Nintendo Switch Brew - User contributions [en]

Hardware

2021-10-14T23:48:58Z

Sephirothkefka:

= Motherboard =
== Nintendo Switch ==
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| ODIN-CPU-X5 || Pre-release Nintendo Switch.
|-
| HAC-CPU-01 || Retail Nintendo Switch (earliest manufacture date seen: 01/12 2016).
|-
| HAC-CPU-10 || Retail Nintendo Switch.
|-
| HAC-CPU-20 || Retail Nintendo Switch (earliest manufacture date seen: 26/10 2017).
|}

== Nintendo Switch Mariko ==
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| MODIN-CPU-X5 || Pre-release Nintendo Switch Mariko.
|-
| HAD-CPU-01 || Retail Nintendo Switch Mariko.
|}

== Nintendo Switch Lite ==
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| VALI-CPU-X5 || Pre-release Nintendo Switch Lite.
|-
| HDH-CPU-02 || Retail Nintendo Switch Lite.
|}

== Nintendo Switch (OLED Model) ==
{| class="wikitable" border="1"
|-
! Product Code || Description
|-
| HEG-CPU-01 || Retail Nintendo Switch (OLED Model).
|}

= Specifications =
== Nintendo Switch ==
{| class="wikitable" border="1"
|-
! Component || Description
|-
| SoC || NVIDIA ODNX02-A2
|-
| Screen || InnoLux P062CCA-AZ1
|-
| Storage || Samsung KLMBG2JENB-B041 32 GB eMMC <br/> or <br/> Toshiba THGBMHG8C2LBAIL 32 GB eMMC
|-
| Memory || Samsung K4F6E304HB-MGCH 2 GB LPDDR4 DRAM x2 (Total 4GB)
|-
| Wifi/BT || Broadcom BCM4356XKUBG
|-
| PMIC || Maxim Integrated MAX77620AEWJ+T
|-
| Audio || Realtek ALC5639
|-
| GC ASIC || B1633 GCBRG HAC STD T1001216
|}

== Nintendo Switch Mariko ==
{| class="wikitable" border="1"
|-
! Component || Description
|-
| SoC || NVIDIA ODNX10-A1
|-
| Screen || InnoLux P062CCA-AZ2
|-
| Storage || SK Hynix H26M62002JPR 32 GB eMMC
|-
| Memory || Samsung K4U6E3S4AM-MGCJ 2 GB LPDDR4x DRAM x2 (Total 4GB)
|-
| Wifi/BT || Broadcom BCM4356XKUBG
|-
| PMIC || Maxim Integrated MAX77812
|-
| Audio || Realtek ALC5639
|-
| GC ASIC || B1834 GCBRG HAC STD T1439218
|}

== Nintendo Switch Lite ==
{| class="wikitable" border="1"
|-
! Component || Description
|-
| SoC || NVIDIA ODNX10-A1
|-
| Screen || InnoLux ZJ055IA-27A
|-
| Storage || Samsung KLMBG2JETD-B041 32 GB eMMC
|-
| Memory || Samsung K4U6E3S4AM-MGCJ 2 GB LPDDR4x DRAM x2 (Total 4GB)
|-
| Wifi/BT || Broadcom BCM4356XKUBG
|-
| PMIC || Maxim Integrated MAX77812
|-
| Audio || Realtek ALC5639
|-
| GC ASIC || B1921 GCBRG HAC STD T1122919A2
|-
| MCU || STMicroelectronics STM32F038C6
|-
| NFC || STMicroelectronics NFCDDR A92089 19
|}

== Nintendo Switch (OLED Model) ==
{| class="wikitable" border="1"
|-
! Component || Description
|-
| SoC || NVIDIA ODNX10-A1
|-
| Screen || Samsung AMS699VC01
|-
| Storage || Samsung KLMCG4JETD-B041 64 GB eMMC
|-
| Memory || Samsung K4U6E3S4AA-MGCL 2 GB LPDDR4x DRAM x2 (Total 4GB)
|-
| Wifi/BT || Broadcom BCM4356XKUBG
|-
| PMIC || Maxim Integrated MAX77812
|-
| Audio || Realtek ALC5639
|-
| GC ASIC ||
|}

= eMMC Pinout =
{{:EMMC_pinout}}

= Notes =
1. https://www.sosav.fr/guides/consoles/nintendo/nintendo-salon/nintendo-switch/demontage-complet/ </br>
2. https://www.ifixit.com/Teardown/Nintendo+Switch+Teardown/78263

Gamecard

2019-06-01T05:13:38Z

Sephirothkefka:

This page documents the Nintendo Switch Gamecard.

{| style="float:right; margin-left: 0px;"
|-
| [[File:ZeldaFront.jpg|200px|thumb|right|A Switch game cartridge, frontside]]
| [[File:ZeldaBack.jpg|200px|thumb|right|A Switch game cartridge, backside]]
|-
| [[File:CartridgeFront.jpeg|200px|thumb|right|Close-up of frontside PCB]]
|rowspan="2"|[[File:CartridgeBack.jpeg|200px|thumb|right|Close-up of backside PCB]]
|-
|[[File:CartridgeFrontBare.jpeg|200px|thumb|right|Close-up of stripped frontside PCB]]
|}

For the Gamecard partitions that can be [[Filesystem_services|mounted]], see [[Gamecard_Partition|here]].

For the Gamecard image format, see [[Gamecard_Format|here]].

For the Gamecard ASIC, see [[Gamecard_ASIC|here]].

= Pinout =
[[File:Gamecard-pinout.png|400px]]

{| class="wikitable"
! Pin
! Name
! Direction
! Description
|-
| 0
| IRQ?
| Output
| Always wired to GND inside game cartridge; Possibly used for interrupt signaling
|-
| 1
| RCLK
| Output
| Return clock; Game cartridge sends back CLK signal delayed by a few ns
|-
| 2
| CLK
| Input
| Clock, 25MHz
|-
| 3
| CS
| Input
| Chip select; Switch pulls this LOW during a transfer
|-
| 4
| DAT0
| Inout
| Data bus pin 0
|-
| 5
| DAT1
| Inout
| Data bus pin 1
|-
| 6
| VCC 3.3v
| Input
|
|-
| 7
| DAT2
| Inout
| Data bus pin 2
|-
| 8
| DAT3
| Inout
| Data bus pin 3
|-
| 9
| VCC 1.8v
| Input
|
|-
| 10
| DAT4
| Inout
| Data bus pin 4
|-
| 11
| DAT5
| Inout
| Data bus pin 5
|-
| 12
| DAT6
| Inout
| Data bus pin 6
|-
| 13
| DAT7
| Inout
| Data bus pin 7
|-
| 14
| GND
|
|
|-
| 15
| RST
| Input
| Reset, active LOW.
|-
|}

All IO use 1.8V for logic HIGH and 0V for logic LOW.

= Protocol =
Switch game cartridges use a simple (but Nintendo proprietery) SPI-like bus with 8-bit width (DAT7..0). It is very similar to the bus interface of 3DS game cartridges, except with very different commands.

The Switch host starts a transfer by first pulling CS low, followed by clocking a byte each clock cycle. The bus data will always be ready before the rising edge of the CLK signal, so that it can be captured on the rising edge.
After command bytes are written to the bus, the direction of the bus implicitly changes and the game cartridge responds. The Switch host keeps clocking while the game cartridge responds.
After the transfer is ended, the CS line is pulled high again.

Commands are 16 bytes long, and followed immediately by a 4-byte CRC-32 over the command bytes. After this, the Switch stops driving the data bus, and the bus will be 'floating'. Due to the pull-ups on the bus, it will slowly converge to logic HIGH state. The Switch will clock 2 cycles to allow the bus to settle a direction change. The Switch host will then clock another cycle and if the game cartridge didn't receive the CRC OK, it will respond with "01". Otherwise it will respond with "00" and pull DAT0 low on the next cycle to signal it is busy. The Switch host will then keep clocking until the cartridge is ready.

When the game cartridge is ready to send the actual data response, it will pull the DAT0 pin high for 2 cycles to let the Switch host know. After this, the game cartridge will send the actual data response bytes.

The actual response bytes are also followed immediately by a 4-byte CRC-32 over the actual data response bytes.

A typical boot up sequence of a game cartridge (in this case, the game "1,2 Switch") looks like this:

{| class="wikitable"
! Command
! Size
! Description
|-
| <code>5B000000000000010000000000000000</code>
| 0x200
| Read sector 0, contains "HEAD" blob
|-
| <code>5B000000000000010000000000000000</code>
| 0x200
| Read sector 0, contains "HEAD" blob
|-
| <code>56000000000000000000000000000000</code>
| 0x4
| Read card id "AE F8 01 21"
|-
| <code>28000000000000000000000000000000</code>
| 0x4
| Read ??? "02 00 00 00"
|-
| <code>A5000000000000000000000000000000</code>
| 0x4
| Read ??? "00 00 00 00"
|-
| <code>56000000000000000000000000000000</code>
| 0x4
| Read card id "AE F8 01 21"
|-
| <code>28000000000000000000000000000000</code>
| 0x4
| Read ??? "02 00 00 00"
|-
| <code>5B000000380000010000000000000000</code>
| 0x200
| Read sector 0x38, contains "CERT" blob
|-
| <code>E2000000000000000000000000000000</code>
| 0x4
| Read ??? "01 00 00 00"
|-
| <code>E0000000000000000000000000000000</code>
| 0x200
| Read crypto-challenge header
|-
| <code>200838A25A344F818ABB6456694D4E8D</code>
| 0
| Enter crypto mode1 with HOST-RANDOM "0838A25A344F818ABB6456694D4E8D"
|-
| <code>7EE41FDF12C01C157CC899910673A0CF</code>
| 0x40
| Encrypted crypto mode1 command, reads CART-RANDOM
|-
| <code>263C8230EC15FAE3CE79365BD850F4BD</code>
| 0x0
| Encrypted mode1 command, enters crypto mode2 with (HOST-RANDOM, CART-RANDOM)
|-
| <code>B6FDA6F37FFA29E18831D0B217DFBDBE</code>
| 0x4
| Encrypted mode2 command, possibly read card id?
|-
| <code>7B97F7DF07240AA9870E1C974336FA8A</code>
| 0x4
| Encrypted mode2 command
|-
|}

= Manufacturers =
;Macronix (MX)
: Uses package: LGA, TSOP-48
: Uses card id: 0xC2
;Renesas
: Uses package: LGA, TSOP-48
: Uses card id: 0x23
;SanDisk?
: Uses package: ??
: Uses card id: 0x45 ?

Gamecard

2019-06-01T00:17:18Z

Sephirothkefka: Edited manufacturers tab; replaced OKI with Renesas; adjusted package types

This page documents the Nintendo Switch Gamecard.

{| style="float:right; margin-left: 0px;"
|-
| [[File:ZeldaFront.jpg|200px|thumb|right|A Switch game cartridge, frontside]]
| [[File:ZeldaBack.jpg|200px|thumb|right|A Switch game cartridge, backside]]
|-
| [[File:CartridgeFront.jpeg|200px|thumb|right|Close-up of frontside PCB]]
|rowspan="2"|[[File:CartridgeBack.jpeg|200px|thumb|right|Close-up of backside PCB]]
|-
|[[File:CartridgeFrontBare.jpeg|200px|thumb|right|Close-up of stripped frontside PCB]]
|}

For the Gamecard partitions that can be [[Filesystem_services|mounted]], see [[Gamecard_Partition|here]].

For the Gamecard image format, see [[Gamecard_Format|here]].

For the Gamecard ASIC, see [[Gamecard_ASIC|here]].

= Pinout =
[[File:Gamecard-pinout.png|400px]]

{| class="wikitable"
! Pin
! Name
! Direction
! Description
|-
| 0
| IRQ?
| Output
| Always wired to GND inside game cartridge; Possibly used for interrupt signaling
|-
| 1
| RCLK
| Output
| Return clock; Game cartridge sends back CLK signal delayed by a few ns
|-
| 2
| CLK
| Input
| Clock, 25MHz
|-
| 3
| CS
| Input
| Chip select; Switch pulls this LOW during a transfer
|-
| 4
| DAT0
| Inout
| Data bus pin 0
|-
| 5
| DAT1
| Inout
| Data bus pin 1
|-
| 6
| VCC 3.3v
| Input
|
|-
| 7
| DAT2
| Inout
| Data bus pin 2
|-
| 8
| DAT3
| Inout
| Data bus pin 3
|-
| 9
| VCC 1.8v
| Input
|
|-
| 10
| DAT4
| Inout
| Data bus pin 4
|-
| 11
| DAT5
| Inout
| Data bus pin 5
|-
| 12
| DAT6
| Inout
| Data bus pin 6
|-
| 13
| DAT7
| Inout
| Data bus pin 7
|-
| 14
| GND
|
|
|-
| 15
| RST
| Input
| Reset, active LOW.
|-
|}

All IO use 1.8V for logic HIGH and 0V for logic LOW.

= Protocol =
Switch game cartridges use a simple (but Nintendo proprietery) SPI-like bus with 8-bit width (DAT7..0). It is very similar to the bus interface of 3DS game cartridges, except with very different commands.

The Switch host starts a transfer by first pulling CS low, followed by clocking a byte each clock cycle. The bus data will always be ready before the rising edge of the CLK signal, so that it can be captured on the rising edge.
After command bytes are written to the bus, the direction of the bus implicitly changes and the game cartridge responds. The Switch host keeps clocking while the game cartridge responds.
After the transfer is ended, the CS line is pulled high again.

Commands are 16 bytes long, and followed immediately by a 4-byte CRC-32 over the command bytes. After this, the Switch stops driving the data bus, and the bus will be 'floating'. Due to the pull-ups on the bus, it will slowly converge to logic HIGH state. The Switch will clock 2 cycles to allow the bus to settle a direction change. The Switch host will then clock another cycle and if the game cartridge didn't receive the CRC OK, it will respond with "01". Otherwise it will respond with "00" and pull DAT0 low on the next cycle to signal it is busy. The Switch host will then keep clocking until the cartridge is ready.

When the game cartridge is ready to send the actual data response, it will pull the DAT0 pin high for 2 cycles to let the Switch host know. After this, the game cartridge will send the actual data response bytes.

The actual response bytes are also followed immediately by a 4-byte CRC-32 over the actual data response bytes.

A typical boot up sequence of a game cartridge (in this case, the game "1,2 Switch") looks like this:

{| class="wikitable"
! Command
! Size
! Description
|-
| <code>5B000000000000010000000000000000</code>
| 0x200
| Read sector 0, contains "HEAD" blob
|-
| <code>5B000000000000010000000000000000</code>
| 0x200
| Read sector 0, contains "HEAD" blob
|-
| <code>56000000000000000000000000000000</code>
| 0x4
| Read card id "AE F8 01 21"
|-
| <code>28000000000000000000000000000000</code>
| 0x4
| Read ??? "02 00 00 00"
|-
| <code>A5000000000000000000000000000000</code>
| 0x4
| Read ??? "00 00 00 00"
|-
| <code>56000000000000000000000000000000</code>
| 0x4
| Read card id "AE F8 01 21"
|-
| <code>28000000000000000000000000000000</code>
| 0x4
| Read ??? "02 00 00 00"
|-
| <code>5B000000380000010000000000000000</code>
| 0x200
| Read sector 0x38, contains "CERT" blob
|-
| <code>E2000000000000000000000000000000</code>
| 0x4
| Read ??? "01 00 00 00"
|-
| <code>E0000000000000000000000000000000</code>
| 0x200
| Read crypto-challenge header
|-
| <code>200838A25A344F818ABB6456694D4E8D</code>
| 0
| Enter crypto mode1 with HOST-RANDOM "0838A25A344F818ABB6456694D4E8D"
|-
| <code>7EE41FDF12C01C157CC899910673A0CF</code>
| 0x40
| Encrypted crypto mode1 command, reads CART-RANDOM
|-
| <code>263C8230EC15FAE3CE79365BD850F4BD</code>
| 0x0
| Encrypted mode1 command, enters crypto mode2 with (HOST-RANDOM, CART-RANDOM)
|-
| <code>B6FDA6F37FFA29E18831D0B217DFBDBE</code>
| 0x4
| Encrypted mode2 command, possibly read card id?
|-
| <code>7B97F7DF07240AA9870E1C974336FA8A</code>
| 0x4
| Encrypted mode2 command
|-
|}

= Manufacturers =
;Macronix (MX)
: Uses package: LGA, TSOP-48
: Uses card id: 0xC2
;Renesas
: Uses package: LGA, TSOP-48
: Uses card id: 0xAE
;SanDisk?
: Uses package: ??
: Uses card id: 0x45 ?