT be set?<br />
15 Disable HCLK divider (0=SDCLK selected via bit7-0, 1=SDCLK=HCLK)<br />
14-10 Unknown (zero on DSi)<br />
9 Unknown (set in some cases on DSi)<br />
8 Unknown (1=Start Clock, or Apply Clock Change, or so?)<br />
7-0 HCLK Div (0,1,2,4,8,10h,20h,40h,80h = Div2,4,8,16,32,64,128,256,512)<br />
Clock supply to SD Card<br><br />
The SDCLK signal is used for a provision of SD Memory Card or SDIO Card. Please<br />
refer to the following setting for enabling the SDCLK output.<br />
(1) Set Stop Clock Control Register (Config Offset:40h) to 1Fh.<br />
(2) Set D0 of SD Software Reset Register (Offset:0E0h) to 1b.<br />
(3) Set D7-0 of SD Card Clock Control Register (Offset:024h). These bits<br />
are used for setting the frequency of SDCLK.<br />
80h : SDCLK=HCLK/512<br />
40h : SDCLK=HCLK/256<br />
20h : SDCLK=HCLK/128<br />
10h : SDCLK=HCLK/64<br />
08h : SDCLK=HCLK/32<br />
04h : SDCLK=HCLK/16<br />
02h : SDCLK=HCLK/8<br />
01h : SDCLK=HCLK/4<br />
00h : SDCLK=HCLK/2<br />
In addition, TC6387XB holds a function that SDCLK can have same<br />
frequency as HCLK. In this case, D7-0 settings of SD Card Clock Control<br />
Register (Offset:024h) becomes invalid setting.<br />
* Set D0 of Clock Mode Register (Config Offset:42h) to 1b.<br />
* Set D15 of SD Card Clock Control Register (Offset:024h) to 1b.<br />
Please attend that the specification of SDCLK is max.25MHz at the case<br />
of SD Card and is max.20MHz at the case of MultiMedia Card.<br />
(4) D8 of SD Card Clock Control Register (Offset:024h) to 1b.<br />
(5) D8 of Clock & Wait Control Register (Offset:138h) to 1b.<br />
On the DSi, HCLK seems to be 33.513982 MHz.<br />
<br />
<br />
'''4004x38h - DSi: 0000 - SDCTL_CLK_AND_WAIT_CTL'''<br><br />
15-0 Unknown (zero on DSi)<br />
Maybe transfer CLK rate, or some master clock control for the clock input.<br />
<br />
<br />
'''4004x3Ah - DSi: 0000 - SDCTL_SDIO_HOST_INFORMATION'''<br><br />
'''4004x3Ch - DSi: 0000 - SDCTL_ERROR_CONTROL'''<br><br />
'''4004x3Eh - DSi: 0000 - SDCTL_SDLED_CONTROL - LED Control (TC6387XB only)'''<br><br />
15-0 Unknown (zero on DSi)<br />
<br />
<br />
'''40048E2h - DSi: 0009 - SDCTL_RESERVED2 (TC6371AF:CORE_REV)'''<br><br />
'''40048E6h - DSi: 0000 - SDCTL_RESERVED3 (TC6371AF:BUF_ADR)'''<br><br />
'''40048E8h - DSi: 0000 - UNDOC/UNUSED (TC6371AF:Resp_Header)'''<br><br />
'''40048F6h - DSi: 0000 - SDCTL_RESERVED4 --- used by DSi !!!'''<br><br />
'''40048F8h - DSi: 0004 - SDCTL_RESERVED5 <-- DSi: SD only (not SDIO)'''<br><br />
'''40048FAh - DSi: 0007 - SDCTL_RESERVED6 <-- DSi: SD only (not SDIO)'''<br><br />
'''40048FCh - DSi: 00FC - SDCTL_RESERVED7'''<br><br />
'''40048FEh - DSi: 00FF - SDCTL_RESERVED8 (TC6371AF:Revision)'''<br><br />
'''4004xE2h - DSi: 0000 - SDCTL_RESERVED9'''<br><br />
'''4004xF0h - DSi: 0000 - SDCTL_RESERVED10'''<br><br />
'''4004836h - DSi: 0002 - UNDOC! (bit1 can be set, other bits always 0)'''<br><br />
15-0 Unknown<br />
<br />
<br />
'''4004838h/4004A38h - DSi: C007 - UNDOC!'''<br><br />
'''4004840h/4004A40h - DSi: 003F - UNDOC?'''<br><br />
'''4004842h/4004A42h - DSi: 002A - UNDOC?'''<br><br />
'''40048B2h/4004AB2h - DSi: FFFF - UNDOC?'''<br><br />
'''40048BAh/4004ABAh - DSi: 0200 - UNDOC?'''<br><br />
'''40048F4h/4004AF4h - DSi: 0700 - UNDOC!'''<br><br />
15-0 Unknown</div>Nocashhttps://dsibrew.org/w/index.php?title=SD/MMC/SDIO_Registers&diff=2098806SD/MMC/SDIO Registers2015-08-25T00:31:38Z<p>Nocash: </p>
<hr />
<div>SD_xxx is used to access onboard eMMC and external SD card slot (as selected via SD_CARD_PORT_SELECT).<br><br />
SDIO_xxx is used to access the Atheros Wifi unit.<br />
<br />
== DSi SD/MMC I/O Ports: Command/Param/Response/Data ==<br />
<br />
'''4004800h - SD_CMD - Command and Response/Data Type (R/W)'''<br><br />
'''4004A00h - SDIO_CMD - Command and Response/Data Type (R/W)'''<br><br />
15 undoc Unknown/undoc (read/write-able)<br />
14 undoc Security Cmd (0=Normal, 1=Whatever/Security) (sdio?)<br />
13 undoc Data Length (0=Single Block, 1=Multiple Blocks)<br />
12 undoc Data Direction (0=Write, 1=Read)<br />
11 NTDT Data Transfer (0=No data, 1=With data)<br />
10-8 REP2-0 Response Type (0..2=Unknown/Reserved, 3=None, 4=48bit,<br />
5=48bit+Busy, 6=136bit, 7=48bitOcrWithoutCRC7)<br />
7-6 CMD1-0 Command Type (0=CMD, 1=ACMD, 2..3=unknown, maybe GEN WR/RD?)<br />
5-0 CIX Command Index (0..3Fh, command index)<br />
Invalid values can cause ILA error (particulary on setting NTDT for CMD12, or<br />
for CMD's Response=None). ILA error will also occur if an old CMD is still<br />
busy.<br />
DSi software is always writing just ZERO to bit11-6 though? Maybe the hardware<br />
does automatically know which SD/MMC CMDs and ACMDs have data? Or maybe data is<br />
always automatically transferred when receiving a data-startbit, or when<br />
writing to data register - and bits like NTDT would be needed only for things<br />
like proper data timeout handling?<br />
<br />
<br />
'''4004804h - SD_CMD_PARAM0-1 - Argument (32bit, 2 halfwords) (R/W)'''<br><br />
'''4004A04h - SDIO_CMD_PARAM0-1 - Argument (32bit, 2 halfwords) (R/W)'''<br><br />
31-0 Parameter value for CMD<br />
The parameter value should be written <before> sending the command via<br />
SD_CMD/SDIO_CMD.<br />
<br />
<br />
'''400480Ch - SD_RESPONSE0-7 - Response (128bit, 8 halfwords) (R)'''<br><br />
'''4004A0Ch - SDIO_RESPONSE0-7 - Response (128bit, 8 halfwords) (R)'''<br><br />
After sending a command, wait for the CMDRESPEND bit (IRQ_STATUS.bit0) to get<br />
set, then read the RESPONSE (if the command does have any response).<br />
For normal 32bit responses:<br />
31-0 Response<br />
127-32 Older Responses<br />
For CID/CSD responses:<br />
119-0 120bit Response<br />
127-120 Zero (always?)<br />
Seems to be left-shifted when receiving response bits. So, for 32bit responses,<br />
bit0-31 would contain the current response, and bit32-127 would contain older<br />
responses.<br />
<br />
<br />
'''DATA16 vs DATA32'''<br><br />
Data can be transferred in 16bit or 32bit units (as selected in DATA_CTL.bit1).<br />
There are separate data, block len, and block count registers for 16bit and<br />
32bit mode (that's probably due to some odd patchwork, where the manufacturer<br />
has added 32bit support to the original 16bit chip design).<br />
Naturally, a 32bit transfer is faster than two 16bit transfers. Nethertheless,<br />
the DSi firmware does use both 32bit and 16bit mode once and then; 32bit mode<br />
is required for NDMA transfers (which don't support 16bit).<br />
<br />
'''40048D8h - SD_DATA_CTL'''<br><br />
'''4004AD8h - SDIO_DATA_CTL'''<br><br />
15-13 Unknown (usually 0)<br />
12 Unknown (usually 1) (R?)<br />
11-6 Unknown (usually 0)<br />
5 Unknown (R/W?) (R/W?)<br />
4 Unknown (usually 1) (R?)<br />
3-2 Unknown (usually 0)<br />
1 Select 16bit/32bit Data Mode (0=DATA16, 1=DATA32) (R/W?)<br />
0 Unknown (usually 0)<br />
Known written values are 0000h and 0002h. However, known read values are 1010h<br />
and 1012h.<br />
<br />
<br />
'''400480Ah - SD_DATA16_BLK_COUNT - "Transfer Sector Count" (R/W)'''<br><br />
'''4004908h - SD_DATA32_BLK_COUNT (R/W)'''<br><br />
'''4004A0Ah - SDIO_DATA16_BLK_COUNT - "Transfer Block Count" (R/W)'''<br><br />
'''4004B08h - SDIO_DATA32_BLK_COUNT (R/W)'''<br><br />
15-0 Number of Data Blocks for multiple read/write commands<br />
Can be max FFFFh. The DATA32_BLK_COUNT value decreases after reading from<br />
somewhere (maybe from DATA32_FIFO?).<br />
<br />
<br />
'''4004826h - SD_DATA16_BLK_LEN - Memory Card Transfer Data Length (R/W)'''<br><br />
'''4004904h - SD_DATA32_BLK_LEN (R/W)'''<br><br />
'''4004A26h - SDIO_DATA16_BLK_LEN - Card Transfer Data Length (R/W)'''<br><br />
'''4004B04h - SDIO_DATA32_BLK_LEN (R/W)'''<br><br />
15-10 Unknown/unused (appears to be always zero)<br />
9-0 Data Block Length in bytes (for DATA16: clipped to max 0200h by hw)<br />
Should be usually 0200h (for 512-byte SD/MMC memory blocks). Other values may<br />
be needed for SDIO functions, or when accessing SSR/SCR/PWD registers via data<br />
transfers.<br />
DATA32_BLK_LEN can be max 3FFh (unlike DATA16_BLK_LEN which is clipped to<br />
max=200h by hardware).<br />
<br />
<br />
'''4004830h - SD_DATA16_FIFO - Data Port (SD_FIFO?)'''<br><br />
'''400490Ch - SD_DATA32_FIFO'''<br><br />
'''4004A30h - SDIO_DATA16_FIFO - Data Port (SD_FIFO?)'''<br><br />
'''4004B0Ch - SDIO_DATA32_FIFO'''<br><br />
For Data16:<br />
15-0 Data (16bit) (...or could it be accessed as 32bit, too?)<br />
For Data32:<br />
31-0 Data (32bit) (...or could it be accessed as 16bit, too?)<br />
Transfer data here (read after RXRDY gets set, or write after TXRQ gets set).<br />
FIFO size is unknown (if there's any FIFO behind it).<br />
<br />
<br />
== DSi SD/MMC I/O Ports: Interrupt/Status ==<br />
<br />
'''400481Ch - SD_IRQ_STATUS0-1 - Interrupt Status (R/ack)'''<br><br />
'''4004A1Ch - SDIO_IRQ_STATUS0-1 - Interrupt Status (R/ack)'''<br><br />
'''4004820h - SD_IRQ_MASK0-1 - Interrupt Mask (R/W)'''<br><br />
'''4004A20h - SDIO_IRQ_MASK0-1 - Interrupt Mask (R/W)'''<br><br />
IRQ Status (0=ack, 1=request)<br><br />
IRQ Mask (0=Enable, 1=Disable)<br><br />
Bit Stat Mask Function<br />
0 SREP MREP CMDRESPEND (response end) (or R1b: busy end)<br />
1 ? - Unknown/unused/undoc<br />
2 SRWA MRWA DATAEND (is NOT set? after data read/write end bit)<br />
3 SCOT MCOT CARD_REMOVE ;\SD only (not SDIO)<br />
4 SCIN MCIN CARD_INSERT ;/<br />
5 undoc - SIGSTATE card/type/signal/signature detect?<br />
6 ? - Unknown/unused/undoc maybe card-detect switch?<br />
7 undoc - WRPROTECT probably write-protect switch<br />
8 undoc undoc CARD_REMOVE_A ;\<br />
9 undoc undoc CARD_INSERT_A ; uh, somewhat dupes of bit3-5?<br />
10 undoc - SIGSTATE_A ;/<br />
11 ? - Unknown/unused/undoc<br />
12 ? - Unknown/unused/undoc<br />
13 ? - Unknown/unused/undoc<br />
14 ? - Unknown/unused/undoc<br />
15 ? - Unknown/unused/undoc<br />
16 SCIX MCIX CMD_IDX_ERR Bad CMD-index in response (RCMDE,SCMDE)<br />
17 SCRC MCRC CRCFAIL CRC response error (WCRCE,RCRCE,SCRCE,CCRCE)<br />
18 SEND MEND STOPBIT_ERR End bit error (WEBER,REBER,SEBER,CEBER)<br />
19 SDTO MDTO DATATIMEOUT Data Timeout (NRCS,NWCS,KBSY)<br />
20 SFOF MFOF RXOVERFLOW HOST tried write full<br />
21 SFUF MFUF TXUNDERRUN HOST tried read empty<br />
22 SCTO MCTO CMDTIMEOUT Response start-bit timeout (NRS,NSR)<br />
23 ? - Unknown/unused/undoc<br />
24 SBRE MBRE RXRDY (fifo not empty) (request data read)<br />
25 SBWE MBWE TXRQ (datafifoempty?) (request data write)<br />
26 ? - Unknown/unused/undoc<br />
27 undoc undoc Unknown/used?! (the bit is mask-able in IRQ_MASK)<br />
28 ? - Unknown/unused/undoc<br />
29 undoc - DSi: Unknown/can be 1 (not exactly like below Toshiba specs)<br />
(29) ILFSL IFSMSK Toshiba: ILL_FUNC Illegal SDIO Function ;SDIO only (not SD)<br />
30 undoc - CMD_BUSY<br />
31 ILA IMSK Illegal Command Access (old CMD still busy, or wrong NTDT)<br />
Acknowledge by STAT=0, or by MASK=1 (uh, really?), or by soft reset (SRST=0) or<br />
hard reset.<br><br />
The Insert/Remove bits (bit3,4, and maybe also bit8,9) exist in the "SD"<br />
registers only, not in the "SDIO" registers (the bits should be treated as<br />
general insert/remove flags though, no matter if the card is an SD or SDIO<br />
card).<br><br />
Bit29 is SDIO related, and exist in SDIO registers only, not in SD registers.<br />
4004820h can be 8B7F031Dh<br />
4004A20h can be 8B7F031Dh<br />
<br />
<br />
'''4004900h - SD_DATA32_IRQ'''<br><br />
'''4004B00h - SDIO_DATA32_IRQ'''<br><br />
15-13 Unknown/unused (appears to be always zero)<br />
12 Unknown (paired with bit9) (can be set) IRQ enable ?! (R/W?)<br />
11 Unknown (paired with bit8) (can be set) IRQ enable ?! (R/W?)<br />
10 Unknown (read=0) write: (0=No change, 1=Clear Bit8,9) ? (W?)<br />
9 Unknown (paired with bit12) (automatically cleared after...) (R?)<br />
8 Unknown (paired with bit11) (R?)<br />
7-2 Unknown (0)<br />
1 Unknown (can be set) (autoclear bit8,9 on xfer end?) (R/W?)<br />
0 Unknown (0)<br />
Can be 1A02h, but changes to 1802h after reading from somewhere (maybe from<br />
DATA32_FIFO?).<br><br />
Bit8,9 seem to be whatever extra IRQ flags, the flags get set ONLY in DATA32<br />
mode (not in DATA16 mode).<br />
<br />
<br />
'''400482Ch - SD_ERROR_DETAIL_STATUS0-1 - Error Detail Status'''<br><br />
'''4004A2Ch - SDIO_ERROR_DETAIL_STATUS0-1 - Error Detail Status'''<br><br />
31-23 ? Unknown/unused/undoc<br />
22 KBSY Timeout for CRC status busy timeout ;\STAT.19<br />
21 NWCS Timeout for CRC status timeout ; (SDTO)<br />
20 NRCS Timeout for Data start-bit, or for Post Data Busy ;/<br />
19-18 ? Unknown/unused/undoc<br />
17 NRS Response timeout for auto-issued CMD12 ;\STAT.22<br />
16 NCR Response timeout for non-auto-issued CMD's ;/(SCTO)<br />
15-14 ? Unknown/unused/undoc<br />
13 ?? Unknown/undoc (bit13 can be nonzero on DSi!)<br />
12 ? Unknown/unused/undoc<br />
11 WCRCE CRC error for Write CRC status for a write command ;\<br />
10 RCRCE CRC error for read data ; STAT.17<br />
9 SCRCE CRC error for a response for auto-issued CMD12 ; (SCRC)<br />
8 CCRCE CRC error for a response for non-auto-issued CMD's ;/<br />
5 WEBER End bit error for Write CRC status ;\<br />
4 REBER End bit error for read data ; STAT.18<br />
3 SEBER End bit error for response for auto-issued CMD12 ; (SEND)<br />
2 CEBER End bit error for response for non-auto-issued CMD's ;/<br />
1? SCMDE Bad CMD-index in response of auto-issued CMD12 ;\STAT.16<br />
0 RCMDE Bad CMD-index in response of non-auto-issued CMD's ;/(SCIX)<br />
Unknown if/when/how the error bits can be reset/acknowledged.<br><br />
Note: CMD12 is STOP_TRANSMISSION (maybe sent after BLK_COUNT?).<br><br />
The four "auto-issued CMD12" bits exist for SD registers only (not SDIO).<br />
SCMDE is probably in bit1 (though, official specs say bit0, which would be same<br />
as RCMDE).<br />
<br />
<br />
'''4004A36h - DSi: 0000 - SDCTL_CARD_INTERRUPT_CONTROL'''<br><br />
This does NOT seem to be implemented as described below on DSi.<br />
4004A36h does seem to behave more like 4004836h, see there.<br />
15-13 ? Unknown (zero on DSi)<br />
12 CINT0 SDIO Interrupt Flag (0=none, 1=irq) (/IRQ aka Data1 pin)<br />
11-9 ? Unknown (zero on DSi)<br />
8 CIMSK0 SDIO Interrupt Mask (0=enable, 1=disable) (/IRQ aka Data1 pin)<br />
7-0 ? Unknown (zero on DSi)<br />
Acknowledge by writing CINT0=0, or CIMSK0=1, or hard reset (unlike as for other<br />
SD/MMC interrupts, soft reset does not acknowlege this interrupt type?).<br />
<br />
== DSi SD/MMC I/O Ports: Control ==<br />
<br />
'''4004802h - SD_CARD_PORT_SELECT (0201h)'''<br><br />
'''4004A02h - SDIO_CARD_PORT_SELECT (0100h)'''<br><br />
15-11 Unknown/unused (appears to be always zero)<br />
10 Unknown (write: should be 1, read: usually/always 0) (W?)<br />
9 Unknown (write: should be 0, read: usually 1 for SD)<br />
8 Unknown (write: should be 0, read: usually 1 for SDIO)<br />
7-4 Unknown/unused (appears to be always zero)<br />
3-1 Unknown (R/W)<br />
0 Port Select (0=SD Card Slot, 1=Onboard eMMC) (for SDIO: Unknown)<br />
Known written values are 0400h and 0401h (SD). However known read values are<br />
0201h (SD) and 0100h (SDIO).<br />
<br />
<br />
'''4004828h - DSi: 40E0 - SD_CARD_OPTION - Memory Card Option Setup'''<br><br />
'''4004A28h - DSi: 40EE - SDIO_CARD_OPTION - Card Option Setup'''<br><br />
15 Bus Width (0=4bit, 1=1bit)<br />
14 Unknown (usually set)<br />
13-8 Unknown/unused (appears to be always zero)<br />
7-4 Unknown, maybe some 4bit timing/timeout value<br />
0-3 Unknown, maybe another 4bit timing/timeout value<br />
Settings spotted on DSi are 40E0h,40EEh.<br><br />
Among others, this register should contain a 4bit timeout setting, "RTO[3:0]<br />
for SD (aka TO[3:0] for SDIO) timeout period for data start/busy bits, in the<br />
form of a multiple number of the SDCLK period."<br><br />
Maybe also selects transfer CLK rate, or whatever.<br />
<br />
<br />
'''4004834h - DSi: 0000 - SD_TRANSACTION_CTL - Transaction Control'''<br><br />
'''4004A34h - DSi: 0000 - SDIO_TRANSACTION_CTL - Transaction Control'''<br><br />
15-10 Unknown/unused (appears to be always zero)<br />
9-8 Unknown<br />
7-3 Unknown/unused (appears to be always zero)<br />
2 Unknown<br />
1 Unknown/unused (appears to be always zero)<br />
0 Unknown<br />
Maybe also selects transfer CLK rate, or whatever.<br />
<br />
<br />
'''40048E0h - DSi: 0007 - SD_SOFT_RESET - Software Reset'''<br><br />
'''4004AE0h - DSi: 0006 - SDIO_SOFT_RESET - Software Reset'''<br><br />
15-3 Unknown/unused (appears to be always zero)<br />
2 ? Unknown (can be nonzero on DSi)<br />
1 ? Unknown (can be nonzero on DSi)<br />
0 SRST Soft Reset (0=Reset, 1=Release)<br />
Software should apply reset after sensing card insertion/removal, and<br />
(thereafter) release reset in case of card insertion. Software reset does<br />
acknowledge all IRQs (except that from SDIO /IRQ pin?), and does probably also<br />
reinitialize some other registers.<br />
<br />
<br />
'''4004808h - DSi: 0100 - SDCTL_STOP_INTERNAL_ACTION'''<br><br />
15-9 Unknown/unused (appears to be always zero)<br />
8 Unknown<br />
7-1 Unknown/unused (appears to be always zero)<br />
0 Unknown<br />
Stop whatever internal action for whatever purpose in whatever situation?<br><br />
Existing code does set bit8 (prior to changing SD_DATA16_BLK_COUNT).<br><br />
Existing code does clear bit0 (alongsides with IRQ enable/acknowlege or so).<br />
<br />
<br />
'''4004824h - DSi: 0000 - DSi: Used? - SDCTL_CARD_CLK_CTL Card Clock Control'''<br><br />
Can be max 07FFh on DSi... ie. bit15 CANNOT be set?<br />
15 Disable HCLK divider (0=SDCLK selected via bit7-0, 1=SDCLK=HCLK)<br />
14-10 Unknown (zero on DSi)<br />
9 Unknown (set in some cases on DSi)<br />
8 Unknown (1=Start Clock, or Apply Clock Change, or so?)<br />
7-0 HCLK Div (0,1,2,4,8,10h,20h,40h,80h = Div2,4,8,16,32,64,128,256,512)<br />
Clock supply to SD Card<br><br />
The SDCLK signal is used for a provision of SD Memory Card or SDIO Card. Please<br />
refer to the following setting for enabling the SDCLK output.<br />
(1) Set Stop Clock Control Register (Config Offset:40h) to 1Fh.<br />
(2) Set D0 of SD Software Reset Register (Offset:0E0h) to 1b.<br />
(3) Set D7-0 of SD Card Clock Control Register (Offset:024h). These bits<br />
are used for setting the frequency of SDCLK.<br />
80h : SDCLK=HCLK/512<br />
40h : SDCLK=HCLK/256<br />
20h : SDCLK=HCLK/128<br />
10h : SDCLK=HCLK/64<br />
08h : SDCLK=HCLK/32<br />
04h : SDCLK=HCLK/16<br />
02h : SDCLK=HCLK/8<br />
01h : SDCLK=HCLK/4<br />
00h : SDCLK=HCLK/2<br />
In addition, TC6387XB holds a function that SDCLK can have same<br />
frequency as HCLK. In this case, D7-0 settings of SD Card Clock Control<br />
Register (Offset:024h) becomes invalid setting.<br />
* Set D0 of Clock Mode Register (Config Offset:42h) to 1b.<br />
* Set D15 of SD Card Clock Control Register (Offset:024h) to 1b.<br />
Please attend that the specification of SDCLK is max.25MHz at the case<br />
of SD Card and is max.20MHz at the case of MultiMedia Card.<br />
(4) D8 of SD Card Clock Control Register (Offset:024h) to 1b.<br />
(5) D8 of Clock & Wait Control Register (Offset:138h) to 1b.<br />
On the DSi, HCLK seems to be 33.513982 MHz.<br />
<br />
<br />
'''4004x38h - DSi: 0000 - SDCTL_CLK_AND_WAIT_CTL'''<br><br />
15-0 Unknown (zero on DSi)<br />
Maybe transfer CLK rate, or some master clock control for the clock input.<br />
<br />
<br />
'''4004x3Ah - DSi: 0000 - SDCTL_SDIO_HOST_INFORMATION'''<br><br />
'''4004x3Ch - DSi: 0000 - SDCTL_ERROR_CONTROL'''<br><br />
'''4004x3Eh - DSi: 0000 - SDCTL_SDLED_CONTROL - LED Control (TC6387XB only)'''<br><br />
15-0 Unknown (zero on DSi)<br />
<br />
<br />
'''40048E2h - DSi: 0009 - SDCTL_RESERVED2 (TC6371AF:CORE_REV)'''<br><br />
'''40048E6h - DSi: 0000 - SDCTL_RESERVED3 (TC6371AF:BUF_ADR)'''<br><br />
'''40048E8h - DSi: 0000 - UNDOC/UNUSED (TC6371AF:Resp_Header)'''<br><br />
'''40048F6h - DSi: 0000 - SDCTL_RESERVED4 --- used by DSi !!!'''<br><br />
'''40048F8h - DSi: 0004 - SDCTL_RESERVED5 <-- DSi: SD only (not SDIO)'''<br><br />
'''40048FAh - DSi: 0007 - SDCTL_RESERVED6 <-- DSi: SD only (not SDIO)'''<br><br />
'''40048FCh - DSi: 00FC - SDCTL_RESERVED7'''<br><br />
'''40048FEh - DSi: 00FF - SDCTL_RESERVED8 (TC6371AF:Revision)'''<br><br />
'''4004xE2h - DSi: 0000 - SDCTL_RESERVED9'''<br><br />
'''4004xF0h - DSi: 0000 - SDCTL_RESERVED10'''<br><br />
'''4004836h - DSi: 0002 - UNDOC! (bit1 can be set, other bits always 0)'''<br><br />
15-0 Unknown<br />
<br />
<br />
'''4004838h/4004A38h - DSi: C007 - UNDOC!'''<br><br />
'''4004840h/4004A40h - DSi: 003F - UNDOC?'''<br><br />
'''4004842h/4004A42h - DSi: 002A - UNDOC?'''<br><br />
'''40048B2h/4004AB2h - DSi: FFFF - UNDOC?'''<br><br />
'''40048BAh/4004ABAh - DSi: 0200 - UNDOC?'''<br><br />
'''40048F4h/4004AF4h - DSi: 0700 - UNDOC!'''<br><br />
15-0 Unknown</div>Nocashhttps://dsibrew.org/w/index.php?title=SD/MMC/SDIO_Registers&diff=2098805SD/MMC/SDIO Registers2015-08-25T00:28:28Z<p>Nocash: </p>
<hr />
<div>== DSi SD/MMC I/O Ports: Command/Param/Response/Data ==<br />
<br />
'''4004800h - SD_CMD - Command and Response/Data Type (R/W)'''<br><br />
'''4004A00h - SDIO_CMD - Command and Response/Data Type (R/W)'''<br><br />
15 undoc Unknown/undoc (read/write-able)<br />
14 undoc Security Cmd (0=Normal, 1=Whatever/Security) (sdio?)<br />
13 undoc Data Length (0=Single Block, 1=Multiple Blocks)<br />
12 undoc Data Direction (0=Write, 1=Read)<br />
11 NTDT Data Transfer (0=No data, 1=With data)<br />
10-8 REP2-0 Response Type (0..2=Unknown/Reserved, 3=None, 4=48bit,<br />
5=48bit+Busy, 6=136bit, 7=48bitOcrWithoutCRC7)<br />
7-6 CMD1-0 Command Type (0=CMD, 1=ACMD, 2..3=unknown, maybe GEN WR/RD?)<br />
5-0 CIX Command Index (0..3Fh, command index)<br />
Invalid values can cause ILA error (particulary on setting NTDT for CMD12, or<br />
for CMD's Response=None). ILA error will also occur if an old CMD is still<br />
busy.<br />
DSi software is always writing just ZERO to bit11-6 though? Maybe the hardware<br />
does automatically know which SD/MMC CMDs and ACMDs have data? Or maybe data is<br />
always automatically transferred when receiving a data-startbit, or when<br />
writing to data register - and bits like NTDT would be needed only for things<br />
like proper data timeout handling?<br />
<br />
<br />
'''4004804h - SD_CMD_PARAM0-1 - Argument (32bit, 2 halfwords) (R/W)'''<br><br />
'''4004A04h - SDIO_CMD_PARAM0-1 - Argument (32bit, 2 halfwords) (R/W)'''<br><br />
31-0 Parameter value for CMD<br />
The parameter value should be written <before> sending the command via<br />
SD_CMD/SDIO_CMD.<br />
<br />
<br />
'''400480Ch - SD_RESPONSE0-7 - Response (128bit, 8 halfwords) (R)'''<br><br />
'''4004A0Ch - SDIO_RESPONSE0-7 - Response (128bit, 8 halfwords) (R)'''<br><br />
After sending a command, wait for the CMDRESPEND bit (IRQ_STATUS.bit0) to get<br />
set, then read the RESPONSE (if the command does have any response).<br />
For normal 32bit responses:<br />
31-0 Response<br />
127-32 Older Responses<br />
For CID/CSD responses:<br />
119-0 120bit Response<br />
127-120 Zero (always?)<br />
Seems to be left-shifted when receiving response bits. So, for 32bit responses,<br />
bit0-31 would contain the current response, and bit32-127 would contain older<br />
responses.<br />
<br />
<br />
'''DATA16 vs DATA32'''<br><br />
Data can be transferred in 16bit or 32bit units (as selected in DATA_CTL.bit1).<br />
There are separate data, block len, and block count registers for 16bit and<br />
32bit mode (that's probably due to some odd patchwork, where the manufacturer<br />
has added 32bit support to the original 16bit chip design).<br />
Naturally, a 32bit transfer is faster than two 16bit transfers. Nethertheless,<br />
the DSi firmware does use both 32bit and 16bit mode once and then; 32bit mode<br />
is required for NDMA transfers (which don't support 16bit).<br />
<br />
'''40048D8h - SD_DATA_CTL'''<br><br />
'''4004AD8h - SDIO_DATA_CTL'''<br><br />
15-13 Unknown (usually 0)<br />
12 Unknown (usually 1) (R?)<br />
11-6 Unknown (usually 0)<br />
5 Unknown (R/W?) (R/W?)<br />
4 Unknown (usually 1) (R?)<br />
3-2 Unknown (usually 0)<br />
1 Select 16bit/32bit Data Mode (0=DATA16, 1=DATA32) (R/W?)<br />
0 Unknown (usually 0)<br />
Known written values are 0000h and 0002h. However, known read values are 1010h<br />
and 1012h.<br />
<br />
<br />
'''400480Ah - SD_DATA16_BLK_COUNT - "Transfer Sector Count" (R/W)'''<br><br />
'''4004908h - SD_DATA32_BLK_COUNT (R/W)'''<br><br />
'''4004A0Ah - SDIO_DATA16_BLK_COUNT - "Transfer Block Count" (R/W)'''<br><br />
'''4004B08h - SDIO_DATA32_BLK_COUNT (R/W)'''<br><br />
15-0 Number of Data Blocks for multiple read/write commands<br />
Can be max FFFFh. The DATA32_BLK_COUNT value decreases after reading from<br />
somewhere (maybe from DATA32_FIFO?).<br />
<br />
<br />
'''4004826h - SD_DATA16_BLK_LEN - Memory Card Transfer Data Length (R/W)'''<br><br />
'''4004904h - SD_DATA32_BLK_LEN (R/W)'''<br><br />
'''4004A26h - SDIO_DATA16_BLK_LEN - Card Transfer Data Length (R/W)'''<br><br />
'''4004B04h - SDIO_DATA32_BLK_LEN (R/W)'''<br><br />
15-10 Unknown/unused (appears to be always zero)<br />
9-0 Data Block Length in bytes (for DATA16: clipped to max 0200h by hw)<br />
Should be usually 0200h (for 512-byte SD/MMC memory blocks). Other values may<br />
be needed for SDIO functions, or when accessing SSR/SCR/PWD registers via data<br />
transfers.<br />
DATA32_BLK_LEN can be max 3FFh (unlike DATA16_BLK_LEN which is clipped to<br />
max=200h by hardware).<br />
<br />
<br />
'''4004830h - SD_DATA16_FIFO - Data Port (SD_FIFO?)'''<br><br />
'''400490Ch - SD_DATA32_FIFO'''<br><br />
'''4004A30h - SDIO_DATA16_FIFO - Data Port (SD_FIFO?)'''<br><br />
'''4004B0Ch - SDIO_DATA32_FIFO'''<br><br />
For Data16:<br />
15-0 Data (16bit) (...or could it be accessed as 32bit, too?)<br />
For Data32:<br />
31-0 Data (32bit) (...or could it be accessed as 16bit, too?)<br />
Transfer data here (read after RXRDY gets set, or write after TXRQ gets set).<br />
FIFO size is unknown (if there's any FIFO behind it).<br />
<br />
<br />
== DSi SD/MMC I/O Ports: Interrupt/Status ==<br />
<br />
'''400481Ch - SD_IRQ_STATUS0-1 - Interrupt Status (R/ack)'''<br><br />
'''4004A1Ch - SDIO_IRQ_STATUS0-1 - Interrupt Status (R/ack)'''<br><br />
'''4004820h - SD_IRQ_MASK0-1 - Interrupt Mask (R/W)'''<br><br />
'''4004A20h - SDIO_IRQ_MASK0-1 - Interrupt Mask (R/W)'''<br><br />
IRQ Status (0=ack, 1=request)<br><br />
IRQ Mask (0=Enable, 1=Disable)<br><br />
Bit Stat Mask Function<br />
0 SREP MREP CMDRESPEND (response end) (or R1b: busy end)<br />
1 ? - Unknown/unused/undoc<br />
2 SRWA MRWA DATAEND (is NOT set? after data read/write end bit)<br />
3 SCOT MCOT CARD_REMOVE ;\SD only (not SDIO)<br />
4 SCIN MCIN CARD_INSERT ;/<br />
5 undoc - SIGSTATE card/type/signal/signature detect?<br />
6 ? - Unknown/unused/undoc maybe card-detect switch?<br />
7 undoc - WRPROTECT probably write-protect switch<br />
8 undoc undoc CARD_REMOVE_A ;\<br />
9 undoc undoc CARD_INSERT_A ; uh, somewhat dupes of bit3-5?<br />
10 undoc - SIGSTATE_A ;/<br />
11 ? - Unknown/unused/undoc<br />
12 ? - Unknown/unused/undoc<br />
13 ? - Unknown/unused/undoc<br />
14 ? - Unknown/unused/undoc<br />
15 ? - Unknown/unused/undoc<br />
16 SCIX MCIX CMD_IDX_ERR Bad CMD-index in response (RCMDE,SCMDE)<br />
17 SCRC MCRC CRCFAIL CRC response error (WCRCE,RCRCE,SCRCE,CCRCE)<br />
18 SEND MEND STOPBIT_ERR End bit error (WEBER,REBER,SEBER,CEBER)<br />
19 SDTO MDTO DATATIMEOUT Data Timeout (NRCS,NWCS,KBSY)<br />
20 SFOF MFOF RXOVERFLOW HOST tried write full<br />
21 SFUF MFUF TXUNDERRUN HOST tried read empty<br />
22 SCTO MCTO CMDTIMEOUT Response start-bit timeout (NRS,NSR)<br />
23 ? - Unknown/unused/undoc<br />
24 SBRE MBRE RXRDY (fifo not empty) (request data read)<br />
25 SBWE MBWE TXRQ (datafifoempty?) (request data write)<br />
26 ? - Unknown/unused/undoc<br />
27 undoc undoc Unknown/used?! (the bit is mask-able in IRQ_MASK)<br />
28 ? - Unknown/unused/undoc<br />
29 undoc - DSi: Unknown/can be 1 (not exactly like below Toshiba specs)<br />
(29) ILFSL IFSMSK Toshiba: ILL_FUNC Illegal SDIO Function ;SDIO only (not SD)<br />
30 undoc - CMD_BUSY<br />
31 ILA IMSK Illegal Command Access (old CMD still busy, or wrong NTDT)<br />
Acknowledge by STAT=0, or by MASK=1 (uh, really?), or by soft reset (SRST=0) or<br />
hard reset.<br><br />
The Insert/Remove bits (bit3,4, and maybe also bit8,9) exist in the "SD"<br />
registers only, not in the "SDIO" registers (the bits should be treated as<br />
general insert/remove flags though, no matter if the card is an SD or SDIO<br />
card).<br><br />
Bit29 is SDIO related, and exist in SDIO registers only, not in SD registers.<br />
4004820h can be 8B7F031Dh<br />
4004A20h can be 8B7F031Dh<br />
<br />
<br />
'''4004900h - SD_DATA32_IRQ'''<br><br />
'''4004B00h - SDIO_DATA32_IRQ'''<br><br />
15-13 Unknown/unused (appears to be always zero)<br />
12 Unknown (paired with bit9) (can be set) IRQ enable ?! (R/W?)<br />
11 Unknown (paired with bit8) (can be set) IRQ enable ?! (R/W?)<br />
10 Unknown (read=0) write: (0=No change, 1=Clear Bit8,9) ? (W?)<br />
9 Unknown (paired with bit12) (automatically cleared after...) (R?)<br />
8 Unknown (paired with bit11) (R?)<br />
7-2 Unknown (0)<br />
1 Unknown (can be set) (autoclear bit8,9 on xfer end?) (R/W?)<br />
0 Unknown (0)<br />
Can be 1A02h, but changes to 1802h after reading from somewhere (maybe from<br />
DATA32_FIFO?).<br><br />
Bit8,9 seem to be whatever extra IRQ flags, the flags get set ONLY in DATA32<br />
mode (not in DATA16 mode).<br />
<br />
<br />
'''400482Ch - SD_ERROR_DETAIL_STATUS0-1 - Error Detail Status'''<br><br />
'''4004A2Ch - SDIO_ERROR_DETAIL_STATUS0-1 - Error Detail Status'''<br><br />
31-23 ? Unknown/unused/undoc<br />
22 KBSY Timeout for CRC status busy timeout ;\STAT.19<br />
21 NWCS Timeout for CRC status timeout ; (SDTO)<br />
20 NRCS Timeout for Data start-bit, or for Post Data Busy ;/<br />
19-18 ? Unknown/unused/undoc<br />
17 NRS Response timeout for auto-issued CMD12 ;\STAT.22<br />
16 NCR Response timeout for non-auto-issued CMD's ;/(SCTO)<br />
15-14 ? Unknown/unused/undoc<br />
13 ?? Unknown/undoc (bit13 can be nonzero on DSi!)<br />
12 ? Unknown/unused/undoc<br />
11 WCRCE CRC error for Write CRC status for a write command ;\<br />
10 RCRCE CRC error for read data ; STAT.17<br />
9 SCRCE CRC error for a response for auto-issued CMD12 ; (SCRC)<br />
8 CCRCE CRC error for a response for non-auto-issued CMD's ;/<br />
5 WEBER End bit error for Write CRC status ;\<br />
4 REBER End bit error for read data ; STAT.18<br />
3 SEBER End bit error for response for auto-issued CMD12 ; (SEND)<br />
2 CEBER End bit error for response for non-auto-issued CMD's ;/<br />
1? SCMDE Bad CMD-index in response of auto-issued CMD12 ;\STAT.16<br />
0 RCMDE Bad CMD-index in response of non-auto-issued CMD's ;/(SCIX)<br />
Unknown if/when/how the error bits can be reset/acknowledged.<br><br />
Note: CMD12 is STOP_TRANSMISSION (maybe sent after BLK_COUNT?).<br><br />
The four "auto-issued CMD12" bits exist for SD registers only (not SDIO).<br />
SCMDE is probably in bit1 (though, official specs say bit0, which would be same<br />
as RCMDE).<br />
<br />
<br />
'''4004A36h - DSi: 0000 - SDCTL_CARD_INTERRUPT_CONTROL'''<br><br />
This does NOT seem to be implemented as described below on DSi.<br />
4004A36h does seem to behave more like 4004836h, see there.<br />
15-13 ? Unknown (zero on DSi)<br />
12 CINT0 SDIO Interrupt Flag (0=none, 1=irq) (/IRQ aka Data1 pin)<br />
11-9 ? Unknown (zero on DSi)<br />
8 CIMSK0 SDIO Interrupt Mask (0=enable, 1=disable) (/IRQ aka Data1 pin)<br />
7-0 ? Unknown (zero on DSi)<br />
Acknowledge by writing CINT0=0, or CIMSK0=1, or hard reset (unlike as for other<br />
SD/MMC interrupts, soft reset does not acknowlege this interrupt type?).<br />
<br />
== DSi SD/MMC I/O Ports: Control ==<br />
<br />
'''4004802h - SD_CARD_PORT_SELECT (0201h)'''<br><br />
'''4004A02h - SDIO_CARD_PORT_SELECT (0100h)'''<br><br />
15-11 Unknown/unused (appears to be always zero)<br />
10 Unknown (write: should be 1, read: usually/always 0) (W?)<br />
9 Unknown (write: should be 0, read: usually 1 for SD)<br />
8 Unknown (write: should be 0, read: usually 1 for SDIO)<br />
7-4 Unknown/unused (appears to be always zero)<br />
3-1 Unknown (R/W)<br />
0 Port Select (0=SD Card Slot, 1=Onboard eMMC) (for SDIO: Unknown)<br />
Known written values are 0400h and 0401h (SD). However known read values are<br />
0201h (SD) and 0100h (SDIO).<br />
<br />
<br />
'''4004828h - DSi: 40E0 - SD_CARD_OPTION - Memory Card Option Setup'''<br><br />
'''4004A28h - DSi: 40EE - SDIO_CARD_OPTION - Card Option Setup'''<br><br />
15 Bus Width (0=4bit, 1=1bit)<br />
14 Unknown (usually set)<br />
13-8 Unknown/unused (appears to be always zero)<br />
7-4 Unknown, maybe some 4bit timing/timeout value<br />
0-3 Unknown, maybe another 4bit timing/timeout value<br />
Settings spotted on DSi are 40E0h,40EEh.<br><br />
Among others, this register should contain a 4bit timeout setting, "RTO[3:0]<br />
for SD (aka TO[3:0] for SDIO) timeout period for data start/busy bits, in the<br />
form of a multiple number of the SDCLK period."<br><br />
Maybe also selects transfer CLK rate, or whatever.<br />
<br />
<br />
'''4004834h - DSi: 0000 - SD_TRANSACTION_CTL - Transaction Control'''<br><br />
'''4004A34h - DSi: 0000 - SDIO_TRANSACTION_CTL - Transaction Control'''<br><br />
15-10 Unknown/unused (appears to be always zero)<br />
9-8 Unknown<br />
7-3 Unknown/unused (appears to be always zero)<br />
2 Unknown<br />
1 Unknown/unused (appears to be always zero)<br />
0 Unknown<br />
Maybe also selects transfer CLK rate, or whatever.<br />
<br />
<br />
'''40048E0h - DSi: 0007 - SD_SOFT_RESET - Software Reset'''<br><br />
'''4004AE0h - DSi: 0006 - SDIO_SOFT_RESET - Software Reset'''<br><br />
15-3 Unknown/unused (appears to be always zero)<br />
2 ? Unknown (can be nonzero on DSi)<br />
1 ? Unknown (can be nonzero on DSi)<br />
0 SRST Soft Reset (0=Reset, 1=Release)<br />
Software should apply reset after sensing card insertion/removal, and<br />
(thereafter) release reset in case of card insertion. Software reset does<br />
acknowledge all IRQs (except that from SDIO /IRQ pin?), and does probably also<br />
reinitialize some other registers.<br />
<br />
<br />
'''4004808h - DSi: 0100 - SDCTL_STOP_INTERNAL_ACTION'''<br><br />
15-9 Unknown/unused (appears to be always zero)<br />
8 Unknown<br />
7-1 Unknown/unused (appears to be always zero)<br />
0 Unknown<br />
Stop whatever internal action for whatever purpose in whatever situation?<br><br />
Existing code does set bit8 (prior to changing SD_DATA16_BLK_COUNT).<br><br />
Existing code does clear bit0 (alongsides with IRQ enable/acknowlege or so).<br />
<br />
<br />
'''4004824h - DSi: 0000 - DSi: Used? - SDCTL_CARD_CLK_CTL Card Clock Control'''<br><br />
Can be max 07FFh on DSi... ie. bit15 CANNOT be set?<br />
15 Disable HCLK divider (0=SDCLK selected via bit7-0, 1=SDCLK=HCLK)<br />
14-10 Unknown (zero on DSi)<br />
9 Unknown (set in some cases on DSi)<br />
8 Unknown (1=Start Clock, or Apply Clock Change, or so?)<br />
7-0 HCLK Div (0,1,2,4,8,10h,20h,40h,80h = Div2,4,8,16,32,64,128,256,512)<br />
Clock supply to SD Card<br><br />
The SDCLK signal is used for a provision of SD Memory Card or SDIO Card. Please<br />
refer to the following setting for enabling the SDCLK output.<br />
(1) Set Stop Clock Control Register (Config Offset:40h) to 1Fh.<br />
(2) Set D0 of SD Software Reset Register (Offset:0E0h) to 1b.<br />
(3) Set D7-0 of SD Card Clock Control Register (Offset:024h). These bits<br />
are used for setting the frequency of SDCLK.<br />
80h : SDCLK=HCLK/512<br />
40h : SDCLK=HCLK/256<br />
20h : SDCLK=HCLK/128<br />
10h : SDCLK=HCLK/64<br />
08h : SDCLK=HCLK/32<br />
04h : SDCLK=HCLK/16<br />
02h : SDCLK=HCLK/8<br />
01h : SDCLK=HCLK/4<br />
00h : SDCLK=HCLK/2<br />
In addition, TC6387XB holds a function that SDCLK can have same<br />
frequency as HCLK. In this case, D7-0 settings of SD Card Clock Control<br />
Register (Offset:024h) becomes invalid setting.<br />
* Set D0 of Clock Mode Register (Config Offset:42h) to 1b.<br />
* Set D15 of SD Card Clock Control Register (Offset:024h) to 1b.<br />
Please attend that the specification of SDCLK is max.25MHz at the case<br />
of SD Card and is max.20MHz at the case of MultiMedia Card.<br />
(4) D8 of SD Card Clock Control Register (Offset:024h) to 1b.<br />
(5) D8 of Clock & Wait Control Register (Offset:138h) to 1b.<br />
On the DSi, HCLK seems to be 33.513982 MHz.<br />
<br />
<br />
'''4004x38h - DSi: 0000 - SDCTL_CLK_AND_WAIT_CTL'''<br><br />
15-0 Unknown (zero on DSi)<br />
Maybe transfer CLK rate, or some master clock control for the clock input.<br />
<br />
<br />
'''4004x3Ah - DSi: 0000 - SDCTL_SDIO_HOST_INFORMATION'''<br><br />
'''4004x3Ch - DSi: 0000 - SDCTL_ERROR_CONTROL'''<br><br />
'''4004x3Eh - DSi: 0000 - SDCTL_SDLED_CONTROL - LED Control (TC6387XB only)'''<br><br />
15-0 Unknown (zero on DSi)<br />
<br />
<br />
'''40048E2h - DSi: 0009 - SDCTL_RESERVED2 (TC6371AF:CORE_REV)'''<br><br />
'''40048E6h - DSi: 0000 - SDCTL_RESERVED3 (TC6371AF:BUF_ADR)'''<br><br />
'''40048E8h - DSi: 0000 - UNDOC/UNUSED (TC6371AF:Resp_Header)'''<br><br />
'''40048F6h - DSi: 0000 - SDCTL_RESERVED4 --- used by DSi !!!'''<br><br />
'''40048F8h - DSi: 0004 - SDCTL_RESERVED5 <-- DSi: SD only (not SDIO)'''<br><br />
'''40048FAh - DSi: 0007 - SDCTL_RESERVED6 <-- DSi: SD only (not SDIO)'''<br><br />
'''40048FCh - DSi: 00FC - SDCTL_RESERVED7'''<br><br />
'''40048FEh - DSi: 00FF - SDCTL_RESERVED8 (TC6371AF:Revision)'''<br><br />
'''4004xE2h - DSi: 0000 - SDCTL_RESERVED9'''<br><br />
'''4004xF0h - DSi: 0000 - SDCTL_RESERVED10'''<br><br />
'''4004836h - DSi: 0002 - UNDOC! (bit1 can be set, other bits always 0)'''<br><br />
15-0 Unknown<br />
<br />
<br />
'''4004838h/4004A38h - DSi: C007 - UNDOC!'''<br><br />
'''4004840h/4004A40h - DSi: 003F - UNDOC?'''<br><br />
'''4004842h/4004A42h - DSi: 002A - UNDOC?'''<br><br />
'''40048B2h/4004AB2h - DSi: FFFF - UNDOC?'''<br><br />
'''40048BAh/4004ABAh - DSi: 0200 - UNDOC?'''<br><br />
'''40048F4h/4004AF4h - DSi: 0700 - UNDOC!'''<br><br />
15-0 Unknown</div>Nocashhttps://dsibrew.org/w/index.php?title=SD/MMC/SDIO_Registers&diff=2098804SD/MMC/SDIO Registers2015-08-25T00:24:31Z<p>Nocash: Created page with "== DSi SD/MMC I/O Ports: Command/Param/Response/Data == '''4004800h - SD_CMD - Command and Response/Data Type (R/W)'''<br> '''4004A00h - SDIO_CMD - Command and Response/Data Typ..."</p>
<hr />
<div>== DSi SD/MMC I/O Ports: Command/Param/Response/Data ==<br />
<br />
'''4004800h - SD_CMD - Command and Response/Data Type (R/W)'''<br><br />
'''4004A00h - SDIO_CMD - Command and Response/Data Type (R/W)'''<br><br />
15 undoc Unknown/undoc (read/write-able)<br />
14 undoc Security Cmd (0=Normal, 1=Whatever/Security) (sdio?)<br />
13 undoc Data Length (0=Single Block, 1=Multiple Blocks)<br />
12 undoc Data Direction (0=Write, 1=Read)<br />
11 NTDT Data Transfer (0=No data, 1=With data)<br />
10-8 REP2-0 Response Type (0..2=Unknown/Reserved, 3=None, 4=48bit,<br />
5=48bit+Busy, 6=136bit, 7=48bitOcrWithoutCRC7)<br />
7-6 CMD1-0 Command Type (0=CMD, 1=ACMD, 2..3=unknown, maybe GEN WR/RD?)<br />
5-0 CIX Command Index (0..3Fh, command index)<br />
Invalid values can cause ILA error (particulary on setting NTDT for CMD12, or<br />
for CMD's Response=None). ILA error will also occur if an old CMD is still<br />
busy.<br />
DSi software is always writing just ZERO to bit11-6 though? Maybe the hardware<br />
does automatically know which SD/MMC CMDs and ACMDs have data? Or maybe data is<br />
always automatically transferred when receiving a data-startbit, or when<br />
writing to data register - and bits like NTDT would be needed only for things<br />
like proper data timeout handling?<br />
<br />
<br />
'''4004804h - SD_CMD_PARAM0-1 - Argument (32bit, 2 halfwords) (R/W)'''<br><br />
'''4004A04h - SDIO_CMD_PARAM0-1 - Argument (32bit, 2 halfwords) (R/W)'''<br><br />
31-0 Parameter value for CMD<br />
The parameter value should be written <before> sending the command via<br />
SD_CMD/SDIO_CMD.<br />
<br />
<br />
'''400480Ch - SD_RESPONSE0-7 - Response (128bit, 8 halfwords) (R)'''<br><br />
'''4004A0Ch - SDIO_RESPONSE0-7 - Response (128bit, 8 halfwords) (R)'''<br><br />
After sending a command, wait for the CMDRESPEND bit (IRQ_STATUS.bit0) to get<br />
set, then read the RESPONSE (if the command does have any response).<br />
For normal 32bit responses:<br />
31-0 Response<br />
127-32 Older Responses<br />
For CID/CSD responses:<br />
119-0 120bit Response<br />
127-120 Zero (always?)<br />
Seems to be left-shifted when receiving response bits. So, for 32bit responses,<br />
bit0-31 would contain the current response, and bit32-127 would contain older<br />
responses.<br />
<br />
<br />
'''DATA16 vs DATA32'''<br><br />
Data can be transferred in 16bit or 32bit units (as selected in DATA_CTL.bit1).<br />
There are separate data, block len, and block count registers for 16bit and<br />
32bit mode (that's probably due to some odd patchwork, where the manufacturer<br />
has added 32bit support to the original 16bit chip design).<br />
Naturally, a 32bit transfer is faster than two 16bit transfers. Nethertheless,<br />
the DSi firmware does use both 32bit and 16bit mode once and then; 32bit mode<br />
is required for NDMA transfers (which don't support 16bit).<br />
<br />
'''40048D8h - SD_DATA_CTL'''<br><br />
'''4004AD8h - SDIO_DATA_CTL'''<br><br />
15-13 Unknown (usually 0)<br />
12 Unknown (usually 1) (R?)<br />
11-6 Unknown (usually 0)<br />
5 Unknown (R/W?) (R/W?)<br />
4 Unknown (usually 1) (R?)<br />
3-2 Unknown (usually 0)<br />
1 Select 16bit/32bit Data Mode (0=DATA16, 1=DATA32) (R/W?)<br />
0 Unknown (usually 0)<br />
Known written values are 0000h and 0002h. However, known read values are 1010h<br />
and 1012h.<br />
<br />
<br />
'''400480Ah - SD_DATA16_BLK_COUNT - "Transfer Sector Count" (R/W)'''<br><br />
'''4004908h - SD_DATA32_BLK_COUNT (R/W)'''<br><br />
'''4004A0Ah - SDIO_DATA16_BLK_COUNT - "Transfer Block Count" (R/W)'''<br><br />
'''4004B08h - SDIO_DATA32_BLK_COUNT (R/W)'''<br><br />
15-0 Number of Data Blocks for multiple read/write commands<br />
Can be max FFFFh. The DATA32_BLK_COUNT value decreases after reading from<br />
somewhere (maybe from DATA32_FIFO?).<br />
<br />
<br />
'''4004826h - SD_DATA16_BLK_LEN - Memory Card Transfer Data Length (R/W)'''<br><br />
'''4004904h - SD_DATA32_BLK_LEN (R/W)'''<br><br />
'''4004A26h - SDIO_DATA16_BLK_LEN - Card Transfer Data Length (R/W)'''<br><br />
'''4004B04h - SDIO_DATA32_BLK_LEN (R/W)'''<br><br />
15-10 Unknown/unused (appears to be always zero)<br />
9-0 Data Block Length in bytes (for DATA16: clipped to max 0200h by hw)<br />
Should be usually 0200h (for 512-byte SD/MMC memory blocks). Other values may<br />
be needed for SDIO functions, or when accessing SSR/SCR/PWD registers via data<br />
transfers.<br />
DATA32_BLK_LEN can be max 3FFh (unlike DATA16_BLK_LEN which is clipped to<br />
max=200h by hardware).<br />
<br />
<br />
'''4004830h - SD_DATA16_FIFO - Data Port (SD_FIFO?)'''<br><br />
'''400490Ch - SD_DATA32_FIFO'''<br><br />
'''4004A30h - SDIO_DATA16_FIFO - Data Port (SD_FIFO?)'''<br><br />
'''4004B0Ch - SDIO_DATA32_FIFO'''<br><br />
For Data16:<br />
15-0 Data (16bit) (...or could it be accessed as 32bit, too?)<br />
For Data32:<br />
31-0 Data (32bit) (...or could it be accessed as 16bit, too?)<br />
Transfer data here (read after RXRDY gets set, or write after TXRQ gets set).<br />
FIFO size is unknown (if there's any FIFO behind it).<br />
<br />
<br />
== DSi SD/MMC I/O Ports: Interrupt/Status ==<br />
<br />
'''400481Ch - SD_IRQ_STATUS0-1 - Interrupt Status (R/ack)'''<br><br />
'''4004A1Ch - SDIO_IRQ_STATUS0-1 - Interrupt Status (R/ack)'''<br><br />
'''4004820h - SD_IRQ_MASK0-1 - Interrupt Mask (R/W)'''<br><br />
'''4004A20h - SDIO_IRQ_MASK0-1 - Interrupt Mask (R/W)'''<br><br />
IRQ Status (0=ack, 1=request)<br><br />
IRQ Mask (0=Enable, 1=Disable)<br><br />
Bit Stat Mask Function<br />
0 SREP MREP CMDRESPEND (response end) (or R1b: busy end)<br />
1 ? - Unknown/unused/undoc<br />
2 SRWA MRWA DATAEND (is NOT set? after data read/write end bit)<br />
3 SCOT MCOT CARD_REMOVE ;\SD only (not SDIO)<br />
4 SCIN MCIN CARD_INSERT ;/<br />
5 undoc - SIGSTATE card/type/signal/signature detect?<br />
6 ? - Unknown/unused/undoc maybe card-detect switch?<br />
7 undoc - WRPROTECT probably write-protect switch<br />
8 undoc undoc CARD_REMOVE_A ;\<br />
9 undoc undoc CARD_INSERT_A ; uh, somewhat dupes of bit3-5?<br />
10 undoc - SIGSTATE_A ;/<br />
11 ? - Unknown/unused/undoc<br />
12 ? - Unknown/unused/undoc<br />
13 ? - Unknown/unused/undoc<br />
14 ? - Unknown/unused/undoc<br />
15 ? - Unknown/unused/undoc<br />
16 SCIX MCIX CMD_IDX_ERR Bad CMD-index in response (RCMDE,SCMDE)<br />
17 SCRC MCRC CRCFAIL CRC response error (WCRCE,RCRCE,SCRCE,CCRCE)<br />
18 SEND MEND STOPBIT_ERR End bit error (WEBER,REBER,SEBER,CEBER)<br />
19 SDTO MDTO DATATIMEOUT Data Timeout (NRCS,NWCS,KBSY)<br />
20 SFOF MFOF RXOVERFLOW HOST tried write full<br />
21 SFUF MFUF TXUNDERRUN HOST tried read empty<br />
22 SCTO MCTO CMDTIMEOUT Response start-bit timeout (NRS,NSR)<br />
23 ? - Unknown/unused/undoc<br />
24 SBRE MBRE RXRDY (fifo not empty) (request data read)<br />
25 SBWE MBWE TXRQ (datafifoempty?) (request data write)<br />
26 ? - Unknown/unused/undoc<br />
27 undoc undoc Unknown/used?! (the bit is mask-able in IRQ_MASK)<br />
28 ? - Unknown/unused/undoc<br />
29 undoc - DSi: Unknown/can be 1 (not exactly like below Toshiba specs)<br />
(29) ILFSL IFSMSK Toshiba: ILL_FUNC Illegal SDIO Function ;SDIO only (not SD)<br />
30 undoc - CMD_BUSY<br />
31 ILA IMSK Illegal Command Access (old CMD still busy, or wrong NTDT)<br />
Acknowledge by STAT=0, or by MASK=1 (uh, really?), or by soft reset (SRST=0) or<br />
hard reset.<br><br />
The Insert/Remove bits (bit3,4, and maybe also bit8,9) exist in the "SD"<br />
registers only, not in the "SDIO" registers (the bits should be treated as<br />
general insert/remove flags though, no matter if the card is an SD or SDIO<br />
card).<br><br />
Bit29 is SDIO related, and exist in SDIO registers only, not in SD registers.<br />
4004820h can be 8B7F031Dh<br />
4004A20h can be 8B7F031Dh<br />
<br />
<br />
'''4004900h - SD_DATA32_IRQ'''<br><br />
'''4004B00h - SDIO_DATA32_IRQ'''<br><br />
15-13 Unknown/unused (appears to be always zero)<br />
12 Unknown (paired with bit9) (can be set) IRQ enable ?! (R/W?)<br />
11 Unknown (paired with bit8) (can be set) IRQ enable ?! (R/W?)<br />
10 Unknown (read=0) write: (0=No change, 1=Clear Bit8,9) ? (W?)<br />
9 Unknown (paired with bit12) (automatically cleared after...) (R?)<br />
8 Unknown (paired with bit11) (R?)<br />
7-2 Unknown (0)<br />
1 Unknown (can be set) (autoclear bit8,9 on xfer end?) (R/W?)<br />
0 Unknown (0)<br />
Can be 1A02h, but changes to 1802h after reading from somewhere (maybe from<br />
DATA32_FIFO?).<br><br />
Bit8,9 seem to be whatever extra IRQ flags, the flags get set ONLY in DATA32<br />
mode (not in DATA16 mode).<br />
<br />
<br />
'''400482Ch - SD_ERROR_DETAIL_STATUS0-1 - Error Detail Status'''<br><br />
'''4004A2Ch - SDIO_ERROR_DETAIL_STATUS0-1 - Error Detail Status'''<br><br />
31-23 ? Unknown/unused/undoc<br />
22 KBSY Timeout for CRC status busy timeout ;\STAT.19<br />
21 NWCS Timeout for CRC status timeout ; (SDTO)<br />
20 NRCS Timeout for Data start-bit, or for Post Data Busy ;/<br />
19-18 ? Unknown/unused/undoc<br />
17 NRS Response timeout for auto-issued CMD12 ;\STAT.22<br />
16 NCR Response timeout for non-auto-issued CMD's ;/(SCTO)<br />
15-14 ? Unknown/unused/undoc<br />
13 ?? Unknown/undoc (bit13 can be nonzero on DSi!)<br />
12 ? Unknown/unused/undoc<br />
11 WCRCE CRC error for Write CRC status for a write command ;\<br />
10 RCRCE CRC error for read data ; STAT.17<br />
9 SCRCE CRC error for a response for auto-issued CMD12 ; (SCRC)<br />
8 CCRCE CRC error for a response for non-auto-issued CMD's ;/<br />
5 WEBER End bit error for Write CRC status ;\<br />
4 REBER End bit error for read data ; STAT.18<br />
3 SEBER End bit error for response for auto-issued CMD12 ; (SEND)<br />
2 CEBER End bit error for response for non-auto-issued CMD's ;/<br />
1? SCMDE Bad CMD-index in response of auto-issued CMD12 ;\STAT.16<br />
0 RCMDE Bad CMD-index in response of non-auto-issued CMD's ;/(SCIX)<br />
Unknown if/when/how the error bits can be reset/acknowledged.<br><br />
Note: CMD12 is STOP_TRANSMISSION (maybe sent after BLK_COUNT?).<br><br />
The four "auto-issued CMD12" bits exist for SD registers only (not SDIO).<br />
SCMDE is probably in bit1 (though, official specs say bit0, which would be same<br />
as RCMDE).<br />
<br />
<br />
'''4004A36h - DSi: 0000 - SDCTL_CARD_INTERRUPT_CONTROL'''<br><br />
This does NOT seem to be implemented as described below on DSi.<br />
4004A36h does seem to behave more like 4004836h, see there.<br />
15-13 ? Unknown (zero on DSi)<br />
12 CINT0 SDIO Interrupt Flag (0=none, 1=irq) (/IRQ aka Data1 pin)<br />
11-9 ? Unknown (zero on DSi)<br />
8 CIMSK0 SDIO Interrupt Mask (0=enable, 1=disable) (/IRQ aka Data1 pin)<br />
7-0 ? Unknown (zero on DSi)<br />
Acknowledge by writing CINT0=0, or CIMSK0=1, or hard reset (unlike as for other<br />
SD/MMC interrupts, soft reset does not acknowlege this interrupt type?).</div>Nocashhttps://dsibrew.org/w/index.php?title=NUS_Downloader/database&diff=2098803NUS Downloader/database2015-08-14T15:36:26Z<p>Nocash: /* Database */ removed space (after commas) otherwise nus downloader crashes</p>
<hr />
<div>Below is the official online database for the NUS Downloader utility (NUSD). If you have additions/corrections to the database, please add them here. NUSD is automatically downloading the data from this wiki page. Don't forget to change the date entry (or try to delete your old xml file in order to get the new database downloaded).<br />
<br />
The NUSD tool allows to download offical DSi firmware/system updates from Nintendo servers to a PC. It can also decrypt the files; this requires a 16-byte file '''dsikey.bin''' containing the DSi's [[Common key]]. The decrypted ".app" files are containing a regular [[DSi Cartridge Header]] (exceptions are non-executable datafiles: [[WiFi Firmware]], [[Version Data]], and [[Nintendo DS Cart Whitelist]]).<br />
<br />
The source code and executable for that utility can be downloaded [http://code.google.com/p/nusdownloader/ here], some how-to-use info can be found [http://wiibrew.org/wiki/NUS_Downloader here]. More titles may be found on [[Title list]] page (although not in the database format).<br />
<br />
==Format==<br />
<br />
The top of the hierarchy is the database tag. Inside of this, there are 2 sub-types. When adding a title, you should chose the category which best represents the title type. They are self explanatory.<br />
<br />
*<DSISYSTEM><br />
*<DSIWARE><br />
<br />
Within the category, the details of the title can be added with the following tags.<br />
<br />
*<name> - The descriptive name of the title<br />
*<titleID> - The title ID of the title. End with XX if the title is region based. Equivalent to [[DSi Cartridge Header|CartHeader[230h]]]<br />
*<version> - The decimal version(s) of the title available on NUS. Equivalent to [[DSi Cartridge Header|CartHeader[01Eh]]] multiplied by 256.<br />
*<region> - The region(s) of the title available on NUS.<br />
*<ticket> - Boolean; whether or not the title has a [[ticket]] available. Tickets are needed for decryption, and are available only for free system files.<br />
*<danger> - A description of why the title could be dangerous to install/tamper with.<br />
<br />
Enough said, here's an example...<br />
<source lang="xml"><br />
<DSISYSTEM><br />
<name>System Menu (Launcher)</name><br />
<titleID>00030017484e41XX</titleID><br />
<version>512,768</version><br />
<region>1,2,5,6,8,10</region><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
</source><br />
<br />
== Database ==<br />
<br />
Here is the latest database available:<br />
<br />
<source lang="xml"><br />
<database v="(08/04/2015)"><!--MM/DD/YYYY--><br />
<DSISYSTEM><br />
<name>System Menu (Launcher)</name><br />
<titleID>00030017484e41XX</titleID><br />
<region>1,2,5,6,8,10</region><br />
<version>256 (Japan),512,768,1024,1280,1536,1792</version><br />
<ticket>true</ticket><br />
<danger>This is the DSi System Menu. Failing to install it properly and intact could result in a brick!</danger><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>System Settings</name><br />
<titleID>00030015484e42XX</titleID><br />
<region>1,2,5,6,8,10</region><br />
<version>512,768</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>WiFi Firmware</name><br />
<titleID>0003000f484e43XX</titleID><br />
<region>0</region><br />
<version>256,512</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>DS Download Play</name><br />
<titleID>00030005484e44XX</titleID><br />
<region>0</region><br />
<version>256</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Pictochat</name><br />
<titleID>00030005484e45XX</titleID><br />
<region>0</region><br />
<version>0</version><br />
<ticket>false</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo DSi Shop</name><br />
<titleID>00030015484e46XX</titleID><br />
<region>1,2,5,6,8,10</region><br />
<version>1536,1792,2048,2304,2560,2816,3072</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo DSi Browser</name><br />
<titleID>00030004484e47XX</titleID><br />
<region>2,5,8,10</region><br />
<version>0,256,512,768</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo DS Cart Whitelist</name><br />
<titleID>0003000f484e48XX</titleID><br />
<region>0</region><br />
<version>256,512,768,1024,1280,1536</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo DSi Camera</name><br />
<titleID>00030005484e49XX</titleID><br />
<region>2,5,8,10</region><br />
<version>256,768,1024</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo Zone</name><br />
<titleID>00030005484e4aXX</titleID><br />
<region>2,5,8,10</region><br />
<version>512,768</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo DSi Sound</name><br />
<titleID>00030005484e4bXX</titleID><br />
<region>2,5,8,10</region><br />
<version>256,512</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Version Data</name><br />
<titleID>0003000f484e4cXX</titleID><br />
<region>1,2,5,6,8,10</region><br />
<version>1 (Japan),2 (Japan),3 (Australia/New Zealand),4 (China),5,6,7,8,9</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo 3DS Transfer Tool</name><br />
<titleID>00030015484e4fXX</titleID><br />
<region>2,5,6,8,10</region><br />
<version>0,256</version><br />
<ticket>false</ticket><br />
</DSISYSTEM><br />
<br />
<DSIWARE><br />
<name>Sudoku</name><br />
<titleID>000300044b3444XX</titleID><br />
<region>2,11</region><br />
<version>0 (EUR/AUS),1 (USA),256 (EUR/AUS),257 (USA)</version><br />
<ticket>false</ticket><br />
</DSIWARE><br />
<DSIWARE><br />
<name>Paper Airplane Chase</name><br />
<titleID>000300044b414dXX</titleID><br />
<region>2,11</region><br />
<ticket>false</ticket><br />
</DSIWARE><br />
<DSIWARE><br />
<name>Flipnote Studio</name><br />
<titleID>000300044b4755XX</titleID><br />
<region>2,5,11</region><br />
<version>0,512 (Japan)</version><br />
<ticket>true</ticket><br />
</DSIWARE><br />
<DSIWARE><br />
<name>Dokodemo Wii no Ma</name><br />
<titleID>000300044B4447XX</titleID><br />
<region>5</region><br />
<version>0,256</version><br />
<ticket>true</ticket><br />
</DSIWARE><br />
<DSIWARE><br />
<name>WarioWare: Snapped!</name><br />
<titleID>000300044b5557XX</titleID><br />
<region>2,11</region><br />
<ticket>false</ticket><br />
</DSIWARE><br />
<REGIONS><br />
<region index="0">41 (All/System)</region><br />
<region index="1">43 (China)</region><br />
<region index="2">45 (USA)</region><br />
<region index="3">48 (Europe, Belgium/Netherlands)</region><br />
<region index="5">4A (Japan)</region><br />
<region index="6">4B (Korea)</region><br />
<region index="7">4F (USA/Europe)</region><br />
<region index="8">50 (Europe)</region><br />
<region index="9">54 (USA/Australia)</region><br />
<region index="10">55 (Australia)</region><br />
<region index="11">56 (Europe/Australia)</region><br />
<region index="12">xx (Unknown)</region><br />
</REGIONS><br />
</database><br />
</source></div>Nocashhttps://dsibrew.org/w/index.php?title=NUS_Downloader/database&diff=2098802NUS Downloader/database2015-08-14T15:31:06Z<p>Nocash: /* Database */ also added US version numbers of sudoku</p>
<hr />
<div>Below is the official online database for the NUS Downloader utility (NUSD). If you have additions/corrections to the database, please add them here. NUSD is automatically downloading the data from this wiki page. Don't forget to change the date entry (or try to delete your old xml file in order to get the new database downloaded).<br />
<br />
The NUSD tool allows to download offical DSi firmware/system updates from Nintendo servers to a PC. It can also decrypt the files; this requires a 16-byte file '''dsikey.bin''' containing the DSi's [[Common key]]. The decrypted ".app" files are containing a regular [[DSi Cartridge Header]] (exceptions are non-executable datafiles: [[WiFi Firmware]], [[Version Data]], and [[Nintendo DS Cart Whitelist]]).<br />
<br />
The source code and executable for that utility can be downloaded [http://code.google.com/p/nusdownloader/ here], some how-to-use info can be found [http://wiibrew.org/wiki/NUS_Downloader here]. More titles may be found on [[Title list]] page (although not in the database format).<br />
<br />
==Format==<br />
<br />
The top of the hierarchy is the database tag. Inside of this, there are 2 sub-types. When adding a title, you should chose the category which best represents the title type. They are self explanatory.<br />
<br />
*<DSISYSTEM><br />
*<DSIWARE><br />
<br />
Within the category, the details of the title can be added with the following tags.<br />
<br />
*<name> - The descriptive name of the title<br />
*<titleID> - The title ID of the title. End with XX if the title is region based. Equivalent to [[DSi Cartridge Header|CartHeader[230h]]]<br />
*<version> - The decimal version(s) of the title available on NUS. Equivalent to [[DSi Cartridge Header|CartHeader[01Eh]]] multiplied by 256.<br />
*<region> - The region(s) of the title available on NUS.<br />
*<ticket> - Boolean; whether or not the title has a [[ticket]] available. Tickets are needed for decryption, and are available only for free system files.<br />
*<danger> - A description of why the title could be dangerous to install/tamper with.<br />
<br />
Enough said, here's an example...<br />
<source lang="xml"><br />
<DSISYSTEM><br />
<name>System Menu (Launcher)</name><br />
<titleID>00030017484e41XX</titleID><br />
<version>512,768</version><br />
<region>1,2,5,6,8,10</region><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
</source><br />
<br />
== Database ==<br />
<br />
Here is the latest database available:<br />
<br />
<source lang="xml"><br />
<database v="(08/03/2015)"><!--MM/DD/YYYY--><br />
<DSISYSTEM><br />
<name>System Menu (Launcher)</name><br />
<titleID>00030017484e41XX</titleID><br />
<region>1,2,5,6,8,10</region><br />
<version>256 (Japan),512,768,1024,1280,1536,1792</version><br />
<ticket>true</ticket><br />
<danger>This is the DSi System Menu. Failing to install it properly and intact could result in a brick!</danger><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>System Settings</name><br />
<titleID>00030015484e42XX</titleID><br />
<region>1,2,5,6,8,10</region><br />
<version>512,768</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>WiFi Firmware</name><br />
<titleID>0003000f484e43XX</titleID><br />
<region>0</region><br />
<version>256,512</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>DS Download Play</name><br />
<titleID>00030005484e44XX</titleID><br />
<region>0</region><br />
<version>256</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Pictochat</name><br />
<titleID>00030005484e45XX</titleID><br />
<region>0</region><br />
<version>0</version><br />
<ticket>false</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo DSi Shop</name><br />
<titleID>00030015484e46XX</titleID><br />
<region>1,2,5,6,8,10</region><br />
<version>1536,1792,2048,2304,2560,2816,3072</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo DSi Browser</name><br />
<titleID>00030004484e47XX</titleID><br />
<region>2,5,8,10</region><br />
<version>0,256,512,768</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo DS Cart Whitelist</name><br />
<titleID>0003000f484e48XX</titleID><br />
<region>0</region><br />
<version>256,512,768,1024,1280,1536</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo DSi Camera</name><br />
<titleID>00030005484e49XX</titleID><br />
<region>2,5,8,10</region><br />
<version>256,768,1024</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo Zone</name><br />
<titleID>00030005484e4aXX</titleID><br />
<region>2,5,8,10</region><br />
<version>512,768</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo DSi Sound</name><br />
<titleID>00030005484e4bXX</titleID><br />
<region>2,5,8,10</region><br />
<version>256,512</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Version Data</name><br />
<titleID>0003000f484e4cXX</titleID><br />
<region>1,2,5,6,8,10</region><br />
<version>1 (Japan),2 (Japan),3 (Australia/New Zealand),4 (China),5,6,7,8,9</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo 3DS Transfer Tool</name><br />
<titleID>00030015484e4fXX</titleID><br />
<region>2,5,6,8,10</region><br />
<version>0,256</version><br />
<ticket>false</ticket><br />
</DSISYSTEM><br />
<br />
<DSIWARE><br />
<name>Sudoku</name><br />
<titleID>000300044b3444XX</titleID><br />
<region>2,11</region><br />
<version>0 (EUR/AUS),1 (USA), 256 (EUR/AUS), 257 (USA)</version><br />
<ticket>false</ticket><br />
</DSIWARE><br />
<DSIWARE><br />
<name>Paper Airplane Chase</name><br />
<titleID>000300044b414dXX</titleID><br />
<region>2,11</region><br />
<ticket>false</ticket><br />
</DSIWARE><br />
<DSIWARE><br />
<name>Flipnote Studio</name><br />
<titleID>000300044b4755XX</titleID><br />
<region>2,5,11</region><br />
<version>0,512 (Japan)</version><br />
<ticket>true</ticket><br />
</DSIWARE><br />
<DSIWARE><br />
<name>Dokodemo Wii no Ma</name><br />
<titleID>000300044B4447XX</titleID><br />
<region>5</region><br />
<version>0,256</version><br />
<ticket>true</ticket><br />
</DSIWARE><br />
<DSIWARE><br />
<name>WarioWare: Snapped!</name><br />
<titleID>000300044b5557XX</titleID><br />
<region>2,11</region><br />
<ticket>false</ticket><br />
</DSIWARE><br />
<REGIONS><br />
<region index="0">41 (All/System)</region><br />
<region index="1">43 (China)</region><br />
<region index="2">45 (USA)</region><br />
<region index="3">48 (Europe, Belgium/Netherlands)</region><br />
<region index="5">4A (Japan)</region><br />
<region index="6">4B (Korea)</region><br />
<region index="7">4F (USA/Europe)</region><br />
<region index="8">50 (Europe)</region><br />
<region index="9">54 (USA/Australia)</region><br />
<region index="10">55 (Australia)</region><br />
<region index="11">56 (Europe/Australia)</region><br />
<region index="12">xx (Unknown)</region><br />
</REGIONS><br />
</database><br />
</source></div>Nocashhttps://dsibrew.org/w/index.php?title=NUS_Downloader/database&diff=2098801NUS Downloader/database2015-08-14T15:26:32Z<p>Nocash: /* Database */ added EUR/AUS version numbers of sudoku</p>
<hr />
<div>Below is the official online database for the NUS Downloader utility (NUSD). If you have additions/corrections to the database, please add them here. NUSD is automatically downloading the data from this wiki page. Don't forget to change the date entry (or try to delete your old xml file in order to get the new database downloaded).<br />
<br />
The NUSD tool allows to download offical DSi firmware/system updates from Nintendo servers to a PC. It can also decrypt the files; this requires a 16-byte file '''dsikey.bin''' containing the DSi's [[Common key]]. The decrypted ".app" files are containing a regular [[DSi Cartridge Header]] (exceptions are non-executable datafiles: [[WiFi Firmware]], [[Version Data]], and [[Nintendo DS Cart Whitelist]]).<br />
<br />
The source code and executable for that utility can be downloaded [http://code.google.com/p/nusdownloader/ here], some how-to-use info can be found [http://wiibrew.org/wiki/NUS_Downloader here]. More titles may be found on [[Title list]] page (although not in the database format).<br />
<br />
==Format==<br />
<br />
The top of the hierarchy is the database tag. Inside of this, there are 2 sub-types. When adding a title, you should chose the category which best represents the title type. They are self explanatory.<br />
<br />
*<DSISYSTEM><br />
*<DSIWARE><br />
<br />
Within the category, the details of the title can be added with the following tags.<br />
<br />
*<name> - The descriptive name of the title<br />
*<titleID> - The title ID of the title. End with XX if the title is region based. Equivalent to [[DSi Cartridge Header|CartHeader[230h]]]<br />
*<version> - The decimal version(s) of the title available on NUS. Equivalent to [[DSi Cartridge Header|CartHeader[01Eh]]] multiplied by 256.<br />
*<region> - The region(s) of the title available on NUS.<br />
*<ticket> - Boolean; whether or not the title has a [[ticket]] available. Tickets are needed for decryption, and are available only for free system files.<br />
*<danger> - A description of why the title could be dangerous to install/tamper with.<br />
<br />
Enough said, here's an example...<br />
<source lang="xml"><br />
<DSISYSTEM><br />
<name>System Menu (Launcher)</name><br />
<titleID>00030017484e41XX</titleID><br />
<version>512,768</version><br />
<region>1,2,5,6,8,10</region><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
</source><br />
<br />
== Database ==<br />
<br />
Here is the latest database available:<br />
<br />
<source lang="xml"><br />
<database v="(08/02/2015)"><!--MM/DD/YYYY--><br />
<DSISYSTEM><br />
<name>System Menu (Launcher)</name><br />
<titleID>00030017484e41XX</titleID><br />
<region>1,2,5,6,8,10</region><br />
<version>256 (Japan),512,768,1024,1280,1536,1792</version><br />
<ticket>true</ticket><br />
<danger>This is the DSi System Menu. Failing to install it properly and intact could result in a brick!</danger><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>System Settings</name><br />
<titleID>00030015484e42XX</titleID><br />
<region>1,2,5,6,8,10</region><br />
<version>512,768</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>WiFi Firmware</name><br />
<titleID>0003000f484e43XX</titleID><br />
<region>0</region><br />
<version>256,512</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>DS Download Play</name><br />
<titleID>00030005484e44XX</titleID><br />
<region>0</region><br />
<version>256</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Pictochat</name><br />
<titleID>00030005484e45XX</titleID><br />
<region>0</region><br />
<version>0</version><br />
<ticket>false</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo DSi Shop</name><br />
<titleID>00030015484e46XX</titleID><br />
<region>1,2,5,6,8,10</region><br />
<version>1536,1792,2048,2304,2560,2816,3072</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo DSi Browser</name><br />
<titleID>00030004484e47XX</titleID><br />
<region>2,5,8,10</region><br />
<version>0,256,512,768</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo DS Cart Whitelist</name><br />
<titleID>0003000f484e48XX</titleID><br />
<region>0</region><br />
<version>256,512,768,1024,1280,1536</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo DSi Camera</name><br />
<titleID>00030005484e49XX</titleID><br />
<region>2,5,8,10</region><br />
<version>256,768,1024</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo Zone</name><br />
<titleID>00030005484e4aXX</titleID><br />
<region>2,5,8,10</region><br />
<version>512,768</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo DSi Sound</name><br />
<titleID>00030005484e4bXX</titleID><br />
<region>2,5,8,10</region><br />
<version>256,512</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Version Data</name><br />
<titleID>0003000f484e4cXX</titleID><br />
<region>1,2,5,6,8,10</region><br />
<version>1 (Japan),2 (Japan),3 (Australia/New Zealand),4 (China),5,6,7,8,9</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo 3DS Transfer Tool</name><br />
<titleID>00030015484e4fXX</titleID><br />
<region>2,5,6,8,10</region><br />
<version>0,256</version><br />
<ticket>false</ticket><br />
</DSISYSTEM><br />
<br />
<DSIWARE><br />
<name>Sudoku</name><br />
<titleID>000300044b3444XX</titleID><br />
<region>2,11</region><br />
<version>0,256</version><br />
<ticket>false</ticket><br />
</DSIWARE><br />
<DSIWARE><br />
<name>Paper Airplane Chase</name><br />
<titleID>000300044b414dXX</titleID><br />
<region>2,11</region><br />
<ticket>false</ticket><br />
</DSIWARE><br />
<DSIWARE><br />
<name>Flipnote Studio</name><br />
<titleID>000300044b4755XX</titleID><br />
<region>2,5,11</region><br />
<version>0,512 (Japan)</version><br />
<ticket>true</ticket><br />
</DSIWARE><br />
<DSIWARE><br />
<name>Dokodemo Wii no Ma</name><br />
<titleID>000300044B4447XX</titleID><br />
<region>5</region><br />
<version>0,256</version><br />
<ticket>true</ticket><br />
</DSIWARE><br />
<DSIWARE><br />
<name>WarioWare: Snapped!</name><br />
<titleID>000300044b5557XX</titleID><br />
<region>2,11</region><br />
<ticket>false</ticket><br />
</DSIWARE><br />
<REGIONS><br />
<region index="0">41 (All/System)</region><br />
<region index="1">43 (China)</region><br />
<region index="2">45 (USA)</region><br />
<region index="3">48 (Europe, Belgium/Netherlands)</region><br />
<region index="5">4A (Japan)</region><br />
<region index="6">4B (Korea)</region><br />
<region index="7">4F (USA/Europe)</region><br />
<region index="8">50 (Europe)</region><br />
<region index="9">54 (USA/Australia)</region><br />
<region index="10">55 (Australia)</region><br />
<region index="11">56 (Europe/Australia)</region><br />
<region index="12">xx (Unknown)</region><br />
</REGIONS><br />
</database><br />
</source></div>Nocashhttps://dsibrew.org/w/index.php?title=NUS_Downloader/database&diff=2098800NUS Downloader/database2015-08-14T15:22:21Z<p>Nocash: /* Database */ added EUR/AUS version of sudoku</p>
<hr />
<div>Below is the official online database for the NUS Downloader utility (NUSD). If you have additions/corrections to the database, please add them here. NUSD is automatically downloading the data from this wiki page. Don't forget to change the date entry (or try to delete your old xml file in order to get the new database downloaded).<br />
<br />
The NUSD tool allows to download offical DSi firmware/system updates from Nintendo servers to a PC. It can also decrypt the files; this requires a 16-byte file '''dsikey.bin''' containing the DSi's [[Common key]]. The decrypted ".app" files are containing a regular [[DSi Cartridge Header]] (exceptions are non-executable datafiles: [[WiFi Firmware]], [[Version Data]], and [[Nintendo DS Cart Whitelist]]).<br />
<br />
The source code and executable for that utility can be downloaded [http://code.google.com/p/nusdownloader/ here], some how-to-use info can be found [http://wiibrew.org/wiki/NUS_Downloader here]. More titles may be found on [[Title list]] page (although not in the database format).<br />
<br />
==Format==<br />
<br />
The top of the hierarchy is the database tag. Inside of this, there are 2 sub-types. When adding a title, you should chose the category which best represents the title type. They are self explanatory.<br />
<br />
*<DSISYSTEM><br />
*<DSIWARE><br />
<br />
Within the category, the details of the title can be added with the following tags.<br />
<br />
*<name> - The descriptive name of the title<br />
*<titleID> - The title ID of the title. End with XX if the title is region based. Equivalent to [[DSi Cartridge Header|CartHeader[230h]]]<br />
*<version> - The decimal version(s) of the title available on NUS. Equivalent to [[DSi Cartridge Header|CartHeader[01Eh]]] multiplied by 256.<br />
*<region> - The region(s) of the title available on NUS.<br />
*<ticket> - Boolean; whether or not the title has a [[ticket]] available. Tickets are needed for decryption, and are available only for free system files.<br />
*<danger> - A description of why the title could be dangerous to install/tamper with.<br />
<br />
Enough said, here's an example...<br />
<source lang="xml"><br />
<DSISYSTEM><br />
<name>System Menu (Launcher)</name><br />
<titleID>00030017484e41XX</titleID><br />
<version>512,768</version><br />
<region>1,2,5,6,8,10</region><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
</source><br />
<br />
== Database ==<br />
<br />
Here is the latest database available:<br />
<br />
<source lang="xml"><br />
<database v="(08/01/2015)"><!--MM/DD/YYYY--><br />
<DSISYSTEM><br />
<name>System Menu (Launcher)</name><br />
<titleID>00030017484e41XX</titleID><br />
<region>1,2,5,6,8,10</region><br />
<version>256 (Japan),512,768,1024,1280,1536,1792</version><br />
<ticket>true</ticket><br />
<danger>This is the DSi System Menu. Failing to install it properly and intact could result in a brick!</danger><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>System Settings</name><br />
<titleID>00030015484e42XX</titleID><br />
<region>1,2,5,6,8,10</region><br />
<version>512,768</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>WiFi Firmware</name><br />
<titleID>0003000f484e43XX</titleID><br />
<region>0</region><br />
<version>256,512</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>DS Download Play</name><br />
<titleID>00030005484e44XX</titleID><br />
<region>0</region><br />
<version>256</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Pictochat</name><br />
<titleID>00030005484e45XX</titleID><br />
<region>0</region><br />
<version>0</version><br />
<ticket>false</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo DSi Shop</name><br />
<titleID>00030015484e46XX</titleID><br />
<region>1,2,5,6,8,10</region><br />
<version>1536,1792,2048,2304,2560,2816,3072</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo DSi Browser</name><br />
<titleID>00030004484e47XX</titleID><br />
<region>2,5,8,10</region><br />
<version>0,256,512,768</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo DS Cart Whitelist</name><br />
<titleID>0003000f484e48XX</titleID><br />
<region>0</region><br />
<version>256,512,768,1024,1280,1536</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo DSi Camera</name><br />
<titleID>00030005484e49XX</titleID><br />
<region>2,5,8,10</region><br />
<version>256,768,1024</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo Zone</name><br />
<titleID>00030005484e4aXX</titleID><br />
<region>2,5,8,10</region><br />
<version>512,768</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo DSi Sound</name><br />
<titleID>00030005484e4bXX</titleID><br />
<region>2,5,8,10</region><br />
<version>256,512</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Version Data</name><br />
<titleID>0003000f484e4cXX</titleID><br />
<region>1,2,5,6,8,10</region><br />
<version>1 (Japan),2 (Japan),3 (Australia/New Zealand),4 (China),5,6,7,8,9</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo 3DS Transfer Tool</name><br />
<titleID>00030015484e4fXX</titleID><br />
<region>2,5,6,8,10</region><br />
<version>0,256</version><br />
<ticket>false</ticket><br />
</DSISYSTEM><br />
<br />
<DSIWARE><br />
<name>Sudoku</name><br />
<titleID>000300044b3444XX</titleID><br />
<region>2,11</region><br />
<ticket>false</ticket><br />
</DSIWARE><br />
<DSIWARE><br />
<name>Paper Airplane Chase</name><br />
<titleID>000300044b414dXX</titleID><br />
<region>2,11</region><br />
<ticket>false</ticket><br />
</DSIWARE><br />
<DSIWARE><br />
<name>Flipnote Studio</name><br />
<titleID>000300044b4755XX</titleID><br />
<region>2,5,11</region><br />
<version>0,512 (Japan)</version><br />
<ticket>true</ticket><br />
</DSIWARE><br />
<DSIWARE><br />
<name>Dokodemo Wii no Ma</name><br />
<titleID>000300044B4447XX</titleID><br />
<region>5</region><br />
<version>0,256</version><br />
<ticket>true</ticket><br />
</DSIWARE><br />
<DSIWARE><br />
<name>WarioWare: Snapped!</name><br />
<titleID>000300044b5557XX</titleID><br />
<region>2,11</region><br />
<ticket>false</ticket><br />
</DSIWARE><br />
<REGIONS><br />
<region index="0">41 (All/System)</region><br />
<region index="1">43 (China)</region><br />
<region index="2">45 (USA)</region><br />
<region index="3">48 (Europe, Belgium/Netherlands)</region><br />
<region index="5">4A (Japan)</region><br />
<region index="6">4B (Korea)</region><br />
<region index="7">4F (USA/Europe)</region><br />
<region index="8">50 (Europe)</region><br />
<region index="9">54 (USA/Australia)</region><br />
<region index="10">55 (Australia)</region><br />
<region index="11">56 (Europe/Australia)</region><br />
<region index="12">xx (Unknown)</region><br />
</REGIONS><br />
</database><br />
</source></div>Nocashhttps://dsibrew.org/w/index.php?title=Title_database&diff=2098799Title database2015-08-14T15:16:28Z<p>Nocash: /* Europe */ fixed edit from 28 jan 2011: sudoku US-version isn't used in europe (obviously)</p>
<hr />
<div>The Nintendo DSi uses the same title scheme and introduces separate DSi update servers; Also introduced was a new common-key for DSi title decryption. <br />
<br />
As with the Wii, the [[title metadata]] aka "TMD" for these titles can be found on the Nintendo Update Servers.<br />
<br />
Each title specific url uses a 4 ASCII character code denoting what type of title it is and what region it comes from.<br />
<br />
Titles can be downloaded and decrypted with [http://wiibrew.org/wiki/NUS_Downloader NUS Downloader], a program that allows titles to be fetched from the Nintendo Update Servers.<br />
<br />
== Title codes ==<br />
<br />
=== Region Codes ===<br />
<br />
Region codes are used to determine what region a title belongs to. They are at the end of a Title ID. Eg. XXXA, XXXJ<br />
<br />
{| class="wikitable sortable" width="55%"<br />
|-<br />
! ASCII<br />
! HEX<br />
! Region<br />
|-<br />
| A<br />
| 41<br />
| Region Independent<br />
|-<br />
| C<br />
| 43<br />
| China<br />
|-<br />
| E<br />
| 45<br />
| North America<br />
|-<br />
| H<br />
| 48<br />
| Belgium / Netherlands (DSiWare Only)<br />
|-<br />
| J<br />
| 4A<br />
| Japan<br />
|-<br />
| K<br />
| 4B<br />
| Korea<br />
|-<br />
| O<br />
| 4F<br />
| Unknown<br />
|-<br />
| P<br />
| 50<br />
| Australia and other PAL regions (System and DSiWare)<br />
|-<br />
| T<br />
| 54<br />
| Unknown<br />
|-<br />
| U<br />
| 55<br />
| Australia and New Zealand<br />
|-<br />
| V<br />
| 56<br />
| Europe (DSiWare Only)<br />
|-<br />
| X<br />
| 58<br />
| Unknown<br />
|}<br />
<br />
=== System Codes ===<br />
<br />
System codes are used to determine what type of title it is. They are at the beginning of a Title ID. Eg. KXXX. HXXX<br />
<br />
{| class="wikitable sortable" width="50%"<br />
|-<br />
! ASCII<br />
! HEX<br />
! Type<br />
|-<br />
| K<br />
| 4B<br />
| DSiWare Title<br />
|-<br />
| H<br />
| 48<br />
| System \ Channel<br />
|}<br />
<br />
== Title Database ==<br />
<br />
=== DSiWare (00030004) ===<br />
<br />
DSiWare is an online service available on the [[Nintendo DSi Shop]] to download DSi applications.<br />
<br />
==== Europe ====<br />
<br />
The official list of DSi Ware Europe titles is located on [http://www.nintendo.co.uk/NOE/en_GB/games/nintendo_dsiware_11805.html the Nintendo Europe website -- (broken link)]. An inofficial list is at [http://en.wikipedia.org/wiki/List_of_DSiWare_games_(PAL_region) wikipedia].<br />
<br />
{| class="wikitable sortable" width="100%"<br />
|-<br />
! Type<br />
! Title ID<br />
! Name<br />
! Price<br />
|-<br />
| Game<br />
| KNRV (4B4E5256)<br />
| A Little Bit of... Brain Training™: Maths Edition<br />
| 800 Nintendo Points<br />
|-<br />
| Game<br />
| KD9V (4B443956)<br />
| A Little Bit of... Dr. Mario™<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KM9P (4B4D3950)<br />
| A Little Bit of... Magic Made Fun™: Deep Psyche<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KMFP (4B4D4650)<br />
| A Little Bit of... Magic Made Fun™: Funny Face<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KMSP (4B4D5350)<br />
| A Little Bit of... Magic Made Fun™: Shuffle Games<br />
| 200 Nintendo Points<br />
|-<br />
| Application<br />
| KWGV (4B574756)<br />
| [[Nintendo DSi Calculator|Animal Crossing Calculator]]<br />
| 200 Nintendo Points<br />
|-<br />
| Application<br />
| KWCV (4B574356)<br />
| [[Nintendo DSi Clock|Animal Crossing Clock]]<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KAAV (4B414156)<br />
| Art Style: AQUITE<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KADV (4B414456)<br />
| Art Style: CODE<br />
| 500 Nintendo Points<br />
|-<br />
| Application<br />
| KGUV (4B475556)<br />
| Flipnote Studio<br />
| 0 Nintendo Points<br />
|-<br />
| Game<br />
| KAKV (4B414B56)<br />
| Art Style: KuBos<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KASV (4B415356)<br />
| Art Style: NEMREM<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KAPV (4B415056)<br />
| Art Style: PiCOPiCT<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KA4V (4B413456)<br />
| Asphalt 4: Elite Racing<br />
| 800 Nintendo Points<br />
|-<br />
| Game<br />
| KGRV (4B475256)<br />
| Guitar Rock Tour<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KLEV (4B4C4556)<br />
| Legends of Exidia<br />
| 800 Nintendo Points<br />
|-<br />
| Game<br />
| KMMV (4B4D4D56)<br />
| Mixed Message<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KAMV (4B414D56)<br />
| Paper Plane<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KPOV (4B504F56)<br />
| Pop Superstar!: Road to Celebrity<br />
| 800 Nintendo Points<br />
|-<br />
| Game<br />
| KP6V (4B503656)<br />
| Pyoro<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KS9V (4B533956)<br />
| Real Football 2009<br />
| 800 Nintendo Points<br />
|-<br />
| Game<br />
| K4DV (4B344456)<br />
| Sudoku<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KSMV (4B534D56)<br />
| SUDOKU 150! For Challengers<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KUWV (4B555756)<br />
| WarioWare: Snapped!<br />
| 500 Nintendo Points<br />
|}<br />
<br />
==== Japan ====<br />
<br />
The official list of DSi Ware Japan titles is located on [http://www.nintendo.co.jp/ds/dsiware/titlelist.html the Nintendo japanese website]. An inofficial list is at [http://ja.wikipedia.org/wiki/ニンテンドーDSiウェアのタイトル一覧 wikipedia] (in japanese).<br />
<br />
{| class="wikitable sortable" width="100%"<br />
|-<br />
! Type<br />
! Title ID<br />
! Name<br />
! Price<br />
|-<br />
| Game<br />
| KMSJ (4B4D534A)<br />
| 3-tsu no Shuffle Game<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KAAJ (4B41414A)<br />
| Art Style: AQUARIO<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KADJ (4B41444A)<br />
| Art Style: DECODE<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KAPJ (4B41504A)<br />
| Art Style: PICOPICT<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KASJ (4B41534A)<br />
| Art Style: SOMNIUM<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KTPJ (4B54504A)<br />
| Asobi Taizen<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KNRJ (4B4E524A)<br />
| Brain Training - Science version<br />
| 800 Nintendo Points<br />
|-<br />
| Game<br />
| KD9J (4B44394A)<br />
| A Little Bit of... Dr. Mario™<br />
| 500 Nintendo Points<br />
|-<br />
| Application<br />
| KDGJ (4B44474A)<br />
| Dokodemo [http://en.wikipedia.org/wiki/Wii_no_Ma Wiinoma]<br />
| 0 Nintendo Points<br />
|-<br />
| Game<br />
| KMFJ (4B4D464A)<br />
| A Little Bit of... Magic Made Fun™: Funny Face<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KAMJ (4B414D4A)<br />
| Kami Hikouki<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KLEJ (4B4C454A)<br />
| Legends of Exidia<br />
| 800 Nintendo Points<br />
|-<br />
| Game<br />
| KMMJ (4B4D4D4A)<br />
| Mixed Message<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KM9J (4B4D394A)<br />
| Osoroshii Suuji<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KP6J (4B50364A)<br />
| Tori to Mame<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KGUJ (4B47554A)<br />
| Ugoku Memo Chou (Flipnote Studio)<br />
| 0 Nintendo Points<br />
|-<br />
| Game<br />
| KUWJ (4B55574A)<br />
| Utsutsu! Made in Wario<br />
| 500 Nintendo Points<br />
|-<br />
|}<br />
<br />
==== United States ====<br />
<br />
The official list of DSi Ware US titles is located on [http://www.nintendo.com/games/guide#qhardware=DS&qesrbRating=&qplay=dsiware&qgenre=&qrelease=&panel=qplay the Nintendo US website]. An inofficial list is at [http://en.wikipedia.org/wiki/List_of_DSiWare_games_(North_America) wikipedia].<br />
<br />
{| class="wikitable sortable" width="100%"<br />
|-<br />
! Type<br />
! Title ID<br />
! Name<br />
! Price<br />
|-<br />
| Game<br />
| KM9E (4B4D3945)<br />
| A Little Bit of... Magic Made Fun™: Deep Psyche<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KMFE (4B4D4645)<br />
| A Little Bit of... Magic Made Fun™: Funny Face<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KMSE (4B4D5345)<br />
| A Little Bit of... Magic Made Fun™: Shuffle Games<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KAAE (4B414145)<br />
| Art Style: AQUIA<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KP6E (4B503645)<br />
| Bird & Beans<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KD9E (4B443945)<br />
| Dr. Mario Express<br />
| 500 Nintendo Points<br />
|-<br />
| Application<br />
| KGUE (4B475545)<br />
| Flipnote Studio<br />
| 0 Nintendo Points<br />
|-<br />
| Game<br />
| KGRE (4B475245)<br />
| Guitar Rock Tour<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KLEE (4B4C4545)<br />
| Legends of Exidia<br />
| 800 Nintendo Points<br />
|-<br />
| Application<br />
| KWBE (4B574245)<br />
| Mario Calculator<br />
| 200 Nintendo Points<br />
|-<br />
| Application<br />
| KWFE (4B574645)<br />
| Mario Clock<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KDME (4B444D45)<br />
| Mario vs. Donkey Kong: Minis March Again!<br />
| 800 Nintendo Points<br />
|-<br />
| Game<br />
| KMME (4B4D4D45)<br />
| Mixed Message<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KAME (4B414D45)<br />
| Paper Airplane Chase<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KPBE (4B504245)<br />
| Photo Dojo<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KS9E (4B533945)<br />
| Real Football 2009<br />
| 800 Nintendo Points<br />
|-<br />
| Game<br />
| K4DE (4B344445)<br />
| Sudoku<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KUWE (4B555745)<br />
| WarioWare: Snapped!<br />
| 500 Nintendo Points<br />
|}<br />
<br />
==== Australia and New Zealand ====<br />
<br />
An inofficial list is at [http://en.wikipedia.org/wiki/List_of_DSiWare_games_(PAL_region) wikipedia] (with separate columns for Europe and Australia).<br />
<br />
Many titles are released simultaneously for both Europe and Australia (particulary those with "V" as last gamecode character). Some titles are released separately (or exclusively) for Europe and/or Australia (last gamecode character "P" for Europe, and "U" for Australia).<br />
<br />
==== China ====<br />
<br />
Unknown.<br />
<br />
==== Korea ====<br />
<br />
Unknown.<br />
<br />
=== System ===<br />
<br />
System Titles are all system applications or files used by the Nintendo DSi.<br />
<br />
====All Regions====<br />
{| class="wikitable sortable" width="100%"<br />
|-<br />
! Type<br />
! Title ID<br />
! Name<br />
! Versions<br />
! CDN Availability<br />
|-<br />
| 00030005<br />
| HNDA (484e4441)<br />
| DS Download Play<br />
| 256<br />
| 256<br />
|-<br />
| 00030005<br />
| HNEA (484e4541)<br />
| Pictochat<br />
| 0<br />
| Not Available<br />
|-<br />
| 0003000f<br />
| HNCA (484e4341)<br />
| [[WiFi Firmware]] (non-executable datafile)<br />
| 256, 512<br />
| 256, 512<br />
|-<br />
| 0003000f<br />
| HNHA (484e4841)<br />
| [[Nintendo DS Cart Whitelist]] (non-executable datafile)<br />
| 256, 512, 768, 1024, 1280, 1536<br />
| 256, 512, 768, 1024, 1280, 1536<br />
|}<br />
<br />
====Japan====<br />
{| class="wikitable sortable" width="100%"<br />
|-<br />
! Type<br />
! Title ID<br />
! Name<br />
! Versions<br />
! CDN Availability<br />
|-<br />
| 00030004<br />
| HNGJ (484e474a)<br />
| [[Nintendo DSi Browser]]<br />
| 0, 512, 768<br />
| 0, 512, 768<br />
|-<br />
| 00030005<br />
| HNIJ (484e494a)<br />
| [[Nintendo DSi Camera]]<br />
| 256, 768, 1024<br />
| 256, 768, 1024<br />
|-<br />
| 00030005<br />
| HNJJ (484e4a4a)<br />
| [[Nintendo Zone]]<br />
| 512, 768<br />
| 512, 768<br />
|-<br />
| 00030005<br />
| HNKJ (484e4b4a)<br />
| [[Nintendo DSi Sound]]<br />
| 256, 512<br />
| 256, 512<br />
|-<br />
| 0003000f<br />
| HNLJ (484e4c4a)<br />
| [[Version Data]]<br />
| 1, 2, 3, 4, 5, 6, 7, 8, 9<br />
| 1, 2, 3, 4, 5, 6, 7, 8, 9<br />
|-<br />
| 00030015<br />
| HNOJ (484e4f4a)<br />
| [http://www.nintendo.co.jp/ds/dsiware/hnoj/index.html Nintendo 3DS Transfer Tool]<br />
| 0<br />
| 0<br />
|-<br />
| 00030015<br />
| HNBJ (484e424a)<br />
| [[System Settings]]<br />
| 512, 768<br />
| 512, 768<br />
|-<br />
| 00030015<br />
| HNFJ (484e464a)<br />
| [[Nintendo DSi Shop]]<br />
| 1024, 1280, 1536, 1792, 2048, 2304, 2560, 2816, 3072<br />
| 1024, 1280, 1536, 1792, 2048, 2304, 2560, 2816, 3072<br />
|-<br />
| 00030017<br />
| HNAJ (484e414a)<br />
| [[System Menu]] (Launcher)<br />
| 256, 512, 768, 1024, 1280, 1536, 1792<br />
| 256, 512, 768, 1024, 1280, 1536, 1792<br />
|}<br />
<br />
====United States====<br />
{| class="wikitable sortable" width="100%"<br />
|-<br />
! Type<br />
! Title ID<br />
! Name<br />
! Versions<br />
! CDN Availability<br />
|-<br />
| 00030004<br />
| HNGE (484e4745)<br />
| [[Nintendo DSi Browser]]<br />
| 512, 768<br />
| 512, 768<br />
|-<br />
| 00030005<br />
| HNIE (484e4945)<br />
| [[Nintendo DSi Camera]]<br />
| 768, 1024<br />
| 768, 1024<br />
|-<br />
| 00030005<br />
| HNJE (484e4a45)<br />
| [[Nintendo Zone]]<br />
| 512, 768<br />
| 512, 768<br />
|-<br />
| 00030005<br />
| HNKE (484e4b45)<br />
| [[Nintendo DSi Sound]]<br />
| 256, 512<br />
| 256, 512<br />
|-<br />
| 0003000f<br />
| HNLE (484e4c45)<br />
| [[Version Data]]<br />
| 3, 4, 5, 6, 7, 8, 9<br />
| 3, 4, 5, 6, 7, 8, 9<br />
|-<br />
| 00030015<br />
| HNOE (484e4f45)<br />
| [http://www.nintendo.co.jp/ds/dsiware/hnoj/index.html Nintendo 3DS Transfer Tool]<br />
| 0<br />
| 0<br />
|-<br />
| 00030015<br />
| HNBE (484e4245)<br />
| [[System Settings]]<br />
| 512, 768<br />
| 512, 768<br />
|-<br />
| 00030015<br />
| HNFE (484e4645)<br />
| [[Nintendo DSi Shop]]<br />
| 1536, 1792, 2048, 2304, 2560, 2816, 3072<br />
| 1536, 1792, 2048, 2304, 2560, 2816, 3072<br />
|-<br />
| 00030017<br />
| HNAE (484e4145)<br />
| [[System Menu]] (Launcher)<br />
| 512, 768, 1024, 1280, 1536, 1792<br />
| 512, 768, 1024, 1280, 1536, 1792<br />
|}<br />
<br />
====Europe====<br />
{| class="wikitable sortable" width="100%"<br />
|-<br />
! Type<br />
! Title ID<br />
! Name<br />
! Versions<br />
! CDN Availability<br />
|-<br />
| 00030004<br />
| HNGP (484e4750)<br />
| [[Nintendo DSi Browser]]<br />
| 512, 768<br />
| 512, 768<br />
|-<br />
| 00030005<br />
| HNIP (484e4950)<br />
| [[Nintendo DSi Camera]]<br />
| 768, 1024<br />
| 768, 1024<br />
|-<br />
| 00030005<br />
| HNJP (484e4a50)<br />
| [[Nintendo Zone]]<br />
| 512, 768<br />
| 512, 768<br />
|-<br />
| 00030005<br />
| HNKP (484e4b50)<br />
| [[Nintendo DSi Sound]]<br />
| 256, 512<br />
| 256, 512<br />
|-<br />
| 0003000f<br />
| HNLP (484e4c50)<br />
| [[Version Data]]<br />
| 3, 4, 5, 6, 7, 8, 9<br />
| 3, 4, 5, 6, 7, 8, 9<br />
|-<br />
| 00030015<br />
| HNOP (484e4f50)<br />
| [http://www.nintendo.co.jp/ds/dsiware/hnoj/index.html Nintendo 3DS Transfer Tool]<br />
| 0<br />
| 0<br />
|-<br />
| 00030015<br />
| HNBP (484e4250)<br />
| [[System Settings]]<br />
| 512, 768<br />
| 512, 768<br />
|-<br />
| 00030015<br />
| HNFP (484e4650)<br />
| [[Nintendo DSi Shop]]<br />
| 1536, 1792, 2048, 2304, 2560, 2816, 3072<br />
| 1536, 1792, 2048, 2304, 2560, 2816, 3072<br />
|-<br />
| 00030017<br />
| HNAP (484e4150)<br />
| [[System Menu]] (Launcher)<br />
| 512, 768, 1024, 1280, 1536, 1792<br />
| 512, 768, 1024, 1280, 1536, 1792<br />
|}<br />
<br />
====Australia and New Zealand====<br />
{| class="wikitable sortable" width="100%"<br />
|-<br />
! Type<br />
! Title ID<br />
! Name<br />
! Versions<br />
! CDN Availability<br />
|-<br />
| 00030004<br />
| HNGU (484e4755)<br />
| [[Nintendo DSi Browser]]<br />
| 512, 768<br />
| 512, 768<br />
|-<br />
| 00030005<br />
| HNIU (484e4955)<br />
| [[Nintendo DSi Camera]]<br />
| 768, 1024<br />
| 768, 1024<br />
|-<br />
| 00030005<br />
| HNJU (484e4a55)<br />
| [[Nintendo Zone]]<br />
| 512, 768<br />
| 512, 768<br />
|-<br />
| 00030005<br />
| HNKU (484e4b55)<br />
| [[Nintendo DSi Sound]]<br />
| 256, 512<br />
| 256, 512<br />
|-<br />
| 0003000f<br />
| HNLU (484e4c55)<br />
| [[Version Data]]<br />
| 3, 4, 5, 6, 7, 8, 9<br />
| 3, 4, 5, 6, 7, 8, 9<br />
|-<br />
| 00030015<br />
| HNOU (484e4f55)<br />
| [http://www.nintendo.co.jp/ds/dsiware/hnoj/index.html Nintendo 3DS Transfer Tool]<br />
| 0<br />
| 0<br />
|-<br />
| 00030015<br />
| HNBU (484e4255)<br />
| [[System Settings]]<br />
| 512, 768<br />
| 512, 768<br />
|-<br />
| 00030015<br />
| HNFU (484e4655)<br />
| [[Nintendo DSi Shop]]<br />
| 1536, 1792, 2048, 2304, 2560, 2816, 3072<br />
| 1536, 1792, 2048, 2304, 2560, 2816, 3072<br />
|-<br />
| 00030017<br />
| HNAU (484e4155)<br />
| [[System Menu]] (Launcher)<br />
| 512, 768, 1024, 1280, 1536, 1792<br />
| 512, 768, 1024, 1280, 1536, 1792<br />
|}<br />
<br />
====China====<br />
{| class="wikitable sortable" width="100%"<br />
|-<br />
! Type<br />
! Title ID<br />
! Name<br />
! Versions<br />
! CDN Availability<br />
|-<br />
| 0003000f<br />
| HNLC (484e4c43)<br />
| [[Version Data]]<br />
| 4, 5, 6, 7, 8, 9<br />
| 4, 5, 6, 7, 8, 9<br />
|-<br />
| 00030015<br />
| HNOC (484e4f43)<br />
| [http://www.nintendo.co.jp/ds/dsiware/hnoj/index.html Nintendo 3DS Transfer Tool]<br />
| not available yet in china?<br />
| not available yet in china?<br />
|-<br />
| 00030015<br />
| HNFC (484e4643)<br />
| [[Nintendo DSi Shop]]<br />
| 1792, 2048, 2304, 2560, 2816, 3072<br />
| 1792, 2048, 2304, 2560, 2816, 3072<br />
|-<br />
| 00030017<br />
| HNAC (484e4143)<br />
| [[System Menu]] (Launcher)<br />
| 768, 1024, 1280, 1536, 1792<br />
| 768, 1024, 1280, 1536, 1792<br />
|-<br />
| 00030015<br />
| HNBC (484e4243)<br />
| [[System Settings]]<br />
| 768<br />
| 768<br />
|}<br />
<br />
====Korea====<br />
{| class="wikitable sortable" width="100%"<br />
|-<br />
! Type<br />
! Title ID<br />
! Name<br />
! Versions<br />
! CDN Availability<br />
|-<br />
| 0003000f<br />
| HNLK (484e4c4b)<br />
| [[Version Data]]<br />
| 5, 6, 7, 8, 9<br />
| 5, 6, 7, 8, 9<br />
|-<br />
| 00030015<br />
| HNOK (484e4f5b)<br />
| [http://www.nintendo.co.jp/ds/dsiware/hnoj/index.html Nintendo 3DS Transfer Tool]<br />
| 256<br />
| 256<br />
|-<br />
| 00030015<br />
| HNFK (484e464b)<br />
| [[Nintendo DSi Shop]]<br />
| 1792, 2048, 2304, 2560, 2816, 3072<br />
| 1792, 2048, 2304, 2560, 2816, 3072<br />
|-<br />
| 00030017<br />
| HNAK (484e414b)<br />
| [[System Menu]] (Launcher)<br />
| 768, 1024, 1280, 1536, 1792<br />
| 768, 1024, 1280, 1536, 1792<br />
|-<br />
| 00030015<br />
| HNBK (484e424b)<br />
| [[System Settings]]<br />
| 768<br />
| 768<br />
|}<br />
<br />
== See also ==<br />
<br />
* [[Title metadata|Title metadata (TMD)]]<br />
* [http://wiibrew.org/wiki/NUS_Downloader NUS Downloader info]<br />
* [http://code.google.com/p/nusdownloader/ NUS Downloader source/binary]<br />
* [[NUS Downloader/database]]<br />
* [[Nintendo DSi Shop]]<br />
* [[Nintendo Software]]<br />
* [[System Menu]]</div>Nocashhttps://dsibrew.org/w/index.php?title=Ticket&diff=2098798Ticket2015-06-05T09:51:47Z<p>Nocash: Created page with "Tickets are used for decrypting downloads from DSi shop. They are essentially containing a 16-byte decryption key, plus signatures and some other stuff. == Ticket Format == Tick..."</p>
<hr />
<div>Tickets are used for decrypting downloads from DSi shop. They are essentially containing a 16-byte decryption key, plus signatures and some other stuff.<br />
<br />
== Ticket Format ==<br />
Tickets exist as "cetk" file (as found on Nintendo's server), and as ".tik" files (as found in [[nand/ticket]] folder).<br />
* .tik files: encrypted 2A4h+20h bytes (the +20h bytes are probably ES block encryption footer, using an unknown KEY or KEY X/Y?)<br />
* cetk files: unencrypted 2A4h+700h bytes (the +700h bytes are some certificate footer).<br />
For the overall format of the 2A4h bytes, see [http://wiibrew.org/wiki/Ticket], and NUS Downloader source code.<br />
<br />
== Download Server ==<br />
For free system updates, tickets can be downloaded as "cetk" files. For titles sold commercially in DSi ship, tickets must purchased somehow differently.<br />
For example, the updates for ''DSi System Settings (EUR)'' can be downloaded from:<br />
* http://nus.cdn.t.shop.nintendowifi.net/ccs/download/00030015484e4250/tmd - tmd (unencrypted)<br />
* http://nus.cdn.t.shop.nintendowifi.net/ccs/download/00030015484e4250/cetk - ticket (unencrypted) (available only for free updates)<br />
* http://nus.cdn.t.shop.nintendowifi.net/ccs/download/00030015484e4250/00000002 - executable, version 2 (encrypted via ticket)<br />
* http://nus.cdn.t.shop.nintendowifi.net/ccs/download/00030015484e4250/00000003 - executable, version 3 (encrypted via ticket)<br />
<br />
== Title Decryption ==<br />
First, the encrypted Title Key must be decrypted (via AES-CBC):<br />
KEY[00h..0Fh] = Common Key (AF,1B,F5,16,...) ;from ARM7BIOS<br />
IV[00h..07h] = Title ID (00,03,00,tt,gg,gg,gg,gg) ;tik/cetk[1DCh]<br />
IV[08h..0Fh] = Zerofilled ;padding<br />
Input: Encrypted Title Key ;tik/cetk[1BFh]<br />
Output: Decrypted Title Key ;for use in next step<br />
Then, the actual executable/file can be decrypted (also via AES-CBC):<br />
KEY[00h..0Fh] = Decrypted Title Key ;from above step<br />
IV[00h..01h] = Usually Zero (or "Index" from tmd?) ;tmd[?]<br />
IV[02h..0Fh] = Zerofilled ;padding<br />
Input: Encrypted file "000000vv" ;from http download<br />
Output: Decrypted file "000000vv.app" ;saved on eMMC<br />
The above decryption steps do require a big-endian AES-CBC software implementation (the DSi hardware supports only little-endian, and it supports only AES-CTR and AES-CCM, and, especially, it supports only the "encrypt" key schedule, whilst AES-CBC would require a different "decrypt" key schedule).<br />
<br />
== See Also ==<br />
* [[NUS Downloader/database]]<br />
* http://wiibrew.org/wiki/Ticket - Wii Tickets (similar to DSi tickets)<br />
* http://3dbrew.org/wiki/Ticket - 3DS Tickets</div>Nocashhttps://dsibrew.org/w/index.php?title=DSiBrew:News&diff=2098797DSiBrew:News2015-06-02T04:14:59Z<p>Nocash: /* News */</p>
<hr />
<div><noinclude><br />
==Adding an item==<br />
* Log in to the wiki. Editing is disabled if you don't have an account.<br />
* Add the news event to the top of the list, using this format for the date: <tt><nowiki>'''</nowiki>{{#time: d F y}}<nowiki>''' </nowiki></tt>. Please include the application's creator, version number, and a link to a page on DSiBrew about the application. No external links please.<br />
* '''Move the last entry to the [[DSiBrew:News/Archive|news archive]]. There should be no more than 4 entrees in the list.'''<br />
<br />
==Archives==<br />
For older news, see the [[DSiBrew:News/Archive|news archive]].<br />
<br />
=== News ===<br />
<!-- Add news below --></noinclude><br />
*'''01 June 15''' nocash released [http://problemkaputt.de/gba.htm no$gba v2.8b], allowing to run the whole DSi boot process in the emulator/debugger.<br />
*'''11 February 15''' WinterMute released updated [http://davejmurphy.com/dsi-homebrew-redux/ dslink]. Now working with [[System Menu 1.4.5]].<br />
*'''11 December 12''' Nintendo released [[System Menu 1.4.5]].<br />
*'''21 March 12''' Nintendo released [[System Menu 1.4.4]], updating [[Nintendo_DSi_Camera|Nintendo DSi Camera]], blocking Cooking Coach/Classic Word Games savedata exploits, and blocking flashcards.</div>Nocashhttps://dsibrew.org/w/index.php?title=DSiBrew:News/Archive&diff=2098796DSiBrew:News/Archive2015-06-02T04:14:37Z<p>Nocash: </p>
<hr />
<div>*'''25 August 11''' Team Twiizers released the final [http://hackmii.com/2011/08/final-dsiwarehax/ DSiWareHax].<br />
*'''29 June 11''' Nintendo released [[System Menu 1.4.3]] in all regions, blocking flash-cards.<br />
*'''10 May 11''' Nintendo released a new system update, [[System Menu 1.4.2#Global_Update|System Menu 1.4.2]], globally. This blocks flash cards, and [http://hackmii.com/2011/05/dsi-system-update-1-4-2/ blocks] copying all current and future DSiWare exploits to "internal memory".(A final Sudokuhax update will be [http://hackmii.com/2011/05/dsi-system-update-1-4-2/ released] at same time as the final DSiWareHax mentioned in that post)<br />
*'''24 March 11''' An updated USA Sudoku was [http://hackmii.com/2011/01/sudokuhax-release/ released], which fixed all Sudoku string bugs. On roughly March 30 2011, EUR Sudoku was updated.<br />
*'''28 January 11''' 19 and 24 hours after the Sudokuhax release Nintendo [http://hackmii.com/2011/01/sudokuhax-release/ removed] EA's Sudoku from the EUR/AU and USA DSi Shop.<br />
*'''27 January 11''' Team Twiizers released DSiWare exploit [http://hackmii.com/2011/01/sudokuhax-release/ Sudokuhax], loads full DSi-mode homebrew from SD card.<br />
<br />
*'''14 January 11''' The DSi Common key has been disclosed to the public. Please do not post it here.<br />
<br />
*'''07 September 10''' Nintendo released [[System Menu 1.4.1]] in all regions except China where [[System Menu 1.4.2]] was released instead. This update blocks some flashcards.<br />
*'''25 August 10''' Dave J Murphy (WinterMute) released DSi Link, allowing running larger DSi mode homebrew binaries [http://davejmurphy.com/dsi-mode-homebrew-anyone/]<br />
*'''9 February 10''' Nintendo has released an update for the DSi System. The DSi [[Nintendo Zone]] client was updated to version 3.0, but the system still runs on [[System Menu 1.4]]. No other changes have been identified.<br />
*'''3 August 09''' Nintendo has released [[System Menu 1.4]] in every supported country.<br />
*'''2 August 09''' The Drunken Coders [http://drunkencoders.com/2009/08/dsi-hack-update/ have released] the exploit they are using to run unsigned code in DSi mode.<br />
*'''9 July 09:''' Team Twiizers successfully ran DSi-Mode Homebrew. More details can be found over at [http://hackmii.com/2009/07/dsi-mode-homebrew-anyone/ HackMii]<br />
*'''25 June 09:''' Voting has begun for the [[DSiBrew:Contests|DSiBrew logo]] contest! Please cast your vote '''[[DSiBrew talk:Contests#Voting time!|here]]'''.<br />
*'''8 June 09:''' The [[DSiBrew:Contests|DSiBrew logo]] contest is now closed to submissions.<br />
*'''12 April 09:''' A [[DSiBrew:Contests|DSiBrew logo]] contest has started.<br />
*'''5 April 09:''' The Nintendo DSi has been released in North America.<br />
*'''3 April 09:''' Nintendo has released [[System Update 1.3]]. DSi Shop is accessible. All DSi flashcarts still work. Added a button to start DSi Camera application when pressing L or R.<br />
*'''3 April 09:''' The Nintendo DSi has been released in Europe.<br />
*'''2 April 09:''' The Nintendo DSi has been released in Australia.<br />
*'''19 February 09:''' [http://nintendo.co.uk/NOE/en_GB/news/2008/nintendo_dsi_arrives_in_europe_on_3_april_2009_11627.html Nintendo of Europe] and [http://www.nintendo.com/whatsnew/detail/Q5D4ti_bPqJO_I0Oup0AMFudaUOLz6C7 Nintendo of America] have announced that the DSi will be released on April 3 in Europe and April 5 in North America.<br />
* '''25 January 09 ''': [[User:Bushing|Bushing]] from [http://www.hackmii.com Hackmii] created this wiki as a spinoff of the [http://wiibrew.org/wiki/Main_Page WiiBrew wiki].</div>Nocashhttps://dsibrew.org/w/index.php?title=Stage2&diff=2098794Stage22015-04-20T21:46:59Z<p>Nocash: /* Stage 2 */</p>
<hr />
<div>== Stage 1 ==<br />
<br />
[[Image:boot-stage1-error.jpeg|frame|When the Stage 1 bootloader (in ROM) fails, it displays a 32-bit hexadecimal number on the top screen.]]<br />
<br />
The first stage of the DSi's bootloader lives in ROM, presumably on the CPU die. It loads further encrypted+signed stages from [[NAND]] flash, starting with a plaintext offset table in the sector at offset 0x200.<br />
<br />
Not much is known about this bootloader yet, but it presumably knows how to:<br />
# Initialize the encryption hardware<br />
# Read the contents of [[NVRAM]]<br />
# Initialize both LCDs<br />
# Read blocks (but not files) from the [[NAND]] flash<br />
# Perform some variety of integrity check on all data it reads (signature, CRC, ?)<br />
# Display basic hexadecimal error codes<br />
# Possibly factory-programming the [[NAND]] flash?<br />
# Might also do basic power-on self test of peripherals <br />
<br />
Known error codes:<br />
<br />
{| border="1" cellpadding="3" cellspacing="0"<br />
! Error Code !! Description<br />
|-<br />
| 0000FE00 || Error communicating with NAND chip. (It's missing, CLK is shorted, etc.)<br />
|-<br />
| 0000FEFC || Integrity error in first block of Stage 2 (address at 0x220)<br />
|-<br />
| 0000FEFD || Integrity error in second block of Stage 2 (address at 0x230)<br />
|-<br />
| 0000FEFE || Boot sector integrity error (Sector 0x200 not valid), or error in [[NVRAM]] contents.<br />
|}<br />
<br />
== Stage 2 ==<br />
<br />
[[Image:boot-stage2-error.jpeg|frame|This may have been a Stage 2 bootloader error.]]<br />
<br />
Unlike the stage1 bootloader, which must be small enough to fit in ROM (probably several kilobytes), the stage2 bootloader has about a megabyte of NAND flash reserved for it. The stage2 bootloader understands partitions and filesystems, and it is capable of loading the DSi menu. It also must understand the encryption used on filesystem blocks in the NAND, and it must understand how to load and validate title metadata.<br />
<br />
The Stage 2 loader was not modified by the [[System Menu 1.4]] update. This is still earlier in the boot process than the "Health and Safety" warning(that warning is displayed by the sysmenu).<br />
<br />
The first stage bootloader reads the sector at offset 0x200 in order to find a table of offsets to the Stage 2 bootloader:<br />
<br />
00000220 00 08 00 00 10 64 02 00 00 80 7b 03 00 66 02 00 |.....d....{..f..|<br />
00000230 00 6e 02 00 88 75 02 00 00 80 7b 03 00 76 02 00 |.n...u....{..v..|<br />
00000240 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|<br />
<br />
This is describing two chunks of the stage2 loader: the ARM9-binary 0x26410 bytes in length at address 0x800, and the ARM7-binary 0x27588 bytes at address 0x26e00.<br />
<br />
Structure of this header:<br />
{| border="1" cellpadding="3" cellspacing="0"<br />
! Offset<br />
! Size<br />
! Description<br />
|-<br />
| 0x0<br />
| 0x20<br />
| Reserved (zerofilled)<br />
|-<br />
| 0x20<br />
| 0x4<br />
| ARM9 Bootcode, eMMC Source Offset<br />
|-<br />
| 0x24<br />
| 0x4<br />
| ARM9 Bootcode, Size "Actual binary size"<br />
|-<br />
| 0x28<br />
| 0x4<br />
| ARM9 Bootcode, RAM Destination Address and Entrypoint<br />
|-<br />
| 0x2C<br />
| 0x4<br />
| ARM9 Bootcode, Size rounded up to multiple of 0x200<br />
|-<br />
| 0x30<br />
| 0x4<br />
| ARM7 Bootcode, eMMC Source Offset<br />
|-<br />
| 0x34<br />
| 0x4<br />
| ARM7 Bootcode, Size "Actual binary size"<br />
|-<br />
| 0x38<br />
| 0x4<br />
| ARM7 Bootcode, RAM Destination Address and Entrypoint<br />
|-<br />
| 0x3C<br />
| 0x4<br />
| ARM7 Bootcode, Size rounded up to multiple of 0x200<br />
|-<br />
| 0x40<br />
| 0xBF<br />
| Reserved (zerofilled)<br />
|-<br />
| 0xFF<br />
| 0x1<br />
| Unknown, value 0xFF? (actually, this is appears to be always 0Ch, not FFh?)<br />
|-<br />
| 0x100<br />
| 0x80<br />
| RSA-1024 Data Block<br />
|-<br />
| 0x180<br />
| 0x14<br />
| Global MBK1..MBK5 Slot Settings<br />
|-<br />
| 0x194<br />
| 0xC<br />
| Local MBK6..MBK8 Settings for ARM9 Side<br />
|-<br />
| 0x1A0<br />
| 0xC<br />
| Local MBK6..MBK8 Settings for ARM7 Side<br />
|-<br />
| 0x1AC<br />
| 0x4<br />
| Global MBK9 Slot Master Setting<br />
|-<br />
| 0x1B0<br />
| 0x50<br />
| Reserved (zerofilled)<br />
|}<br />
<br />
Note that the above format resembles the [[DSi Cartridge Header]] (entries 0x20-0x3F are roughly similar, and entries 0x180-0x1AF appear to be same as in cart header).<br />
<br />
The RSA pubks(the one for 3DS and the other one for DSi) for the below signature can be obtained from 3DS TWL_FIRM Process9(this is required for getting the binaries' keyY). It's unknown(?) if the DSi bootrom(s) copy this modulo to anywhere outside of bootrom.<br />
<br />
Structure of the 0x74-byte "hash-data" stored in the RSA message:<br />
{| border="1" cellpadding="3" cellspacing="0"<br />
! Offset<br />
! Size<br />
! Description<br />
|-<br />
| 0x0<br />
| 0x10<br />
| [[AES_Engine]] keyY used for the ARM9/ARM7 binaries crypto.<br />
|-<br />
| 0x10<br />
| 0x14<br />
| SHA1 hash. Going by 3DS TWL_FIRM this seems to calculated over the first 0x28-bytes of [[NAND]], then the first 0x100-bytes of the header, then the last 0x80-bytes of the header(following the signature). This works with the bootloader contained in TWL_FIRM, however it's unknown how the first part is handled on DSi.<br />
|-<br />
| 0x24<br />
| 0x14<br />
| SHA1 hash over the plaintext ARM9 binary, with the actual binary size.<br />
|-<br />
| 0x38<br />
| 0x14<br />
| SHA1 hash over the plaintext ARM7 binary, with the actual binary size.<br />
|-<br />
| 0x4C<br />
| 0x14<br />
| Unknown, not used by 3DS TWL_FIRM. Normally all-zero.<br />
|-<br />
| 0x60<br />
| 0x14<br />
| Unknown, not used by 3DS TWL_FIRM.<br />
|}<br />
<br />
Note that this sector (and two similar ones at 0x400 and 0x600) appear to be the only unencrypted blocks on the NAND flash.<br />
<br />
After loading+verifying the the above header, the ARM7 binary is loaded+verified, then the ARM9 binary is loaded+verified.<br />
<br />
Whereas the filesystem data in NAND is encrypted using a unique key for every DSi, the stage2 bootloader is identical on every DSi tested so far. The stage2 bootloader binaries are not encrypted with any console-unique keys.<br />
<br />
Stage1 uses the [[AES_Engine|AES CTR]] to decrypt each ARM9/ARM7 binary, where keyY is from the above signature. The [[AES_Engine]] keyslot used here is the same one used for the shared areas for [[Tad]], therefore the keyX is the same as the one used for that. The following is used for the CTR, where "binblk->binblocksize" is the above binary size aligned to 0x200-bytes:<br />
<br />
unsigned int ctr[4];<br />
memset(ctr, 0, 16);<br />
<br />
ctr[0] = binblk->binblocksize;<br />
ctr[1] = (unsigned int)(-binblk->binblocksize);<br />
ctr[2] = ~binblk->binblocksize;<br />
<br />
=== Stage2 operations ===<br />
After Stage 2 is loaded:<br />
# The NAND flash is partially re-initialized<br />
# Sector 0 is read from the NAND. This appears to be an (encrypted) DOS-style MBR.<br />
# The MBR signature and the type of the first partition are verified.<br />
# Filesystem metadata is read from sectors starting around 0x100000. The metadata is in FAT16 format with long filenames.<br />
# Multiple files are loaded from the filesystem. The exact read addresses will vary depending on your DSi's firmware version and the state of its filesystem when you performed the last firmware update. On a brand new DSi, it appears that the DSi Menu itself is loaded from 0xb20000 after two small metadata files are read from 0xb1c000 and 0x7a0000.<br />
<br />
All errors show before the health and safety screen. It appears that stage2 errors from a cold power-on always cause the DSi to hang at a black screen, whereas stage2 errors after reset (pressing but not holding the power button) will give an error message screen. Known errors:<br />
<br />
{| border="1" cellpadding="3" cellspacing="0"<br />
! Text !! Description<br />
|-<br />
| "Error: 1-2435-8325" || Invalid signature or partition type in MBR, invalid starting LBA.<br />
|-<br />
| "Error: 3-2435-8325" || DSi Menu integrity checks failed<br />
|-<br />
|}</div>Nocashhttps://dsibrew.org/w/index.php?title=Talk:Stage2&diff=2098793Talk:Stage22015-04-20T21:41:20Z<p>Nocash: /* RSA and Bootsector decryption? */</p>
<hr />
<div>== RSA and Bootsector decryption? ==<br />
<br />
Where is that RSA info from? Is it possible to decrypt the RSA block on DSi, or on 3DS, or both?<br />
Any hints how to do that? Are DSi and 3DS using the same RSA key?<br />
<br />
The notice about keyX being same as for "Tad" sounds good... until one figures out that the "srl extract" utility contains only a normal "key" (not a keyX/Y pair), so decrypting isn't possible even when knowing keyY.<br />
Of course, whomever has found the normal key, should be also able to find the keyX/Y values, but I've no idea how that could be done (it will certainly not work with cooking coach which has all keyslots erased, so it might require main ram hacks in worst case).<br />
<br />
The part about ''"binblk->binblocksize" is the actual binary size'' is confusing. If '''binblk->binblocksize''' is known, then what is '''binblksize''' in the formula? Or is that a typo, and it means same as '''binblk->binblocksize'''?[[User:Nocash|Nocash]] 14:27, 27 March 2015 (CET)<br />
<br />
* 1/3) See last page edit.<br />
* 2) One can easily obtain the keyX^keyY key with F_XY_reverse(<any normalkey>) from that tool, but of course that's rather pointless without a keyX/keyY to XOR with that. Besides ramhaxx, the only other way to obtain the keyX/keyY for that yourself is to just get it from the 3DS [http://3dbrew.org/wiki/Memory_layout#ARM9_ITCM DSi-key-stash] @ 0x01FFD000(essentially *all* DSi keys are stored in there + TWL_FIRM Process9).<br />
--[[User:Yellows8|Yellows8]] 06:00, 7 April 2015 (CEST)<br />
<br />
:4.1) Okay, decrypting the RSA stuff is possible, and it's just me not knowing how to. Are you saying that the RSA key is contained in the TWL_FIRM executable? So one could simply "copy/paste" it from the TWL_FIRM files? Or is the key elsewhere, and TWL_FIRM is just using it during boot? So one would need some exploit to hack TWL_FIRM during boot-up? Sorry, but I don't have a 3DS, and know absolutely nothing about that console.<br />
<br />
:4.3) I've edited it myself (see last page edit). I hope that wasn't wrong.<br />
<br />
:5) Yeah, reversing KeyX without KeyY won't work (I can confirm that). If that Tad KeyX is one of the "known" DSi keys (those relocated from DSi BIOS ROM to TCM/WRAM during booting), then everything would be fine. And otherwise, one would need some 3DS exploit to get that DSi-key-stash... supposedly some special kernel exploit which isn't available to normal 3DS programmers?<br />
:PS. I've added some contact info on my wiki/user page (just in case) --[[User:Nocash|Nocash]] 22:56, 14 April 2015 (CEST)<br />
<br />
::Yes, those two RSA pubks are stored in the TWL_FIRM Process9 binary itself. When one has TWL_FIRM decrypted one can just extract those keys from there. There's public exploit(s)+tools for that, including arm9hax which is required for dumping the DSi keys from 3DS ARM9 ITCM. The common tad-keyX is written to the AES engine keyslot for it by bootrom, AFAIK it doesn't get copied elsewhere(the keyY for it is copied to the keystorage area near the end of ARM7 memory, but of course that area gets cleared when games are booted). --[[User:Yellows8|Yellows8]] 20:34, 18 April 2015 (CEST)<br />
<br />
Thanks! Found the RSA key. And now I do also understand what you meant about reversing Tad key X (the DSi does only relocate Tad key Y to RAM/TCM). My emu is now throwing that "Error: 1-2435-8325" message. That should be a good place to start with. --[[User:Nocash|Nocash]] 23:41, 20 April 2015 (CEST)<br />
<br />
== Bootloader Error Photos ==<br />
<br />
[[File:1124101052.jpg|200px|thumb|left]]<br />
[[File:1124101051.jpg|200px|thumb|left]]<br />
[[File:1124101051a.jpg|200px|thumb|left]]<br />
<br />
Here are some shots of my DSi with what I think is a bootloader error. --[[User:The2Banned2One|The2Banned2One]] 17:25, 24 November 2010 (CET)<br />
<br />
----<br />
<br />
'''Discuss here:'''</div>Nocashhttps://dsibrew.org/w/index.php?title=Nand:/sys/dev.kp&diff=2098791Nand:/sys/dev.kp2015-04-18T01:18:41Z<p>Nocash: unmasked "hidden" filename of hyperlink</p>
<hr />
<div>The dev.kp file is encrypted with [[ES block encryption]], and the contents of an example dev.kp file after decryption is shown below.<br />
<br />
Note that the console id itself is burned in an OTP area of the TWL CPU, and changing the contents of this file will not actually change the console id.<br />
<br />
:[fixme: The DSi does have a unique per-console ID: The wifi MAC address, stored in the FLASH memory on the wifi daughterboard. Is there really another ID in an "OTP area of the TWL CPU", as stated above? And if yes: How is that OTP ID accessed by software?]<br />
<br />
This file contains the unique per-console ECC private-public key pair, along with a certificate issued by Nintendo.<br />
<br />
This file is created by the DSi Shop, with data from a SOAP reply. The SOAP request data includes the hw console id, and the 0x100-byte RSA signature stored in NAND file [[Nand/sys/HWID.sgn]]. Trying to send that request would require a NAND dump, but when you have a NAND dump already sending that request is pointless since you can grab dev.kp from NAND.<br />
<br />
Sending that request is pointless anyway since the dev.kp data from the server is random. The returned dev.kp data from the server for the EC private/public keys are random, the ticket consoleID immediately following TW before - in the twcert keyid is random as well.<br />
DSi Shop and System Settings don't contain any code for deleting dev.kp. If you try to delete/rename dev.kp manually from NAND a new dev.kp will be generated by the shop, but then the server will return an error since the server account public dev.kp cert won't match.<br />
<br />
Data management can't be accessed when dev.kp doesn't exist since you'd have no twcert to sign/verify [[Tad|tads]] with, like when you never connected the DSi Shop server.<br />
<br />
Signature across rest of block -- type = 0x00010002, ECC<br />
0000000: 00 01 00 02 00 db da 21 3b e1 f1 bf bb 4d dc 1d<br />
0000010: 60 29 da 19 42 1e 66 4f a8 e5 27 a1 d4 ea 46 7d<br />
0000020: 9b b4 00 95 c5 0d e8 fa ef a7 8d e9 bc 54 da c1<br />
0000030: 24 94 0b 7c ad a8 61 d5 05 97 c2 64 38 ad 18 f9<br />
<br />
0000040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br />
0000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br />
0000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br />
0000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br />
<br />
Key used to sign this cert (Root-CA00000001-MS00000008)<br />
0000080: 52 6f 6f 74 2d 43 41 30 30 30 30 30 30 30 31 2d Root-CA00000001-<br />
0000090: 4d 53 30 30 30 30 30 30 30 38 00 00 00 00 00 00 MS00000008<br />
00000a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br />
00000b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br />
<br />
Console ID string<br />
00000c0: 00 00 00 02 54 57 63 37 39 64 63 65 63 39 2d 30 ....TWc79dcec9-0<br />
00000d0: 38 61 32 30 32 38 37 30 31 30 38 34 31 31 38 00 8a2028701084118.<br />
00000e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br />
00000f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br />
<br />
Public ECC key (30 bytes, starting at 0x108)<br />
0000100: 00 00 00 00 6f dd de 42 01 e0 34 a3 19 bc a9 af<br />
0000110: 50 fe 8a ac 75 08 07 a9 3a 2c 21 51 93 ae 4a 90<br />
0000120: 6e 62 41 f1 a2 fe 00 00 3d 0a 13 97 da 53 17 98<br />
0000130: 69 38 65 67 ca f4 9c 87 ec 44 b7 eb d0 ec b8 3d <br />
0000140: 23 cf 7a 35 00 00 00 00 00 00 00 00 00 00 00 00<br />
0000150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br />
0000160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br />
0000170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br />
<br />
Private per-console ECC key, used for signing files on SD<br />
0000180: 01 12 9d e0 77 82 44 d3 ee 99 ad ce e5 fa fa ed<br />
0000190: c9 ab 8e a1 f9 b5 c8 14 3c 74 74 f8 19 3a<br />
<br />
See also [http://www.wiibrew.org/wiki/Certificate_chain Certificate Chain], [[nand/sys/cert.sys]]</div>Nocashhttps://dsibrew.org/w/index.php?title=Talk:Stage2&diff=2098790Talk:Stage22015-04-14T20:56:00Z<p>Nocash: /* RSA and Bootsector decryption? */</p>
<hr />
<div>== RSA and Bootsector decryption? ==<br />
<br />
Where is that RSA info from? Is it possible to decrypt the RSA block on DSi, or on 3DS, or both?<br />
Any hints how to do that? Are DSi and 3DS using the same RSA key?<br />
<br />
The notice about keyX being same as for "Tad" sounds good... until one figures out that the "srl extract" utility contains only a normal "key" (not a keyX/Y pair), so decrypting isn't possible even when knowing keyY.<br />
Of course, whomever has found the normal key, should be also able to find the keyX/Y values, but I've no idea how that could be done (it will certainly not work with cooking coach which has all keyslots erased, so it might require main ram hacks in worst case).<br />
<br />
The part about ''"binblk->binblocksize" is the actual binary size'' is confusing. If '''binblk->binblocksize''' is known, then what is '''binblksize''' in the formula? Or is that a typo, and it means same as '''binblk->binblocksize'''?[[User:Nocash|Nocash]] 14:27, 27 March 2015 (CET)<br />
<br />
* 1/3) See last page edit.<br />
* 2) One can easily obtain the keyX^keyY key with F_XY_reverse(<any normalkey>) from that tool, but of course that's rather pointless without a keyX/keyY to XOR with that. Besides ramhaxx, the only other way to obtain the keyX/keyY for that yourself is to just get it from the 3DS [http://3dbrew.org/wiki/Memory_layout#ARM9_ITCM DSi-key-stash] @ 0x01FFD000(essentially *all* DSi keys are stored in there + TWL_FIRM Process9).<br />
--[[User:Yellows8|Yellows8]] 06:00, 7 April 2015 (CEST)<br />
<br />
:4.1) Okay, decrypting the RSA stuff is possible, and it's just me not knowing how to. Are you saying that the RSA key is contained in the TWL_FIRM executable? So one could simply "copy/paste" it from the TWL_FIRM files? Or is the key elsewhere, and TWL_FIRM is just using it during boot? So one would need some exploit to hack TWL_FIRM during boot-up? Sorry, but I don't have a 3DS, and know absolutely nothing about that console.<br />
<br />
:4.3) I've edited it myself (see last page edit). I hope that wasn't wrong.<br />
<br />
:5) Yeah, reversing KeyX without KeyY won't work (I can confirm that). If that Tad KeyX is one of the "known" DSi keys (those relocated from DSi BIOS ROM to TCM/WRAM during booting), then everything would be fine. And otherwise, one would need some 3DS exploit to get that DSi-key-stash... supposedly some special kernel exploit which isn't available to normal 3DS programmers?<br />
:PS. I've added some contact info on my wiki/user page (just in case) --[[User:Nocash|Nocash]] 22:56, 14 April 2015 (CEST)<br />
<br />
== Bootloader Error Photos ==<br />
<br />
[[File:1124101052.jpg|200px|thumb|left]]<br />
[[File:1124101051.jpg|200px|thumb|left]]<br />
[[File:1124101051a.jpg|200px|thumb|left]]<br />
<br />
Here are some shots of my DSi with what I think is a bootloader error. --[[User:The2Banned2One|The2Banned2One]] 17:25, 24 November 2010 (CET)<br />
<br />
----<br />
<br />
'''Discuss here:'''</div>Nocashhttps://dsibrew.org/w/index.php?title=User:Nocash&diff=2098789User:Nocash2015-04-14T20:34:43Z<p>Nocash: </p>
<hr />
<div>emulation author<br />
<br />
webpage: http://problemkaputt.de/<br />
<br />
contact: http://problemkaputt.de/email.htm</div>Nocashhttps://dsibrew.org/w/index.php?title=User:Nocash&diff=2098788User:Nocash2015-04-14T20:34:25Z<p>Nocash: Created page with "emulation author webpage: http://problemkaputt.de/ contact: http://problemkaputt.de/email.htm"</p>
<hr />
<div>emulation author<br />
webpage: http://problemkaputt.de/<br />
contact: http://problemkaputt.de/email.htm</div>Nocashhttps://dsibrew.org/w/index.php?title=Stage2&diff=2098787Stage22015-04-14T20:14:09Z<p>Nocash: /* Stage 2 */ renamed 10-letter "binblksize" to 20-letter "binblk->binblocksize", please correct if that was wrong</p>
<hr />
<div>== Stage 1 ==<br />
<br />
[[Image:boot-stage1-error.jpeg|frame|When the Stage 1 bootloader (in ROM) fails, it displays a 32-bit hexadecimal number on the top screen.]]<br />
<br />
The first stage of the DSi's bootloader lives in ROM, presumably on the CPU die. It loads further encrypted+signed stages from [[NAND]] flash, starting with a plaintext offset table in the sector at offset 0x200.<br />
<br />
Not much is known about this bootloader yet, but it presumably knows how to:<br />
# Initialize the encryption hardware<br />
# Read the contents of [[NVRAM]]<br />
# Initialize both LCDs<br />
# Read blocks (but not files) from the [[NAND]] flash<br />
# Perform some variety of integrity check on all data it reads (signature, CRC, ?)<br />
# Display basic hexadecimal error codes<br />
# Possibly factory-programming the [[NAND]] flash?<br />
# Might also do basic power-on self test of peripherals <br />
<br />
Known error codes:<br />
<br />
{| border="1" cellpadding="3" cellspacing="0"<br />
! Error Code !! Description<br />
|-<br />
| 0000FE00 || Error communicating with NAND chip. (It's missing, CLK is shorted, etc.)<br />
|-<br />
| 0000FEFC || Integrity error in first block of Stage 2 (address at 0x220)<br />
|-<br />
| 0000FEFD || Integrity error in second block of Stage 2 (address at 0x230)<br />
|-<br />
| 0000FEFE || Boot sector integrity error (Sector 0x200 not valid), or error in [[NVRAM]] contents.<br />
|}<br />
<br />
== Stage 2 ==<br />
<br />
[[Image:boot-stage2-error.jpeg|frame|This may have been a Stage 2 bootloader error.]]<br />
<br />
Unlike the stage1 bootloader, which must be small enough to fit in ROM (probably several kilobytes), the stage2 bootloader has about a megabyte of NAND flash reserved for it. The stage2 bootloader understands partitions and filesystems, and it is capable of loading the DSi menu. It also must understand the encryption used on filesystem blocks in the NAND, and it must understand how to load and validate title metadata.<br />
<br />
The Stage 2 loader was not modified by the [[System Menu 1.4]] update. This is still earlier in the boot process than the "Health and Safety" warning(that warning is displayed by the sysmenu).<br />
<br />
The first stage bootloader reads the sector at offset 0x200 in order to find a table of offsets to the Stage 2 bootloader:<br />
<br />
00000220 00 08 00 00 10 64 02 00 00 80 7b 03 00 66 02 00 |.....d....{..f..|<br />
00000230 00 6e 02 00 88 75 02 00 00 80 7b 03 00 76 02 00 |.n...u....{..v..|<br />
00000240 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|<br />
<br />
This is describing two chunks of the stage2 loader: the ARM9-binary 0x26410 bytes in length at address 0x800, and the ARM7-binary 0x27588 bytes at address 0x26e00.<br />
<br />
Structure of this header:<br />
{| border="1" cellpadding="3" cellspacing="0"<br />
! Offset<br />
! Size<br />
! Description<br />
|-<br />
| 0x0<br />
| 0x20<br />
| Reserved (zerofilled)<br />
|-<br />
| 0x20<br />
| 0x4<br />
| ARM9 Bootcode, eMMC Source Offset<br />
|-<br />
| 0x24<br />
| 0x4<br />
| ARM9 Bootcode, Size "Actual binary size"<br />
|-<br />
| 0x28<br />
| 0x4<br />
| ARM9 Bootcode, RAM Destination Address and Entrypoint<br />
|-<br />
| 0x2C<br />
| 0x4<br />
| ARM9 Bootcode, Size rounded up to multiple of 0x200<br />
|-<br />
| 0x30<br />
| 0x4<br />
| ARM7 Bootcode, eMMC Source Offset<br />
|-<br />
| 0x34<br />
| 0x4<br />
| ARM7 Bootcode, Size "Actual binary size"<br />
|-<br />
| 0x38<br />
| 0x4<br />
| ARM7 Bootcode, RAM Destination Address and Entrypoint<br />
|-<br />
| 0x3C<br />
| 0x4<br />
| ARM7 Bootcode, Size rounded up to multiple of 0x200<br />
|-<br />
| 0x40<br />
| 0xBF<br />
| Reserved (zerofilled)<br />
|-<br />
| 0xFF<br />
| 0x1<br />
| Unknown, value 0xFF? (actually, this is appears to be always 0Ch, not FFh?)<br />
|-<br />
| 0x100<br />
| 0x80<br />
| RSA-1024 Data Block<br />
|-<br />
| 0x180<br />
| 0x14<br />
| Global MBK1..MBK5 Slot Settings<br />
|-<br />
| 0x194<br />
| 0xC<br />
| Local MBK6..MBK8 Settings for ARM9 Side<br />
|-<br />
| 0x1A0<br />
| 0xC<br />
| Local MBK6..MBK8 Settings for ARM7 Side<br />
|-<br />
| 0x1AC<br />
| 0x4<br />
| Global MBK9 Slot Master Setting<br />
|-<br />
| 0x1B0<br />
| 0x50<br />
| Reserved (zerofilled)<br />
|}<br />
<br />
Note that the above format resembles the [[DSi Cartridge Header]] (entries 0x20-0x3F are roughly similar, and entries 0x180-0x1AF appear to be same as in cart header).<br />
<br />
The RSA pubks(the one for 3DS and the other one for DSi) for the below signature can be obtained from 3DS TWL_FIRM Process9(this is required for getting the binaries' keyY). It's unknown(?) if the DSi bootrom(s) copy this modulo to anywhere outside of bootrom.<br />
<br />
Structure of the 0x74-byte "hash-data" stored in the RSA message:<br />
{| border="1" cellpadding="3" cellspacing="0"<br />
! Offset<br />
! Size<br />
! Description<br />
|-<br />
| 0x0<br />
| 0x10<br />
| [[AES_Engine]] keyY used for the ARM9/ARM7 binaries crypto.<br />
|-<br />
| 0x10<br />
| 0x14<br />
| SHA1 hash. Going by 3DS TWL_FIRM this seems to calculated over the first 0x28-bytes of [[NAND]], then the first 0x100-bytes of the header, then the last 0x80-bytes of the header(following the signature). This works with the bootloader contained in TWL_FIRM, however it's unknown how the first part is handled on DSi.<br />
|-<br />
| 0x24<br />
| 0x14<br />
| SHA1 hash over the plaintext ARM9 binary, with the actual binary size.<br />
|-<br />
| 0x38<br />
| 0x14<br />
| SHA1 hash over the plaintext ARM7 binary, with the actual binary size.<br />
|-<br />
| 0x4C<br />
| 0x14<br />
| Unknown, not used by 3DS TWL_FIRM. Normally all-zero.<br />
|-<br />
| 0x60<br />
| 0x14<br />
| Unknown, not used by 3DS TWL_FIRM.<br />
|}<br />
<br />
Note that this sector (and two similar ones at 0x400 and 0x600) appear to be the only unencrypted blocks on the NAND flash.<br />
<br />
After loading+verifying the the above header, the ARM7 binary is loaded+verified, then the ARM9 binary is loaded+verified.<br />
<br />
Whereas the filesystem data in NAND is encrypted using a unique key for every DSi, the stage2 bootloader is identical on every DSi tested so far. The stage2 bootloader binaries are not encrypted with any console-unique keys.<br />
<br />
Stage1 uses the [[AES_Engine]] to decrypt each ARM9/ARM7 binary, where keyY is from the above signature. The [[AES_Engine]] keyslot used here is the same one used for the shared areas for [[Tad]], therefore the keyX is the same as the one used for that. The following is used for the CTR, where "binblk->binblocksize" is the above binary size aligned to 0x200-bytes:<br />
<br />
unsigned int ctr[4];<br />
memset(ctr, 0, 16);<br />
<br />
ctr[0] = binblk->binblocksize;<br />
ctr[1] = (unsigned int)(-binblk->binblocksize);<br />
ctr[2] = ~binblk->binblocksize;<br />
<br />
=== Stage2 operations ===<br />
After Stage 2 is loaded:<br />
# The NAND flash is partially re-initialized<br />
# Sector 0 is read from the NAND. This appears to be an (encrypted) DOS-style MBR.<br />
# The MBR signature and the type of the first partition are verified.<br />
# Filesystem metadata is read from sectors starting around 0x100000. The metadata is in FAT16 format with long filenames.<br />
# Multiple files are loaded from the filesystem. The exact read addresses will vary depending on your DSi's firmware version and the state of its filesystem when you performed the last firmware update. On a brand new DSi, it appears that the DSi Menu itself is loaded from 0xb20000 after two small metadata files are read from 0xb1c000 and 0x7a0000.<br />
<br />
All errors show before the health and safety screen. It appears that stage2 errors from a cold power-on always cause the DSi to hang at a black screen, whereas stage2 errors after reset (pressing but not holding the power button) will give an error message screen. Known errors:<br />
<br />
{| border="1" cellpadding="3" cellspacing="0"<br />
! Text !! Description<br />
|-<br />
| "Error: 1-2435-8325" || Invalid signature or partition type in MBR, invalid starting LBA.<br />
|-<br />
| "Error: 3-2435-8325" || DSi Menu integrity checks failed<br />
|-<br />
|}</div>Nocashhttps://dsibrew.org/w/index.php?title=DSi_cartridge_header&diff=2098784DSi cartridge header2015-03-27T14:57:37Z<p>Nocash: </p>
<hr />
<div>The following tries to document the structure of the NDS ROM format and its DSi extended version.<br />
<br />
{| class="wikitable" border="1"<br />
|-<br />
! OFFSET<br />
! SIZE<br />
! DESCRIPTION - ORIGINAL NDS ENTRIES<br />
|-<br />
| 0x000<br />
| 12<br />
| Game Title<br />
|-<br />
| 0x00C<br />
| 4<br />
| Gamecode<br />
|-<br />
| 0x010<br />
| 2<br />
| Makercode<br />
|-<br />
| 0x012<br />
| 1<br />
| Unitcode (00h=NDS, 02h=NDS+DSi, 03h=DSi) (bit1=DSi)<br />
<br />
|-<br />
| 0x013<br />
| 1<br />
| Encryption seed select<br />
|-<br />
| 0x014<br />
| 1<br />
| Devicecapacity<br />
|-<br />
| 0x015<br />
| 7<br />
| Reserved<br />
|-<br />
| 0x01C<br />
| 2<br />
| Unknown (used by DSi titles)<br />
|-<br />
| 0x01E<br />
| 1<br />
| ROM Version<br />
|-<br />
| 0x01F<br />
| 1<br />
| Internal flags, (Bit2: Autostart)<br />
|-<br />
| 0x020<br />
| 4<br />
| ARM9 rom offset<br />
|-<br />
| 0x024<br />
| 4<br />
| ARM9 entry address<br />
|-<br />
| 0x028<br />
| 4<br />
| ARM9 load address<br />
|-<br />
| 0x02C<br />
| 4<br />
| ARM9 size<br />
|-<br />
| 0x030<br />
| 4<br />
| ARM7 rom offset<br />
|-<br />
| 0x034<br />
| 4<br />
| ARM7 entry address<br />
|-<br />
| 0x038<br />
| 4<br />
| ARM7 load address<br />
|-<br />
| 0x03C<br />
| 4<br />
| ARM7 size<br />
|-<br />
| 0x040<br />
| 4<br />
| File Name Table (FNT) offset<br />
|-<br />
| 0x044<br />
| 4<br />
| File Name Table (FNT) length<br />
|-<br />
| 0x048<br />
| 4<br />
| File Allocation Table (FAT) offset<br />
|-<br />
| 0x04C<br />
| 4<br />
| File Allocation Table (FAT) length<br />
|-<br />
| 0x050<br />
| 4<br />
| ARM9 overlay offset<br />
|-<br />
| 0x054<br />
| 4<br />
| ARM9 overlay length<br />
|-<br />
| 0x058<br />
| 4<br />
| ARM7 overlay offset<br />
|-<br />
| 0x05C<br />
| 4<br />
| ARM7 overlay length<br />
|-<br />
| 0x060<br />
| 4<br />
| Normal card control register settings<br />
|-<br />
| 0x064<br />
| 4<br />
| Secure card control register settings<br />
|-<br />
| 0x068<br />
| 4<br />
| Icon Banner offset (same as NDS, but with new extra entries)<br />
<br />
|-<br />
| 0x06C<br />
| 2<br />
| Secure area (2K) CRC<br />
|-<br />
| 0x06E<br />
| 2<br />
| Secure transfer timeout<br />
|-<br />
| 0x070<br />
| 4<br />
| ARM9 autoload<br />
|-<br />
| 0x074<br />
| 4<br />
| ARM7 autoload<br />
|-<br />
| 0x078<br />
| 8<br />
| Secure disable<br />
|-<br />
| 0x080<br />
| 4<br />
| NTR region ROM size (excluding DSi area)<br />
|-<br />
| 0x084<br />
| 4<br />
| Header size<br />
|-<br />
| 0x088<br />
| 56<br />
| Reserved (0x88, 0x8C, 0x90 = Unknown, used by DSi)<br />
|-<br />
| 0x0C0<br />
| 156<br />
| Nintendo Logo<br />
|-<br />
| 0x15C<br />
| 2<br />
| Nintendo Logo CRC<br />
|-<br />
| 0x15E<br />
| 2<br />
| Header CRC<br />
|-<br />
| 0x160<br />
| 32<br />
| Debugger reserved<br />
|-<br />
! OFFSET<br />
! SIZE<br />
! DESCRIPTION - EXTENDED DSi ENTRIES<br />
|-<br />
| 0x180<br />
| 20<br />
| Global MBK1..MBK5 Settings<br />
|-<br />
| 0x194<br />
| 12<br />
| Local MBK6..MBK8 Settings for ARM9<br />
|-<br />
| 0x1A0<br />
| 12<br />
| Local MBK6..MBK8 Settings for ARM7<br />
|-<br />
| 0x1AC<br />
| 4<br />
| Global MBK9 Setting<br />
|-<br />
| 0x1B0<br />
| 4<br />
| Region Flags<br />
|-<br />
| 0x1B4<br />
| 4<br />
| Access control<br />
|-<br />
| 0x1B8<br />
| 4<br />
| ARM7 SCFG EXT mask (controls which devices to enable)<br />
|-<br />
| 0x1BC<br />
| 4<br />
| Reserved/flags? When bit2 of byte 0x1bf is set, usage of banner.sav from the title data dir is enabled.(additional banner data)<br />
|-<br />
| 0x1C0<br />
| 4<br />
| ARM9i rom offset<br />
|-<br />
| 0x1C4<br />
| 4<br />
| Reserved<br />
|-<br />
| 0x1C8<br />
| 4<br />
| ARM9i load address<br />
|-<br />
| 0x1CC<br />
| 4<br />
| ARM9i size<br />
|-<br />
| 0x1D0<br />
| 4<br />
| ARM7i rom offset<br />
|-<br />
| 0x1D4<br />
| 4<br />
| Pointer to [[base address where various structures and parameters are passed to the title]] - what is that???<br />
|-<br />
| 0x1D8<br />
| 4<br />
| ARM7i load address<br />
|-<br />
| 0x1DC<br />
| 4<br />
| ARM7i size<br />
|-<br />
| 0x1E0<br />
| 4<br />
| Digest NTR region offset<br />
|-<br />
| 0x1E4<br />
| 4<br />
| Digest NTR region length<br />
|-<br />
| 0x1E8<br />
| 4<br />
| Digest TWL region offset<br />
|-<br />
| 0x1EC<br />
| 4<br />
| Digest TWL region length<br />
|-<br />
| 0x1F0<br />
| 4<br />
| Digest Sector Hashtable offset<br />
|-<br />
| 0x1F4<br />
| 4<br />
| Digest Sector Hashtable length<br />
|-<br />
| 0x1F8<br />
| 4<br />
| Digest Block Hashtable offset<br />
|-<br />
| 0x1FC<br />
| 4<br />
| Digest Block Hashtable length<br />
|-<br />
| 0x200<br />
| 4<br />
| Digest Sector size<br />
|-<br />
| 0x204<br />
| 4<br />
| Digest Block sectorcount<br />
|-<br />
| 0x208<br />
| 4<br />
| Icon Banner Size (usually 0x23C0)<br />
|-<br />
| 0x20C<br />
| 4<br />
| Unknown (used by DSi)<br />
|-<br />
| 0x210<br />
| 4<br />
| NTR+TWL region ROM size (total size including DSi area)<br />
|-<br />
| 0x214<br />
| 12<br />
| Unknown (used by DSi)<br />
|-<br />
| 0x220<br />
| 4<br />
| Modcrypt area 1 offset<br />
|-<br />
| 0x224<br />
| 4<br />
| Modcrypt area 1 size<br />
|-<br />
| 0x228<br />
| 4<br />
| Modcrypt area 2 offset<br />
|-<br />
| 0x22C<br />
| 4<br />
| Modcrypt area 2 size<br />
|-<br />
| 0x230<br />
| 8<br />
| Title ID<br />
|-<br />
| 0x238<br />
| 4<br />
| DSiWare: "public.sav" size<br />
|-<br />
| 0x23C<br />
| 4<br />
| DSiWare: "private.sav" size<br />
|-<br />
| 0x240<br />
| 176<br />
| Reserved (zero)<br />
|-<br />
| 0x2F0<br />
| 16<br />
| Unknown (used by DSi)<br />
|-<br />
| 0x300<br />
| 20<br />
| ARM9 (with encrypted secure area) SHA1 HMAC hash<br />
|-<br />
| 0x314<br />
| 20<br />
| ARM7 SHA1 HMAC hash<br />
|-<br />
| 0x328<br />
| 20<br />
| Digest master SHA1 HMAC hash<br />
|-<br />
| 0x33C<br />
| 20<br />
| Banner SHA1 HMAC hash<br />
|-<br />
| 0x350<br />
| 20<br />
| ARM9i (decrypted) SHA1 HMAC hash<br />
|-<br />
| 0x364<br />
| 20<br />
| ARM7i (decrypted) SHA1 HMAC hash<br />
|-<br />
| 0x378<br />
| 40<br />
| Reserved<br />
|-<br />
| 0x3A0<br />
| 20<br />
| ARM9 (without secure area) SHA1 HMAC hash<br />
|-<br />
| 0x3B4<br />
| 2636<br />
| Reserved<br />
|-<br />
| 0xE00<br />
| 0x180<br />
| Reserved and unchecked region, always zero. Used for passing arguments in debug environment.<br />
|-<br />
| 0xF80<br />
| 0x80<br />
| RSA signature (the first 0xE00 bytes of the header are signed with an 1024-bit RSA signature).<br />
|}<br />
<br />
= Modcrypt =<br />
Modcrypt is a new additional way of encrypting parts of the NDS ROM executable binary modules using AES CTR. It is mostly being used to encrypt the ARM9i and ARM7i binaries. For example, DSi hybrid card based games have only the ARM9i binary encrypted, while NAND based applications have both the ARM9i and ARM7i binaries encrypted. The modcrypt areas can span over any of the ARM9/ARM7/ARM9i/ARM7i areas.<br />
<br />
The AES counter used for modcrypt area 1 is the first 16 bytes of the ARM9 SHA1 HMAC hash (0x300), and for area 2 the first 16 bytes of the ARM7 SHA1 HMAC hash (0x314). The AES key used is a little more complicated. The header can specify to use a secure or insecure key:<br />
<br />
if ( (header[0x1C] & 4) || (header[0x1BF] & 0x80) )<br />
keytype = INSECURE;<br />
else<br />
keytype = SECURE;<br />
<br />
The insecure key is simply the first 16 bytes of the header. The secure key is constructed from a scrambled key pair, where one part is based on an 8-byte shared secret between all DSi's and an 8-byte expanded gamecode, and the other part is based on the first 16 bytes of the ARM9i SHA1 HMAC hash (0x350). The key pair is scrambled in an unknown way to form the final secure key. <br />
<br />
It is likely that the insecure key is only used for a debug version of an application, since most card based and NAND based applications are using the secure key.<br />
<br />
<br />
= Digests =<br />
The NDS format has been extended with a hash tree to verify the entire contents of an NDS ROM. The NDS ROM is divided into sectors, and each sector will be hashed and have its hash stored in the digest sector hashtable. The size of a sector is defined in the header aswell. Furthermore, the sector hashtable is partitioned and hashed again to form block hashes. This block hashtable is hashed again into a single hash called the digest master hash. These hashtables can be used to verify that the sectors of a NDS ROM have not been tampered with, since the integrity of a sector hash can be verified by a block hash, which in turn can be verified by the master hash. And this hash is part of the header, which is signed with RSA.<br />
<br />
The sector hashtable reaches over the NTR and TWL regions, respectively.<br />
<br />
= See Also =<br />
<br />
* [[Card hardware]] - cartridge bus protocol<br />
* [[Bootloader]] - boot procedure</div>Nocashhttps://dsibrew.org/w/index.php?title=Stage2&diff=2098783Stage22015-03-27T14:46:15Z<p>Nocash: /* Stage 2 */</p>
<hr />
<div>== Stage 1 ==<br />
<br />
[[Image:boot-stage1-error.jpeg|frame|When the Stage 1 bootloader (in ROM) fails, it displays a 32-bit hexadecimal number on the top screen.]]<br />
<br />
The first stage of the DSi's bootloader lives in ROM, presumably on the CPU die. It loads further encrypted+signed stages from [[NAND]] flash, starting with a plaintext offset table in the sector at offset 0x200.<br />
<br />
Not much is known about this bootloader yet, but it presumably knows how to:<br />
# Initialize the encryption hardware<br />
# Read the contents of [[NVRAM]]<br />
# Initialize both LCDs<br />
# Read blocks (but not files) from the [[NAND]] flash<br />
# Perform some variety of integrity check on all data it reads (signature, CRC, ?)<br />
# Display basic hexadecimal error codes<br />
# Possibly factory-programming the [[NAND]] flash?<br />
# Might also do basic power-on self test of peripherals <br />
<br />
Known error codes:<br />
<br />
{| border="1" cellpadding="3" cellspacing="0"<br />
! Error Code !! Description<br />
|-<br />
| 0000FE00 || Error communicating with NAND chip. (It's missing, CLK is shorted, etc.)<br />
|-<br />
| 0000FEFC || Integrity error in first block of Stage 2 (address at 0x220)<br />
|-<br />
| 0000FEFD || Integrity error in second block of Stage 2 (address at 0x230)<br />
|-<br />
| 0000FEFE || Boot sector integrity error (Sector 0x200 not valid), or error in [[NVRAM]] contents.<br />
|}<br />
<br />
== Stage 2 ==<br />
<br />
[[Image:boot-stage2-error.jpeg|frame|This may have been a Stage 2 bootloader error.]]<br />
<br />
Unlike the stage1 bootloader, which must be small enough to fit in ROM (probably several kilobytes), the stage2 bootloader has about a megabyte of NAND flash reserved for it. The stage2 bootloader understands partitions and filesystems, and it is capable of loading the DSi menu. It also must understand the encryption used on filesystem blocks in the NAND, and it must understand how to load and validate title metadata.<br />
<br />
The Stage 2 loader was not modified by the [[System Menu 1.4]] update. This is still earlier in the boot process than the "Health and Safety" warning(that warning is displayed by the sysmenu).<br />
<br />
The first stage bootloader reads the sector at offset 0x200 in order to find a table of offsets to the Stage 2 bootloader:<br />
<br />
00000220 00 08 00 00 10 64 02 00 00 80 7b 03 00 66 02 00 |.....d....{..f..|<br />
00000230 00 6e 02 00 88 75 02 00 00 80 7b 03 00 76 02 00 |.n...u....{..v..|<br />
00000240 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|<br />
<br />
This is describing two chunks of the stage2 loader: the ARM9-binary 0x26410 bytes in length at address 0x800, and the ARM7-binary 0x27588 bytes at address 0x26e00.<br />
<br />
Structure of this header:<br />
{| border="1" cellpadding="3" cellspacing="0"<br />
! Offset<br />
! Size<br />
! Description<br />
|-<br />
| 0x0<br />
| 0x20<br />
| Reserved (zerofilled)<br />
|-<br />
| 0x20<br />
| 0x4<br />
| ARM9 Bootcode, eMMC Source Offset<br />
|-<br />
| 0x24<br />
| 0x4<br />
| ARM9 Bootcode, Size "Actual binary size"<br />
|-<br />
| 0x28<br />
| 0x4<br />
| ARM9 Bootcode, RAM Destination Address and Entrypoint<br />
|-<br />
| 0x2C<br />
| 0x4<br />
| ARM9 Bootcode, Size rounded up to multiple of 0x200<br />
|-<br />
| 0x30<br />
| 0x4<br />
| ARM7 Bootcode, eMMC Source Offset<br />
|-<br />
| 0x34<br />
| 0x4<br />
| ARM7 Bootcode, Size "Actual binary size"<br />
|-<br />
| 0x38<br />
| 0x4<br />
| ARM7 Bootcode, RAM Destination Address and Entrypoint<br />
|-<br />
| 0x3C<br />
| 0x4<br />
| ARM7 Bootcode, Size rounded up to multiple of 0x200<br />
|-<br />
| 0x40<br />
| 0xBF<br />
| Reserved (zerofilled)<br />
|-<br />
| 0xFF<br />
| 0x1<br />
| Unknown, value 0xFF? (actually, this is appears to be always 0Ch, not FFh?)<br />
|-<br />
| 0x100<br />
| 0x80<br />
| RSA-1024 Data Block<br />
|-<br />
| 0x180<br />
| 0x14<br />
| Global MBK1..MBK5 Slot Settings<br />
|-<br />
| 0x194<br />
| 0xC<br />
| Local MBK6..MBK8 Settings for ARM9 Side<br />
|-<br />
| 0x1A0<br />
| 0xC<br />
| Local MBK6..MBK8 Settings for ARM7 Side<br />
|-<br />
| 0x1AC<br />
| 0x4<br />
| Global MBK9 Slot Master Setting<br />
|-<br />
| 0x1B0<br />
| 0x50<br />
| Reserved (zerofilled)<br />
|}<br />
<br />
Note that the above format resembles the [[DSi Cartridge Header]] (entries 0x20-0x3F are roughly similar, and entries 0x180-0x1AF appear to be same as in cart header).<br />
<br />
<br />
Below is some interesting info on the RSA Data Block, but it's unclear if or how that data block has been decrypted, and if it has been done on DSi or 3DS (or both).<br />
<br />
In practice, bootcode decryption isn't possible because the RSA key is unknown, keyY is also unknown (when not knowing the RSA key), and keyX is also unknown (it's said to be same as for Tad; which is unknown, it isn't included in the "srl extract" utility), and the "binblksize" value for CTR is also unclear (it might be same as "'''binblk->'''binbl'''oc'''ksize" though).<br />
<br />
Structure of the 0x74-byte "hash-data" stored in the RSA message:<br />
{| border="1" cellpadding="3" cellspacing="0"<br />
! Offset<br />
! Size<br />
! Description<br />
|-<br />
| 0x0<br />
| 0x10<br />
| [[AES_Engine]] keyY used for the ARM9/ARM7 binaries crypto.<br />
|-<br />
| 0x10<br />
| 0x14<br />
| SHA1 hash. Going by 3DS TWL_FIRM this seems to calculated over the first 0x28-bytes of [[NAND]], then the first 0x100-bytes of the header, then the last 0x80-bytes of the header(following the signature). This works with the bootloader contained in TWL_FIRM, however it's unknown how the first part is handled on DSi.<br />
|-<br />
| 0x24<br />
| 0x14<br />
| SHA1 hash over the plaintext ARM9 binary, with the actual binary size.<br />
|-<br />
| 0x38<br />
| 0x14<br />
| SHA1 hash over the plaintext ARM7 binary, with the actual binary size.<br />
|-<br />
| 0x4C<br />
| 0x14<br />
| Unknown, not used by 3DS TWL_FIRM. Normally all-zero.<br />
|-<br />
| 0x60<br />
| 0x14<br />
| Unknown, not used by 3DS TWL_FIRM.<br />
|}<br />
<br />
Note that this sector (and two similar ones at 0x400 and 0x600) appear to be the only unencrypted blocks on the NAND flash.<br />
<br />
After loading+verifying the the above header, the ARM7 binary is loaded+verified, then the ARM9 binary is loaded+verified.<br />
<br />
Whereas the filesystem data in NAND is encrypted using a unique key for every DSi, the stage2 bootloader is identical on every DSi tested so far. The stage2 bootloader binaries are not encrypted with any console-unique keys.<br />
<br />
Stage1 uses the [[AES_Engine]] to decrypt each ARM9/ARM7 binary, where keyY is from the above signature. The [[AES_Engine]] keyslot used here is the same one used for the shared areas for [[Tad]], therefore the keyX is the same as the one used for that. The following is used for the CTR, where "binblk->binblocksize" is the actual binary size:<br />
<br />
unsigned int ctr[4];<br />
memset(ctr, 0, 16);<br />
<br />
ctr[0] = binblk->binblocksize;<br />
ctr[1] = (unsigned int)(-binblksize);<br />
ctr[2] = ~binblk->binblocksize;<br />
<br />
=== Stage2 operations ===<br />
After Stage 2 is loaded:<br />
# The NAND flash is partially re-initialized<br />
# Sector 0 is read from the NAND. This appears to be an (encrypted) DOS-style MBR.<br />
# The MBR signature and the type of the first partition are verified.<br />
# Filesystem metadata is read from sectors starting around 0x100000. The metadata is in FAT16 format with long filenames.<br />
# Multiple files are loaded from the filesystem. The exact read addresses will vary depending on your DSi's firmware version and the state of its filesystem when you performed the last firmware update. On a brand new DSi, it appears that the DSi Menu itself is loaded from 0xb20000 after two small metadata files are read from 0xb1c000 and 0x7a0000.<br />
<br />
All errors show before the health and safety screen. It appears that stage2 errors from a cold power-on always cause the DSi to hang at a black screen, whereas stage2 errors after reset (pressing but not holding the power button) will give an error message screen. Known errors:<br />
<br />
{| border="1" cellpadding="3" cellspacing="0"<br />
! Text !! Description<br />
|-<br />
| "Error: 1-2435-8325" || Invalid signature or partition type in MBR, invalid starting LBA.<br />
|-<br />
| "Error: 3-2435-8325" || DSi Menu integrity checks failed<br />
|-<br />
|}</div>Nocashhttps://dsibrew.org/w/index.php?title=Stage2&diff=2098782Stage22015-03-27T14:38:33Z<p>Nocash: </p>
<hr />
<div>== Stage 1 ==<br />
<br />
[[Image:boot-stage1-error.jpeg|frame|When the Stage 1 bootloader (in ROM) fails, it displays a 32-bit hexadecimal number on the top screen.]]<br />
<br />
The first stage of the DSi's bootloader lives in ROM, presumably on the CPU die. It loads further encrypted+signed stages from [[NAND]] flash, starting with a plaintext offset table in the sector at offset 0x200.<br />
<br />
Not much is known about this bootloader yet, but it presumably knows how to:<br />
# Initialize the encryption hardware<br />
# Read the contents of [[NVRAM]]<br />
# Initialize both LCDs<br />
# Read blocks (but not files) from the [[NAND]] flash<br />
# Perform some variety of integrity check on all data it reads (signature, CRC, ?)<br />
# Display basic hexadecimal error codes<br />
# Possibly factory-programming the [[NAND]] flash?<br />
# Might also do basic power-on self test of peripherals <br />
<br />
Known error codes:<br />
<br />
{| border="1" cellpadding="3" cellspacing="0"<br />
! Error Code !! Description<br />
|-<br />
| 0000FE00 || Error communicating with NAND chip. (It's missing, CLK is shorted, etc.)<br />
|-<br />
| 0000FEFC || Integrity error in first block of Stage 2 (address at 0x220)<br />
|-<br />
| 0000FEFD || Integrity error in second block of Stage 2 (address at 0x230)<br />
|-<br />
| 0000FEFE || Boot sector integrity error (Sector 0x200 not valid), or error in [[NVRAM]] contents.<br />
|}<br />
<br />
== Stage 2 ==<br />
<br />
[[Image:boot-stage2-error.jpeg|frame|This may have been a Stage 2 bootloader error.]]<br />
<br />
Unlike the stage1 bootloader, which must be small enough to fit in ROM (probably several kilobytes), the stage2 bootloader has about a megabyte of NAND flash reserved for it. The stage2 bootloader understands partitions and filesystems, and it is capable of loading the DSi menu. It also must understand the encryption used on filesystem blocks in the NAND, and it must understand how to load and validate title metadata.<br />
<br />
The Stage 2 loader was not modified by the [[System Menu 1.4]] update. This is still earlier in the boot process than the "Health and Safety" warning(that warning is displayed by the sysmenu).<br />
<br />
The first stage bootloader reads the sector at offset 0x200 in order to find a table of offsets to the Stage 2 bootloader:<br />
<br />
00000220 00 08 00 00 10 64 02 00 00 80 7b 03 00 66 02 00 |.....d....{..f..|<br />
00000230 00 6e 02 00 88 75 02 00 00 80 7b 03 00 76 02 00 |.n...u....{..v..|<br />
00000240 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|<br />
<br />
This is describing two chunks of the stage2 loader: the ARM9-binary 0x26410 bytes in length at address 0x800, and the ARM7-binary 0x27588 bytes at address 0x26e00.<br />
<br />
Structure of this header:<br />
{| border="1" cellpadding="3" cellspacing="0"<br />
! Offset<br />
! Size<br />
! Description<br />
|-<br />
| 0x0<br />
| 0x20<br />
| Reserved (zerofilled)<br />
|-<br />
| 0x20<br />
| 0x4<br />
| ARM9 Bootcode, eMMC Source Offset<br />
|-<br />
| 0x24<br />
| 0x4<br />
| ARM9 Bootcode, Size "Actual binary size"<br />
|-<br />
| 0x28<br />
| 0x4<br />
| ARM9 Bootcode, RAM Destination Address and Entrypoint<br />
|-<br />
| 0x2C<br />
| 0x4<br />
| ARM9 Bootcode, Size rounded up to multiple of 0x200<br />
|-<br />
| 0x30<br />
| 0x4<br />
| ARM7 Bootcode, eMMC Source Offset<br />
|-<br />
| 0x34<br />
| 0x4<br />
| ARM7 Bootcode, Size "Actual binary size"<br />
|-<br />
| 0x38<br />
| 0x4<br />
| ARM7 Bootcode, RAM Destination Address and Entrypoint<br />
|-<br />
| 0x3C<br />
| 0x4<br />
| ARM7 Bootcode, Size rounded up to multiple of 0x200<br />
|-<br />
| 0x40<br />
| 0xBF<br />
| Reserved (zerofilled)<br />
|-<br />
| 0xFF<br />
| 0x1<br />
| Unknown, value 0xFF? (actually, this is appears to be always 0Ch, not FFh?)<br />
|-<br />
| 0x100<br />
| 0x80<br />
| RSA-1024 Data Block<br />
|-<br />
| 0x180<br />
| 0x14<br />
| Global MBK1..MBK5 Slot Settings<br />
|-<br />
| 0x194<br />
| 0xC<br />
| Local MBK6..MBK8 Settings for ARM9 Side<br />
|-<br />
| 0x1A0<br />
| 0xC<br />
| Local MBK6..MBK8 Settings for ARM7 Side<br />
|-<br />
| 0x1AC<br />
| 0x4<br />
| Global MBK9 Slot Master Setting<br />
|-<br />
| 0x1B0<br />
| 0x50<br />
| Reserved (zerofilled)<br />
|}<br />
<br />
Below is some interesting info on the RSA Data Block, but it's unclear if or how that data block has been decrypted, and if it has been done on DSi or 3DS (or both).<br />
<br />
In practice, bootcode decryption isn't possible because the RSA key is unknown, keyY is also unknown (when not knowing the RSA key), and keyX is also unknown (it's said to be same as for Tad; which is unknown, it isn't included in the "srl extract" utility), and the "binblksize" value for CTR is also unclear (it might be same as "'''binblk->'''binbl'''oc'''ksize" though).<br />
<br />
Structure of the 0x74-byte "hash-data" stored in the RSA message:<br />
{| border="1" cellpadding="3" cellspacing="0"<br />
! Offset<br />
! Size<br />
! Description<br />
|-<br />
| 0x0<br />
| 0x10<br />
| [[AES_Engine]] keyY used for the ARM9/ARM7 binaries crypto.<br />
|-<br />
| 0x10<br />
| 0x14<br />
| SHA1 hash. Going by 3DS TWL_FIRM this seems to calculated over the first 0x28-bytes of [[NAND]], then the first 0x100-bytes of the header, then the last 0x80-bytes of the header(following the signature). This works with the bootloader contained in TWL_FIRM, however it's unknown how the first part is handled on DSi.<br />
|-<br />
| 0x24<br />
| 0x14<br />
| SHA1 hash over the plaintext ARM9 binary, with the actual binary size.<br />
|-<br />
| 0x38<br />
| 0x14<br />
| SHA1 hash over the plaintext ARM7 binary, with the actual binary size.<br />
|-<br />
| 0x4C<br />
| 0x14<br />
| Unknown, not used by 3DS TWL_FIRM. Normally all-zero.<br />
|-<br />
| 0x60<br />
| 0x14<br />
| Unknown, not used by 3DS TWL_FIRM.<br />
|}<br />
<br />
Note that this sector (and two similar ones at 0x400 and 0x600) appear to be the only unencrypted blocks on the NAND flash.<br />
<br />
After loading+verifying the the above header, the ARM7 binary is loaded+verified, then the ARM9 binary is loaded+verified.<br />
<br />
Whereas the filesystem data in NAND is encrypted using a unique key for every DSi, the stage2 bootloader is identical on every DSi tested so far. The stage2 bootloader binaries are not encrypted with any console-unique keys.<br />
<br />
Stage1 uses the [[AES_Engine]] to decrypt each ARM9/ARM7 binary, where keyY is from the above signature. The [[AES_Engine]] keyslot used here is the same one used for the shared areas for [[Tad]], therefore the keyX is the same as the one used for that. The following is used for the CTR, where "binblk->binblocksize" is the actual binary size:<br />
<br />
unsigned int ctr[4];<br />
memset(ctr, 0, 16);<br />
<br />
ctr[0] = binblk->binblocksize;<br />
ctr[1] = (unsigned int)(-binblksize);<br />
ctr[2] = ~binblk->binblocksize;<br />
<br />
=== Stage2 operations ===<br />
After Stage 2 is loaded:<br />
# The NAND flash is partially re-initialized<br />
# Sector 0 is read from the NAND. This appears to be an (encrypted) DOS-style MBR.<br />
# The MBR signature and the type of the first partition are verified.<br />
# Filesystem metadata is read from sectors starting around 0x100000. The metadata is in FAT16 format with long filenames.<br />
# Multiple files are loaded from the filesystem. The exact read addresses will vary depending on your DSi's firmware version and the state of its filesystem when you performed the last firmware update. On a brand new DSi, it appears that the DSi Menu itself is loaded from 0xb20000 after two small metadata files are read from 0xb1c000 and 0x7a0000.<br />
<br />
All errors show before the health and safety screen. It appears that stage2 errors from a cold power-on always cause the DSi to hang at a black screen, whereas stage2 errors after reset (pressing but not holding the power button) will give an error message screen. Known errors:<br />
<br />
{| border="1" cellpadding="3" cellspacing="0"<br />
! Text !! Description<br />
|-<br />
| "Error: 1-2435-8325" || Invalid signature or partition type in MBR, invalid starting LBA.<br />
|-<br />
| "Error: 3-2435-8325" || DSi Menu integrity checks failed<br />
|-<br />
|}</div>Nocashhttps://dsibrew.org/w/index.php?title=Stage2&diff=2098781Stage22015-03-27T14:36:33Z<p>Nocash: </p>
<hr />
<div>== Stage 1 ==<br />
<br />
[[Image:boot-stage1-error.jpeg|frame|When the Stage 1 bootloader (in ROM) fails, it displays a 32-bit hexadecimal number on the top screen.]]<br />
<br />
The first stage of the DSi's bootloader lives in ROM, presumably on the CPU die. It loads further encrypted+signed stages from [[NAND]] flash, starting with a plaintext offset table in the sector at offset 0x200.<br />
<br />
Not much is known about this bootloader yet, but it presumably knows how to:<br />
# Initialize the encryption hardware<br />
# Read the contents of [[NVRAM]]<br />
# Initialize both LCDs<br />
# Read blocks (but not files) from the [[NAND]] flash<br />
# Perform some variety of integrity check on all data it reads (signature, CRC, ?)<br />
# Display basic hexadecimal error codes<br />
# Possibly factory-programming the [[NAND]] flash?<br />
# Might also do basic power-on self test of peripherals <br />
<br />
Known error codes:<br />
<br />
{| border="1" cellpadding="3" cellspacing="0"<br />
! Error Code !! Description<br />
|-<br />
| 0000FE00 || Error communicating with NAND chip. (It's missing, CLK is shorted, etc.)<br />
|-<br />
| 0000FEFC || Integrity error in first block of Stage 2 (address at 0x220)<br />
|-<br />
| 0000FEFD || Integrity error in second block of Stage 2 (address at 0x230)<br />
|-<br />
| 0000FEFE || Boot sector integrity error (Sector 0x200 not valid), or error in [[NVRAM]] contents.<br />
|}<br />
<br />
== Stage 2 ==<br />
<br />
[[Image:boot-stage2-error.jpeg|frame|This may have been a Stage 2 bootloader error.]]<br />
<br />
Unlike the stage1 bootloader, which must be small enough to fit in ROM (probably several kilobytes), the stage2 bootloader has about a megabyte of NAND flash reserved for it. The stage2 bootloader understands partitions and filesystems, and it is capable of loading the DSi menu. It also must understand the encryption used on filesystem blocks in the NAND, and it must understand how to load and validate title metadata.<br />
<br />
The Stage 2 loader was not modified by the [[System Menu 1.4]] update. This is still earlier in the boot process than the "Health and Safety" warning(that warning is displayed by the sysmenu).<br />
<br />
The first stage bootloader reads the sector at offset 0x200 in order to find a table of offsets to the Stage 2 bootloader:<br />
<br />
00000220 00 08 00 00 10 64 02 00 00 80 7b 03 00 66 02 00 |.....d....{..f..|<br />
00000230 00 6e 02 00 88 75 02 00 00 80 7b 03 00 76 02 00 |.n...u....{..v..|<br />
00000240 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|<br />
<br />
This is describing two chunks of the stage2 loader: the ARM9-binary 0x26410 bytes in length at address 0x800, and the ARM7-binary 0x27588 bytes at address 0x26e00.<br />
<br />
Structure of this header:<br />
{| border="1" cellpadding="3" cellspacing="0"<br />
! Offset<br />
! Size<br />
! Description<br />
|-<br />
| 0x0<br />
| 0x20<br />
| Reserved (zerofilled)<br />
|-<br />
| 0x20<br />
| 0x4<br />
| ARM9 Bootcode, eMMC Source Offset<br />
|-<br />
| 0x24<br />
| 0x4<br />
| ARM9 Bootcode, Size "Actual binary size"<br />
|-<br />
| 0x28<br />
| 0x4<br />
| ARM9 Bootcode, RAM Destination Address and Entrypoint<br />
|-<br />
| 0x2C<br />
| 0x4<br />
| ARM9 Bootcode, Size rounded up to multiple of 0x200<br />
|-<br />
| 0x30<br />
| 0x4<br />
| ARM7 Bootcode, eMMC Source Offset<br />
|-<br />
| 0x34<br />
| 0x4<br />
| ARM7 Bootcode, Size "Actual binary size"<br />
|-<br />
| 0x38<br />
| 0x4<br />
| ARM7 Bootcode, RAM Destination Address and Entrypoint<br />
|-<br />
| 0x3C<br />
| 0x4<br />
| ARM7 Bootcode, Size rounded up to multiple of 0x200<br />
|-<br />
| 0x40<br />
| 0xBF<br />
| Reserved (zerofilled)<br />
|-<br />
| 0xFF<br />
| 0x1<br />
| Unknown, value 0xFF? (actually, this is appears to be always 0Ch, not FFh?)<br />
|-<br />
| 0x100<br />
| 0x80<br />
| RSA-1024 Data Block<br />
|-<br />
| 0x180<br />
| 0x14<br />
| Global MBK1..MBK5 Slot Settings<br />
|-<br />
| 0x194<br />
| 0xC<br />
| Local MBK8..MBK9 Settings for ARM9 Side<br />
|-<br />
| 0x1A0<br />
| 0xC<br />
| Local MBK8..MBK9 Settings for ARM7 Side<br />
|-<br />
| 0x1AC<br />
| 0x4<br />
| Global MBK9 Slot Master Setting<br />
|-<br />
| 0x1B0<br />
| 0x50<br />
| Reserved (zerofilled)<br />
|}<br />
<br />
Below is some interesting info on the RSA Data Block, but it's unclear if or how that data block has been decrypted, and if it has been done on DSi or 3DS (or both).<br />
<br />
In practice, bootcode decryption isn't possible because the RSA key is unknown, keyY is also unknown (when not knowing the RSA key), and keyX is also unknown (it's said to be same as for Tad; which is unknown, it isn't included in the "srl extract" utility), and the "binblksize" value for CTR is also unclear (it might be same as "'''binblk->'''binbl'''oc'''ksize" though).<br />
<br />
Structure of the 0x74-byte "hash-data" stored in the RSA message:<br />
{| border="1" cellpadding="3" cellspacing="0"<br />
! Offset<br />
! Size<br />
! Description<br />
|-<br />
| 0x0<br />
| 0x10<br />
| [[AES_Engine]] keyY used for the ARM9/ARM7 binaries crypto.<br />
|-<br />
| 0x10<br />
| 0x14<br />
| SHA1 hash. Going by 3DS TWL_FIRM this seems to calculated over the first 0x28-bytes of [[NAND]], then the first 0x100-bytes of the header, then the last 0x80-bytes of the header(following the signature). This works with the bootloader contained in TWL_FIRM, however it's unknown how the first part is handled on DSi.<br />
|-<br />
| 0x24<br />
| 0x14<br />
| SHA1 hash over the plaintext ARM9 binary, with the actual binary size.<br />
|-<br />
| 0x38<br />
| 0x14<br />
| SHA1 hash over the plaintext ARM7 binary, with the actual binary size.<br />
|-<br />
| 0x4C<br />
| 0x14<br />
| Unknown, not used by 3DS TWL_FIRM. Normally all-zero.<br />
|-<br />
| 0x60<br />
| 0x14<br />
| Unknown, not used by 3DS TWL_FIRM.<br />
|}<br />
<br />
Note that this sector (and two similar ones at 0x400 and 0x600) appear to be the only unencrypted blocks on the NAND flash.<br />
<br />
After loading+verifying the the above header, the ARM7 binary is loaded+verified, then the ARM9 binary is loaded+verified.<br />
<br />
Whereas the filesystem data in NAND is encrypted using a unique key for every DSi, the stage2 bootloader is identical on every DSi tested so far. The stage2 bootloader binaries are not encrypted with any console-unique keys.<br />
<br />
Stage1 uses the [[AES_Engine]] to decrypt each ARM9/ARM7 binary, where keyY is from the above signature. The [[AES_Engine]] keyslot used here is the same one used for the shared areas for [[Tad]], therefore the keyX is the same as the one used for that. The following is used for the CTR, where "binblk->binblocksize" is the actual binary size:<br />
<br />
unsigned int ctr[4];<br />
memset(ctr, 0, 16);<br />
<br />
ctr[0] = binblk->binblocksize;<br />
ctr[1] = (unsigned int)(-binblksize);<br />
ctr[2] = ~binblk->binblocksize;<br />
<br />
=== Stage2 operations ===<br />
After Stage 2 is loaded:<br />
# The NAND flash is partially re-initialized<br />
# Sector 0 is read from the NAND. This appears to be an (encrypted) DOS-style MBR.<br />
# The MBR signature and the type of the first partition are verified.<br />
# Filesystem metadata is read from sectors starting around 0x100000. The metadata is in FAT16 format with long filenames.<br />
# Multiple files are loaded from the filesystem. The exact read addresses will vary depending on your DSi's firmware version and the state of its filesystem when you performed the last firmware update. On a brand new DSi, it appears that the DSi Menu itself is loaded from 0xb20000 after two small metadata files are read from 0xb1c000 and 0x7a0000.<br />
<br />
All errors show before the health and safety screen. It appears that stage2 errors from a cold power-on always cause the DSi to hang at a black screen, whereas stage2 errors after reset (pressing but not holding the power button) will give an error message screen. Known errors:<br />
<br />
{| border="1" cellpadding="3" cellspacing="0"<br />
! Text !! Description<br />
|-<br />
| "Error: 1-2435-8325" || Invalid signature or partition type in MBR, invalid starting LBA.<br />
|-<br />
| "Error: 3-2435-8325" || DSi Menu integrity checks failed<br />
|-<br />
|}</div>Nocashhttps://dsibrew.org/w/index.php?title=Talk:Stage2&diff=2098780Talk:Stage22015-03-27T13:27:36Z<p>Nocash: /* RSA and Bootsector decryption? */</p>
<hr />
<div>== RSA and Bootsector decryption? ==<br />
<br />
Where is that RSA info from? Is it possible to decrypt the RSA block on DSi, or on 3DS, or both?<br />
Any hints how to do that? Are DSi and 3DS using the same RSA key?<br />
<br />
The notice about keyX being same as for "Tad" sounds good... until one figures out that the "srl extract" utility contains only a normal "key" (not a keyX/Y pair), so decrypting isn't possible even when knowing keyY.<br />
Of course, whomever has found the normal key, should be also able to find the keyX/Y values, but I've no idea how that could be done (it will certainly not work with cooking coach which has all keyslots erased, so it might require main ram hacks in worst case).<br />
<br />
The part about ''"binblk->binblocksize" is the actual binary size'' is confusing. If '''binblk->binblocksize''' is known, then what is '''binblocksize''' in the formula? Or is that a typo, and it means same as '''binblk->binblocksize'''?[[User:Nocash|Nocash]] 14:27, 27 March 2015 (CET)<br />
<br />
== Bootloader Error Photos ==<br />
<br />
[[File:1124101052.jpg|200px|thumb|left]]<br />
[[File:1124101051.jpg|200px|thumb|left]]<br />
[[File:1124101051a.jpg|200px|thumb|left]]<br />
<br />
Here are some shots of my DSi with what I think is a bootloader error. --[[User:The2Banned2One|The2Banned2One]] 17:25, 24 November 2010 (CET)<br />
<br />
----<br />
<br />
'''Discuss here:'''</div>Nocashhttps://dsibrew.org/w/index.php?title=Talk:Stage2&diff=2098779Talk:Stage22015-03-27T13:20:00Z<p>Nocash: </p>
<hr />
<div>== RSA and Bootsector decryption? ==<br />
<br />
Where is that RSA info from? Is it possible to decrypt the RSA block on DSi, or on 3DS, or both?<br />
Any hints how to do that? Are DSi and 3DS using the same RSA key?<br />
<br />
The notice about keyX being same as for "Tad" sounds good... until one figures out that the "srl extract" utility contains only a normal "key" (not a keyX/Y pair), so decrypting isn't possible even when knowing keyY.<br />
Of course, whomever has found the normal key, should be also able to find the keyX/Y values, but I've no idea how that could be done (it will certainly not work with cooking coach which has all keyslots erased, so it might require main ram hacks in worst case).<br />
<br />
The part about ''"binblk->binblocksize" is the actual binary size'' is confusing. If '''binblk->binblocksize''' is known, then what is '''binblocksize''' in the formula? Or is that a typo, and it means same as '''binblk->binblocksize'''?<br />
<br />
== Bootloader Error Photos ==<br />
<br />
[[File:1124101052.jpg|200px|thumb|left]]<br />
[[File:1124101051.jpg|200px|thumb|left]]<br />
[[File:1124101051a.jpg|200px|thumb|left]]<br />
<br />
Here are some shots of my DSi with what I think is a bootloader error. --[[User:The2Banned2One|The2Banned2One]] 17:25, 24 November 2010 (CET)<br />
<br />
----<br />
<br />
'''Discuss here:'''</div>Nocashhttps://dsibrew.org/w/index.php?title=Nintendo_DS_Cart_Whitelist&diff=2098778Nintendo DS Cart Whitelist2015-03-27T12:57:07Z<p>Nocash: Undo revision 2455 by Zbrahead91 (talk)</p>
<hr />
<div>== Description ==<br />
If i remember correctly, HNHA.bin is a file stored in the DSi (NAND fs ?), that contains a list of white listed DS games.<br />
<br />
== Basic HNHA.bin File Structure ==<br />
<br />
The file consists in one header, a list of Titles and a footer.<br />
<br />
=== Header Structure ===<br />
The header is 136 bytes.<br />
{| class="wikitable"<br />
|- style="background-color: #ddd;"<br />
! Start<br />
! Length<br />
! Description<br />
|-<br />
| 0x00<br />
| 4<br />
| An ID (NDHT)<br />
|-<br />
| 0x04<br />
| 0x80<br />
| Unknown<br />
|-<br />
| 0x84<br />
| 4<br />
| Number of titles in file<br />
|}<br />
<br />
=== Title Structure ===<br />
A title is 48 bytes.<br />
{| class="wikitable"<br />
|- style="background-color: #ddd;"<br />
! Start<br />
! Length<br />
! Description<br />
|-<br />
| 0x00<br />
| 4<br />
| The title ID<br />
|-<br />
| 0x04<br />
| 4<br />
| The title version<br />
|-<br />
| 0x08<br />
| 20<br />
| The first SHA-1 sum<br />
|-<br />
| 0x1C<br />
| 20<br />
| The second SHA-1 sum<br />
|}<br />
<br />
=== Footer Structure ===<br />
The footer is 24 bytes.<br />
{| class="wikitable"<br />
|- style="background-color: #ddd;"<br />
! Start<br />
! Length<br />
! Description<br />
|-<br />
| 0x00<br />
| 24<br />
| Unknown<br />
|}</div>Nocashhttps://dsibrew.org/w/index.php?title=Nintendo_DSi_Sound&diff=2098777Nintendo DSi Sound2015-03-27T12:55:20Z<p>Nocash: Undo revision 4316 by ToniHensley1973 (talk)</p>
<hr />
<div>{{stub}}<br />
<br />
Nintendo DSi Sound is an sound application built into the Nintendo DSi to play and play WITH music files in the AAC format and utilizes its microphone.<br />
<br />
== Description ==<br />
<br />
Nintendo DSi Sound is an application that ship with the Nintendo DSi. With it, you can listen and "play with" AAC audio files stored on a memory card. You can also record and edit your own voice. It can't play MP3 audio files. The sound application can also browse through folders that you store your music in. For instance, you can make a folder on the SD card that is named "Country" and put all of your country music in it and when you are looking for music on the channel you will see the folder "Country" and be able to see all of the music, and play, all the music that has been put in it. This can help you organize your music if you have a lot of it on the SD card. Note that there is a 3,000 song display limit on the Nintendo DSi.<br />
<br />
== Converting to supported formats ==<br />
<br />
=== Convert music to an AAC format using BonkEnc encoder ===<br />
<br />
* Download and install the application [http://mesh.dl.sourceforge.net/sourceforge/bonkenc/BonkEnc-1.0.11.exe BonkEnc]<br />
* Add your music (in your computer) with the red icon or add your music (in a CD) with the blue icon<br />
[[Image:Convert_music_DSi.gif]]<br />
* Now, click on the red icon to configure the encoder<br />
[[Image:Convert_music_DSi2.gif]]<br />
* In the new window, change "Encoder" to "FAAC MP4/AAC Encoder v1.26" and click on the "OK" button<br />
* Select the output directory (on the bottom of the window)<br />
* Now you can start by cliking on the red icon<br />
[[Image:Convert_music_DSi4.gif]]<br />
* Your music will be available in the output directory in .m4a format<br />
<br />
=== Convert music to an AAC format using iTunes ===<br />
<br />
If the file on iTunes is a normal AAC:<br />
* Download and install the application iTunes.<br />
* Click on file>add file to library.<br />
* Choose your audio file.<br />
* Right click on a file in your library and select "convert to AAC."<br />
<br />
If the file on iTunes is a protected AAC:<br />
* Copy the song(s) to a CD.<br />
* Copy the song(s) on the CD to Windows Media Player.<br />
* Windows Media Player will make these into MP3s, which iTunes can convert to AAC.<br />
<br />
=== Convert music to an AAC format using WinFF (GNU FFmpeg frontend) ===<br />
<br />
*Download from http://winff.org/html_new/downloads.html<br />
**This is for WinXP and Linux<br />
*Get it to work<br />
**Install<br />
**Configure directories if needed<br />
***Edit>Preferences<br />
*Add all files that need conversion (Video files will rip only the audio portion)<br />
*Change to proper encoding settings<br />
**Output Details tab<br />
***Convert To: Audio<br />
***Device Precet: MPEG4 Audio<br />
***Change output folder to the SD card you wish to insert into the DSi<br />
*Click the Convert button<br />
*Please Wait<br />
<br />
Note: This will output .m4a files. These are AAC files readable by the DSi.</div>Nocashhttps://dsibrew.org/w/index.php?title=NUS_Downloader/database&diff=2098767NUS Downloader/database2015-02-05T23:22:16Z<p>Nocash: typo...</p>
<hr />
<div>Below is the official online database for the NUS Downloader utility (NUSD). If you have additions/corrections to the database, please add them here. NUSD is automatically downloading the data from this wiki page. Don't forget to change the date entry (or try to delete your old xml file in order to get the new database downloaded).<br />
<br />
The NUSD tool allows to download offical DSi firmware/system updates from Nintendo servers to a PC. It can also decrypt the files; this requires a 16-byte file '''dsikey.bin''' containing the DSi's [[Common key]]. The decrypted ".app" files are containing a regular [[DSi Cartridge Header]] (exceptions are non-executable datafiles: [[WiFi Firmware]], [[Version Data]], and [[Nintendo DS Cart Whitelist]]).<br />
<br />
The source code and executable for that utility can be downloaded [http://code.google.com/p/nusdownloader/ here], some how-to-use info can be found [http://wiibrew.org/wiki/NUS_Downloader here]. More titles may be found on [[Title list]] page (although not in the database format).<br />
<br />
==Format==<br />
<br />
The top of the hierarchy is the database tag. Inside of this, there are 2 sub-types. When adding a title, you should chose the category which best represents the title type. They are self explanatory.<br />
<br />
*<DSISYSTEM><br />
*<DSIWARE><br />
<br />
Within the category, the details of the title can be added with the following tags.<br />
<br />
*<name> - The descriptive name of the title<br />
*<titleID> - The title ID of the title. End with XX if the title is region based. Equivalent to [[DSi Cartridge Header|CartHeader[230h]]]<br />
*<version> - The decimal version(s) of the title available on NUS. Equivalent to [[DSi Cartridge Header|CartHeader[01Eh]]] multiplied by 256.<br />
*<region> - The region(s) of the title available on NUS.<br />
*<ticket> - Boolean; whether or not the title has a [[ticket]] available. Tickets are needed for decryption, and are available only for free system files.<br />
*<danger> - A description of why the title could be dangerous to install/tamper with.<br />
<br />
Enough said, here's an example...<br />
<source lang="xml"><br />
<DSISYSTEM><br />
<name>System Menu (Launcher)</name><br />
<titleID>00030017484e41XX</titleID><br />
<version>512,768</version><br />
<region>1,2,5,6,8,10</region><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
</source><br />
<br />
== Database ==<br />
<br />
Here is the latest database available:<br />
<br />
<source lang="xml"><br />
<database v="(02/06/2015)"><!--MM/DD/YYYY--><br />
<DSISYSTEM><br />
<name>System Menu (Launcher)</name><br />
<titleID>00030017484e41XX</titleID><br />
<region>1,2,5,6,8,10</region><br />
<version>512,768</version><br />
<ticket>true</ticket><br />
<danger>This is the DSi System Menu. Failing to install it properly and intact could result in a brick!</danger><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo DSi Shop</name><br />
<titleID>00030015484e46XX</titleID><br />
<region>1,2,5,6,8,10</region><br />
<version>1792,2048</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo DSi Browser</name><br />
<titleID>00030004484e47XX</titleID><br />
<region>2,5,8,10</region><br />
<version>0,512,768</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Flipnote Studio</name><br />
<titleID>000300044b4755XX</titleID><br />
<region>2,5,11</region><br />
<version>0</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Dokodemo Wii no ma</name><br />
<titleID>000300044B4447XX</titleID><br />
<region>5</region><br />
<version>0,256</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo DSi Camera</name><br />
<titleID>00030005484e49XX</titleID><br />
<region>2,5,8,10</region><br />
<version>256,768</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo DSi Sound</name><br />
<titleID>00030005484e4bXX</titleID><br />
<region>2,5,8,10</region><br />
<version>256,512</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo Zone</name><br />
<titleID>00030005484e4aXX</titleID><br />
<region>2,5,8,10</region><br />
<version>512,768</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>DS Download Play</name><br />
<titleID>00030005484e44XX</titleID><br />
<region>0</region><br />
<version>256</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Pictochat</name><br />
<titleID>00030005484e45XX</titleID><br />
<region>0</region><br />
<version>0</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>WiFi Firmware</name><br />
<titleID>0003000f484e43XX</titleID><br />
<region>0</region><br />
<version>256,512</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo DS Cart Whitelist</name><br />
<titleID>0003000f484e48XX</titleID><br />
<region>0</region><br />
<version>256,512</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Version Data</name><br />
<titleID>0003000f484e4cXX</titleID><br />
<region>1,2,5,6,8,10</region><br />
<version>1 (Japan),2 (Japan),3 (Australia/NewZealand),4 (China),5</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>System Settings</name><br />
<titleID>00030015484e42XX</titleID><br />
<region>1,2,5,6,8,10</region><br />
<version>512,768</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo 3DS Transfer Tool</name><br />
<titleID>00030015484e4fXX</titleID><br />
<region>2,5,6,8,10</region><br />
<version>0,256</version><br />
<ticket>false</ticket><br />
</DSISYSTEM><br />
<DSIWARE><br />
<name>Paper Airplane Chase</name><br />
<titleID>000300044B414DXX</titleID><br />
<region>2,11</region><br />
<ticket>false</ticket><br />
</DSIWARE><br />
<DSIWARE><br />
<name>WarioWare: Snapped!</name><br />
<titleID>000300044B5557XX</titleID><br />
<region>2,11</region><br />
<ticket>false</ticket><br />
</DSIWARE><br />
<REGIONS><br />
<region index="0">41 (All/System)</region><br />
<region index="1">43 (China)</region><br />
<region index="2">45 (USA)</region><br />
<region index="3">48 (Europe, Belgium/Netherlands)</region><br />
<region index="5">4A (Japan)</region><br />
<region index="6">4B (Korea)</region><br />
<region index="7">4F (Unknown)</region><br />
<region index="8">50 (Europe)</region><br />
<region index="9">54 (USA/Australia)</region><br />
<region index="10">55 (Australia)</region><br />
<region index="11">56 (Europe/Australia)</region><br />
<region index="12">xx (Unknown)</region><br />
</REGIONS><br />
</database><br />
</source></div>Nocashhttps://dsibrew.org/w/index.php?title=NUS_Downloader/database&diff=2098766NUS Downloader/database2015-02-05T23:19:18Z<p>Nocash: typo</p>
<hr />
<div>Below is the official online database for the NUS Downloader utility (NUSD). If you have additions/corrections to the database, please add them here. NUSD is automatically downloading the data from this wiki page. Don't forget to change the date entry (or try to delete your old xml file in order to get the new database downloaded).<br />
<br />
The NUSD tool allows to download offical DSi firmware/system updates from Nintendo servers to a PC. It can also decrypt the files; this requires a 16-byte file '''dsikey.bin''' containing the DSi's [[Common key]]. The decrypted ".app" files are containing a regular [[DSi Cartridge Header]] (exceptions are non-executable datafiles: [[WiFi Firmware]], [[Version Data]], and [[Nintendo DS Cart Whitelist]]).<br />
<br />
The source code and executable for that utility can be downloaded [http://code.google.com/p/nusdownloader/ here], some how-to-use info can be found [http://wiibrew.org/wiki/NUS_Downloader here]. More titles may be found on [[Title list]] page (although not in the database format).<br />
<br />
==Format==<br />
<br />
The top of the hierarchy is the database tag. Inside of this, there are 2 sub-types. When adding a title, you should chose the category which best represents the title type. They are self explanatory.<br />
<br />
*<DSISYSTEM><br />
*<DSIWARE><br />
<br />
Within the category, the details of the title can be added with the following tags.<br />
<br />
*<name> - The descriptive name of the title<br />
*<titleID> - The title ID of the title. End with XX if the title is region based. Equivalent to [[DSi Cartridge Header|CartHeader[230h]]]<br />
*<version> - The decimal version(s) of the title available on NUS. Equivalent to [[DSi Cartridge Header|CartHeader[01Eh]]] multiplied by 256.<br />
*<region> - The region(s) of the title available on NUS.<br />
*<ticket> - Boolean; whether or not the title has a [[ticket]] available. Tickets are needed for decryption, and are available only for free system files.<br />
*<danger> - A description of why the title could be dangerous to install/tamper with.<br />
<br />
Enough said, here's an example...<br />
<source lang="xml"><br />
<DSISYSTEM><br />
<name>System Menu (Launcher)</name><br />
<titleID>00030017484e41XX</titleID><br />
<version>512,768</version><br />
<region>1,2,5,6,8,10</region><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
</source><br />
<br />
== Database ==<br />
<br />
Here is the latest database available:<br />
<br />
<source lang="xml"><br />
<database v="(02/05/2015)"><!--MM/DD/YYYY--><br />
<DSISYSTEM><br />
<name>System Menu (Launcher)</name><br />
<titleID>00030017484e41XX</titleID><br />
<region>1,2,5,6,8,10</region><br />
<version>512,768</version><br />
<ticket>true</ticket><br />
<danger>This is the DSi System Menu. Failing to install it properly and intact could result in a brick!</danger><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo DSi Shop</name><br />
<titleID>00030015484e46XX</titleID><br />
<region>1,2,5,6,8,10</region><br />
<version>1792,2048</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo DSi Browser</name><br />
<titleID>00030004484e47XX</titleID><br />
<region>2,5,8,10</region><br />
<version>0,512,768</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Flipnote Studio</name><br />
<titleID>000300044b4755XX</titleID><br />
<region>2,5,11</region><br />
<version>0</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Dokodemo Wii no ma</name><br />
<titleID>00030004484447XX</titleID><br />
<region>5</region><br />
<version>0,256</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo DSi Camera</name><br />
<titleID>00030005484e49XX</titleID><br />
<region>2,5,8,10</region><br />
<version>256,768</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo DSi Sound</name><br />
<titleID>00030005484e4bXX</titleID><br />
<region>2,5,8,10</region><br />
<version>256,512</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo Zone</name><br />
<titleID>00030005484e4aXX</titleID><br />
<region>2,5,8,10</region><br />
<version>512,768</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>DS Download Play</name><br />
<titleID>00030005484e44XX</titleID><br />
<region>0</region><br />
<version>256</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Pictochat</name><br />
<titleID>00030005484e45XX</titleID><br />
<region>0</region><br />
<version>0</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>WiFi Firmware</name><br />
<titleID>0003000f484e43XX</titleID><br />
<region>0</region><br />
<version>256,512</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo DS Cart Whitelist</name><br />
<titleID>0003000f484e48XX</titleID><br />
<region>0</region><br />
<version>256,512</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Version Data</name><br />
<titleID>0003000f484e4cXX</titleID><br />
<region>1,2,5,6,8,10</region><br />
<version>1 (Japan),2 (Japan),3 (Australia/NewZealand),4 (China),5</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>System Settings</name><br />
<titleID>00030015484e42XX</titleID><br />
<region>1,2,5,6,8,10</region><br />
<version>512,768</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo 3DS Transfer Tool</name><br />
<titleID>00030015484e4fXX</titleID><br />
<region>2,5,6,8,10</region><br />
<version>0,256</version><br />
<ticket>false</ticket><br />
</DSISYSTEM><br />
<DSIWARE><br />
<name>Paper Airplane Chase</name><br />
<titleID>000300044B414DXX</titleID><br />
<region>2,11</region><br />
<ticket>false</ticket><br />
</DSIWARE><br />
<DSIWARE><br />
<name>WarioWare: Snapped!</name><br />
<titleID>000300044B5557XX</titleID><br />
<region>2,11</region><br />
<ticket>false</ticket><br />
</DSIWARE><br />
<REGIONS><br />
<region index="0">41 (All/System)</region><br />
<region index="1">43 (China)</region><br />
<region index="2">45 (USA)</region><br />
<region index="3">48 (Europe, Belgium/Netherlands)</region><br />
<region index="5">4A (Japan)</region><br />
<region index="6">4B (Korea)</region><br />
<region index="7">4F (Unknown)</region><br />
<region index="8">50 (Europe)</region><br />
<region index="9">54 (USA/Australia)</region><br />
<region index="10">55 (Australia)</region><br />
<region index="11">56 (Europe/Australia)</region><br />
<region index="12">xx (Unknown)</region><br />
</REGIONS><br />
</database><br />
</source></div>Nocashhttps://dsibrew.org/w/index.php?title=NUS_Downloader/database&diff=2098765NUS Downloader/database2015-02-05T23:17:40Z<p>Nocash: added Dokodemo Wiinoma (japan only, see "Title list" page)</p>
<hr />
<div>Below is the official online database for the NUS Downloader utility (NUSD). If you have additions/corrections to the database, please add them here. NUSD is automatically downloading the data from this wiki page. Don't forget to change the date entry (or try to delete your old xml file in order to get the new database downloaded).<br />
<br />
The NUSD tool allows to download offical DSi firmware/system updates from Nintendo servers to a PC. It can also decrypt the files; this requires a 16-byte file '''dsikey.bin''' containing the DSi's [[Common key]]. The decrypted ".app" files are containing a regular [[DSi Cartridge Header]] (exceptions are non-executable datafiles: [[WiFi Firmware]], [[Version Data]], and [[Nintendo DS Cart Whitelist]]).<br />
<br />
The source code and executable for that utility can be downloaded [http://code.google.com/p/nusdownloader/ here], some how-to-use info can be found [http://wiibrew.org/wiki/NUS_Downloader here]. More titles may be found on [[Title list]] page (although not in the database format).<br />
<br />
==Format==<br />
<br />
The top of the hierarchy is the database tag. Inside of this, there are 2 sub-types. When adding a title, you should chose the category which best represents the title type. They are self explanatory.<br />
<br />
*<DSISYSTEM><br />
*<DSIWARE><br />
<br />
Within the category, the details of the title can be added with the following tags.<br />
<br />
*<name> - The descriptive name of the title<br />
*<titleID> - The title ID of the title. End with XX if the title is region based. Equivalent to [[DSi Cartridge Header|CartHeader[230h]]]<br />
*<version> - The decimal version(s) of the title available on NUS. Equivalent to [[DSi Cartridge Header|CartHeader[01Eh]]] multiplied by 256.<br />
*<region> - The region(s) of the title available on NUS.<br />
*<ticket> - Boolean; whether or not the title has a [[ticket]] available. Tickets are needed for decryption, and are available only for free system files.<br />
*<danger> - A description of why the title could be dangerous to install/tamper with.<br />
<br />
Enough said, here's an example...<br />
<source lang="xml"><br />
<DSISYSTEM><br />
<name>System Menu (Launcher)</name><br />
<titleID>00030017484e41XX</titleID><br />
<version>512,768</version><br />
<region>1,2,5,6,8,10</region><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
</source><br />
<br />
== Database ==<br />
<br />
Here is the latest database available:<br />
<br />
<source lang="xml"><br />
<database v="(02/04/2015)"><!--MM/DD/YYYY--><br />
<DSISYSTEM><br />
<name>System Menu (Launcher)</name><br />
<titleID>00030017484e41XX</titleID><br />
<region>1,2,5,6,8,10</region><br />
<version>512,768</version><br />
<ticket>true</ticket><br />
<danger>This is the DSi System Menu. Failing to install it properly and intact could result in a brick!</danger><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo DSi Shop</name><br />
<titleID>00030015484e46XX</titleID><br />
<region>1,2,5,6,8,10</region><br />
<version>1792,2048</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo DSi Browser</name><br />
<titleID>00030004484e47XX</titleID><br />
<region>2,5,8,10</region><br />
<version>0,512,768</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Flipnote Studio</name><br />
<titleID>000300044b4755XX</titleID><br />
<region>2,5,11</region><br />
<version>0</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Dokodemo Wii no ma</name><br />
<titleID>00030015484447XX</titleID><br />
<region>5</region><br />
<version>0,256</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo DSi Camera</name><br />
<titleID>00030005484e49XX</titleID><br />
<region>2,5,8,10</region><br />
<version>256,768</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo DSi Sound</name><br />
<titleID>00030005484e4bXX</titleID><br />
<region>2,5,8,10</region><br />
<version>256,512</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo Zone</name><br />
<titleID>00030005484e4aXX</titleID><br />
<region>2,5,8,10</region><br />
<version>512,768</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>DS Download Play</name><br />
<titleID>00030005484e44XX</titleID><br />
<region>0</region><br />
<version>256</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Pictochat</name><br />
<titleID>00030005484e45XX</titleID><br />
<region>0</region><br />
<version>0</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>WiFi Firmware</name><br />
<titleID>0003000f484e43XX</titleID><br />
<region>0</region><br />
<version>256,512</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo DS Cart Whitelist</name><br />
<titleID>0003000f484e48XX</titleID><br />
<region>0</region><br />
<version>256,512</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Version Data</name><br />
<titleID>0003000f484e4cXX</titleID><br />
<region>1,2,5,6,8,10</region><br />
<version>1 (Japan),2 (Japan),3 (Australia/NewZealand),4 (China),5</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>System Settings</name><br />
<titleID>00030015484e42XX</titleID><br />
<region>1,2,5,6,8,10</region><br />
<version>512,768</version><br />
<ticket>true</ticket><br />
</DSISYSTEM><br />
<DSISYSTEM><br />
<name>Nintendo 3DS Transfer Tool</name><br />
<titleID>00030015484e4fXX</titleID><br />
<region>2,5,6,8,10</region><br />
<version>0,256</version><br />
<ticket>false</ticket><br />
</DSISYSTEM><br />
<DSIWARE><br />
<name>Paper Airplane Chase</name><br />
<titleID>000300044B414DXX</titleID><br />
<region>2,11</region><br />
<ticket>false</ticket><br />
</DSIWARE><br />
<DSIWARE><br />
<name>WarioWare: Snapped!</name><br />
<titleID>000300044B5557XX</titleID><br />
<region>2,11</region><br />
<ticket>false</ticket><br />
</DSIWARE><br />
<REGIONS><br />
<region index="0">41 (All/System)</region><br />
<region index="1">43 (China)</region><br />
<region index="2">45 (USA)</region><br />
<region index="3">48 (Europe, Belgium/Netherlands)</region><br />
<region index="5">4A (Japan)</region><br />
<region index="6">4B (Korea)</region><br />
<region index="7">4F (Unknown)</region><br />
<region index="8">50 (Europe)</region><br />
<region index="9">54 (USA/Australia)</region><br />
<region index="10">55 (Australia)</region><br />
<region index="11">56 (Europe/Australia)</region><br />
<region index="12">xx (Unknown)</region><br />
</REGIONS><br />
</database><br />
</source></div>Nocashhttps://dsibrew.org/w/index.php?title=Title_database&diff=2098764Title database2015-02-05T22:59:48Z<p>Nocash: /* Europe */</p>
<hr />
<div>The Nintendo DSi uses the same title scheme and introduces separate DSi update servers; Also introduced was a new common-key for DSi title decryption. <br />
<br />
As with the Wii, the [[title metadata]] aka "TMD" for these titles can be found on the Nintendo Update Servers.<br />
<br />
Each title specific url uses a 4 ASCII character code denoting what type of title it is and what region it comes from.<br />
<br />
Titles can be downloaded and decrypted with [http://wiibrew.org/wiki/NUS_Downloader NUS Downloader], a program that allows titles to be fetched from the Nintendo Update Servers.<br />
<br />
== Title codes ==<br />
<br />
=== Region Codes ===<br />
<br />
Region codes are used to determine what region a title belongs to. They are at the end of a Title ID. Eg. XXXA, XXXJ<br />
<br />
{| class="wikitable sortable" width="55%"<br />
|-<br />
! ASCII<br />
! HEX<br />
! Region<br />
|-<br />
| A<br />
| 41<br />
| Region Independent<br />
|-<br />
| C<br />
| 43<br />
| China<br />
|-<br />
| E<br />
| 45<br />
| North America<br />
|-<br />
| H<br />
| 48<br />
| Belgium / Netherlands (DSiWare Only)<br />
|-<br />
| J<br />
| 4A<br />
| Japan<br />
|-<br />
| K<br />
| 4B<br />
| Korea<br />
|-<br />
| O<br />
| 4F<br />
| Unknown<br />
|-<br />
| P<br />
| 50<br />
| Australia and other PAL regions (System and DSiWare)<br />
|-<br />
| T<br />
| 54<br />
| Unknown<br />
|-<br />
| U<br />
| 55<br />
| Australia and New Zealand<br />
|-<br />
| V<br />
| 56<br />
| Europe (DSiWare Only)<br />
|-<br />
| X<br />
| 58<br />
| Unknown<br />
|}<br />
<br />
=== System Codes ===<br />
<br />
System codes are used to determine what type of title it is. They are at the beginning of a Title ID. Eg. KXXX. HXXX<br />
<br />
{| class="wikitable sortable" width="50%"<br />
|-<br />
! ASCII<br />
! HEX<br />
! Type<br />
|-<br />
| K<br />
| 4B<br />
| DSiWare Title<br />
|-<br />
| H<br />
| 48<br />
| System \ Channel<br />
|}<br />
<br />
== Title Database ==<br />
<br />
=== DSiWare (00030004) ===<br />
<br />
DSiWare is an online service available on the [[Nintendo DSi Shop]] to download DSi applications.<br />
<br />
==== Europe ====<br />
<br />
The official list of DSi Ware Europe titles is located on [http://www.nintendo.co.uk/NOE/en_GB/games/nintendo_dsiware_11805.html the Nintendo Europe website -- (broken link)]. An inofficial list is at [http://en.wikipedia.org/wiki/List_of_DSiWare_games_(PAL_region) wikipedia].<br />
<br />
{| class="wikitable sortable" width="100%"<br />
|-<br />
! Type<br />
! Title ID<br />
! Name<br />
! Price<br />
|-<br />
| Game<br />
| KNRV (4B4E5256)<br />
| A Little Bit of... Brain Training™: Maths Edition<br />
| 800 Nintendo Points<br />
|-<br />
| Game<br />
| KD9V (4B443956)<br />
| A Little Bit of... Dr. Mario™<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KM9P (4B4D3950)<br />
| A Little Bit of... Magic Made Fun™: Deep Psyche<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KMFP (4B4D4650)<br />
| A Little Bit of... Magic Made Fun™: Funny Face<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KMSP (4B4D5350)<br />
| A Little Bit of... Magic Made Fun™: Shuffle Games<br />
| 200 Nintendo Points<br />
|-<br />
| Application<br />
| KWGV (4B574756)<br />
| [[Nintendo DSi Calculator|Animal Crossing Calculator]]<br />
| 200 Nintendo Points<br />
|-<br />
| Application<br />
| KWCV (4B574356)<br />
| [[Nintendo DSi Clock|Animal Crossing Clock]]<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KAAV (4B414156)<br />
| Art Style: AQUITE<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KADV (4B414456)<br />
| Art Style: CODE<br />
| 500 Nintendo Points<br />
|-<br />
| Application<br />
| KGUV (4B475556)<br />
| Flipnote Studio<br />
| 0 Nintendo Points<br />
|-<br />
| Game<br />
| KAKV (4B414B56)<br />
| Art Style: KuBos<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KASV (4B415356)<br />
| Art Style: NEMREM<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KAPV (4B415056)<br />
| Art Style: PiCOPiCT<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KA4V (4B413456)<br />
| Asphalt 4: Elite Racing<br />
| 800 Nintendo Points<br />
|-<br />
| Game<br />
| KGRV (4B475256)<br />
| Guitar Rock Tour<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KLEV (4B4C4556)<br />
| Legends of Exidia<br />
| 800 Nintendo Points<br />
|-<br />
| Game<br />
| KMMV (4B4D4D56)<br />
| Mixed Message<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KAMV (4B414D56)<br />
| Paper Plane<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KPOV (4B504F56)<br />
| Pop Superstar!: Road to Celebrity<br />
| 800 Nintendo Points<br />
|-<br />
| Game<br />
| KP6V (4B503656)<br />
| Pyoro<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KS9V (4B533956)<br />
| Real Football 2009<br />
| 800 Nintendo Points<br />
|-<br />
| Game<br />
| K4DE (4B344445)<br />
| Sudoku<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KSMV (4B534D56)<br />
| SUDOKU 150! For Challengers<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KUWV (4B555756)<br />
| WarioWare: Snapped!<br />
| 500 Nintendo Points<br />
|}<br />
<br />
==== Japan ====<br />
<br />
The official list of DSi Ware Japan titles is located on [http://www.nintendo.co.jp/ds/dsiware/titlelist.html the Nintendo japanese website]. An inofficial list is at [http://ja.wikipedia.org/wiki/ニンテンドーDSiウェアのタイトル一覧 wikipedia] (in japanese).<br />
<br />
{| class="wikitable sortable" width="100%"<br />
|-<br />
! Type<br />
! Title ID<br />
! Name<br />
! Price<br />
|-<br />
| Game<br />
| KMSJ (4B4D534A)<br />
| 3-tsu no Shuffle Game<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KAAJ (4B41414A)<br />
| Art Style: AQUARIO<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KADJ (4B41444A)<br />
| Art Style: DECODE<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KAPJ (4B41504A)<br />
| Art Style: PICOPICT<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KASJ (4B41534A)<br />
| Art Style: SOMNIUM<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KTPJ (4B54504A)<br />
| Asobi Taizen<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KNRJ (4B4E524A)<br />
| Brain Training - Science version<br />
| 800 Nintendo Points<br />
|-<br />
| Game<br />
| KD9J (4B44394A)<br />
| A Little Bit of... Dr. Mario™<br />
| 500 Nintendo Points<br />
|-<br />
| Application<br />
| KDGJ (4B44474A)<br />
| Dokodemo [http://en.wikipedia.org/wiki/Wii_no_Ma Wiinoma]<br />
| 0 Nintendo Points<br />
|-<br />
| Game<br />
| KMFJ (4B4D464A)<br />
| A Little Bit of... Magic Made Fun™: Funny Face<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KAMJ (4B414D4A)<br />
| Kami Hikouki<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KLEJ (4B4C454A)<br />
| Legends of Exidia<br />
| 800 Nintendo Points<br />
|-<br />
| Game<br />
| KMMJ (4B4D4D4A)<br />
| Mixed Message<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KM9J (4B4D394A)<br />
| Osoroshii Suuji<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KP6J (4B50364A)<br />
| Tori to Mame<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KGUJ (4B47554A)<br />
| Ugoku Memo Chou (Flipnote Studio)<br />
| 0 Nintendo Points<br />
|-<br />
| Game<br />
| KUWJ (4B55574A)<br />
| Utsutsu! Made in Wario<br />
| 500 Nintendo Points<br />
|-<br />
|}<br />
<br />
==== United States ====<br />
<br />
The official list of DSi Ware US titles is located on [http://www.nintendo.com/games/guide#qhardware=DS&qesrbRating=&qplay=dsiware&qgenre=&qrelease=&panel=qplay the Nintendo US website]. An inofficial list is at [http://en.wikipedia.org/wiki/List_of_DSiWare_games_(North_America) wikipedia].<br />
<br />
{| class="wikitable sortable" width="100%"<br />
|-<br />
! Type<br />
! Title ID<br />
! Name<br />
! Price<br />
|-<br />
| Game<br />
| KM9E (4B4D3945)<br />
| A Little Bit of... Magic Made Fun™: Deep Psyche<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KMFE (4B4D4645)<br />
| A Little Bit of... Magic Made Fun™: Funny Face<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KMSE (4B4D5345)<br />
| A Little Bit of... Magic Made Fun™: Shuffle Games<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KAAE (4B414145)<br />
| Art Style: AQUIA<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KP6E (4B503645)<br />
| Bird & Beans<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KD9E (4B443945)<br />
| Dr. Mario Express<br />
| 500 Nintendo Points<br />
|-<br />
| Application<br />
| KGUE (4B475545)<br />
| Flipnote Studio<br />
| 0 Nintendo Points<br />
|-<br />
| Game<br />
| KGRE (4B475245)<br />
| Guitar Rock Tour<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KLEE (4B4C4545)<br />
| Legends of Exidia<br />
| 800 Nintendo Points<br />
|-<br />
| Application<br />
| KWBE (4B574245)<br />
| Mario Calculator<br />
| 200 Nintendo Points<br />
|-<br />
| Application<br />
| KWFE (4B574645)<br />
| Mario Clock<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KDME (4B444D45)<br />
| Mario vs. Donkey Kong: Minis March Again!<br />
| 800 Nintendo Points<br />
|-<br />
| Game<br />
| KMME (4B4D4D45)<br />
| Mixed Message<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KAME (4B414D45)<br />
| Paper Airplane Chase<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KPBE (4B504245)<br />
| Photo Dojo<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KS9E (4B533945)<br />
| Real Football 2009<br />
| 800 Nintendo Points<br />
|-<br />
| Game<br />
| K4DE (4B344445)<br />
| Sudoku<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KUWE (4B555745)<br />
| WarioWare: Snapped!<br />
| 500 Nintendo Points<br />
|}<br />
<br />
==== Australia and New Zealand ====<br />
<br />
An inofficial list is at [http://en.wikipedia.org/wiki/List_of_DSiWare_games_(PAL_region) wikipedia] (with separate columns for Europe and Australia).<br />
<br />
Many titles are released simultaneously for both Europe and Australia (particulary those with "V" as last gamecode character). Some titles are released separately (or exclusively) for Europe and/or Australia (last gamecode character "P" for Europe, and "U" for Australia).<br />
<br />
==== China ====<br />
<br />
Unknown.<br />
<br />
==== Korea ====<br />
<br />
Unknown.<br />
<br />
=== System ===<br />
<br />
System Titles are all system applications or files used by the Nintendo DSi.<br />
<br />
====All Regions====<br />
{| class="wikitable sortable" width="100%"<br />
|-<br />
! Type<br />
! Title ID<br />
! Name<br />
! Versions<br />
! CDN Availability<br />
|-<br />
| 00030005<br />
| HNDA (484e4441)<br />
| DS Download Play<br />
| 256<br />
| 256<br />
|-<br />
| 00030005<br />
| HNEA (484e4541)<br />
| Pictochat<br />
| 0<br />
| Not Available<br />
|-<br />
| 0003000f<br />
| HNCA (484e4341)<br />
| [[WiFi Firmware]] (non-executable datafile)<br />
| 256, 512<br />
| 256, 512<br />
|-<br />
| 0003000f<br />
| HNHA (484e4841)<br />
| [[Nintendo DS Cart Whitelist]] (non-executable datafile)<br />
| 256, 512, 768, 1024, 1280, 1536<br />
| 256, 512, 768, 1024, 1280, 1536<br />
|}<br />
<br />
====Japan====<br />
{| class="wikitable sortable" width="100%"<br />
|-<br />
! Type<br />
! Title ID<br />
! Name<br />
! Versions<br />
! CDN Availability<br />
|-<br />
| 00030004<br />
| HNGJ (484e474a)<br />
| [[Nintendo DSi Browser]]<br />
| 0, 512, 768<br />
| 0, 512, 768<br />
|-<br />
| 00030005<br />
| HNIJ (484e494a)<br />
| [[Nintendo DSi Camera]]<br />
| 256, 768, 1024<br />
| 256, 768, 1024<br />
|-<br />
| 00030005<br />
| HNJJ (484e4a4a)<br />
| [[Nintendo Zone]]<br />
| 512, 768<br />
| 512, 768<br />
|-<br />
| 00030005<br />
| HNKJ (484e4b4a)<br />
| [[Nintendo DSi Sound]]<br />
| 256, 512<br />
| 256, 512<br />
|-<br />
| 0003000f<br />
| HNLJ (484e4c4a)<br />
| [[Version Data]]<br />
| 1, 2, 3, 4, 5, 6, 7, 8, 9<br />
| 1, 2, 3, 4, 5, 6, 7, 8, 9<br />
|-<br />
| 00030015<br />
| HNOJ (484e4f4a)<br />
| [http://www.nintendo.co.jp/ds/dsiware/hnoj/index.html Nintendo 3DS Transfer Tool]<br />
| 0<br />
| 0<br />
|-<br />
| 00030015<br />
| HNBJ (484e424a)<br />
| [[System Settings]]<br />
| 512, 768<br />
| 512, 768<br />
|-<br />
| 00030015<br />
| HNFJ (484e464a)<br />
| [[Nintendo DSi Shop]]<br />
| 1024, 1280, 1536, 1792, 2048, 2304, 2560, 2816, 3072<br />
| 1024, 1280, 1536, 1792, 2048, 2304, 2560, 2816, 3072<br />
|-<br />
| 00030017<br />
| HNAJ (484e414a)<br />
| [[System Menu]] (Launcher)<br />
| 256, 512, 768, 1024, 1280, 1536, 1792<br />
| 256, 512, 768, 1024, 1280, 1536, 1792<br />
|}<br />
<br />
====United States====<br />
{| class="wikitable sortable" width="100%"<br />
|-<br />
! Type<br />
! Title ID<br />
! Name<br />
! Versions<br />
! CDN Availability<br />
|-<br />
| 00030004<br />
| HNGE (484e4745)<br />
| [[Nintendo DSi Browser]]<br />
| 512, 768<br />
| 512, 768<br />
|-<br />
| 00030005<br />
| HNIE (484e4945)<br />
| [[Nintendo DSi Camera]]<br />
| 768, 1024<br />
| 768, 1024<br />
|-<br />
| 00030005<br />
| HNJE (484e4a45)<br />
| [[Nintendo Zone]]<br />
| 512, 768<br />
| 512, 768<br />
|-<br />
| 00030005<br />
| HNKE (484e4b45)<br />
| [[Nintendo DSi Sound]]<br />
| 256, 512<br />
| 256, 512<br />
|-<br />
| 0003000f<br />
| HNLE (484e4c45)<br />
| [[Version Data]]<br />
| 3, 4, 5, 6, 7, 8, 9<br />
| 3, 4, 5, 6, 7, 8, 9<br />
|-<br />
| 00030015<br />
| HNOE (484e4f45)<br />
| [http://www.nintendo.co.jp/ds/dsiware/hnoj/index.html Nintendo 3DS Transfer Tool]<br />
| 0<br />
| 0<br />
|-<br />
| 00030015<br />
| HNBE (484e4245)<br />
| [[System Settings]]<br />
| 512, 768<br />
| 512, 768<br />
|-<br />
| 00030015<br />
| HNFE (484e4645)<br />
| [[Nintendo DSi Shop]]<br />
| 1536, 1792, 2048, 2304, 2560, 2816, 3072<br />
| 1536, 1792, 2048, 2304, 2560, 2816, 3072<br />
|-<br />
| 00030017<br />
| HNAE (484e4145)<br />
| [[System Menu]] (Launcher)<br />
| 512, 768, 1024, 1280, 1536, 1792<br />
| 512, 768, 1024, 1280, 1536, 1792<br />
|}<br />
<br />
====Europe====<br />
{| class="wikitable sortable" width="100%"<br />
|-<br />
! Type<br />
! Title ID<br />
! Name<br />
! Versions<br />
! CDN Availability<br />
|-<br />
| 00030004<br />
| HNGP (484e4750)<br />
| [[Nintendo DSi Browser]]<br />
| 512, 768<br />
| 512, 768<br />
|-<br />
| 00030005<br />
| HNIP (484e4950)<br />
| [[Nintendo DSi Camera]]<br />
| 768, 1024<br />
| 768, 1024<br />
|-<br />
| 00030005<br />
| HNJP (484e4a50)<br />
| [[Nintendo Zone]]<br />
| 512, 768<br />
| 512, 768<br />
|-<br />
| 00030005<br />
| HNKP (484e4b50)<br />
| [[Nintendo DSi Sound]]<br />
| 256, 512<br />
| 256, 512<br />
|-<br />
| 0003000f<br />
| HNLP (484e4c50)<br />
| [[Version Data]]<br />
| 3, 4, 5, 6, 7, 8, 9<br />
| 3, 4, 5, 6, 7, 8, 9<br />
|-<br />
| 00030015<br />
| HNOP (484e4f50)<br />
| [http://www.nintendo.co.jp/ds/dsiware/hnoj/index.html Nintendo 3DS Transfer Tool]<br />
| 0<br />
| 0<br />
|-<br />
| 00030015<br />
| HNBP (484e4250)<br />
| [[System Settings]]<br />
| 512, 768<br />
| 512, 768<br />
|-<br />
| 00030015<br />
| HNFP (484e4650)<br />
| [[Nintendo DSi Shop]]<br />
| 1536, 1792, 2048, 2304, 2560, 2816, 3072<br />
| 1536, 1792, 2048, 2304, 2560, 2816, 3072<br />
|-<br />
| 00030017<br />
| HNAP (484e4150)<br />
| [[System Menu]] (Launcher)<br />
| 512, 768, 1024, 1280, 1536, 1792<br />
| 512, 768, 1024, 1280, 1536, 1792<br />
|}<br />
<br />
====Australia and New Zealand====<br />
{| class="wikitable sortable" width="100%"<br />
|-<br />
! Type<br />
! Title ID<br />
! Name<br />
! Versions<br />
! CDN Availability<br />
|-<br />
| 00030004<br />
| HNGU (484e4755)<br />
| [[Nintendo DSi Browser]]<br />
| 512, 768<br />
| 512, 768<br />
|-<br />
| 00030005<br />
| HNIU (484e4955)<br />
| [[Nintendo DSi Camera]]<br />
| 768, 1024<br />
| 768, 1024<br />
|-<br />
| 00030005<br />
| HNJU (484e4a55)<br />
| [[Nintendo Zone]]<br />
| 512, 768<br />
| 512, 768<br />
|-<br />
| 00030005<br />
| HNKU (484e4b55)<br />
| [[Nintendo DSi Sound]]<br />
| 256, 512<br />
| 256, 512<br />
|-<br />
| 0003000f<br />
| HNLU (484e4c55)<br />
| [[Version Data]]<br />
| 3, 4, 5, 6, 7, 8, 9<br />
| 3, 4, 5, 6, 7, 8, 9<br />
|-<br />
| 00030015<br />
| HNOU (484e4f55)<br />
| [http://www.nintendo.co.jp/ds/dsiware/hnoj/index.html Nintendo 3DS Transfer Tool]<br />
| 0<br />
| 0<br />
|-<br />
| 00030015<br />
| HNBU (484e4255)<br />
| [[System Settings]]<br />
| 512, 768<br />
| 512, 768<br />
|-<br />
| 00030015<br />
| HNFU (484e4655)<br />
| [[Nintendo DSi Shop]]<br />
| 1536, 1792, 2048, 2304, 2560, 2816, 3072<br />
| 1536, 1792, 2048, 2304, 2560, 2816, 3072<br />
|-<br />
| 00030017<br />
| HNAU (484e4155)<br />
| [[System Menu]] (Launcher)<br />
| 512, 768, 1024, 1280, 1536, 1792<br />
| 512, 768, 1024, 1280, 1536, 1792<br />
|}<br />
<br />
====China====<br />
{| class="wikitable sortable" width="100%"<br />
|-<br />
! Type<br />
! Title ID<br />
! Name<br />
! Versions<br />
! CDN Availability<br />
|-<br />
| 0003000f<br />
| HNLC (484e4c43)<br />
| [[Version Data]]<br />
| 4, 5, 6, 7, 8, 9<br />
| 4, 5, 6, 7, 8, 9<br />
|-<br />
| 00030015<br />
| HNOC (484e4f43)<br />
| [http://www.nintendo.co.jp/ds/dsiware/hnoj/index.html Nintendo 3DS Transfer Tool]<br />
| not available yet in china?<br />
| not available yet in china?<br />
|-<br />
| 00030015<br />
| HNFC (484e4643)<br />
| [[Nintendo DSi Shop]]<br />
| 1792, 2048, 2304, 2560, 2816, 3072<br />
| 1792, 2048, 2304, 2560, 2816, 3072<br />
|-<br />
| 00030017<br />
| HNAC (484e4143)<br />
| [[System Menu]] (Launcher)<br />
| 768, 1024, 1280, 1536, 1792<br />
| 768, 1024, 1280, 1536, 1792<br />
|-<br />
| 00030015<br />
| HNBC (484e4243)<br />
| [[System Settings]]<br />
| 768<br />
| 768<br />
|}<br />
<br />
====Korea====<br />
{| class="wikitable sortable" width="100%"<br />
|-<br />
! Type<br />
! Title ID<br />
! Name<br />
! Versions<br />
! CDN Availability<br />
|-<br />
| 0003000f<br />
| HNLK (484e4c4b)<br />
| [[Version Data]]<br />
| 5, 6, 7, 8, 9<br />
| 5, 6, 7, 8, 9<br />
|-<br />
| 00030015<br />
| HNOK (484e4f5b)<br />
| [http://www.nintendo.co.jp/ds/dsiware/hnoj/index.html Nintendo 3DS Transfer Tool]<br />
| 256<br />
| 256<br />
|-<br />
| 00030015<br />
| HNFK (484e464b)<br />
| [[Nintendo DSi Shop]]<br />
| 1792, 2048, 2304, 2560, 2816, 3072<br />
| 1792, 2048, 2304, 2560, 2816, 3072<br />
|-<br />
| 00030017<br />
| HNAK (484e414b)<br />
| [[System Menu]] (Launcher)<br />
| 768, 1024, 1280, 1536, 1792<br />
| 768, 1024, 1280, 1536, 1792<br />
|-<br />
| 00030015<br />
| HNBK (484e424b)<br />
| [[System Settings]]<br />
| 768<br />
| 768<br />
|}<br />
<br />
== See also ==<br />
<br />
* [[Title metadata|Title metadata (TMD)]]<br />
* [http://wiibrew.org/wiki/NUS_Downloader NUS Downloader info]<br />
* [http://code.google.com/p/nusdownloader/ NUS Downloader source/binary]<br />
* [[NUS Downloader/database]]<br />
* [[Nintendo DSi Shop]]<br />
* [[Nintendo Software]]<br />
* [[System Menu]]</div>Nocashhttps://dsibrew.org/w/index.php?title=Title_database&diff=2098763Title database2015-02-05T22:57:55Z<p>Nocash: /* Japan */</p>
<hr />
<div>The Nintendo DSi uses the same title scheme and introduces separate DSi update servers; Also introduced was a new common-key for DSi title decryption. <br />
<br />
As with the Wii, the [[title metadata]] aka "TMD" for these titles can be found on the Nintendo Update Servers.<br />
<br />
Each title specific url uses a 4 ASCII character code denoting what type of title it is and what region it comes from.<br />
<br />
Titles can be downloaded and decrypted with [http://wiibrew.org/wiki/NUS_Downloader NUS Downloader], a program that allows titles to be fetched from the Nintendo Update Servers.<br />
<br />
== Title codes ==<br />
<br />
=== Region Codes ===<br />
<br />
Region codes are used to determine what region a title belongs to. They are at the end of a Title ID. Eg. XXXA, XXXJ<br />
<br />
{| class="wikitable sortable" width="55%"<br />
|-<br />
! ASCII<br />
! HEX<br />
! Region<br />
|-<br />
| A<br />
| 41<br />
| Region Independent<br />
|-<br />
| C<br />
| 43<br />
| China<br />
|-<br />
| E<br />
| 45<br />
| North America<br />
|-<br />
| H<br />
| 48<br />
| Belgium / Netherlands (DSiWare Only)<br />
|-<br />
| J<br />
| 4A<br />
| Japan<br />
|-<br />
| K<br />
| 4B<br />
| Korea<br />
|-<br />
| O<br />
| 4F<br />
| Unknown<br />
|-<br />
| P<br />
| 50<br />
| Australia and other PAL regions (System and DSiWare)<br />
|-<br />
| T<br />
| 54<br />
| Unknown<br />
|-<br />
| U<br />
| 55<br />
| Australia and New Zealand<br />
|-<br />
| V<br />
| 56<br />
| Europe (DSiWare Only)<br />
|-<br />
| X<br />
| 58<br />
| Unknown<br />
|}<br />
<br />
=== System Codes ===<br />
<br />
System codes are used to determine what type of title it is. They are at the beginning of a Title ID. Eg. KXXX. HXXX<br />
<br />
{| class="wikitable sortable" width="50%"<br />
|-<br />
! ASCII<br />
! HEX<br />
! Type<br />
|-<br />
| K<br />
| 4B<br />
| DSiWare Title<br />
|-<br />
| H<br />
| 48<br />
| System \ Channel<br />
|}<br />
<br />
== Title Database ==<br />
<br />
=== DSiWare (00030004) ===<br />
<br />
DSiWare is an online service available on the [[Nintendo DSi Shop]] to download DSi applications.<br />
<br />
==== Europe ====<br />
<br />
The official list of DSi Ware Europe titles is located on [http://www.nintendo.co.uk/NOE/en_GB/games/nintendo_dsiware_11805.html the Nintendo Europe website -- (broken link)]. An inofficial list is at [http://en.wikipedia.org/wiki/List_of_DSiWare_games_(PAL_region) wikipedia].<br />
<br />
{| class="wikitable sortable" width="100%"<br />
|-<br />
! Type<br />
! Title ID<br />
! Name<br />
! Price<br />
|-<br />
| Game<br />
| KNRV (4B4E5256)<br />
| A Little Bit of... Brain Training™: Maths Edition<br />
| 800 Nintendo Points<br />
|-<br />
| Game<br />
| KD9V (4B443956)<br />
| A Little Bit of... Dr. Mario™<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KM9P (4B4D3950)<br />
| A Little Bit of... Magic Made Fun™: Deep Psyche<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KMFP (4B4D4650)<br />
| A Little Bit of... Magic Made Fun™: Funny Face<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KMSP (4B4D5350)<br />
| A Little Bit of... Magic Made Fun™: Shuffle Games<br />
| 200 Nintendo Points<br />
|-<br />
| Application<br />
| KWGV (4B574756)<br />
| [[Nintendo DSi Calculator|Animal Crossing Calculator]]<br />
| 200 Nintendo Points<br />
|-<br />
| Application<br />
| KWCV (4B574356)<br />
| [[Nintendo DSi Clock|Animal Crossing Clock]]<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KAAV (4B414156)<br />
| Art Style: AQUITE<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KADV (4B414456)<br />
| Art Style: CODE<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KAKV (4B414B56)<br />
| Art Style: KuBos<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KASV (4B415356)<br />
| Art Style: NEMREM<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KAPV (4B415056)<br />
| Art Style: PiCOPiCT<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KA4V (4B413456)<br />
| Asphalt 4: Elite Racing<br />
| 800 Nintendo Points<br />
|-<br />
| Game<br />
| KGRV (4B475256)<br />
| Guitar Rock Tour<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KLEV (4B4C4556)<br />
| Legends of Exidia<br />
| 800 Nintendo Points<br />
|-<br />
| Game<br />
| KMMV (4B4D4D56)<br />
| Mixed Message<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KAMV (4B414D56)<br />
| Paper Plane<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KPOV (4B504F56)<br />
| Pop Superstar!: Road to Celebrity<br />
| 800 Nintendo Points<br />
|-<br />
| Game<br />
| KP6V (4B503656)<br />
| Pyoro<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KS9V (4B533956)<br />
| Real Football 2009<br />
| 800 Nintendo Points<br />
|-<br />
| Game<br />
| K4DE (4B344445)<br />
| Sudoku<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KSMV (4B534D56)<br />
| SUDOKU 150! For Challengers<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KUWV (4B555756)<br />
| WarioWare: Snapped!<br />
| 500 Nintendo Points<br />
|}<br />
<br />
==== Japan ====<br />
<br />
The official list of DSi Ware Japan titles is located on [http://www.nintendo.co.jp/ds/dsiware/titlelist.html the Nintendo japanese website]. An inofficial list is at [http://ja.wikipedia.org/wiki/ニンテンドーDSiウェアのタイトル一覧 wikipedia] (in japanese).<br />
<br />
{| class="wikitable sortable" width="100%"<br />
|-<br />
! Type<br />
! Title ID<br />
! Name<br />
! Price<br />
|-<br />
| Game<br />
| KMSJ (4B4D534A)<br />
| 3-tsu no Shuffle Game<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KAAJ (4B41414A)<br />
| Art Style: AQUARIO<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KADJ (4B41444A)<br />
| Art Style: DECODE<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KAPJ (4B41504A)<br />
| Art Style: PICOPICT<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KASJ (4B41534A)<br />
| Art Style: SOMNIUM<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KTPJ (4B54504A)<br />
| Asobi Taizen<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KNRJ (4B4E524A)<br />
| Brain Training - Science version<br />
| 800 Nintendo Points<br />
|-<br />
| Game<br />
| KD9J (4B44394A)<br />
| A Little Bit of... Dr. Mario™<br />
| 500 Nintendo Points<br />
|-<br />
| Application<br />
| KDGJ (4B44474A)<br />
| Dokodemo [http://en.wikipedia.org/wiki/Wii_no_Ma Wiinoma]<br />
| 0 Nintendo Points<br />
|-<br />
| Game<br />
| KMFJ (4B4D464A)<br />
| A Little Bit of... Magic Made Fun™: Funny Face<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KAMJ (4B414D4A)<br />
| Kami Hikouki<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KLEJ (4B4C454A)<br />
| Legends of Exidia<br />
| 800 Nintendo Points<br />
|-<br />
| Game<br />
| KMMJ (4B4D4D4A)<br />
| Mixed Message<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KM9J (4B4D394A)<br />
| Osoroshii Suuji<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KP6J (4B50364A)<br />
| Tori to Mame<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KGUJ (4B47554A)<br />
| Ugoku Memo Chou (Flipnote Studio)<br />
| 0 Nintendo Points<br />
|-<br />
| Game<br />
| KUWJ (4B55574A)<br />
| Utsutsu! Made in Wario<br />
| 500 Nintendo Points<br />
|-<br />
|}<br />
<br />
==== United States ====<br />
<br />
The official list of DSi Ware US titles is located on [http://www.nintendo.com/games/guide#qhardware=DS&qesrbRating=&qplay=dsiware&qgenre=&qrelease=&panel=qplay the Nintendo US website]. An inofficial list is at [http://en.wikipedia.org/wiki/List_of_DSiWare_games_(North_America) wikipedia].<br />
<br />
{| class="wikitable sortable" width="100%"<br />
|-<br />
! Type<br />
! Title ID<br />
! Name<br />
! Price<br />
|-<br />
| Game<br />
| KM9E (4B4D3945)<br />
| A Little Bit of... Magic Made Fun™: Deep Psyche<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KMFE (4B4D4645)<br />
| A Little Bit of... Magic Made Fun™: Funny Face<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KMSE (4B4D5345)<br />
| A Little Bit of... Magic Made Fun™: Shuffle Games<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KAAE (4B414145)<br />
| Art Style: AQUIA<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KP6E (4B503645)<br />
| Bird & Beans<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KD9E (4B443945)<br />
| Dr. Mario Express<br />
| 500 Nintendo Points<br />
|-<br />
| Application<br />
| KGUE (4B475545)<br />
| Flipnote Studio<br />
| 0 Nintendo Points<br />
|-<br />
| Game<br />
| KGRE (4B475245)<br />
| Guitar Rock Tour<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KLEE (4B4C4545)<br />
| Legends of Exidia<br />
| 800 Nintendo Points<br />
|-<br />
| Application<br />
| KWBE (4B574245)<br />
| Mario Calculator<br />
| 200 Nintendo Points<br />
|-<br />
| Application<br />
| KWFE (4B574645)<br />
| Mario Clock<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KDME (4B444D45)<br />
| Mario vs. Donkey Kong: Minis March Again!<br />
| 800 Nintendo Points<br />
|-<br />
| Game<br />
| KMME (4B4D4D45)<br />
| Mixed Message<br />
| 500 Nintendo Points<br />
|-<br />
| Game<br />
| KAME (4B414D45)<br />
| Paper Airplane Chase<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KPBE (4B504245)<br />
| Photo Dojo<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KS9E (4B533945)<br />
| Real Football 2009<br />
| 800 Nintendo Points<br />
|-<br />
| Game<br />
| K4DE (4B344445)<br />
| Sudoku<br />
| 200 Nintendo Points<br />
|-<br />
| Game<br />
| KUWE (4B555745)<br />
| WarioWare: Snapped!<br />
| 500 Nintendo Points<br />
|}<br />
<br />
==== Australia and New Zealand ====<br />
<br />
An inofficial list is at [http://en.wikipedia.org/wiki/List_of_DSiWare_games_(PAL_region) wikipedia] (with separate columns for Europe and Australia).<br />
<br />
Many titles are released simultaneously for both Europe and Australia (particulary those with "V" as last gamecode character). Some titles are released separately (or exclusively) for Europe and/or Australia (last gamecode character "P" for Europe, and "U" for Australia).<br />
<br />
==== China ====<br />
<br />
Unknown.<br />
<br />
==== Korea ====<br />
<br />
Unknown.<br />
<br />
=== System ===<br />
<br />
System Titles are all system applications or files used by the Nintendo DSi.<br />
<br />
====All Regions====<br />
{| class="wikitable sortable" width="100%"<br />
|-<br />
! Type<br />
! Title ID<br />
! Name<br />
! Versions<br />
! CDN Availability<br />
|-<br />
| 00030005<br />
| HNDA (484e4441)<br />
| DS Download Play<br />
| 256<br />
| 256<br />
|-<br />
| 00030005<br />
| HNEA (484e4541)<br />
| Pictochat<br />
| 0<br />
| Not Available<br />
|-<br />
| 0003000f<br />
| HNCA (484e4341)<br />
| [[WiFi Firmware]] (non-executable datafile)<br />
| 256, 512<br />
| 256, 512<br />
|-<br />
| 0003000f<br />
| HNHA (484e4841)<br />
| [[Nintendo DS Cart Whitelist]] (non-executable datafile)<br />
| 256, 512, 768, 1024, 1280, 1536<br />
| 256, 512, 768, 1024, 1280, 1536<br />
|}<br />
<br />
====Japan====<br />
{| class="wikitable sortable" width="100%"<br />
|-<br />
! Type<br />
! Title ID<br />
! Name<br />
! Versions<br />
! CDN Availability<br />
|-<br />
| 00030004<br />
| HNGJ (484e474a)<br />
| [[Nintendo DSi Browser]]<br />
| 0, 512, 768<br />
| 0, 512, 768<br />
|-<br />
| 00030005<br />
| HNIJ (484e494a)<br />
| [[Nintendo DSi Camera]]<br />
| 256, 768, 1024<br />
| 256, 768, 1024<br />
|-<br />
| 00030005<br />
| HNJJ (484e4a4a)<br />
| [[Nintendo Zone]]<br />
| 512, 768<br />
| 512, 768<br />
|-<br />
| 00030005<br />
| HNKJ (484e4b4a)<br />
| [[Nintendo DSi Sound]]<br />
| 256, 512<br />
| 256, 512<br />
|-<br />
| 0003000f<br />
| HNLJ (484e4c4a)<br />
| [[Version Data]]<br />
| 1, 2, 3, 4, 5, 6, 7, 8, 9<br />
| 1, 2, 3, 4, 5, 6, 7, 8, 9<br />
|-<br />
| 00030015<br />
| HNOJ (484e4f4a)<br />
| [http://www.nintendo.co.jp/ds/dsiware/hnoj/index.html Nintendo 3DS Transfer Tool]<br />
| 0<br />
| 0<br />
|-<br />
| 00030015<br />
| HNBJ (484e424a)<br />
| [[System Settings]]<br />
| 512, 768<br />
| 512, 768<br />
|-<br />
| 00030015<br />
| HNFJ (484e464a)<br />
| [[Nintendo DSi Shop]]<br />
| 1024, 1280, 1536, 1792, 2048, 2304, 2560, 2816, 3072<br />
| 1024, 1280, 1536, 1792, 2048, 2304, 2560, 2816, 3072<br />
|-<br />
| 00030017<br />
| HNAJ (484e414a)<br />
| [[System Menu]] (Launcher)<br />
| 256, 512, 768, 1024, 1280, 1536, 1792<br />
| 256, 512, 768, 1024, 1280, 1536, 1792<br />
|}<br />
<br />
====United States====<br />
{| class="wikitable sortable" width="100%"<br />
|-<br />
! Type<br />
! Title ID<br />
! Name<br />
! Versions<br />
! CDN Availability<br />
|-<br />
| 00030004<br />
| HNGE (484e4745)<br />
| [[Nintendo DSi Browser]]<br />
| 512, 768<br />
| 512, 768<br />
|-<br />
| 00030005<br />
| HNIE (484e4945)<br />
| [[Nintendo DSi Camera]]<br />
| 768, 1024<br />
| 768, 1024<br />
|-<br />
| 00030005<br />
| HNJE (484e4a45)<br />
| [[Nintendo Zone]]<br />
| 512, 768<br />
| 512, 768<br />
|-<br />
| 00030005<br />
| HNKE (484e4b45)<br />
| [[Nintendo DSi Sound]]<br />
| 256, 512<br />
| 256, 512<br />
|-<br />
| 0003000f<br />
| HNLE (484e4c45)<br />
| [[Version Data]]<br />
| 3, 4, 5, 6, 7, 8, 9<br />
| 3, 4, 5, 6, 7, 8, 9<br />
|-<br />
| 00030015<br />
| HNOE (484e4f45)<br />
| [http://www.nintendo.co.jp/ds/dsiware/hnoj/index.html Nintendo 3DS Transfer Tool]<br />
| 0<br />
| 0<br />
|-<br />
| 00030015<br />
| HNBE (484e4245)<br />
| [[System Settings]]<br />
| 512, 768<br />
| 512, 768<br />
|-<br />
| 00030015<br />
| HNFE (484e4645)<br />
| [[Nintendo DSi Shop]]<br />
| 1536, 1792, 2048, 2304, 2560, 2816, 3072<br />
| 1536, 1792, 2048, 2304, 2560, 2816, 3072<br />
|-<br />
| 00030017<br />
| HNAE (484e4145)<br />
| [[System Menu]] (Launcher)<br />
| 512, 768, 1024, 1280, 1536, 1792<br />
| 512, 768, 1024, 1280, 1536, 1792<br />
|}<br />
<br />
====Europe====<br />
{| class="wikitable sortable" width="100%"<br />
|-<br />
! Type<br />
! Title ID<br />
! Name<br />
! Versions<br />
! CDN Availability<br />
|-<br />
| 00030004<br />
| HNGP (484e4750)<br />
| [[Nintendo DSi Browser]]<br />
| 512, 768<br />
| 512, 768<br />
|-<br />
| 00030005<br />
| HNIP (484e4950)<br />
| [[Nintendo DSi Camera]]<br />
| 768, 1024<br />
| 768, 1024<br />
|-<br />
| 00030005<br />
| HNJP (484e4a50)<br />
| [[Nintendo Zone]]<br />
| 512, 768<br />
| 512, 768<br />
|-<br />
| 00030005<br />
| HNKP (484e4b50)<br />
| [[Nintendo DSi Sound]]<br />
| 256, 512<br />
| 256, 512<br />
|-<br />
| 0003000f<br />
| HNLP (484e4c50)<br />
| [[Version Data]]<br />
| 3, 4, 5, 6, 7, 8, 9<br />
| 3, 4, 5, 6, 7, 8, 9<br />
|-<br />
| 00030015<br />
| HNOP (484e4f50)<br />
| [http://www.nintendo.co.jp/ds/dsiware/hnoj/index.html Nintendo 3DS Transfer Tool]<br />
| 0<br />
| 0<br />
|-<br />
| 00030015<br />
| HNBP (484e4250)<br />
| [[System Settings]]<br />
| 512, 768<br />
| 512, 768<br />
|-<br />
| 00030015<br />
| HNFP (484e4650)<br />
| [[Nintendo DSi Shop]]<br />
| 1536, 1792, 2048, 2304, 2560, 2816, 3072<br />
| 1536, 1792, 2048, 2304, 2560, 2816, 3072<br />
|-<br />
| 00030017<br />
| HNAP (484e4150)<br />
| [[System Menu]] (Launcher)<br />
| 512, 768, 1024, 1280, 1536, 1792<br />
| 512, 768, 1024, 1280, 1536, 1792<br />
|}<br />
<br />
====Australia and New Zealand====<br />
{| class="wikitable sortable" width="100%"<br />
|-<br />
! Type<br />
! Title ID<br />
! Name<br />
! Versions<br />
! CDN Availability<br />
|-<br />
| 00030004<br />
| HNGU (484e4755)<br />
| [[Nintendo DSi Browser]]<br />
| 512, 768<br />
| 512, 768<br />
|-<br />
| 00030005<br />
| HNIU (484e4955)<br />
| [[Nintendo DSi Camera]]<br />
| 768, 1024<br />
| 768, 1024<br />
|-<br />
| 00030005<br />
| HNJU (484e4a55)<br />
| [[Nintendo Zone]]<br />
| 512, 768<br />
| 512, 768<br />
|-<br />
| 00030005<br />
| HNKU (484e4b55)<br />
| [[Nintendo DSi Sound]]<br />
| 256, 512<br />
| 256, 512<br />
|-<br />
| 0003000f<br />
| HNLU (484e4c55)<br />
| [[Version Data]]<br />
| 3, 4, 5, 6, 7, 8, 9<br />
| 3, 4, 5, 6, 7, 8, 9<br />
|-<br />
| 00030015<br />
| HNOU (484e4f55)<br />
| [http://www.nintendo.co.jp/ds/dsiware/hnoj/index.html Nintendo 3DS Transfer Tool]<br />
| 0<br />
| 0<br />
|-<br />
| 00030015<br />
| HNBU (484e4255)<br />
| [[System Settings]]<br />
| 512, 768<br />
| 512, 768<br />
|-<br />
| 00030015<br />
| HNFU (484e4655)<br />
| [[Nintendo DSi Shop]]<br />
| 1536, 1792, 2048, 2304, 2560, 2816, 3072<br />
| 1536, 1792, 2048, 2304, 2560, 2816, 3072<br />
|-<br />
| 00030017<br />
| HNAU (484e4155)<br />
| [[System Menu]] (Launcher)<br />
| 512, 768, 1024, 1280, 1536, 1792<br />
| 512, 768, 1024, 1280, 1536, 1792<br />
|}<br />
<br />
====China====<br />
{| class="wikitable sortable" width="100%"<br />
|-<br />
! Type<br />
! Title ID<br />
! Name<br />
! Versions<br />
! CDN Availability<br />
|-<br />
| 0003000f<br />
| HNLC (484e4c43)<br />
| [[Version Data]]<br />
| 4, 5, 6, 7, 8, 9<br />
| 4, 5, 6, 7, 8, 9<br />
|-<br />
| 00030015<br />
| HNOC (484e4f43)<br />
| [http://www.nintendo.co.jp/ds/dsiware/hnoj/index.html Nintendo 3DS Transfer Tool]<br />
| not available yet in china?<br />
| not available yet in china?<br />
|-<br />
| 00030015<br />
| HNFC (484e4643)<br />
| [[Nintendo DSi Shop]]<br />
| 1792, 2048, 2304, 2560, 2816, 3072<br />
| 1792, 2048, 2304, 2560, 2816, 3072<br />
|-<br />
| 00030017<br />
| HNAC (484e4143)<br />
| [[System Menu]] (Launcher)<br />
| 768, 1024, 1280, 1536, 1792<br />
| 768, 1024, 1280, 1536, 1792<br />
|-<br />
| 00030015<br />
| HNBC (484e4243)<br />
| [[System Settings]]<br />
| 768<br />
| 768<br />
|}<br />
<br />
====Korea====<br />
{| class="wikitable sortable" width="100%"<br />
|-<br />
! Type<br />
! Title ID<br />
! Name<br />
! Versions<br />
! CDN Availability<br />
|-<br />
| 0003000f<br />
| HNLK (484e4c4b)<br />
| [[Version Data]]<br />
| 5, 6, 7, 8, 9<br />
| 5, 6, 7, 8, 9<br />
|-<br />
| 00030015<br />
| HNOK (484e4f5b)<br />
| [http://www.nintendo.co.jp/ds/dsiware/hnoj/index.html Nintendo 3DS Transfer Tool]<br />
| 256<br />
| 256<br />
|-<br />
| 00030015<br />
| HNFK (484e464b)<br />
| [[Nintendo DSi Shop]]<br />
| 1792, 2048, 2304, 2560, 2816, 3072<br />
| 1792, 2048, 2304, 2560, 2816, 3072<br />
|-<br />
| 00030017<br />
| HNAK (484e414b)<br />
| [[System Menu]] (Launcher)<br />
| 768, 1024, 1280, 1536, 1792<br />
| 768, 1024, 1280, 1536, 1792<br />
|-<br />
| 00030015<br />
| HNBK (484e424b)<br />
| [[System Settings]]<br />
| 768<br />
| 768<br />
|}<br />
<br />
== See also ==<br />
<br />
* [[Title metadata|Title metadata (TMD)]]<br />
* [http://wiibrew.org/wiki/NUS_Downloader NUS Downloader info]<br />
* [http://code.google.com/p/nusdownloader/ NUS Downloader source/binary]<br />
* [[NUS Downloader/database]]<br />
* [[Nintendo DSi Shop]]<br />
* [[Nintendo Software]]<br />
* [[System Menu]]</div>Nocash