CONFIG9 Registers

CONFIG9 Registers

Registers #

Old3DSNameAddressWidthUsed by
YesCFG9_SYSPROT90x100000001Boot9
YesCFG9_SYSPROT110x100000011Boot9
YesCFG9_RST110x100000021Boot9
YesCFG9_DEBUGCTL0x100000044
YesCFG9_XDMA_CNT0x100000081Boot9, Process9, TwlProcess9
YesCFG9_CARDCTL0x1000000C2Process9
YesCFG9_CARDSTATUS0x100000101Process9
YesCFG9_CARDCYCLES00x100000122Boot9, Process9
YesCFG9_CARDCYCLES10x100000142Boot9, Process9
YesCFG9_SDMMCCTL0x100000202Process9
Yes?0x100001002
NoCFG9_EXTMEMCNT90x100002001NewKernel9
YesCFG9_MPCORECFG0x10000FFC4
YesCFG9_BOOTENV0x100100004
YesCFG9_UNITINFO0x100100101Process9
YesCFG9_TWLUNITINFO0x100100141Process9

CFG9_SYSPROT9 #

CFG9_SYSPROT9 is used to permanently disable certain security-sensitive ARM9 memory areas until the next hard reset.

BitDescriptionUsed by
0Disables ARM9 bootrom(+0x8000) when set to 1, and enables access to FCRAM. Cannot be cleared to 0 once set to 1.Boot9
1Disables OTP area when set to 1. Cannot be cleared to 0 once set to 1.NewKernel9Loader, Process9
31-2Not used

On Old 3DS, NATIVE_FIRM reads CFG9_SYSPROT9 to know whether it has previously initialized the TWL console-unique keys using the OTP data. After setting the TWL console-unique keys, NATIVE_FIRM sets CFG9_SYSPROT9 bit 1 to disable the OTP area. In subsequent FIRM launches prior to the next reset, NATIVE_FIRM will see that the OTP area is disabled, and skip this step.

On New 3DS, the above is instead done by the Kernel9 loader. In addition to using the OTP data for initializing the TWL console-unique keys, the Kernel9 loader will generate the decryption key for NATIVE_FIRM. The final keyslot for NATIVE_FIRM is preserved, so that at a non-reset FIRM launch, the keyslot can be reused, since the OTP would then be inaccessible.

CFG9_SYSPROT11 #

BitDescriptionUsed by
0Disables ARM11 bootrom(+0x8000) when set to 1, and enables access to FCRAM. Cannot be cleared to 0 once set to 1.Boot9
31-1Not used

CFG9_RST11 #

BitDescriptionUsed by
0Presumably takes ARM11 out of reset. Cannot be set to 1 once it has been cleared.Boot9
31-1Not used

CFG9_XDMA_CNT #

Write 1 to enable XDMA for the device, 0 to disable. Always enabled for CTRCARD (ids 0 and 1), NTRCARD (id 8), and SHA (id 6 for infifo and 7 for outfifo).

BitDescriptionUsed by
0SDIO controller 1 (eMMC and usually SD card; XDMA device ID: 2)
1SDIO controller 3 (SD card if configured so; ID: 3)
2AES Input FIFO (ID: 4)Boot9, Process9, TwlProcess9
3AES Output FIFO (ID: 5)Boot9, Process9, TwlProcess9
31-4Reserved

CFG9_CARDCTL #

BitDescriptionUsed by
1-0Gamecard active controller select (0=NTRCARD, 1=?, 2=CTRCARD0, 3=CTRCARD1)Process9
81 = Switch to SPICARD interface (savegames).Process9

Depending on the gamecard controller that has been selected, one of the following gamecard registers will become active:

  • Selecting NTRCARD will activate the register space at 0x10164000.
  • Selecting CTRCARD0 will activate the register space at 0x10004000.
  • Selecting CTRCARD1 will activate the register space at 0x10005000.

CFG9_CARDSTATUS #

BitDescriptionUsed by
0Cartridge-slot empty (0=inserted, 1=empty)Process9
3-2Cartridge-slot power supply (0=off, 1=prepare power regulator, 2=enable output, 3=request power down)Process9

When the power supply is in the “request power down” state, the power bits will be reset to 0=off after some time.

CFG9_SDMMCCTL #

This register controls power of multiple ports/controllers and allows to map controller 3 to ARM9 or ARM11. The SD card can be accessed on ARM11 by setting bit 8 and clearing bit 9.

BitDescriptionUsed by
0Controller 1/3 port 0 power (SD card) (1=off)Process9
1Controller 1 port 1 power (eMMC) (1=off)Process9
2Controller 2 port 0 power (WiFi SDIO) (1=off)Process9
3Controller 3 port 1 power? Set at cold boot.-
4-5Unused.-
6Wifi port related? Pull up? Set at cold boot.-
8Controller 3 mapping (0=ARM9 0x10007000, 1=ARM11 0x10100000)Process9
9SD card controller select (0=0x10007000/0x10100000, 1=0x10006000)Process9
10-15Unused.-

CFG9_EXTMEMCNT9 #

This register is New3DS-only.

BitDescriptionUsed by
0Hide extended ARM9 memory (0=hidden, 1=shown)Kernel9 (New3DS)
31-1Reserved

CFG9_MPCORECFG #

Identical to PDN_MPCORE_CFG.

CFG9_BOOTENV #

This register is used to determine what the previous running FIRM was. Its value is kept following an MCU reboot. Its initial value (on a cold boot) is 0. NATIVE_FIRM sets it to 1 on shutdown/FIRM launch. LGY FIRM writes value 3 here when launching a TWL title, and writes value 7 when launching an AGB title.

NATIVE_FIRM will only launch titles if this is not value 0, and will only save the AGB_FIRM savegame to SD if this is value 7.

CFG9_UNITINFO #

This 8-bit register is value zero for retail, non-zero for dev/debug units.

CFG9_TWLUNITINFO #

In the console-unique TWL key-init/etc function the ARM9 copies the u8 value from REG_UNITINFO to this register.

This is also used by TWL_FIRM Process9.