WiFi Module: Difference between revisions

(3 intermediate revisions by the same user not shown)

Line 3:

There appear to be 3 WiFi modules at use in the DSi. These implement both the "old" WiFi chip (MM3315/MM3218) for DS-mode backwards compatibility, as well as a new Atheros 6k-based WiFi chip. The DS WiFi is configured through profiles 1-3 and is limited to 802.11b 1-2Mbps and WEP encryption while the Atheros supports 802.11g rates and WPA encryption, configured through profiles 4-6.

The DSi only uses a tiny portion of the 128KB available for startup data, calibration, and user settings. Newer revisions of this board have a SPI EEPROM that has no backing memory for most of the 1Mbit address space (presumably as cost savings?). Thus, older modules can be used for installing the "dslink" WiFi loader (to be launched in DSi mode via save-game hacks in DSi hybrid games), while newer modules require a hardmod (chip replacement) to achieve this (as demonstrated by khmann, using an ST M34PE20 chip as replacement). All revisions of the module have footprints for both large and small NVRAM chip, and the change to the limited chip occurred prior to the release of the dslink exploit.

Next to the WiFi chips, these modules also carry the [[NVRAM]] chip. The DSi only uses a tiny portion of the 128KB available for startup data, calibration, and user settings. Newer revisions of this board have a SPI EEPROM that has no backing memory for most of the 1Mbit address space (presumably as cost savings?). Thus, older modules can be used for installing the "dslink" WiFi loader (to be launched in DSi mode via save-game hacks in DSi hybrid games), while newer modules require a hardmod (chip replacement) to achieve this (as demonstrated by khmann, using an ST M34PE20 chip as replacement). All revisions of the module have footprints for both large and small NVRAM chip, and the change to the limited chip occurred prior to the release of the dslink exploit.

The Mitsumi WiFi is controlled through data in the NVRAM (eg: [https://problemkaputt.de/gbatek-ds-firmware-wifi-calibration-data.htm calibration data, allowed channels]), while the Atheros configuration is stored in the other tiny IC on the board, an I2C EEPROM.

Line 13:

== Models ==

The original DSi DWM-W015 module features two wireless chips; a Mitsumi MM3218 for DS compatibility and a more modern Atheros AR6002G BGA which share the antenna through an RF switch. It also features 1Mbit of SPI EEPROM ([[~~ST M45PE10|~~Media:STM45PE10.pdf]]) for [[NVRAM]]. It has enough space to store a full copy of the old DS firmware.

The original DSi DWM-W015 module features two wireless chips; a Mitsumi MM3218 for DS compatibility and a more modern Atheros AR6002G BGA which share the antenna through an RF switch. It also features 1Mbit of SPI EEPROM ([[Media:STM45PE10.pdf|ST M45PE10]]) for NVRAM. It has enough space to store a full copy of the old DS firmware.

The updated DWM-W015A module uses a tiny "5A32" chip as NVRAM (UDFN/XSON, as opposed to the SOIC-sized chip in the older revision). Only the first and last few memory blocks are actually backed by a nonvolatile memory, other addresses return garbage.

Line 24:

=== DWM-W015 ===

http://www.flickr.com/photos/micahdowty/3846960965/sizes/o/in/photostream/

[http://www.flickr.com/photos/micahdowty/3846960965/sizes/o/in/photostream/ Image source]

[[Image:Dwm-w015-scanlime.jpg|800px]]

=== DWM-W015A ===

Line 34:

Line 36:

=== DWM-W024 ===

[[Image:Dwm-w024.jpg]]

[[Image:Dwm-w024.jpg|800px]]

== Debugging the Ath6k Xtensa CPU ==

In case you want to run your own code on it (and subsequently need to debug it), the Atheros chip has two debug facilities: UART and JTAG. UART is a simple serial connection for printf-debugging, while JTAG can be used for single-stepping, breakpoints, etc.

'''NOTE THAT BOTH UART AND JTAG USE 1.8V LOGIC LEVELS. DO NOT DRIVE WITH 3.3 OR 5.0 V!!!'''

=== UART ===

Serial communication on the Xtensa side can be done as [https://problemkaputt.de/gbatek-dsi-atheros-wifi-internal-i-o-00c000h-serial-uart-hw2-hw4-hw6.htm described in GBATEK]. On the DWM-W015, the UART testpoints appear on the bottom side of the PCB, near the edge (see below). On the DWM-W024, RX and TX are probably one of the four testpoints on the top side (see above).

[[Image:Dwm-w015-bottom-marked.jpg|400px]]

=== JTAG ===

The four primary JTAG pins are exposed on the connector to the main board. However, the AR6002 has two extra pins that control JTAG functionality: JTAG_nRST and EJTAG_RST. They are marked in the image below, and they work as follows:

* '''JTAG_nRST''' resets the CPU core when pulled low. Some debuggers use this signal.

* '''EJTAG_RST''' is latched on chip powerup. If high, after a 'system' reset (read: the nWIFI_RST on the connector is pulled low), the Xtensa CPU is held at reset until JTAG_nRST is brought high. If EJTAG_RST is low, nothing special happens.

Thus, if your debugger has a JTAG_nRST signal (and you want to use it), pull EJTAG_RST to VDD18, and connect JTAG_nRST to your debugger. Otherwise, pull EJTAG_RST to ground (or leave it floating as-is, it probably has an internal pulldown).

As debugger, OpenOCD (or its fork for the ESP32) and any JTAG dongle compatible with it should work. '''Note that all JTAG communications use 1.8V! Using a higher voltage will kill the AR6002!'''

[[Image:Dwm-w015-top-marked.jpg|400px]]

=== DWM-W024 testpoints ===

The DWM-W024 has four testpoints with currently-unknown functionality. These are probably UART TX, UART RX, JTAG_nRST, and EJTAG_RST. However, which testpoint is which signal is not yet known.

== Documents and external links ==

@@ Line 3: / Line 3: @@
 There appear to be 3 WiFi modules at use in the DSi. These implement both the "old" WiFi chip (MM3315/MM3218) for DS-mode backwards compatibility, as well as a new Atheros 6k-based WiFi chip. The DS WiFi is configured through profiles 1-3 and is limited to 802.11b 1-2Mbps and WEP encryption while the Atheros supports 802.11g rates and WPA encryption, configured through profiles 4-6.
-The DSi only uses a tiny portion of the 128KB available for startup data, calibration, and user settings. Newer revisions of this board have a SPI EEPROM that has no backing memory for most of the 1Mbit address space (presumably as cost savings?). Thus, older modules can be used for installing the "dslink" WiFi loader (to be launched in DSi mode via save-game hacks in DSi hybrid games), while newer modules require a hardmod (chip replacement) to achieve this (as demonstrated by khmann, using an ST M34PE20 chip as replacement). All revisions of the module have footprints for both large and small NVRAM chip, and the change to the limited chip occurred prior to the release of the dslink exploit.
+Next to the WiFi chips, these modules also carry the [[NVRAM]] chip. The DSi only uses a tiny portion of the 128KB available for startup data, calibration, and user settings. Newer revisions of this board have a SPI EEPROM that has no backing memory for most of the 1Mbit address space (presumably as cost savings?). Thus, older modules can be used for installing the "dslink" WiFi loader (to be launched in DSi mode via save-game hacks in DSi hybrid games), while newer modules require a hardmod (chip replacement) to achieve this (as demonstrated by khmann, using an ST M34PE20 chip as replacement). All revisions of the module have footprints for both large and small NVRAM chip, and the change to the limited chip occurred prior to the release of the dslink exploit.
 The Mitsumi WiFi is controlled through data in the NVRAM (eg: [https://problemkaputt.de/gbatek-ds-firmware-wifi-calibration-data.htm calibration data, allowed channels]), while the Atheros configuration is stored in the other tiny IC on the board, an I2C EEPROM.
@@ Line 13: / Line 13: @@
 == Models ==
-The original DSi DWM-W015 module features two wireless chips; a Mitsumi MM3218 for DS compatibility and a more modern Atheros AR6002G BGA which share the antenna through an RF switch. It also features 1Mbit of SPI EEPROM ([[ST M45PE10|Media:STM45PE10.pdf]]) for [[NVRAM]]. It has enough space to store a full copy of the old DS firmware.
+The original DSi DWM-W015 module features two wireless chips; a Mitsumi MM3218 for DS compatibility and a more modern Atheros AR6002G BGA which share the antenna through an RF switch. It also features 1Mbit of SPI EEPROM ([[Media:STM45PE10.pdf|ST M45PE10]]) for NVRAM. It has enough space to store a full copy of the old DS firmware.
 The updated DWM-W015A module uses a tiny "5A32" chip as NVRAM (UDFN/XSON, as opposed to the SOIC-sized chip in the older revision). Only the first and last few memory blocks are actually backed by a nonvolatile memory, other addresses return garbage.
@@ Line 24: / Line 24: @@
 === DWM-W015 ===
-http://www.flickr.com/photos/micahdowty/3846960965/sizes/o/in/photostream/
+[http://www.flickr.com/photos/micahdowty/3846960965/sizes/o/in/photostream/ Image source]
+[[Image:Dwm-w015-scanlime.jpg|800px]]
 === DWM-W015A ===
@@ Line 34: / Line 36: @@
 === DWM-W024 ===
-[[Image:Dwm-w024.jpg]]
+[[Image:Dwm-w024.jpg|800px]]
+== Debugging the Ath6k Xtensa CPU ==
+In case you want to run your own code on it (and subsequently need to debug it), the Atheros chip has two debug facilities: UART and JTAG. UART is a simple serial connection for printf-debugging, while JTAG can be used for single-stepping, breakpoints, etc.
+'''NOTE THAT BOTH UART AND JTAG USE 1.8V LOGIC LEVELS. DO NOT DRIVE WITH 3.3 OR 5.0 V!!!'''
+=== UART ===
+Serial communication on the Xtensa side can be done as [https://problemkaputt.de/gbatek-dsi-atheros-wifi-internal-i-o-00c000h-serial-uart-hw2-hw4-hw6.htm described in GBATEK]. On the DWM-W015, the UART testpoints appear on the bottom side of the PCB, near the edge (see below). On the DWM-W024, RX and TX are probably one of the four testpoints on the top side (see above).
+[[Image:Dwm-w015-bottom-marked.jpg|400px]]
+=== JTAG ===
+The four primary JTAG pins are exposed on the connector to the main board. However, the AR6002 has two extra pins that control JTAG functionality: JTAG_nRST and EJTAG_RST. They are marked in the image below, and they work as follows:
+* '''JTAG_nRST''' resets the CPU core when pulled low. Some debuggers use this signal.
+* '''EJTAG_RST''' is latched on chip powerup. If high, after a 'system' reset (read: the nWIFI_RST on the connector is pulled low), the Xtensa CPU is held at reset until JTAG_nRST is brought high. If EJTAG_RST is low, nothing special happens.
+Thus, if your debugger has a JTAG_nRST signal (and you want to use it), pull EJTAG_RST to VDD18, and connect JTAG_nRST to your debugger. Otherwise, pull EJTAG_RST to ground (or leave it floating as-is, it probably has an internal pulldown).
+As debugger, OpenOCD (or its fork for the ESP32) and any JTAG dongle compatible with it should work. '''Note that all JTAG communications use 1.8V! Using a higher voltage will kill the AR6002!'''
+[[Image:Dwm-w015-top-marked.jpg|400px]]
+=== DWM-W024 testpoints ===
+The DWM-W024 has four testpoints with currently-unknown functionality. These are probably UART TX, UART RX, JTAG_nRST, and EJTAG_RST. However, which testpoint is which signal is not yet known.
 == Documents and external links ==