Nintendo Switch Brew - User contributions [en]

Product Information

2023-05-26T01:40:08Z

CapNem: /* Prefix */

This page details miscellaneous Switch product information (serial numbers, product models, etc...).

= Product List =
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HAC-001 || Retail Nintendo Switch console
|-
| HAC-002 || AC adapter
|-
| HAC-003 || Nintendo Switch Battery
|-
| HAC-004 ||
|-
| HAC-005 ||
|-
| HAC-006 || Joy-Con battery
|-
| HAC-007 || Dock
|-
| HAC-008 || Gamecard
|-
| HAC-009 || Gamecard case
|-
| HAC-010 || USB charging cable also included in ("Mario Kart Live: Home Circuit")
|-
| HAC-011 || Joy-Con grip
|-
| HAC-012 || Joy-Con charge grip
|-
| HAC-013 || Pro Controller
|-
| HAC-014 || Joy-Con strap
|-
| HAC-015 || Left Joy-Con
|-
| HAC-016 || Right Joy-Con
|-
| HAC-017 || Joy-Con handle
|-
| HAC-018 || Screen protector
|-
| HAC-019 || Left Joy-Con extended battery
|-
| HAC-020 || Right Joy-Con extended battery
|-
| HAC-021 || Carrying case
|-
| HAC-022 || Ring-Con
|-
| HAC-023 || Leg Strap
|-
| HAC-024 || Poké Ball Plus controller
|-
| HAC-025 ||
|-
| HAC-026 ||
|-
| HAC-027 ||
|-
| HAC-028 ||
|-
| HAC-029 || Steelbook Gamecard case
|-
| HAC-030 || Poké Ball Plus battery
|-
| HAC-031 || Charging stand
|-
| HAC-032 ||
|-
| HAC-033 || Left NES controller
|-
| HAC-034 || Right NES controller
|-
| HAC-035 || Left Famicom controller
|-
| HAC-036 || Right Famicom controller
|-
| HAC-037 || Kart ("Mario Kart Live: Home Circuit")
|-
| HAC-038 || Battery for kart ("Mario Kart Live: Home Circuit")
|-
| HAC-039 || Gates ("Mario Kart Live: Home Circuit")
|-
| HAC-040 || Touch Pen ("Super Mario Maker 2")
|-
| HAC-041 || Touch Pen ("Brain Training for Switch")
|-
| HAC-042 || SNES controller
|-
| HAC-043 || N64 controller
|-
| HAC-044 || Arrow Markers ("Mario Kart Live: Home Circuit")
|-
| HAC-045 || Sega Genesis 3 Button controller
|-
| HAC-046 || Sega Genesis 6 Button controller
|-
| HAC-047 || USB charging cable ("Mario Kart Live: Home Circuit") known as HAC-010 instead
|-
| HAC-048 ||
|-
| HAC-049 ||
|-
| HAC-050 ||
|-
| HAC-051 || Nintendo Labo Toy-Con 1: Variety Kit
|-
| HAC-052 || Nintendo Labo Toy-Con 2: Robot Kit
|-
| HAC-053 || Nintendo Labo Toy-Con 3: Vehicle Kit
|-
| HAC-054 || Nintendo Labo Toy-Con 4: VR Kit
|-
| HAC-055 || Nintendo Labo Storage Box
|}
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HAC-001(-01) || Retail Nintendo Switch Mariko console (also known as HAD[...])
|}
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HAT-001 || SDEV Nintendo Switch console
|-
| HAT-001(-01) || SDEV-D Nintendo Switch Mariko console
|-
| HAT-002 || EDEV Nintendo Switch console
|-
| HAT-002(-01) || EDEV-D Nintendo Switch Mariko console
|-
| HAT-003 || SDEV cradle
|-
| HAT-004 || RelayBox/RelayBox-D
|}
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HDH-001 || Retail Nintendo Switch Lite console
|-
| HDH-002 || HDEV Nintendo Switch console
|-
| HDH-003 || Battery
|-
| HDH-004 || Carrying case
|-
| HDH-005 || Screen protector
|-
| HDH-006 || Flip cover
|}
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HEG-001 || Retail Nintendo Switch (OLED Model) console
|-
| HEG-002 || ADEV Nintendo Switch console
|-
| HEG-004 || RelayBox-A
|-
| HEG-005 || Nintendo Switch (OLED Model) HDMI cable
|-
| HEG-007 || Nintendo Switch (OLED Model) dock
|-
| HEG-021 || Nintendo Switch (OLED Model) carrying case
|}

= Product Serial Numbers =
Serial numbers are composed of at least [[#Prefix|three letters]] followed by ten decimal digits. The tenth digit is a [[#Check_Digit|check digit]], meaning that it is derived from the other digits.

== Prefix ==
Observed prefixes are normally as follows:

* First letter represents the product line:
** "X" (NX)
* Second letter represents the product model:
** "A" (HAC-001; Nintendo Switch console)
** "B" (HAC-015; Left Joy-Con)
** "C" (HAC-016; Right Joy-Con)
** "D" (HAC-012; Joy-Con charge grip)
** "E" (HAC-013; Pro Controller)
** "F" (HAC-007; Dock)
** "H" (HAC-024; Poké Ball Plus controller)
** "J" (HDH-001; Nintendo Switch Lite console)
** "K" (HAC-001-01; Nintendo Switch Mariko console)
** "L" (HAC-033; Left NES controller)
** "M" (HAC-034; Right NES controller)
** "N" (HAC-035; Left Famicom controller)
** "P" (HAC-036; Right Famicom controller)
** "Q" (HAC-037; Kart for "Mario Kart Live: Home Circuit")
** "R" (HAC-042; SNES controller)
** "S" (HAC-043; N64 controller)
** "T" (HEG-001; Nintendo Switch (OLED Model) console)
** "V" (HEG-007; Nintendo Switch (OLED Model) dock)
** "X" (HAC-045; Sega Genesis controller)
** "Y" (HAT-004/HEG-004; RelayBox/RelayBox-D/RelayBox-A)
** "Z" (HAT-003; SDEV cradle)
* Third letter represents the product region:
** "C" (China)
** "E" (Europe)
** "J" (Japan; and Europe on old models)
** "K" (Korea)
** "L" (All; for development only)
** "W" (Americas)
* Fourth letter is optional:
** "F" (Factory)

== Assembly Line ==
The first two digits immediately after the [[#Prefix|prefix]] represent the assembly line as follows:

{| class="wikitable" border="1"
|-
! Value || Description
|-
| 00 || Unspecified
|-
| 01 || Prototype
|-
| 02 || SDEV
|-
| 03 || EDEV
|-
| 04 || DPRD
|-
| 05 || HDEV
|-
| 06 || SDEV-D
|-
| 07 || EDEV-D
|-
| 10 || Retail
|-
| 40 || Retail
|-
| 50 || Retail
|-
| 70 || Retail
|-
| 80 || Retail Pro Controller
|-
| 90 || Refurbished
|-
| 14 || Retail Joy-Con
|-
| 17 || Retail Joy-Con
|}

== Check Digit ==
The check digit is an industry-standard algorithm and is calculated just like it was on the [https://www.3dbrew.org/wiki/Serials#Console_Serial_Numbers 3DS].

To calculate the check digit of a Switch console, separate the non-check digits into "odd" and "even" groups, where the "odd" group is digits in odd-numbered positions, and the "even" group is digits in even-numbered positions. (The first digit is "odd", with "first" representing "1".)

After separating the digits, add the digits in each group together. Multiply the sum of the even digits by 3, then add the sum of the odd digits. To calculate the check digit, take this value modulo 10, and if not 0, subtract from 10.

Example: XAW10075273452

The non-check digits are 1007527345. Separating into odd and even groups, we get the following:

Odds: 1 + 0 + 5 + 7 + 4 = 17 Evens: 0 + 7 + 2 + 3 + 5 = 17

Applying the algorithm, we get ((3 * 17) + 17) % 10 = 8, which is not 0, thus 10 - 8 = 2, matching the example's check digit.

Joy-Con

2023-04-28T23:07:44Z

CapNem: /* Colors */

Joy-Con is the name for the Switch's primary game controllers. The controllers communicate to the console through bluetooth and can be disconnected from the main unit.

= Hardware =
The controllers themselves are simple to disassemble and identify.
[[File:JoyconFront.jpg|400px|thumb|The front of the Joy-Con internal[https://www.ifixit.com/Teardown/Nintendo+Switch+Teardown/78263]]]
[[File:JoyconRear.jpg|400px|thumb|The rear of the Joy-Con internal[https://www.ifixit.com/Teardown/Nintendo+Switch+Teardown/78263]]]
{| class="wikitable"
! Color || Item
|-
| Red || Broadcom BCM20734 Bluetooth 4.1/2.4 GHz Transceiver
|-
| Orange || STMicroelectronics NFCBEA 812006 33 (Likely NFC reader IC)
|-
| Yellow|| Macronix International MX25U4033E 4 Mb CMOS Flash
|}

= Firmware =
''See also: [[Joy-Con Firmware]]''

The firmware of the Joy-Cons seems to be generic across all instances. Details such as the handedness of the controller and the color is just indicated in a configuration part of the flash. Judging by quick glance at the firmware, it's probably identical to that used on the Pro Controller as well.
{| class="wikitable"
! Controller || 1.0.0
|-
| Joy-Con Left (Blue) || [[:File:pad.L.bin|flash dump]]
|-
| Joy-Con Right (Red) || [[:File:pad.R.bin|flash dump]]
|}

The flash is in a patch-ram format. Tools for dealing with it are available [https://github.com/shuffle2/nxpad].
A dump of the ROM region (taken while firmware was running) can be found [[:File:bcm20734_rom.bin|here]]. Note this is the same SoC used on the other controller models, as well.

= Protocol =
The Joy-Con can communicate wirelessly over Bluetooth or through the rails over UART. This uses a Nintendo proprietary protocol called "Nwcp".

== NwcpPacket ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x5
| [[#HciHeader|HciHeader]]
|-
| 0x5
| 0x7
| [[#NwcpHeader|NwcpHeader]]
|-
| 0xC
| Variable
| Data
|}

=== HciHeader ===
This is a 5-byte packet header used by Broadcom's HCI Control Protocol.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| PacketType (always 0x19)
|-
| 0x1
| 0x1
| [[#CommandCode|CommandCode]]
|-
| 0x2
| 0x1
| GroupCode (always 0x03)
|-
| 0x3
| 0x2
| PacketLength
|}

==== CommandCode ====
{| class="wikitable" border="1"
! Value
! Description
|-
| 0x1 || SendToDevice
|-
| 0x81 || ReceiveFromDevice
|}

=== NwcpHeader ===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| [[#CommandType|CommandType]]
|-
| 0x1
| 0x1
| [[#DeviceCommand|DeviceCommand]]
|-
| 0x2
| 0x2
| DataSize
|-
| 0x4
| 0x1
| CommandResult
|-
| 0x5
| 0x1
| DataCrc (CRC8 over Data for DataSize bytes)
|-
| 0x6
| 0x1
| HeaderCrc (CRC8 over the previous 6 bytes)
|}

==== CommandType ====
{| class="wikitable" border="1"
! Value
! Description
|-
| 0x91 || DeviceCommandToDevice
|-
| 0x92 || Hid
|-
| 0x94 || DeviceCommandFromDevice
|-
| 0x9A ||
|-
| 0xA3 ||
|-
| 0xA5 || Handshake
|}

== DeviceCommand ==
{| class="wikitable" border="1"
! Value
! Description
|-
| 0x01 || Inquiry
|-
| 0x02 || WriteChargerSettings
|-
| 0x03 || ReadChargerSettings
|-
| 0x04 || AttachmentEnable
|-
| 0x05 || IsAttachmentEnabled
|-
| 0x06 || GetBatteryVoltage
|-
| 0x07 || ReadWakeUpReason
|-
| 0x10 || CreateHidConnection
|-
| 0x11 || DisconnectHid
|-
| 0x12 || SetHidInterval
|-
| 0x13 || GetHidInterval
|-
| 0x18 || Pairing
|-
| 0x20 || UpdateUartBaudRate
|-
| 0x40 || Test
|}

== HidCommand ==
{| class="wikitable" border="1"
! Value
! Description
|-
| 0x01 || PairingOut
|-
| 0x02 || GetDeviceInfo
|-
| 0x03 || SetDataFormat
|-
| 0x04 || LRButtonDetection
|-
| 0x05 || Page
|-
| 0x06 || Reset
|-
| 0x07 || ClearPairingInfo
|-
| 0x08 || Shipment
|-
| 0x10 || SerialFlashRead
|-
| 0x11 || SerialFlashWrite
|-
| 0x12 || SerialFlashSectorErase
|-
| 0x20 || McuReset
|-
| 0x21 || McuWrite
|-
| 0x22 || McuResume
|-
| 0x24 || McuPollingEnable
|-
| 0x25 || McuPollingDisable
|-
| 0x28 || AttachmentWrite
|-
| 0x29 || AttachmentRead
|-
| 0x2A || AttachmentEnable
|-
| 0x2B || GetAttachmentInfo
|-
| 0x30 || SetIndicatorLed
|-
| 0x31 || GetIndicatorLed
|-
| 0x38 || SetNotificationLed
|-
| 0x40 || SensorSleep
|-
| 0x41 || SensorConfig
|-
| 0x42 || SensorWrite
|-
| 0x43 || SensorRead
|-
| 0x48 || MotorEnable
|-
| 0x50 || GetBatteryVoltage
|-
| 0x51 || WriteChargeSetting
|-
| 0x52 || ReadChargeSetting
|-
| 0x58 || ExtDevWrite
|-
| 0x59 || GetExtDevInfo
|-
| 0x5A || ExtDevPollingEnable
|-
| 0x5B || ExtDevPollingDisable
|-
| 0x5C || ExtDevInFormatConfig
|-
| 0x5D ||
|-
| 0x60 || InternalAttachmentWrite
|-
| 0x61 ||
|-
| 0x62 || InternalAttachmentEnable
|-
| 0x63 || InternalAttachmentPollingEnable
|-
| 0x64 || InternalAttachmentPollingDisable
|-
| 0x7A || AddButtonPlayData
|-
| 0x7B || StartStopButtonPlayData
|-
| 0x80 || Ack
|-
| 0x81 || PairingIn
|-
| 0x82 || DeviceInfo
|-
| 0x83 || LRButtonElapsedTime
|-
| 0x90 || SerialFlashData
|-
| 0xA0 || McuData
|-
| 0xA8 || AttachmentData
|-
| 0xA9 || AttachmentInfo
|-
| 0xAA || InternalAttachmentRead
|-
| 0xB0 || IndicatorLed
|-
| 0xC0 || SensorData
|-
| 0xD0 || BatteryVoltage
|-
| 0xD8 || ExtDevRead
|-
| 0xD9 || ExtDevInfo
|}

== Left & Right Separate Joy-con ==
When paired directly to a computer over bluetooth, the joy-con both provide identical HID input report descriptor. This does not appear to include motion controls, IR data, or NFC. They both behave as detached single-player controllers.

HID Input Report Descriptor (Hexadecimal):
<pre>
00000000: 05010905 A1010601 FF852109 21750895 ....¡...ÿ…!.!u.•
00000010: 30810285 30093075 08953081 02853109 0..…0.0u.•0..…1.
00000020: 31750896 69018102 85320932 75089669 1u.–i...…2.2u.–i
00000030: 01810285 33093375 08966901 8102853F ...…3.3u.–i...…?
00000040: 05091901 29101500 25017501 95108102 ....)...%.u.•...
00000050: 05010939 15002507 75049501 81420509 ...9..%.u.•..B..
00000060: 75049501 81010501 09300931 09330934 u.•......0.1.3.4
00000070: 16000027 FFFF0000 75109504 81020601 ...'ÿÿ..u.•.....
00000080: FF850109 01750895 30910285 10091075 ÿ…...u.•0‘.…...u
00000090: 08953091 02851109 11750895 30910285 .•0‘.…...u.•0‘.…
000000A0: 12091275 08953091 02C0 ...u.•0‘.À
</pre>

{| class="wikitable"
! Parsed Bytes || Description
|-
|0x05, 0x01, || Usage Page (Generic Desktop Ctrls)
|-
|0x09, 0x05, || Usage (Game Pad)
|-
|0xA1, 0x01, || Collection (Application)
|-
|0x06, 0x01, 0xFF, || Usage Page (Vendor Defined 0xFF01)
|-
|0x85, 0x21, || Report ID (33)
|-
|0x09, 0x21, || Usage (0x21)
|-
|0x75, 0x08, || Report Size (8)
|-
|0x95, 0x30, || Report Count (48)
|-
|0x81, 0x02, || Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)
|-
|0x85, 0x30, || Report ID (48)
|-
|0x09, 0x30, || Usage (0x30)
|-
|0x75, 0x08, || Report Size (8)
|-
|0x95, 0x30, || Report Count (48)
|-
|0x81, 0x02, || Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)
|-
|0x85, 0x31, || Report ID (49)
|-
|0x09, 0x31, || Usage (0x31)
|-
|0x75, 0x08, || Report Size (8)
|-
|0x96, 0x69, 0x01, || Report Count (361)
|-
|0x81, 0x02, || Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)
|-
|0x85, 0x32, || Report ID (50)
|-
|0x09, 0x32, || Usage (0x32)
|-
|0x75, 0x08, || Report Size (8)
|-
|0x96, 0x69, 0x01, || Report Count (361)
|-
|0x81, 0x02, || Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)
|-
|0x85, 0x33, || Report ID (51)
|-
|0x09, 0x33, || Usage (0x33)
|-
|0x75, 0x08, || Report Size (8)
|-
|0x96, 0x69, 0x01, || Report Count (361)
|-
|0x81, 0x02, || Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)
|-
|0x85, 0x3F, || Report ID (63)
|-
|0x05, 0x09, || Usage Page (Button)
|-
|0x19, 0x01, || Usage Minimum (0x01)
|-
|0x29, 0x10, || Usage Maximum (0x10)
|-
|0x15, 0x00, || Logical Minimum (0)
|-
|0x25, 0x01, || Logical Maximum (1)
|-
|0x75, 0x01, || Report Size (1)
|-
|0x95, 0x10, || Report Count (16)
|-
|0x81, 0x02, || Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)
|-
|0x05, 0x01, || Usage Page (Generic Desktop Ctrls)
|-
|0x09, 0x39, || Usage (Hat switch)
|-
|0x15, 0x00, || Logical Minimum (0)
|-
|0x25, 0x07, || Logical Maximum (7)
|-
|0x75, 0x04, || Report Size (4)
|-
|0x95, 0x01, || Report Count (1)
|-
|0x81, 0x42, || Input (Data,Var,Abs,No Wrap,Linear,Preferred State,Null State)
|-
|0x05, 0x09, || Usage Page (Button)
|-
|0x75, 0x04, || Report Size (4)
|-
|0x95, 0x01, || Report Count (1)
|-
|0x81, 0x01, || Input (Const,Array,Abs,No Wrap,Linear,Preferred State,No Null Position)
|-
|0x05, 0x01, || Usage Page (Generic Desktop Ctrls)
|-
|0x09, 0x30, || Usage (X)
|-
|0x09, 0x31, || Usage (Y)
|-
|0x09, 0x33, || Usage (Rx)
|-
|0x09, 0x34, || Usage (Ry)
|-
|0x16, 0x00, 0x00, || Logical Minimum (0)
|-
|0x27, 0xFF, 0xFF, 0x00, 0x00, || Logical Maximum (65534)
|-
|0x75, 0x10, || Report Size (16)
|-
|0x95, 0x04, || Report Count (4)
|-
|0x81, 0x02, || Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)
|-
|0x06, 0x01, 0xFF, || Usage Page (Vendor Defined 0xFF01)
|-
|0x85, 0x01, || Report ID (1)
|-
|0x09, 0x01, || Usage (0x01)
|-
|0x75, 0x08, || Report Size (8)
|-
|0x95, 0x30, || Report Count (48)
|-
|0x91, 0x02, || Output (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
|-
|0x85, 0x10, || Report ID (16)
|-
|0x09, 0x10, || Usage (0x10)
|-
|0x75, 0x08, || Report Size (8)
|-
|0x95, 0x30, || Report Count (48)
|-
|0x91, 0x02, || Output (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
|-
|0x85, 0x11, || Report ID (17)
|-
|0x09, 0x11, || Usage (0x11)
|-
|0x75, 0x08, || Report Size (8)
|-
|0x95, 0x30, || Report Count (48)
|-
|0x91, 0x02, || Output (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
|-
|0x85, 0x12, || Report ID (18)
|-
|0x09, 0x12, || Usage (0x12)
|-
|0x75, 0x08, || Report Size (8)
|-
|0x95, 0x30, || Report Count (48)
|-
|0x91, 0x02, || Output (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
|-
|0xC0, || End Collection
|}

== Colors ==
HEX codes for the colors shown in the "Controllers" menu of the Switch UI can be found in a Joy-con SPI dump starting at offset 0x6050. Body color is first followed by button color and each is 3 bytes long. These values are able to be re-written with any HEX color value to make the Joy-cons show up as different colors in the UI. The following is a list of official HEX colors recovered from SPI dumps.
{| class="wikitable"
! Developer Kit Joy-Con || Release || Body HEX || Button HEX
|-
| Black / ブラック || 2015.10.16 || #313131 || #0F0F0F
|-
! Standard Retail Joy-Con Color || Release || Body HEX || Button HEX
|-
| Gray / グレー || 2017.03.03 || #828282 || #0F0F0F
|-
| Neon Red / ネオンレッド || 2017.03.03 || #FF3C28 || #1E0A0A
|-
| Neon Blue / ネオンブルー || 2017.03.03 || #0AB9E6 || #001E1E
|-
| Neon Yellow / ネオンイエロー || 2017.06.16 || #E6FF00 || #142800
|-
| Neon Green / ネオングリーン || 2017.07.21 || #1EDC00 || #002800
|-
| Neon Pink / ネオンピンク || 2017.07.21 || #FF3278 || #28001E
|-
| Red / レッド || 2017.10.27 || #E10F00 || #280A0A
|-
| Blue / ブルー || 2019.10.04 || #4655F5 || #00000A
|-
| Neon Purple / ネオンパープル || 2019.10.04 || #B400E6 || #140014
|-
| Neon Orange / ネオンオレンジ || 2019.10.04 || #FAA005 || #0F0A00
|-
| White / ホワイト || 2021.10.08 || #E6E6E6 || #323232
|-
! Special Edition Joy-Con Color || Release || Body HEX || Button HEX
|-
| Nintendo Switch Gray Joy-Con / Nintendo Switch グレー || 2017.03.03 || #828282 || #0F0F0F
|-
| Nintendo Switch Neon-Blue Left Joy-Con / Nintendo Switch ネオンブルー・ネオンレッド || 2017.03.03 || #0AB9E6 || #001E1E
|-
| Nintendo Switch Neon-Red Right Joy-Con / Nintendo Switch ネオンブルー・ネオンレッド || 2017.03.03 || #FF3C28 || #1E0A0A
|-
| Splatoon 2 Edition Neon-Green Left Joy-Con / スプラトゥーン2 || 2017.07.21 || #1EDC00 || #002800
|-
| Splatoon 2 Edition Neon-Pink Right Joy-Con / スプラトゥーン2 || 2017.07.21 || #FF3278 || #28001E
|-
| Super Mario Odyssey Edition Red Joy-Con / スーパーマリオオデッセイ || 2017.10.27 || #E10F00 || #280A0A
|-
| Super Smash Bros. Ultimate Edition Gray Joy-Con / 大乱闘スマッシュブラザーズ || 2018.11.02 || #828282 || #0F0F0F
|-
| Pokémon: Let's Go! Edition Eevee-Brown Left Joy-Con / ポケットモンスター Let's Go! イーブイ || 2018.11.16 || #C88C32 || #281900
|-
| Pokémon: Let's Go! Edition Pikachu-Yellow Right Joy-Con / ポケットモンスター Let's Go! ピカチュウ || 2018.11.16 || #FFDC00 || #322800
|-
| *Nintendo Labo Creators Contest Edition "Cardboard"-Colored Joy-Con || 2018. (...?) || #D7AA73 || #1E1914
|-
| **Dragon Quest XI S Lotto Edition Royal-Blue Joy-Con / ドラゴンクエスト XI S （ロト版） || 2019.09.27 || #1473FA || #00000F
|-
| **Disney Tsum Tsum Festival Edition Neon-Purple Left Joy-Con / ディズニーツムツムフェスティバル || 2019.10.10 || #B400E6 || #140014
|-
| **Disney Tsum Tsum Festival Edition Neon-Pink Right Joy-Con / ディズニーツムツムフェスティバル || 2019.10.10 || #FF3278 || #28001E
|-
| Animal Crossing: New Horizons Edition Pastel-Green Left Joy-Con / あつまれどうぶつの森 || 2020.03.13 || #82FF96 || #0A1E0A
|-
| Animal Crossing: New Horizons Edition Pastel-Blue Right Joy-Con / あつまれどうぶつの森 || 2020.03.13 || #96F5F5 || #0A1E28
|-
| Fortnite Wildcat Edition Yellow Left Joy-Con / フォートナイトワイルドキャット(山猫) || 2020.10.30 || #FFCC00 || #1A1100
|-
| Fortnite Wildcat Edition Dark-Blue Right Joy-Con / フォートナイトワイルドキャット(山猫) || 2020.10.30 || #0084FF || #000F1E
|-
| Mario Red × Blue Edition Red Joy-Con / マリオレッド × ブルー || 2021.02.12 || #F04614 || #1E1914
|-
| Monster Hunter Rise Edition Gray Joy-Con / モンスターハンターライズ || 2021.03.26 || #818282 || #0E0F0F
|-
| Fortnite Fleet Force Edition Dark-Blue Left Joy-Con / フォートナイトフリートフォース(力の艦隊) || 2021.06.04 || #0084FF || #000F1E
|-
| Fortnite Fleet Force Edition Yellow Right Joy-Con / フォートナイトフリートフォース(力の艦隊) || 2021.06.04 || #FFCC00 || #1A1100
|-
| Legend of Zelda: Skyward Sword Edition Dark-Blue Left Joy-Con / ゼルダの伝説スカイウォードソード || 2021.07.16 || #2D50F0 || #1E0F46
|-
| Legend of Zelda: Skyward Sword Edition Dark-Purple Right Joy-Con / ゼルダの伝説スカイウォードソード || 2021.07.16 || #500FC8 || #00051E
|-
| Nintendo Switch OLED Edition White Joy-Con / Nintendo Switch （有機ELモデル）ホワイト || 2021.10.08 || #E6E6E6 || #323232
|-
| Splatoon 3 OLED Edition Blue-Gradient Left Joy-Con / （有機ELモデル）スプラトゥーン3 || 2022.08.26 || #6455F5 || #28282D
|-
| Splatoon 3 OLED Edition Neon-Yellow-Gradient Right Joy-Con / （有機ELモデル）スプラトゥーン3 || 2022.08.26 || #C3FA05 || #1E1E28
|-
| Pokémon: Scarlet × Violet OLED Edition Scarlet Left Joy-Con / （有機ELモデル）ポケットモンスタースカーレット・バイオレット || 2022.11.04 || #F07341 || #322D1E
|-
| Pokémon: Scarlet × Violet OLED Edition Violet Right Joy-Con / （有機ELモデル）ポケットモンスタースカーレット・バイオレット || 2022.11.04 || #9650AA || #32322D
|-
| Legend of Zelda: Tears of the Kingdom Edition Gold Joy-Con / （有機ELモデル）ゼルダの伝説　ティアーズオブザキングダムエディション || 2023.04.28 || #D2BE69 || #32322D
|-
| // *(Prize Awarded for Labo Contest - No Retail) // **(Available Japan Only)
|}

= Additional Links =
[https://github.com/dekuNukem/Nintendo_Switch_Reverse_Engineering Reverse Engineering of the Joy-Con by Github user dekuNukem]

Product Information

2022-09-18T23:31:04Z

CapNem: /* Assembly Line */ Added newer assembly line indexes seen on some newer controllers.

This page details miscellaneous Switch product information (serial numbers, product models, etc...).

= Product List =
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HAC-001 || Retail Nintendo Switch console
|-
| HAC-002 || AC adapter
|-
| HAC-003 || Nintendo Switch Battery
|-
| HAC-004 ||
|-
| HAC-005 ||
|-
| HAC-006 || Joy-Con battery
|-
| HAC-007 || Dock
|-
| HAC-008 || Gamecard
|-
| HAC-009 || Gamecard case
|-
| HAC-010 || USB charging cable also included in ("Mario Kart Live: Home Circuit")
|-
| HAC-011 || Joy-Con grip
|-
| HAC-012 || Joy-Con charge grip
|-
| HAC-013 || Pro Controller
|-
| HAC-014 || Joy-Con strap
|-
| HAC-015 || Left Joy-Con
|-
| HAC-016 || Right Joy-Con
|-
| HAC-017 || Joy-Con handle
|-
| HAC-018 || Screen protector
|-
| HAC-019 || Left Joy-Con extended battery
|-
| HAC-020 || Right Joy-Con extended battery
|-
| HAC-021 || Carrying case
|-
| HAC-022 || Ring-Con
|-
| HAC-023 || Leg Strap
|-
| HAC-024 || Poké Ball Plus controller
|-
| HAC-025 ||
|-
| HAC-026 ||
|-
| HAC-027 ||
|-
| HAC-028 ||
|-
| HAC-029 || Steelbook Gamecard case
|-
| HAC-030 || Poké Ball Plus battery
|-
| HAC-031 || Charging stand
|-
| HAC-032 ||
|-
| HAC-033 || Left NES controller
|-
| HAC-034 || Right NES controller
|-
| HAC-035 || Left Famicom controller
|-
| HAC-036 || Right Famicom controller
|-
| HAC-037 || Kart ("Mario Kart Live: Home Circuit")
|-
| HAC-038 || Battery for kart ("Mario Kart Live: Home Circuit")
|-
| HAC-039 || Gates ("Mario Kart Live: Home Circuit")
|-
| HAC-040 || Touch Pen ("Super Mario Maker 2")
|-
| HAC-041 || Touch Pen ("Brain Training for Switch")
|-
| HAC-042 || SNES controller
|-
| HAC-043 || N64 controller
|-
| HAC-044 || Arrow Markers ("Mario Kart Live: Home Circuit")
|-
| HAC-045 || Sega Genesis 3 Button controller
|-
| HAC-046 || Sega Genesis 6 Button controller
|-
| HAC-047 || USB charging cable ("Mario Kart Live: Home Circuit") known as HAC-010 instead
|-
| HAC-048 ||
|-
| HAC-049 ||
|-
| HAC-050 ||
|-
| HAC-051 || Nintendo Labo Toy-Con 1: Variety Kit
|-
| HAC-052 || Nintendo Labo Toy-Con 2: Robot Kit
|-
| HAC-053 || Nintendo Labo Toy-Con 3: Vehicle Kit
|-
| HAC-054 || Nintendo Labo Toy-Con 4: VR Kit
|-
| HAC-055 || Nintendo Labo Storage Box
|}
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HAC-001(-01) || Retail Nintendo Switch Mariko console (also known as HAD[...])
|}
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HAT-001 || SDEV Nintendo Switch console
|-
| HAT-001(-01) || SDEV-D Nintendo Switch Mariko console
|-
| HAT-002 || EDEV Nintendo Switch console
|-
| HAT-002(-01) || EDEV-D Nintendo Switch Mariko console
|-
| HAT-003 || SDEV cradle
|-
| HAT-004 || RelayBox/RelayBox-D
|}
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HDH-001 || Retail Nintendo Switch Lite console
|-
| HDH-002 || HDEV Nintendo Switch console
|-
| HDH-003 || Battery
|-
| HDH-004 || Carrying case
|-
| HDH-005 || Screen protector
|-
| HDH-006 || Flip cover
|}
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HEG-001 || Retail Nintendo Switch (OLED Model) console
|-
| HEG-002 || ADEV Nintendo Switch console
|-
| HEG-004 || RelayBox-A
|-
| HEG-005 || Nintendo Switch (OLED Model) HDMI cable
|-
| HEG-007 || Nintendo Switch (OLED Model) dock
|-
| HEG-021 || Nintendo Switch (OLED Model) carrying case
|}

= Product Serial Numbers =
Serial numbers are composed of at least [[#Prefix|three letters]] followed by ten decimal digits. The tenth digit is a [[#Check_Digit|check digit]], meaning that it is derived from the other digits.

== Prefix ==
Observed prefixes are normally as follows:

* First letter represents the product line:
** "X" (NX)
* Second letter represents the product model:
** "A" (HAC-001; Nintendo Switch console)
** "B" (HAC-015; Left Joy-Con)
** "C" (HAC-016; Right Joy-Con)
** "D" (HAC-012; Joy-Con charge grip)
** "E" (HAC-013; Pro Controller)
** "F" (HAC-007; Dock)
** "H" (HAC-024; Poké Ball Plus controller)
** "J" (HDH-001; Nintendo Switch Lite console)
** "K" (HAC-001-01; Nintendo Switch Mariko console)
** "L" (HAC-033; Left NES controller)
** "M" (HAC-034; Right NES controller)
** "Q" (HAC-037; Kart for "Mario Kart Live: Home Circuit")
** "R" (HAC-042; SNES controller)
** "S" (HAC-043; N64 controller)
** "T" (HEG-001; Nintendo Switch (OLED Model) console)
** "V" (HEG-007; Nintendo Switch (OLED Model) dock)
** "X" (HAC-045; Sega Genesis controller)
** "Y" (HAT-004/HEG-004; RelayBox/RelayBox-D/RelayBox-A)
** "Z" (HAT-003; SDEV cradle)
* Third letter represents the product region:
** "C" (China)
** "E" (Europe)
** "J" (Japan; and Europe on old models)
** "K" (Korea)
** "L" (All; for development only)
** "W" (Americas)
* Fourth letter is optional:
** "F" (Factory)

== Assembly Line ==
The first two digits immediately after the [[#Prefix|prefix]] represent the assembly line as follows:

{| class="wikitable" border="1"
|-
! Value || Description
|-
| 00 || Unspecified
|-
| 01 || Prototype
|-
| 02 || SDEV
|-
| 03 || EDEV
|-
| 04 || DPRD
|-
| 05 || HDEV
|-
| 06 || SDEV-D
|-
| 07 || EDEV-D
|-
| 10 || Retail
|-
| 40 || Retail
|-
| 50 || Retail
|-
| 70 || Retail
|-
| 80 || Retail Pro Controller
|-
| 90 || Refurbished
|-
| 14 || Retail Joy-Con
|-
| 17 || Retail Joy-Con
|}

== Check Digit ==
The check digit is an industry-standard algorithm and is calculated just like it was on the [https://www.3dbrew.org/wiki/Serials#Console_Serial_Numbers 3DS].

To calculate the check digit of a Switch console, separate the non-check digits into "odd" and "even" groups, where the "odd" group is digits in odd-numbered positions, and the "even" group is digits in even-numbered positions. (The first digit is "odd", with "first" representing "1".)

After separating the digits, add the digits in each group together. Multiply the sum of the even digits by 3, then add the sum of the odd digits. To calculate the check digit, take this value modulo 10, and if not 0, subtract from 10.

Example: XAW10075273452

The non-check digits are 1007527345. Separating into odd and even groups, we get the following:

Odds: 1 + 0 + 5 + 7 + 4 = 17 Evens: 0 + 7 + 2 + 3 + 5 = 17

Applying the algorithm, we get ((3 * 17) + 17) % 10 = 8, which is not 0, thus 10 - 8 = 2, matching the example's check digit.

Secure Monitor

2022-02-28T17:30:12Z

CapNem: /* DramId */

= Secure Monitor Calls =
The secure monitor provides two top level handlers of which each provides a range of sub handlers.

Secure Monitor calls follow the ARM SMC calling convention with a small change:
{| class=wikitable
! Bits || Description
|-
| 0-7 || Function Number
|-
| 8-15 || Argument Type
|-
| 16-23 || Reserved
|-
| 24-29 || Call Range
|-
| 30 || Call Convention (0 = SMC32, 1 = SMC64)
|-
| 31 || Call Type (0 = Yielding Call, 1 = Fast Call)
|}

If bit ''n'' is set in the argument type then parameter X''n'' is treated as a pointer and the kernel will setup address translation for it in [[SVC#svcCallSecureMonitor|svcCallSecureMonitor]].

SMC arguments are passed using registers X0-X7 with X0 always sending the call sub-id and returning the result of the call.

== FunctionId0 ==
Functions exposed to user-mode processes using [[SVC|svcCallSecureMonitor]]. SMCs should be called from CPUID 3 (where SPL runs).

{| class=wikitable
! Value || Name
|-
| 0xC3000401 || SetConfig
|-
| 0xC3000002 || [[#GetConfig|GetConfig]] (same as in [[#FunctionId1]])
|-
| 0xC3000003 || GetResult
|-
| 0xC3000404 || GetResultData
|-
| 0xC3000E05 || ModularExponentiate
|-
| 0xC3000006 || [[#GenerateRandomBytes|GenerateRandomBytes]] (same as in [[#FunctionId1]])
|-
| 0xC3000007 || [[#GenerateAesKek|GenerateAesKek]]
|-
| 0xC3000008 || [[#LoadAesKey|LoadAesKey]]
|-
| 0xC3000009 || [[#ComputeAes|ComputeAes]]
|-
| 0xC300000A || [[#GenerateSpecificAesKey|GenerateSpecificAesKey]]
|-
| 0xC300040B || [[#ComputeCmac|ComputeCmac]]
|-
| [1.0.0-4.1.0] 0xC300100C || [[#DecryptAndImportEsDeviceKey|DecryptAndImportEsDeviceKey]]
|-
| [5.0.0+] 0xC300D60C || [[#ReencryptDeviceUniqueData|ReencryptDeviceUniqueData]]
|-
| 0xC300100D || [[#DecryptDeviceUniqueData|DecryptDeviceUniqueData]]
|-
| [1.0.0-4.1.0] 0xC300100E || [[#DecryptAndImportLotusKey|DecryptAndImportLotusKey]]
|-
| 0xC300060F || [[#ModularExponentiateByStorageKey|ModularExponentiateByStorageKey]]
|-
| 0xC3000610 || [[#PrepareEsDeviceUniqueKey|PrepareEsDeviceUniqueKey]]
|-
| 0xC3000011 || [[#LoadPreparedAesKey|LoadPreparedAesKey]]
|-
| 0xC3000012 || [2.0.0+] [[#PrepareEsCommonKey|PrepareEsCommonKey]]
|}

The overall concept here is the following:
* All key material (AES and RSA) is stored in userspace, but it's encrypted with random AES kek's ("key encryption keys").
* Each kek is generated as a function of an access key (picked at random).
* The kek is generated differently depending on the [[#CryptoUsecase]] the key is used for.
** This means: Each key is "locked" to the [[#CryptoUsecase]] it was designated for.
** You can use a key for a different usecase, but you will only get garbage output.
* After the kek has been generated, it is wrapped with a session-specific key and given back to userspace.
** This means: Plaintext kek keys never leave TrustZone.
** Further, this means: Actual AES/RSA keys never leave TrustZone.

=== GenerateRandomBytes ===
Takes an u64 '''Size'''. Returns [[#Result]] and '''RandomBytes'''.

'''Size''' is limited to 0x38 (for fitting in return registers).

=== GenerateAesKek ===
Takes an "access key" as input, an [[#CryptoUsecase]].

Returns a session-unique kek for said usecase.

=== LoadAesKey ===
Takes a session kek created with [[#GenerateAesKek]], and a wrapped AES key.

The session kek must have been created with [[#CryptoUsecase|CryptoUsecase Aes]].

=== ComputeAes ===
Encrypts/decrypts using AES (CTR and CBC). Takes an [[#CipherMode]].

Key must be set prior using one of the [[#LoadAesKey]] or [[#GenerateSpecificAesKey]] commands.

=== GenerateSpecificAesKey ===
Takes a wrapped AES key and decrypts it using static data.

=== ComputeCmac ===
Calculates CMAC over input data.

=== DecryptAndImportEsDeviceKey ===
Takes a session kek created with [[#GenerateAesKek]], a wrapped AES key, and a wrapped RSA private key.

The session kek must have been created with [[#CryptoUsecase|CryptoUsecase TitleKey]].

[5.0.0] This function was removed and replaced with [[#ReencryptDeviceUniqueData]].

=== ReencryptDeviceUniqueData ===
Takes in two session keks created with [[#GenerateAesKek]], two wrapped AES keys, an enum member, and a wrapped RSA private key.

Decrypts and validates the wrapped RSA private key with the first kek/wrapped key, and re-encrypts it with the second if valid.

The re-encrypted key is then passed to the user, for use with [[#DecryptDeviceUniqueData]].

=== DecryptDeviceUniqueData ===
Takes a session kek created with [[#GenerateAesKek]], a wrapped AES key, an enum member, and a wrapped RSA private key.

The session kek must have been created with [[#CryptoUsecase|CryptoUsecase RsaPrivate]].

[4.0.0+] The SMC handler when certain conditions pass and FunctionId0==0xC300100D now returns error 0x6 instead of calling the handler funcptr.

[5.0.0+] This function now takes an additional input [[#DecryptOrImportMode]]. This extends the original functionality to enable importing private keys into the security engine instead of decrypting them.

=== DecryptAndImportLotusKey ===
Takes a session kek created with [[#GenerateAesKek]], and a wrapped RSA key.

The session kek must have been created with [[#CryptoUsecase|CryptoUsecase RsaSecureExpMod]].

[5.0.0] This function was removed.

=== ModularExponentiateByStorageKey ===
Performs an ExpMod operation using an exponent previously loaded with the [[#DecryptAndImportLotusKey]] command.

[5.0.0+] This now uses any exponent previously loaded with [[#DecryptDeviceUniqueData]] and takes an [[#SecureExpModMode]].

=== PrepareEsDeviceUniqueKey ===
Takes an Rsa-Oaep-wrapped TitleKey, an RSA Public Key, and a label hash.

Performs an ExpMod operation using an exponent previously loaded with the [[#DecryptAndImportEsDeviceKey]] command, and then validates/extracts a Titlekey from the resulting message.

Returns a session-unique AES key especially for use in [[#LoadTitleKey]].

[5.0.0+] This now uses any exponent previously loaded with [[#DecryptDeviceUniqueData]].

=== LoadPreparedAesKey ===
Takes a session-unique AES key from [[#PrepareEsCommonKey]] or [[#PrepareEsDeviceUniqueKey]].

=== PrepareEsCommonKey ===
Takes an AES-wrapped common TitleKey and returns a sealed AES key.

== FunctionId1 ==
Functions exposed to the kernel internally.

{| class=wikitable
! Value || Name
|-
| 0xC4000001 || [[#SuspendCpu|SuspendCpu]]
|-
| 0x84000002 || [[#PowerOffCpu|PowerOffCpu]]
|-
| 0xC4000003 || [[#PowerOnCpu|PowerOnCpu]]
|-
| 0xC3000004 || [[#GetConfig|GetConfig]] (same as in [[#FunctionId0]])
|-
| 0xC3000005 || [[#GenerateRandomBytes|GenerateRandomBytesNonBlocking]]
|-
| 0xC3000006 || [[#ShowError|ShowError]]
|-
| 0xC3000007 || [2.0.0+] [[#SetKernelCarveoutRegion|SetKernelCarveoutRegion]]
|-
| 0xC3000008 || [2.0.0+] [[#ReadWriteRegister|ReadWriteRegister]]
|}

=== SuspendCpu ===
Takes an u64 '''PowerState''', an u64 '''EntrypointAddress''' and an u64 '''ContextId'''. No output.

Suspends the CPU (CPU0).

The kernel calls this SMC on shutdown with '''PowerState''' set to 0x0201001B (power level: 0x02==system; power type: 0x01==powerdown; ID: 0x1B).

=== PowerOffCpu ===
No input/output.

Turns off the CPU (CPU1, CPU2 or CPU3).

=== PowerOnCpu ===
Takes an u64 '''TargetCpu''', an u64 '''EntrypointAddress''' and an u64 '''ContextId'''. Returns [[#Result]].

Turns on the CPU (CPU1, CPU2 or CPU3).

=== GetConfig ===
Takes a [[#ConfigItem]]. Returns [[#Result]] and a '''ConfigValue'''.

==== ConfigItem ====
{| class="wikitable" border="1"
|-
! Value || Name
|-
| 1 || [[#DisableProgramVerification]]
|-
| 2 || [[#DramId]]
|-
| 3 || [[#SecurityEngineInterruptNumber]]
|-
| 4 || [[#FuseVersion]]
|-
| 5 || [[#HardwareType]]
|-
| 6 || [[#HardwareState]]
|-
| 7 || [[#IsRecoveryBoot]]
|-
| 8 || [[#DeviceId]]
|-
| 9 || [1.0.0-4.0.0] [[#BootReason]]
|-
| 10 || [[#MemoryMode]]
|-
| 11 || [[#IsDevelopmentFunctionEnabled]]
|-
| 12 || [[#KernelConfiguration]]
|-
| 13 || [[#IsChargerHiZModeEnabled]]
|-
| 14 || [4.0.0+] [[#QuestState]]
|-
| 15 || [5.0.0+] [[#RegulatorType]]
|-
| 16 || [5.0.0+] [[#DeviceUniqueKeyGeneration]]
|-
| 17 || [5.0.0+] [[#Package2Hash]]
|}

===== DisableProgramVerification =====
[[Process Manager services|PM]] checks this item and if non-zero, calls fsp-pr SetEnabledProgramVerification(false).

===== DramId =====
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| EristaIcosaSamsung4gb
|-
| 1
| EristaIcosaHynix4gb
|-
| 2
| EristaIcosaMicron4gb
|-
| 3
| [11.0.0+] MarikoIowaHynix1y4gb ([1.0.0-10.2.0] EristaCopperSamsung4gb)
|-
| 4
| EristaIcosaSamsung6gb
|-
| 5
| [12.0.0+] MarikoHoagHynix1y4gb ([4.0.0+] EristaCopperHynix4gb)
|-
| 6
| [13.0.0+] MarikoAulaHynix1y4gb ([4.0.0+] EristaCopperMicron4gb)
|-
| 7
| [5.0.0+] MarikoIowax1x2Samsung4gb ([4.0.0-4.1.0] Reserved)
|-
| 8
| [5.0.0+] MarikoIowaSamsung4gb
|-
| 9
| [5.0.0+] MarikoIowaSamsung8gb
|-
| 10
| [6.0.0+] MarikoIowaHynix4gb ([5.0.0-5.1.0] Reserved)
|-
| 11
| [7.0.0+] MarikoIowaMicron4gb ([5.0.0-6.2.0] Reserved)
|-
| 12
| [5.0.0+] MarikoHoagSamsung4gb
|-
| 13
| [5.0.0+] MarikoHoagSamsung8gb
|-
| 14
| [7.0.0+] MarikoHoagHynix4gb ([5.0.0-6.2.0] Reserved)
|-
| 15
| [7.0.0+] MarikoHoagMicron4gb ([5.0.0-6.2.0] Reserved)
|-
| 16
| [8.0.0+] MarikoIowaSamsung4gbY
|-
| 17
| [9.0.0+] MarikoIowaSamsung1y4gbX
|-
| 18
| [9.0.0+] MarikoIowaSamsung1y8gbX
|-
| 19
| [9.0.0+] MarikoHoagSamsung1y4gbX
|-
| 20
| [9.0.0+] MarikoIowaSamsung1y4gbY
|-
| 21
| [9.0.0+] MarikoIowaSamsung1y8gbY
|-
| 22
| [13.0.0+] Reserved ([9.0.0+] MarikoAulaSamsung1y4gb)
|-
| 23
| [10.0.0+] MarikoHoagSamsung1y8gbX
|-
| 24
| [10.0.0+] MarikoAulaSamsung1y4gbX
|-
| 25
| [11.0.0+] MarikoIowaMicron1y4gb
|-
| 26
| [11.0.0+] MarikoHoagMicron1y4gb
|-
| 27
| [11.0.0+] MarikoAulaMicron1y4gb
|-
| 28
| [11.0.0+] MarikoAulaSamsung1y8gbX
|}

This is extracted directly from [[Fuse_registers#FUSE_RESERVED_ODM4|FUSE_RESERVED_ODM4]].

[[PCV_services|PCV]] selects memory training tables based on DramId.
{| class="wikitable" border="1"
|-
! SocType
! Platform
! DramId
! Revision
! DVFS
|-
| Erista
| jetson-tx1
| N/A
| 0x07
|
11_40800_01_V9.8.3_V1.6
11_68000_01_V9.8.3_V1.6
11_102000_01_V9.8.3_V1.6
11_204000_05_V9.8.3_V1.6
11_408000_02_V9.8.3_V1.6
11_665600_03_V9.8.3_V1.6
11_800000_01_V9.8.3_V1.6
11_1065600_01_V9.8.3_V1.6
11_1331200_01_V9.8.3_V1.6
11_1600000_02_V9.8.3_V1.6
|-
| Erista
| nx-abcb
| EristaIcosaSamsung4gb
| 0x07
|
10_40800_NoCfgVersion_V9.8.7_V1.6
10_68000_NoCfgVersion_V9.8.7_V1.6
10_102000_NoCfgVersion_V9.8.7_V1.6
10_204000_NoCfgVersion_V9.8.7_V1.6
10_408000_NoCfgVersion_V9.8.7_V1.6
10_665600_NoCfgVersion_V9.8.7_V1.6
10_800000_NoCfgVersion_V9.8.7_V1.6
10_1065600_NoCfgVersion_V9.8.7_V1.6
10_1331200_NoCfgVersion_V9.8.7_V1.6
10_1600000_NoCfgVersion_V9.8.7_V1.6
|-
| Erista
| nx-abcb
| EristaIcosaMicron4gb
| 0x07
|
10_40800_NoCfgVersion_V9.8.4_V1.6
10_68000_NoCfgVersion_V9.8.4_V1.6
10_102000_NoCfgVersion_V9.8.4_V1.6
10_204000_NoCfgVersion_V9.8.4_V1.6
10_408000_NoCfgVersion_V9.8.4_V1.6
10_665600_NoCfgVersion_V9.8.4_V1.6
10_800000_NoCfgVersion_V9.8.4_V1.6
10_1065600_NoCfgVersion_V9.8.4_V1.6
10_1331200_NoCfgVersion_V9.8.4_V1.6
10_1600000_NoCfgVersion_V9.8.4_V1.6
|-
| Erista
| nx-abcb
| EristaIcosaHynix4gb
| 0x07
|
10_40800_NoCfgVersion_V9.8.4_V1.6
10_68000_NoCfgVersion_V9.8.4_V1.6
10_102000_NoCfgVersion_V9.8.4_V1.6
10_204000_NoCfgVersion_V9.8.4_V1.6
10_408000_NoCfgVersion_V9.8.4_V1.6
10_665600_NoCfgVersion_V9.8.4_V1.6
10_800000_NoCfgVersion_V9.8.4_V1.6
10_1065600_NoCfgVersion_V9.8.4_V1.6
10_1331200_NoCfgVersion_V9.8.4_V1.6
10_1600000_NoCfgVersion_V9.8.4_V1.6
|-
| Erista
| nx-abca2
| EristaIcosaSamsung4gb, EristaIcosaMicron4gb
| 0x07
|
10_40800_NoCfgVersion_V9.8.7_V1.6
10_68000_NoCfgVersion_V9.8.7_V1.6
10_102000_NoCfgVersion_V9.8.7_V1.6
10_204000_NoCfgVersion_V9.8.7_V1.6
10_408000_NoCfgVersion_V9.8.7_V1.6
10_665600_NoCfgVersion_V9.8.7_V1.6
10_800000_NoCfgVersion_V9.8.7_V1.6
10_1065600_NoCfgVersion_V9.8.7_V1.6
10_1331200_NoCfgVersion_V9.8.7_V1.6
10_1600000_NoCfgVersion_V9.8.7_V1.6
|-
| Erista
| nx-abca2
| EristaIcosaHynix4gb
| 0x07
|
10_40800_NoCfgVersion_V9.8.7_V1.6
10_68000_NoCfgVersion_V9.8.7_V1.6
10_102000_NoCfgVersion_V9.8.7_V1.6
10_204000_NoCfgVersion_V9.8.7_V1.6
10_408000_NoCfgVersion_V9.8.7_V1.6
10_665600_NoCfgVersion_V9.8.7_V1.6
10_800000_NoCfgVersion_V9.8.7_V1.6
10_1065600_NoCfgVersion_V9.8.7_V1.6
10_1331200_NoCfgVersion_V9.8.7_V1.6
10_1600000_NoCfgVersion_V9.8.7_V1.6
|-
| Erista
| nx-abca2
| EristaIcosaSamsung6gb
| 0x07
|
10_40800_NoCfgVersion_V9.8.7_V1.6
10_68000_NoCfgVersion_V9.8.7_V1.6
10_102000_NoCfgVersion_V9.8.7_V1.6
10_204000_NoCfgVersion_V9.8.7_V1.6
10_408000_NoCfgVersion_V9.8.7_V1.6
10_665600_NoCfgVersion_V9.8.7_V1.6
10_800000_NoCfgVersion_V9.8.7_V1.6
10_1065600_NoCfgVersion_V9.8.7_V1.6
10_1331200_NoCfgVersion_V9.8.7_V1.6
10_1600000_NoCfgVersion_V9.8.7_V1.6
|-
| Mariko
| nx-abca2, nx-abcb, nx-abcc, nx-abcd
| MarikoIowax1x2Samsung4gb
| 0x03
|
01_204000_NoCfgVersion_V0.3.1_V2.0
01_1331200.0_NoCfgVersion_V0.3.1_V2.0
01_1600000_NoCfgVersion_V0.3.1_V2.0
|-
| Mariko
| nx-abca2, nx-abcb, nx-abcc, nx-abcd
| MarikoIowaSamsung4gb, MarikoHoagSamsung4gb
| 0x03
|
01_204000_NoCfgVersion_V0.3.1_V2.0
01_1331200.0_NoCfgVersion_V0.3.1_V2.0
01_1600000_NoCfgVersion_V0.3.1_V2.0
|-
| Mariko
| nx-abca2, nx-abcb, nx-abcc, nx-abcd
| MarikoIowaSamsung8gb, MarikoHoagSamsung8gb
| 0x03
|
01_204000_NoCfgVersion_V0.4.2_V2.0
01_1331200.0_NoCfgVersion_V0.4.2_V2.0
01_1600000_NoCfgVersion_V0.4.2_V2.0
|-
| Mariko
| nx-abca2, nx-abcb, nx-abcc, nx-abcd
| MarikoIowaHynix4gb, MarikoHoagHynix4gb
| 0x03
|
01_204000_NoCfgVersion_V0.3.1_V2.0
01_1331200.0_NoCfgVersion_V0.3.1_V2.0
01_1600000_NoCfgVersion_V0.3.1_V2.0
|-
| Mariko
| nx-abca2, nx-abcb, nx-abcc, nx-abcd
| MarikoIowaMicron4gb, MarikoHoagMicron4gb
| 0x03
|
01_204000_NoCfgVersion_V0.4.2_V2.0
01_1331200.0_NoCfgVersion_V0.4.2_V2.0
01_1600000_NoCfgVersion_V0.4.2_V2.0
|-
| Mariko
| nx-abca2, nx-abcb, nx-abcc, nx-abcd
| MarikoIowaSamsung4gbY
| 0x03
|
01_204000_NoCfgVersion_V0.4.2_V2.0
01_1331200.0_NoCfgVersion_V0.4.2_V2.0
01_1600000_NoCfgVersion_V0.4.2_V2.0
|-
| Mariko
| nx-abca2, nx-abcb, nx-abcc, nx-abcd
| MarikoIowaSamsung1y4gbX
| 0x03
|
01_204000_NoCfgVersion_V0.4.2_V2.0
01_1331200.0_NoCfgVersion_V0.4.2_V2.0
01_1600000_NoCfgVersion_V0.4.2_V2.0
|-
| Mariko
| nx-abca2, nx-abcb, nx-abcc, nx-abcd
| MarikoIowaSamsung1y8gbX
| 0x03
|
01_204000_NoCfgVersion_V0.4.2_V2.0
01_1331200.0_NoCfgVersion_V0.4.2_V2.0
01_1600000_NoCfgVersion_V0.4.2_V2.0
|-
| Mariko
| nx-abca2, nx-abcb, nx-abcc, nx-abcd
| MarikoHoagSamsung1y4gbX
| 0x03
|
01_204000_NoCfgVersion_V0.4.2_V2.0
01_1331200.0_NoCfgVersion_V0.4.2_V2.0
01_1600000_NoCfgVersion_V0.4.2_V2.0
|-
| Mariko
| nx-abca2, nx-abcb, nx-abcc, nx-abcd
| MarikoIowaSamsung1y4gbY
| 0x03
|
01_204000_NoCfgVersion_V0.4.2_V2.0
01_1331200.0_NoCfgVersion_V0.4.2_V2.0
01_1600000_NoCfgVersion_V0.4.2_V2.0
|-
| Mariko
| nx-abca2, nx-abcb, nx-abcc, nx-abcd
| MarikoIowaSamsung1y8gbY
| 0x03
|
01_204000_NoCfgVersion_V0.4.2_V2.0
01_1331200.0_NoCfgVersion_V0.4.2_V2.0
01_1600000_NoCfgVersion_V0.4.2_V2.0
|-
| Mariko
| nx-abca2, nx-abcb, nx-abcc, nx-abcd
| MarikoIowaSamsung1y4gbA
| 0x03
|
01_204000_NoCfgVersion_V0.4.5_V2.0
01_1331200.0_NoCfgVersion_V0.4.5_V2.0
01_1600000_NoCfgVersion_V0.4.5_V2.0
|}

'''nx-abca2''' ('''Icosa''' in '''Erista''', '''Iowa''' in '''Mariko''') hardware types are variations of the retail, EDEV and SDEV form factors.

'''nx-abcb''' ('''Copper''' in '''Erista''', '''Calcio''' in '''Mariko''') is a simulation unit. Among other differences, this has extra hardware to support HDMI output.

[8.0.0+] '''nx-abcc''' ('''Hoag''') was added for the Lite retail and HDEV form factors.

[10.0.0+] '''nx-abcd''' ('''Aula''') was added for the OLED Model retail and ADEV form factors.

'''Erista''' memory is LPDDR4, while '''Mariko''' memory is LPDDR4X.

===== SecurityEngineInterruptNumber =====
SPL uses this for setting up the security engine IRQ.

===== FuseVersion =====
The current [[Package2#Versions|bootloader maximum version]] - 1.

===== HardwareType =====
{| class=wikitable
! Value || Description
|-
| 0 || Icosa
|-
| 1 || Copper
|-
| 2 || [8.0.0+] Hoag ([1.0.0-7.0.1] Invalid)
|-
| 3 || [4.0.0+] Iowa
|-
| 4 || [8.0.0+] Calcio
|-
| 5 || [10.0.0+] Aula
|-
| 15 || Invalid
|}

[1.0.0+] This item is obtained by checking bits 8 and 2 from [[Fuse_registers#FUSE_RESERVED_ODM4|FUSE_RESERVED_ODM4]].

[4.0.0+] This item is obtained by checking bits 8, 2 and 16-19 from [[Fuse_registers#FUSE_RESERVED_ODM4|FUSE_RESERVED_ODM4]].

[7.0.0+] This item can now only be 0 (Icosa) or 15 (Invalid) in Erista units.

Hardware is '''Icosa''' (Erista retail, EDEV and SDEV) if [[Fuse_registers#FUSE_RESERVED_ODM4|HardwareType1]] (bit 2) is 1 and [[Fuse_registers#FUSE_RESERVED_ODM4|HardwareType2]] (bit 8) is 0.

Hardware is '''Copper''' (Erista simulation) if [[Fuse_registers#FUSE_RESERVED_ODM4|HardwareType1]] (bit 2) is 0 and [[Fuse_registers#FUSE_RESERVED_ODM4|HardwareType2]] (bit 8) is 1.

[4.0.0+] Hardware is '''Iowa''' (Mariko retail, EDEV and SDEV) if [[Fuse_registers#FUSE_RESERVED_ODM4|HardwareType3]] (bits 16-19) is 1.

[8.0.0+] Hardware is '''Hoag''' (Mariko Lite retail and HDEV) if [[Fuse_registers#FUSE_RESERVED_ODM4|HardwareType3]] (bits 16-19) is 2.

[8.0.0+] Hardware is '''Calcio''' (Mariko simulation) if [[Fuse_registers#FUSE_RESERVED_ODM4|HardwareType1]] (bit 2) is 0 and [[Fuse_registers#FUSE_RESERVED_ODM4|HardwareType2]] (bit 8) is 1.

[10.0.0+] Hardware is '''Aula''' (Mariko OLED Model retail and ADEV) if [[Fuse_registers#FUSE_RESERVED_ODM4|HardwareType3]] (bits 16-19) is 4.

===== HardwareState =====
{| class=wikitable
! Value || Description
|-
| 0 || Development
|-
| 1 || Production
|-
| 2 || Invalid
|}

This item is obtained by checking bits 9 and 0-1 from [[Fuse_registers#FUSE_RESERVED_ODM4|FUSE_RESERVED_ODM4]].

Hardware is '''Development''' if [[Fuse_registers#FUSE_RESERVED_ODM4|HardwareState1]] (bits 0-1) is 3 and [[Fuse_registers#FUSE_RESERVED_ODM4|HardwareState2]] (bit 9) is 0.

Hardware is '''Production''' if [[Fuse_registers#FUSE_RESERVED_ODM4|HardwareState1]] (bits 0-1) is 0 and [[Fuse_registers#FUSE_RESERVED_ODM4|HardwareState2]] (bit 9) is 1.

===== IsRecoveryBoot =====
Used to determine if the system is booting from SafeMode firmware.

Under normal circumstances, this just returns bit 0 of the active [[BCT#bootloader0_info|bootloader info]]'s attribute field.

===== DeviceId =====
[[NIM_services|NIM]] checks if this item matches the [[Settings_services|set:cal]] DeviceId with byte7 cleared. If they don't match, a panic is thrown.

===== BootReason =====
{| class=wikitable
! Value || Description
|-
| 0 || Invalid
|-
| 1 || AcOk
|-
| 2 || OnKey
|-
| 3 || RtcAlarm1
|-
| 4 || RtcAlarm2
|}

Used to determine how the system booted.

===== MemoryMode =====
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 0-3
| Purpose (0 = None, 1 = ForStandard, 2 = ForAppletDev, 3 = ForSystemDev)
|-
| 4-7
| Size (0 = 4GB, 1 = 6GB, 2 = 8GB)
|}

[[Process Manager services|PM]] and the kernel decide memory arrangement based on MemoryMode.
{| class="wikitable" border="1"
|-
! MemoryArrange
! MemoryMode
! Description
|-
| 0
| 0x01
| Standard
|-
| 1
| 0x02
| StandardForAppletDev
|-
| 2
| 0x03
| StandardForSystemDev
|-
| 3
| 0x11
| Expanded
|-
| 4
| 0x12
| ExpandedForAppletDev
|-
| 5
| 0x21
| ExpandedForMarikoDev
|}

===== IsDevelopmentFunctionEnabled =====
Kernel uses this to determine behavior of [[SVC#svcBreak|svcBreak]] positive arguments. It will break instead of just force-exiting the process which is what happens on retail.

[2.0.0+] This is also used with certain debug [[SVC|SVCs]].

[3.0.0+] [[Loader services|RO]] checks this and if set then skipping NRR rsa signatures is allowed.

===== KernelConfiguration =====
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 0
| EnableNonZeroFillMemory
|-
| 1
| EnableUserExceptionHandler
|-
| 2
| PerformanceMonitoringUnit
|-
| 3
| [8.0.0+] EnableApplicationExtraThread
|-
| 8
| CallShowErrorOnPanic
|-
| 16-17
| MemorySize
|}

Kernel reads this when setting up memory-related code.

'''EnableNonZeroFillMemory''' is a boolean determining whether kernel should it will memset various allocated memory-regions with 0x58, 0x59, 0x5A ('X', 'Y', 'Z') instead of zero. This allows Nintendo devs to find uninitialized memory bugs.

'''EnableUserExceptionHandler''' is a boolean determining whether kernel should forcefully enable usermode exception handlers (when false, only certain aborts (((1LL << (esr >> 26)) & 0x1115804400224001) == 0, typically data/prefetch aborts) that occur when the faulting address is in a readable region with MemoryType_CodeStatic will trigger usermode exception handlers).

'''PerformanceMonitoringUnit''' is a boolean determining whether kernel should enable usermode access to the Performance Monitors (whether PMUSERENR_EL0 should be 1 or 0).

'''EnableApplicationExtraThread''' is a boolean determining whether the kernel should increase the KThread slabheap capacity by 160. This also increases object capacities that are calculated based on number of threads.

'''CallShowErrorOnPanic''' is a boolean determining whether kernel should call smcPanic on error instead of infinite-looping.

'''MemorySize''' determines how much memory is available. 00/03 = 4 GB, 01 = 6 GB, 02 = 8 GB.

===== IsChargerHiZModeEnabled =====
This tells if the TI Charger (bq24192) is active.

===== QuestState =====
{| class=wikitable
! Value || Description
|-
| 0 || Disabled
|-
| 1 || Enabled
|}

This item is bit 10 from [[Fuse_registers#FUSE_RESERVED_ODM4|FUSE_RESERVED_ODM4]].

[4.0.0+] [[Settings_services|Settings]] uses this value to overwrite the quest flag from [[Settings_services#set:sys|GetQuestFlag]]. This is used to detect if a Switch is a kiosk unit for display at retail stores.

===== RegulatorType =====
{| class="wikitable" border="1"
|-
! Value
! SocType
! GPU
! Power Blocks
|-
| 0
| Erista
| GM20B (0x12B)
| max77620_sd0, max77621_cpu and max77621_gpu
|-
| 1
| Mariko
| GM20B_B (0x12E)
| max77620_sd0, max77812_cpu and max77812_gpu
|-
| 2
| Mariko
| GM20B_B (0x12E)
| max77620_sd0, max77812_cpu and max77812_gpu
|}

[5.0.0+] [[PCV_services|PCV]] uses this value in combination with [[#HardwareType|HardwareType]] to configure power blocks and memory tables for different hardware.

===== DeviceUniqueKeyGeneration =====
This item is obtained from [[Fuse_registers#FUSE_RESERVED_ODM2|FUSE_RESERVED_ODM2]] if bit 11 from [[Fuse_registers#FUSE_RESERVED_ODM4|FUSE_RESERVED_ODM4]] is set, [[Fuse_registers#FUSE_RESERVED_ODM0|FUSE_RESERVED_ODM0]] matches 0x8E61ECAE and [[Fuse_registers#FUSE_RESERVED_ODM1|FUSE_RESERVED_ODM1]] matches 0xF2BA3BB2.

[5.0.0+] [[Filesystem services|FS]] can now use this value for the '''KeyGeneration''' parameter when calling [[#GenerateAesKek|GenerateAesKek]] during "GetBisEncryptionKey".

===== Package2Hash =====
This is a SHA-256 hash calculated over the [[Package2|package2]] image. Since the hash calculation is an optional step in pkg2ldr, this item is only valid in recovery mode. Otherwise, an error is returned instead.

=== ShowError ===
Takes an u32 '''Color''' and issues a system panic.

The kernel always calls this with '''Color''' set to 0xF00.

=== SetKernelCarveoutRegion ===
Takes an u64 '''Index''', an u64 '''Address''' and an u64 '''Size'''. Returns [[#Result]].

If '''Index''' is 0, '''Address''' and '''Size''' are used to configure '''MC_SECURITY_CARVEOUT4'''.
If '''Index''' is 1, '''Address''' and '''Size''' are used to configure '''MC_SECURITY_CARVEOUT5'''.
Any other '''Index''' values are invalid.

The kernel calls this with '''Index''' set to 0, '''Address''' set to 0x80060000 and '''Size''' set to a dynamically calculated size which covers all the kernel and built-in sysmodules' DRAM regions.

=== ReadWriteRegister ===
Takes an u64 '''Register''', an u32 '''Mask''' and an u32 '''InValue'''. Returns [[#Result]] and an u32 '''OutValue'''.

Relays [[SVC#svcReadWriteRegister|svcReadWriteRegister]] to the Secure Monitor.

= CryptoUsecase =
{| class=wikitable
! Value || Name
|-
| 0 || Aes
|-
| 1 || RsaPrivate
|-
| 2 || SecureExpMod
|-
| 3 || RsaOaep
|-
| 4 || [5.0.0+] RsaImport
|-
| 5 || [5.0.0+]
|-
| 6 || [5.0.0+]
|}

= CipherMode =
{| class=wikitable
! Value || Name
|-
| 0 || CbcEncrypt
|-
| 1 || CbcDecrypt
|-
| 2 || Ctr
|}

= DecryptOrImportMode =
{| class=wikitable
! Value || Name
|-
| 0 || DecryptRsaPrivateKey
|-
| 1 || ImportLotusKey
|-
| 2 || ImportEsKey
|-
| 3 || ImportSslKey
|-
| 4 || ImportDrmKey
|}

= SecureExpModMode =
{| class=wikitable
! Value || Name
|-
| 0 || Lotus
|-
| 1 || Ssl
|-
| 2 || Drm
|}

= EsKeyType =
{| class=wikitable
! Value || Name
|-
| 0 || TitleKey
|-
| 1 || ElicenseKey
|}

= Result =
{| class=wikitable
! Value || Description
|-
| 0 || Success
|-
| 1 || Not implemented
|-
| 2 || Invalid argument
|-
| 3 || In progress
|-
| 4 || No async operation
|-
| 5 || Invalid async operation
|-
| 6 || [8.0.0+] Not permitted
|}

Secure Monitor

2022-02-28T17:29:38Z

CapNem: /* HardwareType */

= Secure Monitor Calls =
The secure monitor provides two top level handlers of which each provides a range of sub handlers.

Secure Monitor calls follow the ARM SMC calling convention with a small change:
{| class=wikitable
! Bits || Description
|-
| 0-7 || Function Number
|-
| 8-15 || Argument Type
|-
| 16-23 || Reserved
|-
| 24-29 || Call Range
|-
| 30 || Call Convention (0 = SMC32, 1 = SMC64)
|-
| 31 || Call Type (0 = Yielding Call, 1 = Fast Call)
|}

If bit ''n'' is set in the argument type then parameter X''n'' is treated as a pointer and the kernel will setup address translation for it in [[SVC#svcCallSecureMonitor|svcCallSecureMonitor]].

SMC arguments are passed using registers X0-X7 with X0 always sending the call sub-id and returning the result of the call.

== FunctionId0 ==
Functions exposed to user-mode processes using [[SVC|svcCallSecureMonitor]]. SMCs should be called from CPUID 3 (where SPL runs).

{| class=wikitable
! Value || Name
|-
| 0xC3000401 || SetConfig
|-
| 0xC3000002 || [[#GetConfig|GetConfig]] (same as in [[#FunctionId1]])
|-
| 0xC3000003 || GetResult
|-
| 0xC3000404 || GetResultData
|-
| 0xC3000E05 || ModularExponentiate
|-
| 0xC3000006 || [[#GenerateRandomBytes|GenerateRandomBytes]] (same as in [[#FunctionId1]])
|-
| 0xC3000007 || [[#GenerateAesKek|GenerateAesKek]]
|-
| 0xC3000008 || [[#LoadAesKey|LoadAesKey]]
|-
| 0xC3000009 || [[#ComputeAes|ComputeAes]]
|-
| 0xC300000A || [[#GenerateSpecificAesKey|GenerateSpecificAesKey]]
|-
| 0xC300040B || [[#ComputeCmac|ComputeCmac]]
|-
| [1.0.0-4.1.0] 0xC300100C || [[#DecryptAndImportEsDeviceKey|DecryptAndImportEsDeviceKey]]
|-
| [5.0.0+] 0xC300D60C || [[#ReencryptDeviceUniqueData|ReencryptDeviceUniqueData]]
|-
| 0xC300100D || [[#DecryptDeviceUniqueData|DecryptDeviceUniqueData]]
|-
| [1.0.0-4.1.0] 0xC300100E || [[#DecryptAndImportLotusKey|DecryptAndImportLotusKey]]
|-
| 0xC300060F || [[#ModularExponentiateByStorageKey|ModularExponentiateByStorageKey]]
|-
| 0xC3000610 || [[#PrepareEsDeviceUniqueKey|PrepareEsDeviceUniqueKey]]
|-
| 0xC3000011 || [[#LoadPreparedAesKey|LoadPreparedAesKey]]
|-
| 0xC3000012 || [2.0.0+] [[#PrepareEsCommonKey|PrepareEsCommonKey]]
|}

The overall concept here is the following:
* All key material (AES and RSA) is stored in userspace, but it's encrypted with random AES kek's ("key encryption keys").
* Each kek is generated as a function of an access key (picked at random).
* The kek is generated differently depending on the [[#CryptoUsecase]] the key is used for.
** This means: Each key is "locked" to the [[#CryptoUsecase]] it was designated for.
** You can use a key for a different usecase, but you will only get garbage output.
* After the kek has been generated, it is wrapped with a session-specific key and given back to userspace.
** This means: Plaintext kek keys never leave TrustZone.
** Further, this means: Actual AES/RSA keys never leave TrustZone.

=== GenerateRandomBytes ===
Takes an u64 '''Size'''. Returns [[#Result]] and '''RandomBytes'''.

'''Size''' is limited to 0x38 (for fitting in return registers).

=== GenerateAesKek ===
Takes an "access key" as input, an [[#CryptoUsecase]].

Returns a session-unique kek for said usecase.

=== LoadAesKey ===
Takes a session kek created with [[#GenerateAesKek]], and a wrapped AES key.

The session kek must have been created with [[#CryptoUsecase|CryptoUsecase Aes]].

=== ComputeAes ===
Encrypts/decrypts using AES (CTR and CBC). Takes an [[#CipherMode]].

Key must be set prior using one of the [[#LoadAesKey]] or [[#GenerateSpecificAesKey]] commands.

=== GenerateSpecificAesKey ===
Takes a wrapped AES key and decrypts it using static data.

=== ComputeCmac ===
Calculates CMAC over input data.

=== DecryptAndImportEsDeviceKey ===
Takes a session kek created with [[#GenerateAesKek]], a wrapped AES key, and a wrapped RSA private key.

The session kek must have been created with [[#CryptoUsecase|CryptoUsecase TitleKey]].

[5.0.0] This function was removed and replaced with [[#ReencryptDeviceUniqueData]].

=== ReencryptDeviceUniqueData ===
Takes in two session keks created with [[#GenerateAesKek]], two wrapped AES keys, an enum member, and a wrapped RSA private key.

Decrypts and validates the wrapped RSA private key with the first kek/wrapped key, and re-encrypts it with the second if valid.

The re-encrypted key is then passed to the user, for use with [[#DecryptDeviceUniqueData]].

=== DecryptDeviceUniqueData ===
Takes a session kek created with [[#GenerateAesKek]], a wrapped AES key, an enum member, and a wrapped RSA private key.

The session kek must have been created with [[#CryptoUsecase|CryptoUsecase RsaPrivate]].

[4.0.0+] The SMC handler when certain conditions pass and FunctionId0==0xC300100D now returns error 0x6 instead of calling the handler funcptr.

[5.0.0+] This function now takes an additional input [[#DecryptOrImportMode]]. This extends the original functionality to enable importing private keys into the security engine instead of decrypting them.

=== DecryptAndImportLotusKey ===
Takes a session kek created with [[#GenerateAesKek]], and a wrapped RSA key.

The session kek must have been created with [[#CryptoUsecase|CryptoUsecase RsaSecureExpMod]].

[5.0.0] This function was removed.

=== ModularExponentiateByStorageKey ===
Performs an ExpMod operation using an exponent previously loaded with the [[#DecryptAndImportLotusKey]] command.

[5.0.0+] This now uses any exponent previously loaded with [[#DecryptDeviceUniqueData]] and takes an [[#SecureExpModMode]].

=== PrepareEsDeviceUniqueKey ===
Takes an Rsa-Oaep-wrapped TitleKey, an RSA Public Key, and a label hash.

Performs an ExpMod operation using an exponent previously loaded with the [[#DecryptAndImportEsDeviceKey]] command, and then validates/extracts a Titlekey from the resulting message.

Returns a session-unique AES key especially for use in [[#LoadTitleKey]].

[5.0.0+] This now uses any exponent previously loaded with [[#DecryptDeviceUniqueData]].

=== LoadPreparedAesKey ===
Takes a session-unique AES key from [[#PrepareEsCommonKey]] or [[#PrepareEsDeviceUniqueKey]].

=== PrepareEsCommonKey ===
Takes an AES-wrapped common TitleKey and returns a sealed AES key.

== FunctionId1 ==
Functions exposed to the kernel internally.

{| class=wikitable
! Value || Name
|-
| 0xC4000001 || [[#SuspendCpu|SuspendCpu]]
|-
| 0x84000002 || [[#PowerOffCpu|PowerOffCpu]]
|-
| 0xC4000003 || [[#PowerOnCpu|PowerOnCpu]]
|-
| 0xC3000004 || [[#GetConfig|GetConfig]] (same as in [[#FunctionId0]])
|-
| 0xC3000005 || [[#GenerateRandomBytes|GenerateRandomBytesNonBlocking]]
|-
| 0xC3000006 || [[#ShowError|ShowError]]
|-
| 0xC3000007 || [2.0.0+] [[#SetKernelCarveoutRegion|SetKernelCarveoutRegion]]
|-
| 0xC3000008 || [2.0.0+] [[#ReadWriteRegister|ReadWriteRegister]]
|}

=== SuspendCpu ===
Takes an u64 '''PowerState''', an u64 '''EntrypointAddress''' and an u64 '''ContextId'''. No output.

Suspends the CPU (CPU0).

The kernel calls this SMC on shutdown with '''PowerState''' set to 0x0201001B (power level: 0x02==system; power type: 0x01==powerdown; ID: 0x1B).

=== PowerOffCpu ===
No input/output.

Turns off the CPU (CPU1, CPU2 or CPU3).

=== PowerOnCpu ===
Takes an u64 '''TargetCpu''', an u64 '''EntrypointAddress''' and an u64 '''ContextId'''. Returns [[#Result]].

Turns on the CPU (CPU1, CPU2 or CPU3).

=== GetConfig ===
Takes a [[#ConfigItem]]. Returns [[#Result]] and a '''ConfigValue'''.

==== ConfigItem ====
{| class="wikitable" border="1"
|-
! Value || Name
|-
| 1 || [[#DisableProgramVerification]]
|-
| 2 || [[#DramId]]
|-
| 3 || [[#SecurityEngineInterruptNumber]]
|-
| 4 || [[#FuseVersion]]
|-
| 5 || [[#HardwareType]]
|-
| 6 || [[#HardwareState]]
|-
| 7 || [[#IsRecoveryBoot]]
|-
| 8 || [[#DeviceId]]
|-
| 9 || [1.0.0-4.0.0] [[#BootReason]]
|-
| 10 || [[#MemoryMode]]
|-
| 11 || [[#IsDevelopmentFunctionEnabled]]
|-
| 12 || [[#KernelConfiguration]]
|-
| 13 || [[#IsChargerHiZModeEnabled]]
|-
| 14 || [4.0.0+] [[#QuestState]]
|-
| 15 || [5.0.0+] [[#RegulatorType]]
|-
| 16 || [5.0.0+] [[#DeviceUniqueKeyGeneration]]
|-
| 17 || [5.0.0+] [[#Package2Hash]]
|}

===== DisableProgramVerification =====
[[Process Manager services|PM]] checks this item and if non-zero, calls fsp-pr SetEnabledProgramVerification(false).

===== DramId =====
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| EristaIcosaSamsung4gb
|-
| 1
| EristaIcosaHynix4gb
|-
| 2
| EristaIcosaMicron4gb
|-
| 3
| [11.0.0+] MarikoIowaHynix1y4gb ([1.0.0-10.2.0] EristaCopperSamsung4gb)
|-
| 4
| EristaIcosaSamsung6gb
|-
| 5
| [12.0.0+] MarikoHoagHynix1y4gb ([4.0.0+] EristaCopperHynix4gb)
|-
| 6
| [13.0.0+] MarikoAulaHynix1y4gb ([4.0.0+] EristaCopperMicron4gb)
|-
| 7
| [5.0.0+] MarikoIowax1x2Samsung4gb ([4.0.0-4.1.0] Reserved)
|-
| 8
| [5.0.0+] MarikoIowaSamsung4gb
|-
| 9
| [5.0.0+] MarikoIowaSamsung8gb
|-
| 10
| [6.0.0+] MarikoIowaHynix4gb ([5.0.0-5.1.0] Reserved)
|-
| 11
| [7.0.0+] MarikoIowaMicron4gb ([5.0.0-6.2.0] Reserved)
|-
| 12
| [5.0.0+] MarikoHoagSamsung4gb
|-
| 13
| [5.0.0+] MarikoHoagSamsung8gb
|-
| 14
| [7.0.0+] MarikoHoagHynix4gb ([5.0.0-6.2.0] Reserved)
|-
| 15
| [7.0.0+] MarikoHoagMicron4gb ([5.0.0-6.2.0] Reserved)
|-
| 16
| [8.0.0+] MarikoIowaSamsung4gbY
|-
| 17
| [9.0.0+] MarikoIowaSamsung1y4gbX
|-
| 18
| [9.0.0+] MarikoIowaSamsung1y8gbX
|-
| 19
| [9.0.0+] MarikoHoagSamsung1y4gbX
|-
| 20
| [9.0.0+] MarikoIowaSamsung1y4gbY
|-
| 21
| [9.0.0+] MarikoIowaSamsung1y8gbY
|-
| 22
| [13.0.0+] Reserved ([9.0.0+] MarikoAulaSamsung1y4gb)
|-
| 23
| [10.0.0+] MarikoHoagSamsung1y8gbX
|-
| 24
| [10.0.0+] MarikoAulaSamsung1y4gbX
|-
| 25
| [11.0.0+] MarikoIowaMicron1y4gb
|-
| 26
| [11.0.0+] MarikoHoagMicron1y4gb
|-
| 27
| [11.0.0+] MarikoAulaMicron1y4gb
|-
| 28
| [11.0.0+] MarikoAulaSamsung1y8gbX
|}

This is extracted directly from [[Fuse_registers#FUSE_RESERVED_ODM4|FUSE_RESERVED_ODM4]].

[[PCV_services|PCV]] selects memory training tables based on DramId.
{| class="wikitable" border="1"
|-
! SocType
! Platform
! DramId
! Revision
! DVFS
|-
| Erista
| jetson-tx1
| N/A
| 0x07
|
11_40800_01_V9.8.3_V1.6
11_68000_01_V9.8.3_V1.6
11_102000_01_V9.8.3_V1.6
11_204000_05_V9.8.3_V1.6
11_408000_02_V9.8.3_V1.6
11_665600_03_V9.8.3_V1.6
11_800000_01_V9.8.3_V1.6
11_1065600_01_V9.8.3_V1.6
11_1331200_01_V9.8.3_V1.6
11_1600000_02_V9.8.3_V1.6
|-
| Erista
| nx-abcb
| EristaIcosaSamsung4gb
| 0x07
|
10_40800_NoCfgVersion_V9.8.7_V1.6
10_68000_NoCfgVersion_V9.8.7_V1.6
10_102000_NoCfgVersion_V9.8.7_V1.6
10_204000_NoCfgVersion_V9.8.7_V1.6
10_408000_NoCfgVersion_V9.8.7_V1.6
10_665600_NoCfgVersion_V9.8.7_V1.6
10_800000_NoCfgVersion_V9.8.7_V1.6
10_1065600_NoCfgVersion_V9.8.7_V1.6
10_1331200_NoCfgVersion_V9.8.7_V1.6
10_1600000_NoCfgVersion_V9.8.7_V1.6
|-
| Erista
| nx-abcb
| EristaIcosaMicron4gb
| 0x07
|
10_40800_NoCfgVersion_V9.8.4_V1.6
10_68000_NoCfgVersion_V9.8.4_V1.6
10_102000_NoCfgVersion_V9.8.4_V1.6
10_204000_NoCfgVersion_V9.8.4_V1.6
10_408000_NoCfgVersion_V9.8.4_V1.6
10_665600_NoCfgVersion_V9.8.4_V1.6
10_800000_NoCfgVersion_V9.8.4_V1.6
10_1065600_NoCfgVersion_V9.8.4_V1.6
10_1331200_NoCfgVersion_V9.8.4_V1.6
10_1600000_NoCfgVersion_V9.8.4_V1.6
|-
| Erista
| nx-abcb
| EristaIcosaHynix4gb
| 0x07
|
10_40800_NoCfgVersion_V9.8.4_V1.6
10_68000_NoCfgVersion_V9.8.4_V1.6
10_102000_NoCfgVersion_V9.8.4_V1.6
10_204000_NoCfgVersion_V9.8.4_V1.6
10_408000_NoCfgVersion_V9.8.4_V1.6
10_665600_NoCfgVersion_V9.8.4_V1.6
10_800000_NoCfgVersion_V9.8.4_V1.6
10_1065600_NoCfgVersion_V9.8.4_V1.6
10_1331200_NoCfgVersion_V9.8.4_V1.6
10_1600000_NoCfgVersion_V9.8.4_V1.6
|-
| Erista
| nx-abca2
| EristaIcosaSamsung4gb, EristaIcosaMicron4gb
| 0x07
|
10_40800_NoCfgVersion_V9.8.7_V1.6
10_68000_NoCfgVersion_V9.8.7_V1.6
10_102000_NoCfgVersion_V9.8.7_V1.6
10_204000_NoCfgVersion_V9.8.7_V1.6
10_408000_NoCfgVersion_V9.8.7_V1.6
10_665600_NoCfgVersion_V9.8.7_V1.6
10_800000_NoCfgVersion_V9.8.7_V1.6
10_1065600_NoCfgVersion_V9.8.7_V1.6
10_1331200_NoCfgVersion_V9.8.7_V1.6
10_1600000_NoCfgVersion_V9.8.7_V1.6
|-
| Erista
| nx-abca2
| EristaIcosaHynix4gb
| 0x07
|
10_40800_NoCfgVersion_V9.8.7_V1.6
10_68000_NoCfgVersion_V9.8.7_V1.6
10_102000_NoCfgVersion_V9.8.7_V1.6
10_204000_NoCfgVersion_V9.8.7_V1.6
10_408000_NoCfgVersion_V9.8.7_V1.6
10_665600_NoCfgVersion_V9.8.7_V1.6
10_800000_NoCfgVersion_V9.8.7_V1.6
10_1065600_NoCfgVersion_V9.8.7_V1.6
10_1331200_NoCfgVersion_V9.8.7_V1.6
10_1600000_NoCfgVersion_V9.8.7_V1.6
|-
| Erista
| nx-abca2
| EristaIcosaSamsung6gb
| 0x07
|
10_40800_NoCfgVersion_V9.8.7_V1.6
10_68000_NoCfgVersion_V9.8.7_V1.6
10_102000_NoCfgVersion_V9.8.7_V1.6
10_204000_NoCfgVersion_V9.8.7_V1.6
10_408000_NoCfgVersion_V9.8.7_V1.6
10_665600_NoCfgVersion_V9.8.7_V1.6
10_800000_NoCfgVersion_V9.8.7_V1.6
10_1065600_NoCfgVersion_V9.8.7_V1.6
10_1331200_NoCfgVersion_V9.8.7_V1.6
10_1600000_NoCfgVersion_V9.8.7_V1.6
|-
| Mariko
| nx-abca2, nx-abcb, nx-abcc, nx-abcd
| MarikoIowax1x2Samsung4gb
| 0x03
|
01_204000_NoCfgVersion_V0.3.1_V2.0
01_1331200.0_NoCfgVersion_V0.3.1_V2.0
01_1600000_NoCfgVersion_V0.3.1_V2.0
|-
| Mariko
| nx-abca2, nx-abcb, nx-abcc, nx-abcd
| MarikoIowaSamsung4gb, MarikoHoagSamsung4gb
| 0x03
|
01_204000_NoCfgVersion_V0.3.1_V2.0
01_1331200.0_NoCfgVersion_V0.3.1_V2.0
01_1600000_NoCfgVersion_V0.3.1_V2.0
|-
| Mariko
| nx-abca2, nx-abcb, nx-abcc, nx-abcd
| MarikoIowaSamsung8gb, MarikoHoagSamsung8gb
| 0x03
|
01_204000_NoCfgVersion_V0.4.2_V2.0
01_1331200.0_NoCfgVersion_V0.4.2_V2.0
01_1600000_NoCfgVersion_V0.4.2_V2.0
|-
| Mariko
| nx-abca2, nx-abcb, nx-abcc, nx-abcd
| MarikoIowaHynix4gb, MarikoHoagHynix4gb
| 0x03
|
01_204000_NoCfgVersion_V0.3.1_V2.0
01_1331200.0_NoCfgVersion_V0.3.1_V2.0
01_1600000_NoCfgVersion_V0.3.1_V2.0
|-
| Mariko
| nx-abca2, nx-abcb, nx-abcc, nx-abcd
| MarikoIowaMicron4gb, MarikoHoagMicron4gb
| 0x03
|
01_204000_NoCfgVersion_V0.4.2_V2.0
01_1331200.0_NoCfgVersion_V0.4.2_V2.0
01_1600000_NoCfgVersion_V0.4.2_V2.0
|-
| Mariko
| nx-abca2, nx-abcb, nx-abcc, nx-abcd
| MarikoIowaSamsung4gbY
| 0x03
|
01_204000_NoCfgVersion_V0.4.2_V2.0
01_1331200.0_NoCfgVersion_V0.4.2_V2.0
01_1600000_NoCfgVersion_V0.4.2_V2.0
|-
| Mariko
| nx-abca2, nx-abcb, nx-abcc, nx-abcd
| MarikoIowaSamsung1y4gbX
| 0x03
|
01_204000_NoCfgVersion_V0.4.2_V2.0
01_1331200.0_NoCfgVersion_V0.4.2_V2.0
01_1600000_NoCfgVersion_V0.4.2_V2.0
|-
| Mariko
| nx-abca2, nx-abcb, nx-abcc, nx-abcd
| MarikoIowaSamsung1y8gbX
| 0x03
|
01_204000_NoCfgVersion_V0.4.2_V2.0
01_1331200.0_NoCfgVersion_V0.4.2_V2.0
01_1600000_NoCfgVersion_V0.4.2_V2.0
|-
| Mariko
| nx-abca2, nx-abcb, nx-abcc, nx-abcd
| MarikoHoagSamsung1y4gbX
| 0x03
|
01_204000_NoCfgVersion_V0.4.2_V2.0
01_1331200.0_NoCfgVersion_V0.4.2_V2.0
01_1600000_NoCfgVersion_V0.4.2_V2.0
|-
| Mariko
| nx-abca2, nx-abcb, nx-abcc, nx-abcd
| MarikoIowaSamsung1y4gbY
| 0x03
|
01_204000_NoCfgVersion_V0.4.2_V2.0
01_1331200.0_NoCfgVersion_V0.4.2_V2.0
01_1600000_NoCfgVersion_V0.4.2_V2.0
|-
| Mariko
| nx-abca2, nx-abcb, nx-abcc, nx-abcd
| MarikoIowaSamsung1y8gbY
| 0x03
|
01_204000_NoCfgVersion_V0.4.2_V2.0
01_1331200.0_NoCfgVersion_V0.4.2_V2.0
01_1600000_NoCfgVersion_V0.4.2_V2.0
|-
| Mariko
| nx-abca2, nx-abcb, nx-abcc, nx-abcd
| MarikoIowaSamsung1y4gbA
| 0x03
|
01_204000_NoCfgVersion_V0.4.5_V2.0
01_1331200.0_NoCfgVersion_V0.4.5_V2.0
01_1600000_NoCfgVersion_V0.4.5_V2.0
|}

'''nx-abca2''' ('''Icosa''' in '''Erista''', '''Iowa''' in '''Mariko''') hardware types are variations of the retail, EDEV and SDEV form factors.

'''nx-abcb''' ('''Copper''' in '''Erista''', '''Calcio''' in '''Mariko''') is a simulation unit. Among other differences, this has extra hardware to support HDMI output.

[8.0.0+] '''nx-abcc''' ('''Hoag''') was added for the Lite retail and HDEV form factors.

[10.0.0+] '''nx-abcd''' ('''Aula''') was added for the OLED retail and ADEV form factors.

'''Erista''' memory is LPDDR4, while '''Mariko''' memory is LPDDR4X.

===== SecurityEngineInterruptNumber =====
SPL uses this for setting up the security engine IRQ.

===== FuseVersion =====
The current [[Package2#Versions|bootloader maximum version]] - 1.

===== HardwareType =====
{| class=wikitable
! Value || Description
|-
| 0 || Icosa
|-
| 1 || Copper
|-
| 2 || [8.0.0+] Hoag ([1.0.0-7.0.1] Invalid)
|-
| 3 || [4.0.0+] Iowa
|-
| 4 || [8.0.0+] Calcio
|-
| 5 || [10.0.0+] Aula
|-
| 15 || Invalid
|}

[1.0.0+] This item is obtained by checking bits 8 and 2 from [[Fuse_registers#FUSE_RESERVED_ODM4|FUSE_RESERVED_ODM4]].

[4.0.0+] This item is obtained by checking bits 8, 2 and 16-19 from [[Fuse_registers#FUSE_RESERVED_ODM4|FUSE_RESERVED_ODM4]].

[7.0.0+] This item can now only be 0 (Icosa) or 15 (Invalid) in Erista units.

Hardware is '''Icosa''' (Erista retail, EDEV and SDEV) if [[Fuse_registers#FUSE_RESERVED_ODM4|HardwareType1]] (bit 2) is 1 and [[Fuse_registers#FUSE_RESERVED_ODM4|HardwareType2]] (bit 8) is 0.

Hardware is '''Copper''' (Erista simulation) if [[Fuse_registers#FUSE_RESERVED_ODM4|HardwareType1]] (bit 2) is 0 and [[Fuse_registers#FUSE_RESERVED_ODM4|HardwareType2]] (bit 8) is 1.

[4.0.0+] Hardware is '''Iowa''' (Mariko retail, EDEV and SDEV) if [[Fuse_registers#FUSE_RESERVED_ODM4|HardwareType3]] (bits 16-19) is 1.

[8.0.0+] Hardware is '''Hoag''' (Mariko Lite retail and HDEV) if [[Fuse_registers#FUSE_RESERVED_ODM4|HardwareType3]] (bits 16-19) is 2.

[8.0.0+] Hardware is '''Calcio''' (Mariko simulation) if [[Fuse_registers#FUSE_RESERVED_ODM4|HardwareType1]] (bit 2) is 0 and [[Fuse_registers#FUSE_RESERVED_ODM4|HardwareType2]] (bit 8) is 1.

[10.0.0+] Hardware is '''Aula''' (Mariko OLED Model retail and ADEV) if [[Fuse_registers#FUSE_RESERVED_ODM4|HardwareType3]] (bits 16-19) is 4.

===== HardwareState =====
{| class=wikitable
! Value || Description
|-
| 0 || Development
|-
| 1 || Production
|-
| 2 || Invalid
|}

This item is obtained by checking bits 9 and 0-1 from [[Fuse_registers#FUSE_RESERVED_ODM4|FUSE_RESERVED_ODM4]].

Hardware is '''Development''' if [[Fuse_registers#FUSE_RESERVED_ODM4|HardwareState1]] (bits 0-1) is 3 and [[Fuse_registers#FUSE_RESERVED_ODM4|HardwareState2]] (bit 9) is 0.

Hardware is '''Production''' if [[Fuse_registers#FUSE_RESERVED_ODM4|HardwareState1]] (bits 0-1) is 0 and [[Fuse_registers#FUSE_RESERVED_ODM4|HardwareState2]] (bit 9) is 1.

===== IsRecoveryBoot =====
Used to determine if the system is booting from SafeMode firmware.

Under normal circumstances, this just returns bit 0 of the active [[BCT#bootloader0_info|bootloader info]]'s attribute field.

===== DeviceId =====
[[NIM_services|NIM]] checks if this item matches the [[Settings_services|set:cal]] DeviceId with byte7 cleared. If they don't match, a panic is thrown.

===== BootReason =====
{| class=wikitable
! Value || Description
|-
| 0 || Invalid
|-
| 1 || AcOk
|-
| 2 || OnKey
|-
| 3 || RtcAlarm1
|-
| 4 || RtcAlarm2
|}

Used to determine how the system booted.

===== MemoryMode =====
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 0-3
| Purpose (0 = None, 1 = ForStandard, 2 = ForAppletDev, 3 = ForSystemDev)
|-
| 4-7
| Size (0 = 4GB, 1 = 6GB, 2 = 8GB)
|}

[[Process Manager services|PM]] and the kernel decide memory arrangement based on MemoryMode.
{| class="wikitable" border="1"
|-
! MemoryArrange
! MemoryMode
! Description
|-
| 0
| 0x01
| Standard
|-
| 1
| 0x02
| StandardForAppletDev
|-
| 2
| 0x03
| StandardForSystemDev
|-
| 3
| 0x11
| Expanded
|-
| 4
| 0x12
| ExpandedForAppletDev
|-
| 5
| 0x21
| ExpandedForMarikoDev
|}

===== IsDevelopmentFunctionEnabled =====
Kernel uses this to determine behavior of [[SVC#svcBreak|svcBreak]] positive arguments. It will break instead of just force-exiting the process which is what happens on retail.

[2.0.0+] This is also used with certain debug [[SVC|SVCs]].

[3.0.0+] [[Loader services|RO]] checks this and if set then skipping NRR rsa signatures is allowed.

===== KernelConfiguration =====
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 0
| EnableNonZeroFillMemory
|-
| 1
| EnableUserExceptionHandler
|-
| 2
| PerformanceMonitoringUnit
|-
| 3
| [8.0.0+] EnableApplicationExtraThread
|-
| 8
| CallShowErrorOnPanic
|-
| 16-17
| MemorySize
|}

Kernel reads this when setting up memory-related code.

'''EnableNonZeroFillMemory''' is a boolean determining whether kernel should it will memset various allocated memory-regions with 0x58, 0x59, 0x5A ('X', 'Y', 'Z') instead of zero. This allows Nintendo devs to find uninitialized memory bugs.

'''EnableUserExceptionHandler''' is a boolean determining whether kernel should forcefully enable usermode exception handlers (when false, only certain aborts (((1LL << (esr >> 26)) & 0x1115804400224001) == 0, typically data/prefetch aborts) that occur when the faulting address is in a readable region with MemoryType_CodeStatic will trigger usermode exception handlers).

'''PerformanceMonitoringUnit''' is a boolean determining whether kernel should enable usermode access to the Performance Monitors (whether PMUSERENR_EL0 should be 1 or 0).

'''EnableApplicationExtraThread''' is a boolean determining whether the kernel should increase the KThread slabheap capacity by 160. This also increases object capacities that are calculated based on number of threads.

'''CallShowErrorOnPanic''' is a boolean determining whether kernel should call smcPanic on error instead of infinite-looping.

'''MemorySize''' determines how much memory is available. 00/03 = 4 GB, 01 = 6 GB, 02 = 8 GB.

===== IsChargerHiZModeEnabled =====
This tells if the TI Charger (bq24192) is active.

===== QuestState =====
{| class=wikitable
! Value || Description
|-
| 0 || Disabled
|-
| 1 || Enabled
|}

This item is bit 10 from [[Fuse_registers#FUSE_RESERVED_ODM4|FUSE_RESERVED_ODM4]].

[4.0.0+] [[Settings_services|Settings]] uses this value to overwrite the quest flag from [[Settings_services#set:sys|GetQuestFlag]]. This is used to detect if a Switch is a kiosk unit for display at retail stores.

===== RegulatorType =====
{| class="wikitable" border="1"
|-
! Value
! SocType
! GPU
! Power Blocks
|-
| 0
| Erista
| GM20B (0x12B)
| max77620_sd0, max77621_cpu and max77621_gpu
|-
| 1
| Mariko
| GM20B_B (0x12E)
| max77620_sd0, max77812_cpu and max77812_gpu
|-
| 2
| Mariko
| GM20B_B (0x12E)
| max77620_sd0, max77812_cpu and max77812_gpu
|}

[5.0.0+] [[PCV_services|PCV]] uses this value in combination with [[#HardwareType|HardwareType]] to configure power blocks and memory tables for different hardware.

===== DeviceUniqueKeyGeneration =====
This item is obtained from [[Fuse_registers#FUSE_RESERVED_ODM2|FUSE_RESERVED_ODM2]] if bit 11 from [[Fuse_registers#FUSE_RESERVED_ODM4|FUSE_RESERVED_ODM4]] is set, [[Fuse_registers#FUSE_RESERVED_ODM0|FUSE_RESERVED_ODM0]] matches 0x8E61ECAE and [[Fuse_registers#FUSE_RESERVED_ODM1|FUSE_RESERVED_ODM1]] matches 0xF2BA3BB2.

[5.0.0+] [[Filesystem services|FS]] can now use this value for the '''KeyGeneration''' parameter when calling [[#GenerateAesKek|GenerateAesKek]] during "GetBisEncryptionKey".

===== Package2Hash =====
This is a SHA-256 hash calculated over the [[Package2|package2]] image. Since the hash calculation is an optional step in pkg2ldr, this item is only valid in recovery mode. Otherwise, an error is returned instead.

=== ShowError ===
Takes an u32 '''Color''' and issues a system panic.

The kernel always calls this with '''Color''' set to 0xF00.

=== SetKernelCarveoutRegion ===
Takes an u64 '''Index''', an u64 '''Address''' and an u64 '''Size'''. Returns [[#Result]].

If '''Index''' is 0, '''Address''' and '''Size''' are used to configure '''MC_SECURITY_CARVEOUT4'''.
If '''Index''' is 1, '''Address''' and '''Size''' are used to configure '''MC_SECURITY_CARVEOUT5'''.
Any other '''Index''' values are invalid.

The kernel calls this with '''Index''' set to 0, '''Address''' set to 0x80060000 and '''Size''' set to a dynamically calculated size which covers all the kernel and built-in sysmodules' DRAM regions.

=== ReadWriteRegister ===
Takes an u64 '''Register''', an u32 '''Mask''' and an u32 '''InValue'''. Returns [[#Result]] and an u32 '''OutValue'''.

Relays [[SVC#svcReadWriteRegister|svcReadWriteRegister]] to the Secure Monitor.

= CryptoUsecase =
{| class=wikitable
! Value || Name
|-
| 0 || Aes
|-
| 1 || RsaPrivate
|-
| 2 || SecureExpMod
|-
| 3 || RsaOaep
|-
| 4 || [5.0.0+] RsaImport
|-
| 5 || [5.0.0+]
|-
| 6 || [5.0.0+]
|}

= CipherMode =
{| class=wikitable
! Value || Name
|-
| 0 || CbcEncrypt
|-
| 1 || CbcDecrypt
|-
| 2 || Ctr
|}

= DecryptOrImportMode =
{| class=wikitable
! Value || Name
|-
| 0 || DecryptRsaPrivateKey
|-
| 1 || ImportLotusKey
|-
| 2 || ImportEsKey
|-
| 3 || ImportSslKey
|-
| 4 || ImportDrmKey
|}

= SecureExpModMode =
{| class=wikitable
! Value || Name
|-
| 0 || Lotus
|-
| 1 || Ssl
|-
| 2 || Drm
|}

= EsKeyType =
{| class=wikitable
! Value || Name
|-
| 0 || TitleKey
|-
| 1 || ElicenseKey
|}

= Result =
{| class=wikitable
! Value || Description
|-
| 0 || Success
|-
| 1 || Not implemented
|-
| 2 || Invalid argument
|-
| 3 || In progress
|-
| 4 || No async operation
|-
| 5 || Invalid async operation
|-
| 6 || [8.0.0+] Not permitted
|}

Secure Monitor

2022-02-28T17:26:55Z

CapNem: /* DramId */

= Secure Monitor Calls =
The secure monitor provides two top level handlers of which each provides a range of sub handlers.

Secure Monitor calls follow the ARM SMC calling convention with a small change:
{| class=wikitable
! Bits || Description
|-
| 0-7 || Function Number
|-
| 8-15 || Argument Type
|-
| 16-23 || Reserved
|-
| 24-29 || Call Range
|-
| 30 || Call Convention (0 = SMC32, 1 = SMC64)
|-
| 31 || Call Type (0 = Yielding Call, 1 = Fast Call)
|}

If bit ''n'' is set in the argument type then parameter X''n'' is treated as a pointer and the kernel will setup address translation for it in [[SVC#svcCallSecureMonitor|svcCallSecureMonitor]].

SMC arguments are passed using registers X0-X7 with X0 always sending the call sub-id and returning the result of the call.

== FunctionId0 ==
Functions exposed to user-mode processes using [[SVC|svcCallSecureMonitor]]. SMCs should be called from CPUID 3 (where SPL runs).

{| class=wikitable
! Value || Name
|-
| 0xC3000401 || SetConfig
|-
| 0xC3000002 || [[#GetConfig|GetConfig]] (same as in [[#FunctionId1]])
|-
| 0xC3000003 || GetResult
|-
| 0xC3000404 || GetResultData
|-
| 0xC3000E05 || ModularExponentiate
|-
| 0xC3000006 || [[#GenerateRandomBytes|GenerateRandomBytes]] (same as in [[#FunctionId1]])
|-
| 0xC3000007 || [[#GenerateAesKek|GenerateAesKek]]
|-
| 0xC3000008 || [[#LoadAesKey|LoadAesKey]]
|-
| 0xC3000009 || [[#ComputeAes|ComputeAes]]
|-
| 0xC300000A || [[#GenerateSpecificAesKey|GenerateSpecificAesKey]]
|-
| 0xC300040B || [[#ComputeCmac|ComputeCmac]]
|-
| [1.0.0-4.1.0] 0xC300100C || [[#DecryptAndImportEsDeviceKey|DecryptAndImportEsDeviceKey]]
|-
| [5.0.0+] 0xC300D60C || [[#ReencryptDeviceUniqueData|ReencryptDeviceUniqueData]]
|-
| 0xC300100D || [[#DecryptDeviceUniqueData|DecryptDeviceUniqueData]]
|-
| [1.0.0-4.1.0] 0xC300100E || [[#DecryptAndImportLotusKey|DecryptAndImportLotusKey]]
|-
| 0xC300060F || [[#ModularExponentiateByStorageKey|ModularExponentiateByStorageKey]]
|-
| 0xC3000610 || [[#PrepareEsDeviceUniqueKey|PrepareEsDeviceUniqueKey]]
|-
| 0xC3000011 || [[#LoadPreparedAesKey|LoadPreparedAesKey]]
|-
| 0xC3000012 || [2.0.0+] [[#PrepareEsCommonKey|PrepareEsCommonKey]]
|}

The overall concept here is the following:
* All key material (AES and RSA) is stored in userspace, but it's encrypted with random AES kek's ("key encryption keys").
* Each kek is generated as a function of an access key (picked at random).
* The kek is generated differently depending on the [[#CryptoUsecase]] the key is used for.
** This means: Each key is "locked" to the [[#CryptoUsecase]] it was designated for.
** You can use a key for a different usecase, but you will only get garbage output.
* After the kek has been generated, it is wrapped with a session-specific key and given back to userspace.
** This means: Plaintext kek keys never leave TrustZone.
** Further, this means: Actual AES/RSA keys never leave TrustZone.

=== GenerateRandomBytes ===
Takes an u64 '''Size'''. Returns [[#Result]] and '''RandomBytes'''.

'''Size''' is limited to 0x38 (for fitting in return registers).

=== GenerateAesKek ===
Takes an "access key" as input, an [[#CryptoUsecase]].

Returns a session-unique kek for said usecase.

=== LoadAesKey ===
Takes a session kek created with [[#GenerateAesKek]], and a wrapped AES key.

The session kek must have been created with [[#CryptoUsecase|CryptoUsecase Aes]].

=== ComputeAes ===
Encrypts/decrypts using AES (CTR and CBC). Takes an [[#CipherMode]].

Key must be set prior using one of the [[#LoadAesKey]] or [[#GenerateSpecificAesKey]] commands.

=== GenerateSpecificAesKey ===
Takes a wrapped AES key and decrypts it using static data.

=== ComputeCmac ===
Calculates CMAC over input data.

=== DecryptAndImportEsDeviceKey ===
Takes a session kek created with [[#GenerateAesKek]], a wrapped AES key, and a wrapped RSA private key.

The session kek must have been created with [[#CryptoUsecase|CryptoUsecase TitleKey]].

[5.0.0] This function was removed and replaced with [[#ReencryptDeviceUniqueData]].

=== ReencryptDeviceUniqueData ===
Takes in two session keks created with [[#GenerateAesKek]], two wrapped AES keys, an enum member, and a wrapped RSA private key.

Decrypts and validates the wrapped RSA private key with the first kek/wrapped key, and re-encrypts it with the second if valid.

The re-encrypted key is then passed to the user, for use with [[#DecryptDeviceUniqueData]].

=== DecryptDeviceUniqueData ===
Takes a session kek created with [[#GenerateAesKek]], a wrapped AES key, an enum member, and a wrapped RSA private key.

The session kek must have been created with [[#CryptoUsecase|CryptoUsecase RsaPrivate]].

[4.0.0+] The SMC handler when certain conditions pass and FunctionId0==0xC300100D now returns error 0x6 instead of calling the handler funcptr.

[5.0.0+] This function now takes an additional input [[#DecryptOrImportMode]]. This extends the original functionality to enable importing private keys into the security engine instead of decrypting them.

=== DecryptAndImportLotusKey ===
Takes a session kek created with [[#GenerateAesKek]], and a wrapped RSA key.

The session kek must have been created with [[#CryptoUsecase|CryptoUsecase RsaSecureExpMod]].

[5.0.0] This function was removed.

=== ModularExponentiateByStorageKey ===
Performs an ExpMod operation using an exponent previously loaded with the [[#DecryptAndImportLotusKey]] command.

[5.0.0+] This now uses any exponent previously loaded with [[#DecryptDeviceUniqueData]] and takes an [[#SecureExpModMode]].

=== PrepareEsDeviceUniqueKey ===
Takes an Rsa-Oaep-wrapped TitleKey, an RSA Public Key, and a label hash.

Performs an ExpMod operation using an exponent previously loaded with the [[#DecryptAndImportEsDeviceKey]] command, and then validates/extracts a Titlekey from the resulting message.

Returns a session-unique AES key especially for use in [[#LoadTitleKey]].

[5.0.0+] This now uses any exponent previously loaded with [[#DecryptDeviceUniqueData]].

=== LoadPreparedAesKey ===
Takes a session-unique AES key from [[#PrepareEsCommonKey]] or [[#PrepareEsDeviceUniqueKey]].

=== PrepareEsCommonKey ===
Takes an AES-wrapped common TitleKey and returns a sealed AES key.

== FunctionId1 ==
Functions exposed to the kernel internally.

{| class=wikitable
! Value || Name
|-
| 0xC4000001 || [[#SuspendCpu|SuspendCpu]]
|-
| 0x84000002 || [[#PowerOffCpu|PowerOffCpu]]
|-
| 0xC4000003 || [[#PowerOnCpu|PowerOnCpu]]
|-
| 0xC3000004 || [[#GetConfig|GetConfig]] (same as in [[#FunctionId0]])
|-
| 0xC3000005 || [[#GenerateRandomBytes|GenerateRandomBytesNonBlocking]]
|-
| 0xC3000006 || [[#ShowError|ShowError]]
|-
| 0xC3000007 || [2.0.0+] [[#SetKernelCarveoutRegion|SetKernelCarveoutRegion]]
|-
| 0xC3000008 || [2.0.0+] [[#ReadWriteRegister|ReadWriteRegister]]
|}

=== SuspendCpu ===
Takes an u64 '''PowerState''', an u64 '''EntrypointAddress''' and an u64 '''ContextId'''. No output.

Suspends the CPU (CPU0).

The kernel calls this SMC on shutdown with '''PowerState''' set to 0x0201001B (power level: 0x02==system; power type: 0x01==powerdown; ID: 0x1B).

=== PowerOffCpu ===
No input/output.

Turns off the CPU (CPU1, CPU2 or CPU3).

=== PowerOnCpu ===
Takes an u64 '''TargetCpu''', an u64 '''EntrypointAddress''' and an u64 '''ContextId'''. Returns [[#Result]].

Turns on the CPU (CPU1, CPU2 or CPU3).

=== GetConfig ===
Takes a [[#ConfigItem]]. Returns [[#Result]] and a '''ConfigValue'''.

==== ConfigItem ====
{| class="wikitable" border="1"
|-
! Value || Name
|-
| 1 || [[#DisableProgramVerification]]
|-
| 2 || [[#DramId]]
|-
| 3 || [[#SecurityEngineInterruptNumber]]
|-
| 4 || [[#FuseVersion]]
|-
| 5 || [[#HardwareType]]
|-
| 6 || [[#HardwareState]]
|-
| 7 || [[#IsRecoveryBoot]]
|-
| 8 || [[#DeviceId]]
|-
| 9 || [1.0.0-4.0.0] [[#BootReason]]
|-
| 10 || [[#MemoryMode]]
|-
| 11 || [[#IsDevelopmentFunctionEnabled]]
|-
| 12 || [[#KernelConfiguration]]
|-
| 13 || [[#IsChargerHiZModeEnabled]]
|-
| 14 || [4.0.0+] [[#QuestState]]
|-
| 15 || [5.0.0+] [[#RegulatorType]]
|-
| 16 || [5.0.0+] [[#DeviceUniqueKeyGeneration]]
|-
| 17 || [5.0.0+] [[#Package2Hash]]
|}

===== DisableProgramVerification =====
[[Process Manager services|PM]] checks this item and if non-zero, calls fsp-pr SetEnabledProgramVerification(false).

===== DramId =====
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| EristaIcosaSamsung4gb
|-
| 1
| EristaIcosaHynix4gb
|-
| 2
| EristaIcosaMicron4gb
|-
| 3
| [11.0.0+] MarikoIowaHynix1y4gb ([1.0.0-10.2.0] EristaCopperSamsung4gb)
|-
| 4
| EristaIcosaSamsung6gb
|-
| 5
| [12.0.0+] MarikoHoagHynix1y4gb ([4.0.0+] EristaCopperHynix4gb)
|-
| 6
| [13.0.0+] MarikoAulaHynix1y4gb ([4.0.0+] EristaCopperMicron4gb)
|-
| 7
| [5.0.0+] MarikoIowax1x2Samsung4gb ([4.0.0-4.1.0] Reserved)
|-
| 8
| [5.0.0+] MarikoIowaSamsung4gb
|-
| 9
| [5.0.0+] MarikoIowaSamsung8gb
|-
| 10
| [6.0.0+] MarikoIowaHynix4gb ([5.0.0-5.1.0] Reserved)
|-
| 11
| [7.0.0+] MarikoIowaMicron4gb ([5.0.0-6.2.0] Reserved)
|-
| 12
| [5.0.0+] MarikoHoagSamsung4gb
|-
| 13
| [5.0.0+] MarikoHoagSamsung8gb
|-
| 14
| [7.0.0+] MarikoHoagHynix4gb ([5.0.0-6.2.0] Reserved)
|-
| 15
| [7.0.0+] MarikoHoagMicron4gb ([5.0.0-6.2.0] Reserved)
|-
| 16
| [8.0.0+] MarikoIowaSamsung4gbY
|-
| 17
| [9.0.0+] MarikoIowaSamsung1y4gbX
|-
| 18
| [9.0.0+] MarikoIowaSamsung1y8gbX
|-
| 19
| [9.0.0+] MarikoHoagSamsung1y4gbX
|-
| 20
| [9.0.0+] MarikoIowaSamsung1y4gbY
|-
| 21
| [9.0.0+] MarikoIowaSamsung1y8gbY
|-
| 22
| [13.0.0+] Reserved ([9.0.0+] MarikoAulaSamsung1y4gb)
|-
| 23
| [10.0.0+] MarikoHoagSamsung1y8gbX
|-
| 24
| [10.0.0+] MarikoAulaSamsung1y4gbX
|-
| 25
| [11.0.0+] MarikoIowaMicron1y4gb
|-
| 26
| [11.0.0+] MarikoHoagMicron1y4gb
|-
| 27
| [11.0.0+] MarikoAulaMicron1y4gb
|-
| 28
| [11.0.0+] MarikoAulaSamsung1y8gbX
|}

This is extracted directly from [[Fuse_registers#FUSE_RESERVED_ODM4|FUSE_RESERVED_ODM4]].

[[PCV_services|PCV]] selects memory training tables based on DramId.
{| class="wikitable" border="1"
|-
! SocType
! Platform
! DramId
! Revision
! DVFS
|-
| Erista
| jetson-tx1
| N/A
| 0x07
|
11_40800_01_V9.8.3_V1.6
11_68000_01_V9.8.3_V1.6
11_102000_01_V9.8.3_V1.6
11_204000_05_V9.8.3_V1.6
11_408000_02_V9.8.3_V1.6
11_665600_03_V9.8.3_V1.6
11_800000_01_V9.8.3_V1.6
11_1065600_01_V9.8.3_V1.6
11_1331200_01_V9.8.3_V1.6
11_1600000_02_V9.8.3_V1.6
|-
| Erista
| nx-abcb
| EristaIcosaSamsung4gb
| 0x07
|
10_40800_NoCfgVersion_V9.8.7_V1.6
10_68000_NoCfgVersion_V9.8.7_V1.6
10_102000_NoCfgVersion_V9.8.7_V1.6
10_204000_NoCfgVersion_V9.8.7_V1.6
10_408000_NoCfgVersion_V9.8.7_V1.6
10_665600_NoCfgVersion_V9.8.7_V1.6
10_800000_NoCfgVersion_V9.8.7_V1.6
10_1065600_NoCfgVersion_V9.8.7_V1.6
10_1331200_NoCfgVersion_V9.8.7_V1.6
10_1600000_NoCfgVersion_V9.8.7_V1.6
|-
| Erista
| nx-abcb
| EristaIcosaMicron4gb
| 0x07
|
10_40800_NoCfgVersion_V9.8.4_V1.6
10_68000_NoCfgVersion_V9.8.4_V1.6
10_102000_NoCfgVersion_V9.8.4_V1.6
10_204000_NoCfgVersion_V9.8.4_V1.6
10_408000_NoCfgVersion_V9.8.4_V1.6
10_665600_NoCfgVersion_V9.8.4_V1.6
10_800000_NoCfgVersion_V9.8.4_V1.6
10_1065600_NoCfgVersion_V9.8.4_V1.6
10_1331200_NoCfgVersion_V9.8.4_V1.6
10_1600000_NoCfgVersion_V9.8.4_V1.6
|-
| Erista
| nx-abcb
| EristaIcosaHynix4gb
| 0x07
|
10_40800_NoCfgVersion_V9.8.4_V1.6
10_68000_NoCfgVersion_V9.8.4_V1.6
10_102000_NoCfgVersion_V9.8.4_V1.6
10_204000_NoCfgVersion_V9.8.4_V1.6
10_408000_NoCfgVersion_V9.8.4_V1.6
10_665600_NoCfgVersion_V9.8.4_V1.6
10_800000_NoCfgVersion_V9.8.4_V1.6
10_1065600_NoCfgVersion_V9.8.4_V1.6
10_1331200_NoCfgVersion_V9.8.4_V1.6
10_1600000_NoCfgVersion_V9.8.4_V1.6
|-
| Erista
| nx-abca2
| EristaIcosaSamsung4gb, EristaIcosaMicron4gb
| 0x07
|
10_40800_NoCfgVersion_V9.8.7_V1.6
10_68000_NoCfgVersion_V9.8.7_V1.6
10_102000_NoCfgVersion_V9.8.7_V1.6
10_204000_NoCfgVersion_V9.8.7_V1.6
10_408000_NoCfgVersion_V9.8.7_V1.6
10_665600_NoCfgVersion_V9.8.7_V1.6
10_800000_NoCfgVersion_V9.8.7_V1.6
10_1065600_NoCfgVersion_V9.8.7_V1.6
10_1331200_NoCfgVersion_V9.8.7_V1.6
10_1600000_NoCfgVersion_V9.8.7_V1.6
|-
| Erista
| nx-abca2
| EristaIcosaHynix4gb
| 0x07
|
10_40800_NoCfgVersion_V9.8.7_V1.6
10_68000_NoCfgVersion_V9.8.7_V1.6
10_102000_NoCfgVersion_V9.8.7_V1.6
10_204000_NoCfgVersion_V9.8.7_V1.6
10_408000_NoCfgVersion_V9.8.7_V1.6
10_665600_NoCfgVersion_V9.8.7_V1.6
10_800000_NoCfgVersion_V9.8.7_V1.6
10_1065600_NoCfgVersion_V9.8.7_V1.6
10_1331200_NoCfgVersion_V9.8.7_V1.6
10_1600000_NoCfgVersion_V9.8.7_V1.6
|-
| Erista
| nx-abca2
| EristaIcosaSamsung6gb
| 0x07
|
10_40800_NoCfgVersion_V9.8.7_V1.6
10_68000_NoCfgVersion_V9.8.7_V1.6
10_102000_NoCfgVersion_V9.8.7_V1.6
10_204000_NoCfgVersion_V9.8.7_V1.6
10_408000_NoCfgVersion_V9.8.7_V1.6
10_665600_NoCfgVersion_V9.8.7_V1.6
10_800000_NoCfgVersion_V9.8.7_V1.6
10_1065600_NoCfgVersion_V9.8.7_V1.6
10_1331200_NoCfgVersion_V9.8.7_V1.6
10_1600000_NoCfgVersion_V9.8.7_V1.6
|-
| Mariko
| nx-abca2, nx-abcb, nx-abcc, nx-abcd
| MarikoIowax1x2Samsung4gb
| 0x03
|
01_204000_NoCfgVersion_V0.3.1_V2.0
01_1331200.0_NoCfgVersion_V0.3.1_V2.0
01_1600000_NoCfgVersion_V0.3.1_V2.0
|-
| Mariko
| nx-abca2, nx-abcb, nx-abcc, nx-abcd
| MarikoIowaSamsung4gb, MarikoHoagSamsung4gb
| 0x03
|
01_204000_NoCfgVersion_V0.3.1_V2.0
01_1331200.0_NoCfgVersion_V0.3.1_V2.0
01_1600000_NoCfgVersion_V0.3.1_V2.0
|-
| Mariko
| nx-abca2, nx-abcb, nx-abcc, nx-abcd
| MarikoIowaSamsung8gb, MarikoHoagSamsung8gb
| 0x03
|
01_204000_NoCfgVersion_V0.4.2_V2.0
01_1331200.0_NoCfgVersion_V0.4.2_V2.0
01_1600000_NoCfgVersion_V0.4.2_V2.0
|-
| Mariko
| nx-abca2, nx-abcb, nx-abcc, nx-abcd
| MarikoIowaHynix4gb, MarikoHoagHynix4gb
| 0x03
|
01_204000_NoCfgVersion_V0.3.1_V2.0
01_1331200.0_NoCfgVersion_V0.3.1_V2.0
01_1600000_NoCfgVersion_V0.3.1_V2.0
|-
| Mariko
| nx-abca2, nx-abcb, nx-abcc, nx-abcd
| MarikoIowaMicron4gb, MarikoHoagMicron4gb
| 0x03
|
01_204000_NoCfgVersion_V0.4.2_V2.0
01_1331200.0_NoCfgVersion_V0.4.2_V2.0
01_1600000_NoCfgVersion_V0.4.2_V2.0
|-
| Mariko
| nx-abca2, nx-abcb, nx-abcc, nx-abcd
| MarikoIowaSamsung4gbY
| 0x03
|
01_204000_NoCfgVersion_V0.4.2_V2.0
01_1331200.0_NoCfgVersion_V0.4.2_V2.0
01_1600000_NoCfgVersion_V0.4.2_V2.0
|-
| Mariko
| nx-abca2, nx-abcb, nx-abcc, nx-abcd
| MarikoIowaSamsung1y4gbX
| 0x03
|
01_204000_NoCfgVersion_V0.4.2_V2.0
01_1331200.0_NoCfgVersion_V0.4.2_V2.0
01_1600000_NoCfgVersion_V0.4.2_V2.0
|-
| Mariko
| nx-abca2, nx-abcb, nx-abcc, nx-abcd
| MarikoIowaSamsung1y8gbX
| 0x03
|
01_204000_NoCfgVersion_V0.4.2_V2.0
01_1331200.0_NoCfgVersion_V0.4.2_V2.0
01_1600000_NoCfgVersion_V0.4.2_V2.0
|-
| Mariko
| nx-abca2, nx-abcb, nx-abcc, nx-abcd
| MarikoHoagSamsung1y4gbX
| 0x03
|
01_204000_NoCfgVersion_V0.4.2_V2.0
01_1331200.0_NoCfgVersion_V0.4.2_V2.0
01_1600000_NoCfgVersion_V0.4.2_V2.0
|-
| Mariko
| nx-abca2, nx-abcb, nx-abcc, nx-abcd
| MarikoIowaSamsung1y4gbY
| 0x03
|
01_204000_NoCfgVersion_V0.4.2_V2.0
01_1331200.0_NoCfgVersion_V0.4.2_V2.0
01_1600000_NoCfgVersion_V0.4.2_V2.0
|-
| Mariko
| nx-abca2, nx-abcb, nx-abcc, nx-abcd
| MarikoIowaSamsung1y8gbY
| 0x03
|
01_204000_NoCfgVersion_V0.4.2_V2.0
01_1331200.0_NoCfgVersion_V0.4.2_V2.0
01_1600000_NoCfgVersion_V0.4.2_V2.0
|-
| Mariko
| nx-abca2, nx-abcb, nx-abcc, nx-abcd
| MarikoIowaSamsung1y4gbA
| 0x03
|
01_204000_NoCfgVersion_V0.4.5_V2.0
01_1331200.0_NoCfgVersion_V0.4.5_V2.0
01_1600000_NoCfgVersion_V0.4.5_V2.0
|}

'''nx-abca2''' ('''Icosa''' in '''Erista''', '''Iowa''' in '''Mariko''') hardware types are variations of the retail, EDEV and SDEV form factors.

'''nx-abcb''' ('''Copper''' in '''Erista''', '''Calcio''' in '''Mariko''') is a simulation unit. Among other differences, this has extra hardware to support HDMI output.

[8.0.0+] '''nx-abcc''' ('''Hoag''') was added for the Lite retail and HDEV form factors.

[10.0.0+] '''nx-abcd''' ('''Aula''') was added for the OLED retail and ADEV form factors.

'''Erista''' memory is LPDDR4, while '''Mariko''' memory is LPDDR4X.

===== SecurityEngineInterruptNumber =====
SPL uses this for setting up the security engine IRQ.

===== FuseVersion =====
The current [[Package2#Versions|bootloader maximum version]] - 1.

===== HardwareType =====
{| class=wikitable
! Value || Description
|-
| 0 || Icosa
|-
| 1 || Copper
|-
| 2 || [8.0.0+] Hoag ([1.0.0-7.0.1] Invalid)
|-
| 3 || [4.0.0+] Iowa
|-
| 4 || [8.0.0+] Calcio
|-
| 5 || [10.0.0+] Aula
|-
| 15 || Invalid
|}

[1.0.0+] This item is obtained by checking bits 8 and 2 from [[Fuse_registers#FUSE_RESERVED_ODM4|FUSE_RESERVED_ODM4]].

[4.0.0+] This item is obtained by checking bits 8, 2 and 16-19 from [[Fuse_registers#FUSE_RESERVED_ODM4|FUSE_RESERVED_ODM4]].

[7.0.0+] This item can now only be 0 (Icosa) or 15 (Invalid) in Erista units.

Hardware is '''Icosa''' (Erista retail, EDEV and SDEV) if [[Fuse_registers#FUSE_RESERVED_ODM4|HardwareType1]] (bit 2) is 1 and [[Fuse_registers#FUSE_RESERVED_ODM4|HardwareType2]] (bit 8) is 0.

Hardware is '''Copper''' (Erista simulation) if [[Fuse_registers#FUSE_RESERVED_ODM4|HardwareType1]] (bit 2) is 0 and [[Fuse_registers#FUSE_RESERVED_ODM4|HardwareType2]] (bit 8) is 1.

[4.0.0+] Hardware is '''Iowa''' (Mariko retail, EDEV and SDEV) if [[Fuse_registers#FUSE_RESERVED_ODM4|HardwareType3]] (bits 16-19) is 1.

[8.0.0+] Hardware is '''Hoag''' (Mariko Lite retail and HDEV) if [[Fuse_registers#FUSE_RESERVED_ODM4|HardwareType3]] (bits 16-19) is 2.

[8.0.0+] Hardware is '''Calcio''' (Mariko simulation) if [[Fuse_registers#FUSE_RESERVED_ODM4|HardwareType1]] (bit 2) is 0 and [[Fuse_registers#FUSE_RESERVED_ODM4|HardwareType2]] (bit 8) is 1.

[10.0.0+] Hardware is '''Aula''' if [[Fuse_registers#FUSE_RESERVED_ODM4|HardwareType3]] (bits 16-19) is 4.

===== HardwareState =====
{| class=wikitable
! Value || Description
|-
| 0 || Development
|-
| 1 || Production
|-
| 2 || Invalid
|}

This item is obtained by checking bits 9 and 0-1 from [[Fuse_registers#FUSE_RESERVED_ODM4|FUSE_RESERVED_ODM4]].

Hardware is '''Development''' if [[Fuse_registers#FUSE_RESERVED_ODM4|HardwareState1]] (bits 0-1) is 3 and [[Fuse_registers#FUSE_RESERVED_ODM4|HardwareState2]] (bit 9) is 0.

Hardware is '''Production''' if [[Fuse_registers#FUSE_RESERVED_ODM4|HardwareState1]] (bits 0-1) is 0 and [[Fuse_registers#FUSE_RESERVED_ODM4|HardwareState2]] (bit 9) is 1.

===== IsRecoveryBoot =====
Used to determine if the system is booting from SafeMode firmware.

Under normal circumstances, this just returns bit 0 of the active [[BCT#bootloader0_info|bootloader info]]'s attribute field.

===== DeviceId =====
[[NIM_services|NIM]] checks if this item matches the [[Settings_services|set:cal]] DeviceId with byte7 cleared. If they don't match, a panic is thrown.

===== BootReason =====
{| class=wikitable
! Value || Description
|-
| 0 || Invalid
|-
| 1 || AcOk
|-
| 2 || OnKey
|-
| 3 || RtcAlarm1
|-
| 4 || RtcAlarm2
|}

Used to determine how the system booted.

===== MemoryMode =====
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 0-3
| Purpose (0 = None, 1 = ForStandard, 2 = ForAppletDev, 3 = ForSystemDev)
|-
| 4-7
| Size (0 = 4GB, 1 = 6GB, 2 = 8GB)
|}

[[Process Manager services|PM]] and the kernel decide memory arrangement based on MemoryMode.
{| class="wikitable" border="1"
|-
! MemoryArrange
! MemoryMode
! Description
|-
| 0
| 0x01
| Standard
|-
| 1
| 0x02
| StandardForAppletDev
|-
| 2
| 0x03
| StandardForSystemDev
|-
| 3
| 0x11
| Expanded
|-
| 4
| 0x12
| ExpandedForAppletDev
|-
| 5
| 0x21
| ExpandedForMarikoDev
|}

===== IsDevelopmentFunctionEnabled =====
Kernel uses this to determine behavior of [[SVC#svcBreak|svcBreak]] positive arguments. It will break instead of just force-exiting the process which is what happens on retail.

[2.0.0+] This is also used with certain debug [[SVC|SVCs]].

[3.0.0+] [[Loader services|RO]] checks this and if set then skipping NRR rsa signatures is allowed.

===== KernelConfiguration =====
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 0
| EnableNonZeroFillMemory
|-
| 1
| EnableUserExceptionHandler
|-
| 2
| PerformanceMonitoringUnit
|-
| 3
| [8.0.0+] EnableApplicationExtraThread
|-
| 8
| CallShowErrorOnPanic
|-
| 16-17
| MemorySize
|}

Kernel reads this when setting up memory-related code.

'''EnableNonZeroFillMemory''' is a boolean determining whether kernel should it will memset various allocated memory-regions with 0x58, 0x59, 0x5A ('X', 'Y', 'Z') instead of zero. This allows Nintendo devs to find uninitialized memory bugs.

'''EnableUserExceptionHandler''' is a boolean determining whether kernel should forcefully enable usermode exception handlers (when false, only certain aborts (((1LL << (esr >> 26)) & 0x1115804400224001) == 0, typically data/prefetch aborts) that occur when the faulting address is in a readable region with MemoryType_CodeStatic will trigger usermode exception handlers).

'''PerformanceMonitoringUnit''' is a boolean determining whether kernel should enable usermode access to the Performance Monitors (whether PMUSERENR_EL0 should be 1 or 0).

'''EnableApplicationExtraThread''' is a boolean determining whether the kernel should increase the KThread slabheap capacity by 160. This also increases object capacities that are calculated based on number of threads.

'''CallShowErrorOnPanic''' is a boolean determining whether kernel should call smcPanic on error instead of infinite-looping.

'''MemorySize''' determines how much memory is available. 00/03 = 4 GB, 01 = 6 GB, 02 = 8 GB.

===== IsChargerHiZModeEnabled =====
This tells if the TI Charger (bq24192) is active.

===== QuestState =====
{| class=wikitable
! Value || Description
|-
| 0 || Disabled
|-
| 1 || Enabled
|}

This item is bit 10 from [[Fuse_registers#FUSE_RESERVED_ODM4|FUSE_RESERVED_ODM4]].

[4.0.0+] [[Settings_services|Settings]] uses this value to overwrite the quest flag from [[Settings_services#set:sys|GetQuestFlag]]. This is used to detect if a Switch is a kiosk unit for display at retail stores.

===== RegulatorType =====
{| class="wikitable" border="1"
|-
! Value
! SocType
! GPU
! Power Blocks
|-
| 0
| Erista
| GM20B (0x12B)
| max77620_sd0, max77621_cpu and max77621_gpu
|-
| 1
| Mariko
| GM20B_B (0x12E)
| max77620_sd0, max77812_cpu and max77812_gpu
|-
| 2
| Mariko
| GM20B_B (0x12E)
| max77620_sd0, max77812_cpu and max77812_gpu
|}

[5.0.0+] [[PCV_services|PCV]] uses this value in combination with [[#HardwareType|HardwareType]] to configure power blocks and memory tables for different hardware.

===== DeviceUniqueKeyGeneration =====
This item is obtained from [[Fuse_registers#FUSE_RESERVED_ODM2|FUSE_RESERVED_ODM2]] if bit 11 from [[Fuse_registers#FUSE_RESERVED_ODM4|FUSE_RESERVED_ODM4]] is set, [[Fuse_registers#FUSE_RESERVED_ODM0|FUSE_RESERVED_ODM0]] matches 0x8E61ECAE and [[Fuse_registers#FUSE_RESERVED_ODM1|FUSE_RESERVED_ODM1]] matches 0xF2BA3BB2.

[5.0.0+] [[Filesystem services|FS]] can now use this value for the '''KeyGeneration''' parameter when calling [[#GenerateAesKek|GenerateAesKek]] during "GetBisEncryptionKey".

===== Package2Hash =====
This is a SHA-256 hash calculated over the [[Package2|package2]] image. Since the hash calculation is an optional step in pkg2ldr, this item is only valid in recovery mode. Otherwise, an error is returned instead.

=== ShowError ===
Takes an u32 '''Color''' and issues a system panic.

The kernel always calls this with '''Color''' set to 0xF00.

=== SetKernelCarveoutRegion ===
Takes an u64 '''Index''', an u64 '''Address''' and an u64 '''Size'''. Returns [[#Result]].

If '''Index''' is 0, '''Address''' and '''Size''' are used to configure '''MC_SECURITY_CARVEOUT4'''.
If '''Index''' is 1, '''Address''' and '''Size''' are used to configure '''MC_SECURITY_CARVEOUT5'''.
Any other '''Index''' values are invalid.

The kernel calls this with '''Index''' set to 0, '''Address''' set to 0x80060000 and '''Size''' set to a dynamically calculated size which covers all the kernel and built-in sysmodules' DRAM regions.

=== ReadWriteRegister ===
Takes an u64 '''Register''', an u32 '''Mask''' and an u32 '''InValue'''. Returns [[#Result]] and an u32 '''OutValue'''.

Relays [[SVC#svcReadWriteRegister|svcReadWriteRegister]] to the Secure Monitor.

= CryptoUsecase =
{| class=wikitable
! Value || Name
|-
| 0 || Aes
|-
| 1 || RsaPrivate
|-
| 2 || SecureExpMod
|-
| 3 || RsaOaep
|-
| 4 || [5.0.0+] RsaImport
|-
| 5 || [5.0.0+]
|-
| 6 || [5.0.0+]
|}

= CipherMode =
{| class=wikitable
! Value || Name
|-
| 0 || CbcEncrypt
|-
| 1 || CbcDecrypt
|-
| 2 || Ctr
|}

= DecryptOrImportMode =
{| class=wikitable
! Value || Name
|-
| 0 || DecryptRsaPrivateKey
|-
| 1 || ImportLotusKey
|-
| 2 || ImportEsKey
|-
| 3 || ImportSslKey
|-
| 4 || ImportDrmKey
|}

= SecureExpModMode =
{| class=wikitable
! Value || Name
|-
| 0 || Lotus
|-
| 1 || Ssl
|-
| 2 || Drm
|}

= EsKeyType =
{| class=wikitable
! Value || Name
|-
| 0 || TitleKey
|-
| 1 || ElicenseKey
|}

= Result =
{| class=wikitable
! Value || Description
|-
| 0 || Success
|-
| 1 || Not implemented
|-
| 2 || Invalid argument
|-
| 3 || In progress
|-
| 4 || No async operation
|-
| 5 || Invalid async operation
|-
| 6 || [8.0.0+] Not permitted
|}

Product Information

2021-11-03T06:21:18Z

CapNem: /* Prefix */ Added N64 Controller Prefix

This page details miscellaneous Switch product information (serial numbers, product models, etc...).

= Product List =
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HAC-001 || Retail Nintendo Switch console
|-
| HAC-002 || AC adapter
|-
| HAC-003 || Nintendo Switch Battery
|-
| HAC-004 ||
|-
| HAC-005 ||
|-
| HAC-006 || Joy-Con battery
|-
| HAC-007 || Dock
|-
| HAC-008 || Gamecard
|-
| HAC-009 || Gamecard case
|-
| HAC-010 || USB charging cable also included in ("Mario Kart Live: Home Circuit")
|-
| HAC-011 || Joy-Con grip
|-
| HAC-012 || Joy-Con charge grip
|-
| HAC-013 || Pro Controller
|-
| HAC-014 || Joy-Con strap
|-
| HAC-015 || Left Joy-Con
|-
| HAC-016 || Right Joy-Con
|-
| HAC-017 || Joy-Con handle
|-
| HAC-018 || Screen protector
|-
| HAC-019 || Left Joy-Con extended battery
|-
| HAC-020 || Right Joy-Con extended battery
|-
| HAC-021 || Carrying case
|-
| HAC-022 || Ring-Con
|-
| HAC-023 || Leg Strap
|-
| HAC-024 || Poké Ball Plus controller
|-
| HAC-025 ||
|-
| HAC-026 ||
|-
| HAC-027 ||
|-
| HAC-028 ||
|-
| HAC-029 || Steelbook Gamecard case
|-
| HAC-030 || Poké Ball Plus battery
|-
| HAC-031 || Charging stand
|-
| HAC-032 ||
|-
| HAC-033 || Left NES controller
|-
| HAC-034 || Right NES controller
|-
| HAC-035 || Left Famicom controller
|-
| HAC-036 || Right Famicom controller
|-
| HAC-037 || Kart ("Mario Kart Live: Home Circuit")
|-
| HAC-038 || Battery for kart ("Mario Kart Live: Home Circuit")
|-
| HAC-039 || Gates ("Mario Kart Live: Home Circuit")
|-
| HAC-040 || Touch Pen ("Super Mario Maker 2")
|-
| HAC-041 || Touch Pen ("Brain Training for Switch")
|-
| HAC-042 || SNES controller
|-
| HAC-043 || N64 controller
|-
| HAC-044 || Arrow Markers ("Mario Kart Live: Home Circuit")
|-
| HAC-045 || Sega Genesis controller
|-
| HAC-046 ||
|-
| HAC-047 || USB charging cable ("Mario Kart Live: Home Circuit") known as HAC-010 instead
|-
| HAC-048 ||
|-
| HAC-049 ||
|-
| HAC-050 ||
|-
| HAC-051 || Nintendo Labo Toy-Con 1: Variety Kit
|-
| HAC-052 || Nintendo Labo Toy-Con 2: Robot Kit
|-
| HAC-053 || Nintendo Labo Toy-Con 3: Vehicle Kit
|-
| HAC-054 || Nintendo Labo Toy-Con 4: VR Kit
|-
| HAC-055 || Nintendo Labo Storage Box
|}
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HAC-001(-01) || Retail Nintendo Switch Mariko console (also known as HAD[...])
|}
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HAT-001 || SDEV Nintendo Switch console
|-
| HAT-001(-01) || SDEV-D Nintendo Switch Mariko console
|-
| HAT-002 || EDEV Nintendo Switch console
|-
| HAT-002(-01) || EDEV-D Nintendo Switch Mariko console
|-
| HAT-003 || SDEV cradle
|-
| HAT-004 || Relay Box
|}
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HDH-001 || Retail Nintendo Switch Lite console
|-
| HDH-002 || HDEV Nintendo Switch console
|-
| HDH-003 || Battery
|-
| HDH-004 || Carrying case
|-
| HDH-005 || Screen protector
|-
| HDH-006 || Flip cover
|}
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HEG-001 || Retail Nintendo Switch (OLED Model) console
|-
| HEG-002 || ADEV Nintendo Switch console
|-
| HEG-004 || ADEV Relay Box
|-
| HEG-005 || Nintendo Switch (OLED Model) HDMI cable
|-
| HEG-007 || Nintendo Switch (OLED Model) dock
|-
| HEG-021 || Nintendo Switch (OLED Model) carrying case
|}

= Product Serial Numbers =
Serial numbers are composed of at least [[#Prefix|three letters]] followed by ten decimal digits. The tenth digit is a [[#Check_Digit|check digit]], meaning that it is derived from the other digits.

== Prefix ==
Observed prefixes are normally as follows:

* First letter represents the product line:
** "X" (NX)
* Second letter represents the product model:
** "A" (HAC-001; Nintendo Switch console)
** "B" (HAC-015; Left Joy-Con)
** "C" (HAC-016; Right Joy-Con)
** "D" (HAC-012; Joy-Con charge grip)
** "E" (HAC-013; Pro Controller)
** "F" (HAC-007; Dock)
** "H" (HAC-024; Poké Ball Plus controller)
** "J" (HDH-001; Nintendo Switch Lite console)
** "K" (HAC-001-01; Nintendo Switch Mariko console)
** "L" (HAC-033; Left NES controller)
** "M" (HAC-034; Right NES controller)
** "Q" (HAC-037; Kart for "Mario Kart Live: Home Circuit")
** "R" (HAC-042; SNES controller)
** "S" (HAC-043; N64 controller)
** "T" (HEG-001; Nintendo Switch (OLED Model) console)
** "V" (HEG-007; Nintendo Switch (OLED Model) dock)
** "X" (HAC-045; Sega Genesis controller)
** "Y" (HAT-004/HEG-004; EDEV/ADEV Relay Box)
** "Z" (HAT-003; SDEV cradle)
* Third letter represents the product region:
** "C" (China)
** "E" (Europe)
** "J" (Japan; and Europe on old models)
** "K" (Korea)
** "L" (All; for development only)
** "W" (Americas)
* Fourth letter is optional:
** "F" (Factory)

== Assembly Line ==
The first two digits immediately after the [[#Prefix|prefix]] represent the assembly line as follows:

{| class="wikitable" border="1"
|-
! Value || Description
|-
| 00 || Unspecified
|-
| 01 || Prototype
|-
| 02 || SDEV
|-
| 03 || EDEV
|-
| 04 || DPRD
|-
| 05 || HDEV
|-
| 06 || SDEV-D
|-
| 07 || EDEV-D
|-
| 10 || Retail
|-
| 40 || Retail
|-
| 70 || Retail
|-
| 90 || Refurbished
|}

== Check Digit ==
The check digit is an industry-standard algorithm and is calculated just like it was on the [https://www.3dbrew.org/wiki/Serials#Console_Serial_Numbers 3DS].

To calculate the check digit of a Switch console, separate the non-check digits into "odd" and "even" groups, where the "odd" group is digits in odd-numbered positions, and the "even" group is digits in even-numbered positions. (The first digit is "odd", with "first" representing "1".)

After separating the digits, add the digits in each group together. Multiply the sum of the even digits by 3, then add the sum of the odd digits. To calculate the check digit, take this value modulo 10, and if not 0, subtract from 10.

Example: XAW10075273452

The non-check digits are 1007527345. Separating into odd and even groups, we get the following:

Odds: 1 + 0 + 5 + 7 + 4 = 17 Evens: 0 + 7 + 2 + 3 + 5 = 17

Applying the algorithm, we get ((3 * 17) + 17) % 10 = 8, which is not 0, thus 10 - 8 = 2, matching the example's check digit.

Product Information

2021-10-17T15:47:55Z

CapNem: /* Prefix */ Generalize Y prefix

This page details miscellaneous Switch product information (serial numbers, product models, etc...).

= Product List =
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HAC-001 || Retail Nintendo Switch console
|-
| HAC-002 || AC adapter
|-
| HAC-003 || Nintendo Switch Battery
|-
| HAC-004 ||
|-
| HAC-005 ||
|-
| HAC-006 || Joy-Con battery
|-
| HAC-007 || Dock
|-
| HAC-008 || Gamecard
|-
| HAC-009 || Gamecard case
|-
| HAC-010 || USB charging cable also included in ("Mario Kart Live: Home Circuit")
|-
| HAC-011 || Joy-Con grip
|-
| HAC-012 || Joy-Con charge grip
|-
| HAC-013 || Pro Controller
|-
| HAC-014 || Joy-Con strap
|-
| HAC-015 || Left Joy-Con
|-
| HAC-016 || Right Joy-Con
|-
| HAC-017 || Joy-Con handle
|-
| HAC-018 || Screen protector
|-
| HAC-019 || Left Joy-Con extended battery
|-
| HAC-020 || Right Joy-Con extended battery
|-
| HAC-021 || Carrying case
|-
| HAC-022 || Ring-Con
|-
| HAC-023 || Leg Strap
|-
| HAC-024 || Poké Ball Plus controller
|-
| HAC-025 ||
|-
| HAC-026 ||
|-
| HAC-027 ||
|-
| HAC-028 ||
|-
| HAC-029 || Steelbook Gamecard case
|-
| HAC-030 || Poké Ball Plus battery
|-
| HAC-031 || Charging stand
|-
| HAC-032 ||
|-
| HAC-033 || Left NES controller
|-
| HAC-034 || Right NES controller
|-
| HAC-035 || Left Famicom controller
|-
| HAC-036 || Right Famicom controller
|-
| HAC-037 || Kart ("Mario Kart Live: Home Circuit")
|-
| HAC-038 || Battery for kart ("Mario Kart Live: Home Circuit")
|-
| HAC-039 || Gates ("Mario Kart Live: Home Circuit")
|-
| HAC-040 || Touch Pen ("Super Mario Maker 2")
|-
| HAC-041 || Touch Pen ("Brain Training for Switch")
|-
| HAC-042 || SNES controller
|-
| HAC-043 || N64 controller
|-
| HAC-044 || Arrow Markers ("Mario Kart Live: Home Circuit")
|-
| HAC-045 || Sega Genesis controller
|-
| HAC-046 ||
|-
| HAC-047 || USB charging cable ("Mario Kart Live: Home Circuit") known as HAC-010 instead
|-
| HAC-048 ||
|-
| HAC-049 ||
|-
| HAC-050 ||
|-
| HAC-051 || Nintendo Labo Toy-Con 1: Variety Kit
|-
| HAC-052 || Nintendo Labo Toy-Con 2: Robot Kit
|-
| HAC-053 || Nintendo Labo Toy-Con 3: Vehicle Kit
|-
| HAC-054 || Nintendo Labo Toy-Con 4: VR Kit
|-
| HAC-055 || Nintendo Labo Storage Box
|}
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HAC-001(-01) || Retail Nintendo Switch Mariko console (also known as HAD[...])
|}
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HAT-001 || SDEV Nintendo Switch console
|-
| HAT-001(-01) || SDEV-D Nintendo Switch Mariko console
|-
| HAT-002 || EDEV Nintendo Switch console
|-
| HAT-002(-01) || EDEV-D Nintendo Switch Mariko console
|-
| HAT-003 || SDEV cradle
|-
| HAT-004 || Relay Box
|}
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HDH-001 || Retail Nintendo Switch Lite console
|-
| HDH-002 || HDEV Nintendo Switch console
|-
| HDH-003 || Battery
|-
| HDH-004 || Carrying case
|-
| HDH-005 || Screen protector
|-
| HDH-006 || Flip cover
|}
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HEG-001 || Retail Nintendo Switch (OLED Model) console
|-
| HEG-002 || ADEV Nintendo Switch console
|-
| HEG-004 || ADEV Relay Box
|-
| HEG-005 || Nintendo Switch (OLED Model) HDMI cable
|-
| HEG-007 || Nintendo Switch (OLED Model) dock
|-
| HEG-021 || Nintendo Switch (OLED Model) carrying case
|}

= Product Serial Numbers =
Serial numbers are composed of at least [[#Prefix|three letters]] followed by ten decimal digits. The tenth digit is a [[#Check_Digit|check digit]], meaning that it is derived from the other digits.

== Prefix ==
Observed prefixes are normally as follows:

* First letter represents the product line:
** "X" (NX)
* Second letter represents the product model:
** "A" (HAC-001; Nintendo Switch console)
** "B" (HAC-015; Left Joy-Con)
** "C" (HAC-016; Right Joy-Con)
** "D" (HAC-012; Joy-Con charge grip)
** "E" (HAC-013; Pro Controller)
** "F" (HAC-007; Dock)
** "H" (HAC-024; Poké Ball Plus controller)
** "J" (HDH-001; Nintendo Switch Lite console)
** "K" (HAC-001-01; Nintendo Switch Mariko console)
** "L" (HAC-033; Left NES controller)
** "M" (HAC-034; Right NES controller)
** "Q" (HAC-037; Kart for "Mario Kart Live: Home Circuit")
** "R" (HAC-042; SNES controller)
** "T" (HEG-001; Nintendo Switch (OLED Model) console)
** "V" (HEG-007; Nintendo Switch (OLED Model) dock)
** "X" (HAC-045; Sega Genesis controller)
** "Y" (HAT-004/HEG-004; EDEV/ADEV Relay Box)
** "Z" (HAT-003; SDEV cradle)
* Third letter represents the product region:
** "C" (China)
** "E" (Europe)
** "J" (Japan; and Europe on old models)
** "K" (Korea)
** "L" (All; for development only)
** "W" (Americas)
* Fourth letter is optional:
** "F" (Factory)

== Assembly Line ==
The first two digits immediately after the [[#Prefix|prefix]] represent the assembly line as follows:

{| class="wikitable" border="1"
|-
! Value || Description
|-
| 00 || Unspecified
|-
| 01 || Prototype
|-
| 02 || SDEV
|-
| 03 || EDEV
|-
| 04 || DPRD
|-
| 05 || HDEV
|-
| 06 || SDEV-D
|-
| 07 || EDEV-D
|-
| 10 || Retail
|-
| 40 || Retail
|-
| 70 || Retail
|-
| 90 || Refurbished
|}

== Check Digit ==
The check digit is an industry-standard algorithm and is calculated just like it was on the [https://www.3dbrew.org/wiki/Serials#Console_Serial_Numbers 3DS].

To calculate the check digit of a Switch console, separate the non-check digits into "odd" and "even" groups, where the "odd" group is digits in odd-numbered positions, and the "even" group is digits in even-numbered positions. (The first digit is "odd", with "first" representing "1".)

After separating the digits, add the digits in each group together. Multiply the sum of the even digits by 3, then add the sum of the odd digits. To calculate the check digit, take this value modulo 10, and if not 0, subtract from 10.

Example: XAW10075273452

The non-check digits are 1007527345. Separating into odd and even groups, we get the following:

Odds: 1 + 0 + 5 + 7 + 4 = 17 Evens: 0 + 7 + 2 + 3 + 5 = 17

Applying the algorithm, we get ((3 * 17) + 17) % 10 = 8, which is not 0, thus 10 - 8 = 2, matching the example's check digit.

Product Information

2021-10-12T20:25:00Z

CapNem: /* Prefix */ Add the Joy-Con charging grip prefix

This page details miscellaneous Switch product information (serial numbers, product models, etc...).

= Product List =
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HAC-001 || Retail Nintendo Switch console
|-
| HAC-002 || AC adapter
|-
| HAC-003 || Nintendo Switch Battery
|-
| HAC-004 ||
|-
| HAC-005 ||
|-
| HAC-006 || Joy-Con battery
|-
| HAC-007 || Dock
|-
| HAC-008 || Gamecard
|-
| HAC-009 || Gamecard case
|-
| HAC-010 || USB charging cable also included in ("Mario Kart Live: Home Circuit")
|-
| HAC-011 || Joy-Con grip
|-
| HAC-012 || Joy-Con charge grip
|-
| HAC-013 || Pro Controller
|-
| HAC-014 || Joy-Con strap
|-
| HAC-015 || Left Joy-Con
|-
| HAC-016 || Right Joy-Con
|-
| HAC-017 || Joy-Con handle
|-
| HAC-018 || Screen protector
|-
| HAC-019 || Left Joy-Con extended battery
|-
| HAC-020 || Right Joy-Con extended battery
|-
| HAC-021 || Carrying case
|-
| HAC-022 || Ring-Con
|-
| HAC-023 || Leg Strap
|-
| HAC-024 || Poké Ball Plus controller
|-
| HAC-025 ||
|-
| HAC-026 ||
|-
| HAC-027 ||
|-
| HAC-028 ||
|-
| HAC-029 || Steelbook Gamecard case
|-
| HAC-030 || Poké Ball Plus battery
|-
| HAC-031 || Charging stand
|-
| HAC-032 ||
|-
| HAC-033 || Left NES controller
|-
| HAC-034 || Right NES controller
|-
| HAC-035 || Left Famicom controller
|-
| HAC-036 || Right Famicom controller
|-
| HAC-037 || Kart ("Mario Kart Live: Home Circuit")
|-
| HAC-038 || Battery for kart ("Mario Kart Live: Home Circuit")
|-
| HAC-039 || Gates ("Mario Kart Live: Home Circuit")
|-
| HAC-040 || Touch Pen ("Super Mario Maker 2")
|-
| HAC-041 || Touch Pen ("Brain Training for Switch")
|-
| HAC-042 || SNES controller
|-
| HAC-043 || N64 controller
|-
| HAC-044 || Arrow Markers ("Mario Kart Live: Home Circuit")
|-
| HAC-045 || Sega Genesis controller
|-
| HAC-046 ||
|-
| HAC-047 || USB charging cable ("Mario Kart Live: Home Circuit") known as HAC-010 instead
|-
| HAC-048 ||
|-
| HAC-049 ||
|-
| HAC-050 ||
|-
| HAC-051 || Nintendo Labo Toy-Con 1: Variety Kit
|-
| HAC-052 || Nintendo Labo Toy-Con 2: Robot Kit
|-
| HAC-053 || Nintendo Labo Toy-Con 3: Vehicle Kit
|-
| HAC-054 || Nintendo Labo Toy-Con 4: VR Kit
|-
| HAC-055 || Nintendo Labo Storage Box
|}
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HAC-001(-01) || Retail Nintendo Switch Mariko console (also known as HAD[...])
|}
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HAT-001 || SDEV Nintendo Switch console
|-
| HAT-001(-01) || SDEV-D Nintendo Switch Mariko console
|-
| HAT-002 || EDEV Nintendo Switch console
|-
| HAT-002(-01) || EDEV-D Nintendo Switch Mariko console
|-
| HAT-003 || SDEV cradle
|-
| HAT-004 || Relay Box
|}
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HDH-001 || Retail Nintendo Switch Lite console
|-
| HDH-002 || HDEV Nintendo Switch console
|-
| HDH-003 || Battery
|-
| HDH-004 || Carrying case
|-
| HDH-005 || Screen protector
|-
| HDH-006 || Flip cover
|}
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HEG-001 || Retail Nintendo Switch (OLED Model) console
|-
| HEG-002 || ADEV Nintendo Switch console
|-
| HEG-004 || ADEV Relay Box
|-
| HEG-005 || Nintendo Switch (OLED Model) HDMI cable
|-
| HEG-007 || Nintendo Switch (OLED Model) dock
|-
| HEG-021 || Nintendo Switch (OLED Model) carrying case
|}

= Product Serial Numbers =
Serial numbers are composed of at least [[#Prefix|three letters]] followed by ten decimal digits. The tenth digit is a [[#Check_Digit|check digit]], meaning that it is derived from the other digits.

== Prefix ==
Observed prefixes are normally as follows:

* First letter represents the product line:
** "X" (NX)
* Second letter represents the product model:
** "A" (HAC-001; Nintendo Switch console)
** "B" (HAC-015; Left Joy-Con)
** "C" (HAC-016; Right Joy-Con)
** "D" (HAC-012; Joy-Con charge grip)
** "E" (HAC-013; Pro Controller)
** "F" (HAC-007; Dock)
** "H" (HAC-024; Poké Ball Plus controller)
** "J" (HDH-001; Nintendo Switch Lite console)
** "K" (HAC-001-01; Nintendo Switch Mariko console)
** "L" (HAC-033; Left NES controller)
** "M" (HAC-034; Right NES controller)
** "Q" (HAC-037; Kart for "Mario Kart Live: Home Circuit")
** "R" (HAC-042; SNES controller)
** "T" (HEG-001; Nintendo Switch (OLED Model) console)
** "V" (HEG-007; Nintendo Switch (OLED Model) dock)
** "X" (HAC-045; Sega Genesis controller)
** "Y" (HEG-004; ADEV Relay Box)
** "Z" (HAT-003; SDEV cradle)
* Third letter represents the product region:
** "C" (China)
** "E" (Europe)
** "J" (Japan; and Europe on old models)
** "K" (Korea)
** "L" (All; for development only)
** "W" (Americas)
* Fourth letter is optional:
** "F" (Factory)

== Assembly Line ==
The first two digits immediately after the [[#Prefix|prefix]] represent the assembly line as follows:

{| class="wikitable" border="1"
|-
! Value || Description
|-
| 00 || Unspecified
|-
| 01 || Prototype
|-
| 02 || SDEV
|-
| 03 || EDEV
|-
| 04 || DPRD
|-
| 05 || HDEV
|-
| 06 || SDEV-D
|-
| 07 || EDEV-D
|-
| 10 || Retail
|-
| 40 || Retail
|-
| 70 || Retail
|-
| 90 || Refurbished
|}

== Check Digit ==
The check digit is an industry-standard algorithm and is calculated just like it was on the [https://www.3dbrew.org/wiki/Serials#Console_Serial_Numbers 3DS].

To calculate the check digit of a Switch console, separate the non-check digits into "odd" and "even" groups, where the "odd" group is digits in odd-numbered positions, and the "even" group is digits in even-numbered positions. (The first digit is "odd", with "first" representing "1".)

After separating the digits, add the digits in each group together. Multiply the sum of the even digits by 3, then add the sum of the odd digits. To calculate the check digit, take this value modulo 10, and if not 0, subtract from 10.

Example: XAW10075273452

The non-check digits are 1007527345. Separating into odd and even groups, we get the following:

Odds: 1 + 0 + 5 + 7 + 4 = 17 Evens: 0 + 7 + 2 + 3 + 5 = 17

Applying the algorithm, we get ((3 * 17) + 17) % 10 = 8, which is not 0, thus 10 - 8 = 2, matching the example's check digit.

Joy-Con

2021-10-10T20:31:38Z

CapNem: /* Colors */ Fix the official white joy-con color hex

Joy-Con is the name for the Switch's primary game controllers. The controllers communicate to the console through bluetooth and can be disconnected from the main unit.

== Hardware ==
The controllers themselves are simple to disassemble and identify.
[[File:JoyconFront.jpg|400px|thumb|The front of the Joy-Con internal[https://www.ifixit.com/Teardown/Nintendo+Switch+Teardown/78263]]]
[[File:JoyconRear.jpg|400px|thumb|The rear of the Joy-Con internal[https://www.ifixit.com/Teardown/Nintendo+Switch+Teardown/78263]]]
{| class="wikitable"
! Color || Item
|-
| Red || Broadcom BCM20734 Bluetooth 4.1/2.4 GHz Transceiver
|-
| Orange || STMicroelectronics NFCBEA 812006 33 (Likely NFC reader IC)
|-
| Yellow|| Macronix International MX25U4033E 4 Mb CMOS Flash
|}

== Firmware ==
''See also: [[Joy-Con Firmware]]''

The firmware of the Joy-Cons seems to be generic across all instances. Details such as the handedness of the controller and the color is just indicated in a configuration part of the flash. Judging by quick glance at the firmware, it's probably identical to that used on the Pro Controller as well.
{| class="wikitable"
! Controller || 1.0.0
|-
| Joy-Con Left (Blue) || [[:File:pad.L.bin|flash dump]]
|-
| Joy-Con Right (Red) || [[:File:pad.R.bin|flash dump]]
|}
The flash is in a patch-ram format. Tools for dealing with it are available [https://github.com/shuffle2/nxpad].
A dump of the ROM region (taken while firmware was running) can be found [[:File:bcm20734_rom.bin|here]]. Note this is the same SoC used on the other controller models, as well.

== Bluetooth HID ==
=== Commands ===
{| class="wikitable" border="1"
|-
! Command || Name
|-
| 0x00 ||
|-
| 0x01 || PairingOut
|-
| 0x02 || GetDeviceInfo
|-
| 0x03 || SetDataFormat
|-
| 0x04 || LRButtonDetection
|-
| 0x05 || Page
|-
| 0x06 || Reset
|-
| 0x07 || ClearPairingInfo
|-
| 0x08 || Shipment
|-
| 0x10 || SerialFlashRead
|-
| 0x11 || SerialFlashWrite
|-
| 0x12 || SerialFlashSectorErase
|-
| 0x20 || McuReset
|-
| 0x21 || McuWrite
|-
| 0x22 || McuResume
|-
| 0x23 ||
|-
| 0x24 || McuPollingEnable
|-
| 0x25 || McuPollingDisable
|-
| 0x28 || AttachmentWrite
|-
| 0x29 ||
|-
| 0x2A || AttachmentEnable
|-
| 0x2B ||
|-
| 0x30 || SetIndicatorLed
|-
| 0x31 || GetIndicatorLed
|-
| 0x38 || SetNotificationLed
|-
| 0x40 || SensorSleep
|-
| 0x41 || SensorConfig
|-
| 0x42 || SensorWrite
|-
| 0x43 || SensorRead
|-
| 0x48 || MotorEnable
|-
| 0x50 || GetBatteryVoltage
|-
| 0x51 || WriteChargeSetting
|-
| 0x52 ||
|-
| 0x58 || ExtDevWrite
|-
| 0x59 || GetExtDevInfo
|-
| 0x5A || ExtDevPollingEnable
|-
| 0x5B || ExtDevPollingDisable
|-
| 0x5C || ExtDevInFormatConfig
|-
| 0x60 || InternalAttachmentWrite
|-
| 0x61 ||
|-
| 0x62 || InternalAttachmentEnable
|-
| 0x63 || InternalAttachmentPollingEnable
|-
| 0x64 || InternalAttachmentPollingDisable
|-
| 0x80 || Ack
|-
| 0x81 || PairingIn
|-
| 0x82 || DeviceInfo
|-
| 0x83 || LRButtonElapsedTime
|-
| 0x90 || SerialFlashData
|-
| 0xA0 || McuData
|-
| 0xA8 || AttachmentData
|-
| 0xAA || InternalAttachmentRead
|-
| 0xB0 || IndicatorLed
|-
| 0xC0 || SensorData
|-
| 0xD0 || BatteryVoltage
|-
| 0xD8 || ExtDevRead
|-
| 0xD9 || ExtDevInfo
|}

=== Left & Right Separate Joy-con ===
When paired directly to a computer over bluetooth, the joy-con both provide identical HID input report descriptor. This does not appear to include motion controls, IR data, or NFC. They both behave as detached single-player controllers.

HID Input Report Descriptor (Hexadecimal):
<pre>
00000000: 05010905 A1010601 FF852109 21750895 ....¡...ÿ…!.!u.•
00000010: 30810285 30093075 08953081 02853109 0..…0.0u.•0..…1.
00000020: 31750896 69018102 85320932 75089669 1u.–i...…2.2u.–i
00000030: 01810285 33093375 08966901 8102853F ...…3.3u.–i...…?
00000040: 05091901 29101500 25017501 95108102 ....)...%.u.•...
00000050: 05010939 15002507 75049501 81420509 ...9..%.u.•..B..
00000060: 75049501 81010501 09300931 09330934 u.•......0.1.3.4
00000070: 16000027 FFFF0000 75109504 81020601 ...'ÿÿ..u.•.....
00000080: FF850109 01750895 30910285 10091075 ÿ…...u.•0‘.…...u
00000090: 08953091 02851109 11750895 30910285 .•0‘.…...u.•0‘.…
000000A0: 12091275 08953091 02C0 ...u.•0‘.À
</pre>

{| class="wikitable"
! Parsed Bytes || Description
|-
|0x05, 0x01, || Usage Page (Generic Desktop Ctrls)
|-
|0x09, 0x05, || Usage (Game Pad)
|-
|0xA1, 0x01, || Collection (Application)
|-
|0x06, 0x01, 0xFF, || Usage Page (Vendor Defined 0xFF01)
|-
|0x85, 0x21, || Report ID (33)
|-
|0x09, 0x21, || Usage (0x21)
|-
|0x75, 0x08, || Report Size (8)
|-
|0x95, 0x30, || Report Count (48)
|-
|0x81, 0x02, || Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)
|-
|0x85, 0x30, || Report ID (48)
|-
|0x09, 0x30, || Usage (0x30)
|-
|0x75, 0x08, || Report Size (8)
|-
|0x95, 0x30, || Report Count (48)
|-
|0x81, 0x02, || Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)
|-
|0x85, 0x31, || Report ID (49)
|-
|0x09, 0x31, || Usage (0x31)
|-
|0x75, 0x08, || Report Size (8)
|-
|0x96, 0x69, 0x01, || Report Count (361)
|-
|0x81, 0x02, || Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)
|-
|0x85, 0x32, || Report ID (50)
|-
|0x09, 0x32, || Usage (0x32)
|-
|0x75, 0x08, || Report Size (8)
|-
|0x96, 0x69, 0x01, || Report Count (361)
|-
|0x81, 0x02, || Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)
|-
|0x85, 0x33, || Report ID (51)
|-
|0x09, 0x33, || Usage (0x33)
|-
|0x75, 0x08, || Report Size (8)
|-
|0x96, 0x69, 0x01, || Report Count (361)
|-
|0x81, 0x02, || Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)
|-
|0x85, 0x3F, || Report ID (63)
|-
|0x05, 0x09, || Usage Page (Button)
|-
|0x19, 0x01, || Usage Minimum (0x01)
|-
|0x29, 0x10, || Usage Maximum (0x10)
|-
|0x15, 0x00, || Logical Minimum (0)
|-
|0x25, 0x01, || Logical Maximum (1)
|-
|0x75, 0x01, || Report Size (1)
|-
|0x95, 0x10, || Report Count (16)
|-
|0x81, 0x02, || Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)
|-
|0x05, 0x01, || Usage Page (Generic Desktop Ctrls)
|-
|0x09, 0x39, || Usage (Hat switch)
|-
|0x15, 0x00, || Logical Minimum (0)
|-
|0x25, 0x07, || Logical Maximum (7)
|-
|0x75, 0x04, || Report Size (4)
|-
|0x95, 0x01, || Report Count (1)
|-
|0x81, 0x42, || Input (Data,Var,Abs,No Wrap,Linear,Preferred State,Null State)
|-
|0x05, 0x09, || Usage Page (Button)
|-
|0x75, 0x04, || Report Size (4)
|-
|0x95, 0x01, || Report Count (1)
|-
|0x81, 0x01, || Input (Const,Array,Abs,No Wrap,Linear,Preferred State,No Null Position)
|-
|0x05, 0x01, || Usage Page (Generic Desktop Ctrls)
|-
|0x09, 0x30, || Usage (X)
|-
|0x09, 0x31, || Usage (Y)
|-
|0x09, 0x33, || Usage (Rx)
|-
|0x09, 0x34, || Usage (Ry)
|-
|0x16, 0x00, 0x00, || Logical Minimum (0)
|-
|0x27, 0xFF, 0xFF, 0x00, 0x00, || Logical Maximum (65534)
|-
|0x75, 0x10, || Report Size (16)
|-
|0x95, 0x04, || Report Count (4)
|-
|0x81, 0x02, || Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)
|-
|0x06, 0x01, 0xFF, || Usage Page (Vendor Defined 0xFF01)
|-
|0x85, 0x01, || Report ID (1)
|-
|0x09, 0x01, || Usage (0x01)
|-
|0x75, 0x08, || Report Size (8)
|-
|0x95, 0x30, || Report Count (48)
|-
|0x91, 0x02, || Output (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
|-
|0x85, 0x10, || Report ID (16)
|-
|0x09, 0x10, || Usage (0x10)
|-
|0x75, 0x08, || Report Size (8)
|-
|0x95, 0x30, || Report Count (48)
|-
|0x91, 0x02, || Output (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
|-
|0x85, 0x11, || Report ID (17)
|-
|0x09, 0x11, || Usage (0x11)
|-
|0x75, 0x08, || Report Size (8)
|-
|0x95, 0x30, || Report Count (48)
|-
|0x91, 0x02, || Output (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
|-
|0x85, 0x12, || Report ID (18)
|-
|0x09, 0x12, || Usage (0x12)
|-
|0x75, 0x08, || Report Size (8)
|-
|0x95, 0x30, || Report Count (48)
|-
|0x91, 0x02, || Output (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
|-
|0xC0, || End Collection
|}

== Colors ==
HEX codes for the colors shown in the "Controllers" menu of the Switch UI can be found in a Joy-con SPI dump starting at offset 0x6050. Body color is first followed by button color and each is 3 bytes long. These values are able to be re-written with any HEX color value to make the Joy-cons show up as different colors in the UI. The following is a list of official HEX colors recovered from SPI dumps.
{| class="wikitable"
! Retail Color || Body HEX || Button HEX
|-
| Black / ブラック || #313131 || #0F0F0F
|-
| Gray / グレー || #828282 || #0F0F0F
|-
| Neon Red / ネオンレッド || #FF3C28 || #1E0A0A
|-
| Neon Blue / ネオンブルー || #0AB9E6 || #001E1E
|-
| Neon Yellow / ネオンイエロー || #E6FF00 || #142800
|-
| Neon Green / ネオングリーン || #1EDC00 || #002800
|-
| Neon Pink / ネオンピンク || #FF3278 || #28001E
|-
| Red / レッド || #E10F00 || #280A0A
|-
| Blue / ブルー || #4655F5 || #00000A
|-
| Neon Purple / ネオンパープル || #B400E6 || #140014
|-
| Neon Orange / ネオンオレンジ || #FAA005 || #0F0A00
|-
| White / ホワイト || #E6E6E6 || #323232
|-
! Special Edition Color || Body HEX || Button HEX
|-
| Super Smash Bros. Ultimate Edition Gray Joy-Con / 大乱闘スマッシュブラザーズ SPECIAL || #828282 || #0F0F0F
|-
| Pokemon: Let's Go! Eevee-Brown Left Joy-Con / ポケットモンスター Let's Go! イーブイ || #C88C32 || #281900
|-
| Pokemon: Let's Go! Pikachu-Yellow Right Joy-Con / ポケットモンスター Let's Go! ピカチュウ || #FFDC00 || #322800
|-
| *Nintendo Labo Creators Contest Edition "Cardboard"-Colored Joy-Con || #D7AA73 || #1E1914
|-
| **Dragon Quest XI S Lotto Edition Royal-Blue Joy-Con / ドラゴンクエスト XI S （ロト版） || #1473FA || #00000F
|-
| **Disney Tsum Tsum Festival Neon-Purple Left Joy-Con / ディズニーツムツムフェスティバル || #B400E6 || #140014
|-
| **Disney Tsum Tsum Festival Neon-Pink Right Joy-Con / ディズニーツムツムフェスティバル || #FF3278 || #28001E
|-
| Animal Crossing: New Horizons Pastel-Green Left Joy-Con / あつまれどうぶつの森 || #82FF96 || #0A1E0A
|-
| Animal Crossing: New Horizons Pastel-Blue Right Joy-Con / あつまれどうぶつの森 || #96F5F5 || #0A1E28
|-
| Fortnite Wildcat Edition Yellow Left Joy-Con || #FFCC00 || #1A1100
|-
| Fortnite Wildcat Edition Dark-Blue Right Joy-Con || #0084FF || #000F1E
|-
| Mario Red & Blue Edition Red Joy-Con / マリオレッド × ブルー || #F04614 || #1E1914
|-
| Monster Hunter Rise Edition Gray Joy-Con / モンスターハンターライズ || #828282 || #0F0F0F
|-
| Fortnite Fleet Force Edition Dark-Blue Left Joy-Con || #0084FF || #000F1E
|-
| Fortnite Fleet Force Edition Yellow Right Joy-Con || #FFCC00 || #1A1100
|-
| Legend of Zelda: Skyward Sword Dark-Blue Left Joy-Con / ゼルダの伝説スカイウォードソード || #2D50F0 || #1E0F46
|-
| Legend of Zelda: Skyward Sword Dark-Purple Right Joy-Con / ゼルダの伝説スカイウォードソード || #500FC8 || #00051E
|-
| // *(Prize Awarded for Labo Contest - No Retail) // **(Available Japan Only)
|}

== Additional Links ==
[https://github.com/dekuNukem/Nintendo_Switch_Reverse_Engineering Reverse Engineering of the Joy-Con by Github user dekuNukem]

Product Information

2021-10-07T02:32:51Z

CapNem: /* Prefix */ Added the pro controller... since it wasn't here before...

This page details miscellaneous Switch product information (serial numbers, product models, etc...).

= Product List =
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HAC-001 || Retail Nintendo Switch console
|-
| HAC-002 || AC adapter
|-
| HAC-003 || Nintendo Switch Battery
|-
| HAC-004 ||
|-
| HAC-005 ||
|-
| HAC-006 || Joy-Con battery
|-
| HAC-007 || Dock
|-
| HAC-008 || Gamecard
|-
| HAC-009 || Gamecard case
|-
| HAC-010 || USB charging cable also included in ("Mario Kart Live: Home Circuit")
|-
| HAC-011 || Joy-Con grip
|-
| HAC-012 || Joy-Con charge grip
|-
| HAC-013 || Pro Controller
|-
| HAC-014 || Joy-Con strap
|-
| HAC-015 || Left Joy-Con
|-
| HAC-016 || Right Joy-Con
|-
| HAC-017 || Joy-Con handle
|-
| HAC-018 || Screen protector
|-
| HAC-019 || Left Joy-Con extended battery
|-
| HAC-020 || Right Joy-Con extended battery
|-
| HAC-021 || Carrying case
|-
| HAC-022 || Ring-Con
|-
| HAC-023 || Leg Strap
|-
| HAC-024 || Poké Ball Plus controller
|-
| HAC-025 ||
|-
| HAC-026 ||
|-
| HAC-027 ||
|-
| HAC-028 ||
|-
| HAC-029 || Steelbook Gamecard case
|-
| HAC-030 || Poké Ball Plus battery
|-
| HAC-031 || Charging stand
|-
| HAC-032 ||
|-
| HAC-033 || Left NES controller
|-
| HAC-034 || Right NES controller
|-
| HAC-035 || Left Famicom controller
|-
| HAC-036 || Right Famicom controller
|-
| HAC-037 || Kart ("Mario Kart Live: Home Circuit")
|-
| HAC-038 || Battery for kart ("Mario Kart Live: Home Circuit")
|-
| HAC-039 || Gates ("Mario Kart Live: Home Circuit")
|-
| HAC-040 || Touch Pen ("Super Mario Maker 2")
|-
| HAC-041 || Touch Pen ("Brain Training for Switch")
|-
| HAC-042 || SNES controller
|-
| HAC-043 || N64 controller
|-
| HAC-044 || Arrow Markers ("Mario Kart Live: Home Circuit")
|-
| HAC-045 || Sega Genesis controller
|-
| HAC-046 ||
|-
| HAC-047 || USB charging cable ("Mario Kart Live: Home Circuit") known as HAC-010 instead
|-
| HAC-048 ||
|-
| HAC-049 ||
|-
| HAC-050 ||
|-
| HAC-051 || Nintendo Labo Toy-Con 1: Variety Kit
|-
| HAC-052 || Nintendo Labo Toy-Con 2: Robot Kit
|-
| HAC-053 || Nintendo Labo Toy-Con 3: Vehicle Kit
|-
| HAC-054 || Nintendo Labo Toy-Con 4: VR Kit
|-
| HAC-055 || Nintendo Labo Storage Box
|}
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HAC-001(-01) || Retail Nintendo Switch Mariko console (also known as HAD[...])
|}
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HAT-001 || SDEV Nintendo Switch console
|-
| HAT-001(-01) || SDEV-D Nintendo Switch Mariko console
|-
| HAT-002 || EDEV Nintendo Switch console
|-
| HAT-002(-01) || EDEV-D Nintendo Switch Mariko console
|-
| HAT-003 || SDEV cradle
|-
| HAT-004 || Relay Box
|}
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HDH-001 || Retail Nintendo Switch Lite console
|-
| HDH-002 || HDEV Nintendo Switch console
|-
| HDH-003 || Battery
|-
| HDH-004 || Carrying case
|-
| HDH-005 || Screen protector
|-
| HDH-006 || Flip cover
|}
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HEG-001 || Retail Nintendo Switch (OLED Model) console
|-
| HEG-002 || ADEV Nintendo Switch console
|-
| HEG-004 || ADEV Relay Box
|-
| HEG-005 || Nintendo Switch (OLED Model) HDMI cable
|-
| HEG-007 || Nintendo Switch (OLED Model) dock
|-
| HEG-021 || Nintendo Switch (OLED Model) carrying case
|}

= Product Serial Numbers =
Serial numbers are composed of at least [[#Prefix|three letters]] followed by ten decimal digits. The tenth digit is a [[#Check_Digit|check digit]], meaning that it is derived from the other digits.

== Prefix ==
Observed prefixes are normally as follows:

* First letter represents the product line:
** "X" (NX)
* Second letter represents the product model:
** "A" (HAC-001; Nintendo Switch console)
** "B" (HAC-015; Left Joy-Con)
** "C" (HAC-016; Right Joy-Con)
** "E" (HAC-013; Pro Controller)
** "F" (HAC-007; Dock)
** "H" (HAC-024; Poké Ball Plus controller)
** "J" (HDH-001; Nintendo Switch Lite console)
** "K" (HAC-001-01; Nintendo Switch Mariko console)
** "L" (HAC-033; Left NES controller)
** "M" (HAC-034; Right NES controller)
** "Q" (HAC-037; Kart for "Mario Kart Live: Home Circuit")
** "R" (HAC-042; SNES controller)
** "T" (HEG-001; Nintendo Switch (OLED Model) console)
** "V" (HEG-007; Nintendo Switch (OLED Model) dock)
** "X" (HAC-045; Sega Genesis controller)
** "Z" (HAT-003; SDEV cradle)
* Third letter represents the product region:
** "C" (China)
** "E" (Europe)
** "J" (Japan; and Europe on old models)
** "K" (Korea)
** "L" (All; for development only)
** "W" (Americas)
* Fourth letter is optional:
** "F" (Factory)

== Assembly Line ==
The first two digits immediately after the [[#Prefix|prefix]] represent the assembly line as follows:

{| class="wikitable" border="1"
|-
! Value || Description
|-
| 00 || Unspecified
|-
| 01 || Prototype
|-
| 02 || SDEV
|-
| 03 || EDEV
|-
| 04 || DPRD
|-
| 05 || HDEV
|-
| 06 || SDEV-D
|-
| 07 || EDEV-D
|-
| 10 || Retail
|-
| 40 || Retail
|-
| 70 || Retail
|-
| 90 || Refurbished
|}

== Check Digit ==
The check digit is an industry-standard algorithm and is calculated just like it was on the [https://www.3dbrew.org/wiki/Serials#Console_Serial_Numbers 3DS].

To calculate the check digit of a Switch console, separate the non-check digits into "odd" and "even" groups, where the "odd" group is digits in odd-numbered positions, and the "even" group is digits in even-numbered positions. (The first digit is "odd", with "first" representing "1".)

After separating the digits, add the digits in each group together. Multiply the sum of the even digits by 3, then add the sum of the odd digits. To calculate the check digit, take this value modulo 10, and if not 0, subtract from 10.

Example: XAW10075273452

The non-check digits are 1007527345. Separating into odd and even groups, we get the following:

Odds: 1 + 0 + 5 + 7 + 4 = 17 Evens: 0 + 7 + 2 + 3 + 5 = 17

Applying the algorithm, we get ((3 * 17) + 17) % 10 = 8, which is not 0, thus 10 - 8 = 2, matching the example's check digit.

Product Information

2021-09-27T14:13:10Z

CapNem: /* Prefix */

This page details miscellaneous Switch product information (serial numbers, product models, etc...).

= Product List =
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HAC-001 || Retail Nintendo Switch console
|-
| HAC-002 || AC adapter
|-
| HAC-003 || Nintendo Switch Battery
|-
| HAC-004 ||
|-
| HAC-005 ||
|-
| HAC-006 || Joy-Con battery
|-
| HAC-007 || Dock
|-
| HAC-008 || Gamecard
|-
| HAC-009 || Gamecard case
|-
| HAC-010 || USB charging cable also included in ("Mario Kart Live: Home Circuit")
|-
| HAC-011 || Joy-Con grip
|-
| HAC-012 || Joy-Con charge grip
|-
| HAC-013 || Pro Controller
|-
| HAC-014 || Joy-Con strap
|-
| HAC-015 || Left Joy-Con
|-
| HAC-016 || Right Joy-Con
|-
| HAC-017 || Joy-Con handle
|-
| HAC-018 || Screen protector
|-
| HAC-019 || Left Joy-Con extended battery
|-
| HAC-020 || Right Joy-Con extended battery
|-
| HAC-021 || Carrying case
|-
| HAC-022 || Ring-Con
|-
| HAC-023 || Leg Strap
|-
| HAC-024 || Poké Ball Plus controller
|-
| HAC-025 ||
|-
| HAC-026 ||
|-
| HAC-027 ||
|-
| HAC-028 ||
|-
| HAC-029 || Steelbook Gamecard case
|-
| HAC-030 || Poké Ball Plus battery
|-
| HAC-031 || Charging stand
|-
| HAC-032 ||
|-
| HAC-033 || Left NES controller
|-
| HAC-034 || Right NES controller
|-
| HAC-035 || Left Famicom controller
|-
| HAC-036 || Right Famicom controller
|-
| HAC-037 || Kart ("Mario Kart Live: Home Circuit")
|-
| HAC-038 || Battery for kart ("Mario Kart Live: Home Circuit")
|-
| HAC-039 || Gates ("Mario Kart Live: Home Circuit")
|-
| HAC-040 || Touch Pen ("Super Mario Maker 2")
|-
| HAC-041 || Touch Pen ("Brain Training for Switch")
|-
| HAC-042 || SNES controller
|-
| HAC-043 || N64 controller
|-
| HAC-044 || Arrow Markers ("Mario Kart Live: Home Circuit")
|-
| HAC-045 ||
|-
| HAC-046 ||
|-
| HAC-047 || USB charging cable ("Mario Kart Live: Home Circuit") known as HAC-010 instead
|-
| HAC-048 ||
|-
| HAC-049 ||
|-
| HAC-050 ||
|-
| HAC-051 || Nintendo Labo Toy-Con 1: Variety Kit
|-
| HAC-052 || Nintendo Labo Toy-Con 2: Robot Kit
|-
| HAC-053 || Nintendo Labo Toy-Con 3: Vehicle Kit
|-
| HAC-054 || Nintendo Labo Toy-Con 4: VR Kit
|-
| HAC-055 || Nintendo Labo Storage Box
|}
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HAC-001(-01) || Retail Nintendo Switch Mariko console (also known as HAD[...])
|}
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HAT-001 || SDEV Nintendo Switch console
|-
| HAT-001(-01) || SDEV-D Nintendo Switch Mariko console
|-
| HAT-002 || EDEV Nintendo Switch console
|-
| HAT-002(-01) || EDEV-D Nintendo Switch Mariko console
|-
| HAT-003 || SDEV cradle
|-
| HAT-004 || Relay Box
|}
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HDH-001 || Retail Nintendo Switch Lite console
|-
| HDH-002 || HDEV Nintendo Switch console
|-
| HDH-003 || Battery
|-
| HDH-004 || Carrying case
|-
| HDH-005 || Screen protector
|-
| HDH-006 || Flip cover
|}
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HEG-001 || Retail Nintendo Switch (OLED Model) console
|-
| HEG-002 || ADEV Nintendo Switch console
|-
| HEG-004 || ADEV Relay Box
|-
| HEG-005 || Nintendo Switch (OLED Model) HDMI cable
|-
| HEG-007 || Nintendo Switch (OLED Model) dock
|-
| HEG-021 || Nintendo Switch (OLED Model) carrying case
|}

= Product Serial Numbers =
Serial numbers are composed of at least [[#Prefix|three letters]] followed by ten decimal digits. The tenth digit is a [[#Check_Digit|check digit]], meaning that it is derived from the other digits.

== Prefix ==
Observed prefixes are normally as follows:

* First letter represents the product line:
** "X" (NX)
* Second letter represents the product model:
** "A" (HAC-001; Nintendo Switch console)
** "B" (HAC-015; Left Joy-Con)
** "C" (HAC-016; Right Joy-Con)
** "F" (HAC-007; Dock)
** "H" (HAC-024; Poké Ball Plus controller)
** "J" (HDH-001; Nintendo Switch Lite console)
** "K" (HAC-001-01; Nintendo Switch Mariko console)
** "L" (HAC-033; Left NES controller)
** "M" (HAC-034; Right NES controller)
** "Q" (HAC-037; Kart for "Mario Kart Live: Home Circuit")
** "R" (HAC-042; SNES controller)
** "T" (HEG-001; Nintendo Switch (OLED Model) console)
** "V" (HEG-007; Nintendo Switch (OLED Model) Dock)
** "Z" (HAT-003; SDEV cradle)
* Third letter represents the product region:
** "C" (China)
** "E" (Europe)
** "J" (Japan; and Europe on old models)
** "K" (Korea)
** "L" (All; for development only)
** "W" (Americas)
* Fourth letter is optional:
** "F" (Factory)

== Assembly Line ==
The first two digits immediately after the [[#Prefix|prefix]] represent the assembly line as follows:

{| class="wikitable" border="1"
|-
! Value || Description
|-
| 00 || Unspecified
|-
| 01 || Prototype
|-
| 02 || SDEV
|-
| 03 || EDEV
|-
| 04 || DPRD
|-
| 05 || HDEV
|-
| 06 || SDEV-D
|-
| 07 || EDEV-D
|-
| 10 || Retail
|-
| 40 || Retail
|-
| 70 || Retail
|-
| 90 || Refurbished
|}

== Check Digit ==
The check digit is an industry-standard algorithm and is calculated just like it was on the [https://www.3dbrew.org/wiki/Serials#Console_Serial_Numbers 3DS].

To calculate the check digit of a Switch console, separate the non-check digits into "odd" and "even" groups, where the "odd" group is digits in odd-numbered positions, and the "even" group is digits in even-numbered positions. (The first digit is "odd", with "first" representing "1".)

After separating the digits, add the digits in each group together. Multiply the sum of the even digits by 3, then add the sum of the odd digits. To calculate the check digit, take this value modulo 10, and if not 0, subtract from 10.

Example: XAW10075273452

The non-check digits are 1007527345. Separating into odd and even groups, we get the following:

Odds: 1 + 0 + 5 + 7 + 4 = 17 Evens: 0 + 7 + 2 + 3 + 5 = 17

Applying the algorithm, we get ((3 * 17) + 17) % 10 = 8, which is not 0, thus 10 - 8 = 2, matching the example's check digit.