ReSwitched Wiki

Documenting the Nintendo Switch hardware, software, and development.

User Tools

Site Tools

You are here: start » hardware » flash
hardware:flash

Table of Contents

Flash Memory

The Nintendo Switch consumer model comes with 32GB of built-in eMMC flash memory 1) located on a removeable PCB.

Flash memory board

The Nintendo Switch's entire flash memory is contained on a daughterboard, labeled HAC-EMMC-01, featuring the one eMMC chip on side B (facing up from the motherboard), along with some traces and vias; and some passive components and more traces and vias on side A, with the board-to-board interconnect as the main feature here.

Connector

We are fairly certain that the following connector is used on the Switch main board and will mate to the flash PCB: Molex 500913-0302 0.40mm Pitch SlimStack™ Board-to-Board Receptacle, Surface Mount, Dual Row, Vertical Stacking, Mated Height of 1.80mm,…

Pinout

Pin #Name Type Comment
13V3 PWR measured
2GND PWR Visible
3CMD BI From maximus64 pinout
4GND PWR Visible
5DAT_STRB OUT Possibly the data strobe line, guess by stuckpixel
6GND PWR Visible
7DAT4 BI Proven with USB/eMMC board
8GND PWR Visible
9DAT5 BI Proven with USB/eMMC board
10GND PWR Visible
11DAT6 BI Proven with USB/eMMC board
12GND PWR Visible
13DAT7 BI Proven with USB/eMMC board
14GND PWR Visible
151V8 PWR Measured
161V8 PWR Measured
17GND PWR Measured
18GND PWR Measured
19DAT2 BI Proven with USB/eMMC board
20GND PWR Measured
21DAT1 BI Proven with USB/eMMC board
22GND PWR Measured
23DAT0 BI From maximus64 pinout
24GND PWR Measured
25DAT3 BI Proven with USB/eMMC board
26GND PWR Measured
27CLK IN From maximus64 pinout
28GND PWR Measured
29Seems NC guesswork by q3k
303V3 PWR Measured
MNTGND MECH “All 4 corner pads/mounting pads, visible”

eMMC chip

The flash chip used seems to be one of the following:

The flash chips are compliant with the open standard JEDEC/MMCA Version 5.0/5.1 4)

Flash Dump

It looks like Twitter user maximus64 dumped the flash memory using an eMMC to SD interface board (1 wire mode) by Exploitee.rs (current version, alpha)

3v3 capabilities

The Switch drives the eMMC VCCQ (I/O bank) at 1.8v. This is a fairly uncommon voltage for hobbyists electronics, so not having to deal with voltage converters and being able to drive the eMMC at 3.3v is generally useful.

Yuri_10m confirmed that both Toshiba and Samsung eMMCs can be run at 3v3 VCCQ.

Timing & Data Width

Looks like the Switch is driving CLK at 200 MHz DDR (HS400):

CLK and DAT0 trace - channel 1 is DAT0, channel 2 is CLK

It is yet unknown if the Switch uses 8-bit or 4-bit mode during normal operation.

eMMC Areas

The Switch eMMC is divided into physical eMMC areas, and a Replay-Protected Memory Block (RPMB), as per JEDEC JESD84-B51 (login/registration required), which can contain partitions or boot information.

Areas

Name Info Size Comment
User Data Area Default 29.12 GiB Accessible with a standard MMC reader; contains GPT and all the GPT partitions.
Boot Area Partition 1 Hidden 4.00 MiB Contains BCT + two identical ARM7 bootloaders
Boot Area Partition 2 Hidden 4.00 MiB Contains two identical ARM7 bootloaders (different from Boot Area Partition 1)
RPMB Area Hidden, Locked, Auth Req'd 4.00 MiB Replay Protected Memory Block; Contents unknown.

The General Purpose Area Partitions 0 to 3 are not used on the Switch.

User Area and GPT Partitions

The user area contains the entire GPT volume, with the following GPT partitions 5):

# Name Type Size Comment
1PRODINFO 3.98 MiB
2PRODINFOF 4.00 MiB
3BCPKG2-1-Normal-Main 8.00 MiB
4BCPKG2-2-Normal-Sub 8.00 MiB
5BCPKG2-3-SafeMode-Main 8.00 MiB
6BCPKG2-4-SafeMode-Sub 8.00 MiB
7BCPKG2-5-Repair-Main 8.00 MiB
8BCPKG2-6-Repair-Sub 8.00 MiB
9SAFE 64.00 MiB
10SYSTEM 2.50GiB
11USER 26.00GiB
EndUnallocated Space Empty516.00 MiB

Reading boot area partitions

To read the boot area partitions, you will need a way to send raw MMC commands to the eMMC. Some MMC readers might have Linux drivers that support this, your mileage may very.

The approach used here was a FPGA with softprocessor (or any microcontroller) to control the eMMC signals: CLK, CMD, DAT0.

The following sequence of MMC commands need to be sent:

CommandArgumentComment
1.CMD0 00000000reset
2.CMD1 40FF8080send operating conditions, repeated until success
3.CMD3 00010000set rca
4.CMD9 00010000send csd
5.CMD7 00010000select card
6.CMD13 00010000send status
7.CMD16 00000200set block length
Then, either of
8.CMD6 03B30100switch enable read boot1 partition
CMD6 03B30200switch enable read boot2 partition
CMD6 03B30000switch enable read user partition
Followed by
9.CMD17 sector read sector, repeated for each sector to be read

Registers

Register contents were recorded using a Samsung eMMC and the ReSwitched µLyNX USB/eMMC interface board. The selected modes and configureable field contents are listed for completeness and do not currently indicate the configurations actually used by the Nintendo Switch

CID Register

Device IDentification register from a Samsung eMMC

FieldName Width CID-Slice Data (bin) Data (hex) Meaning
MIDManufacturer ID 8 [127:120] 00010101 0x15
Reserved 6 [119:114] 000000 0x00
CBXDevice/BGA 2 [113:112] 01 0x1 BGA (Discrete embedded)
OIDOEM/Application ID 8 [111:104] 00000000 0x00
PNMProduct name 48 [103:56] 42 4a 4e 42 34 52 ASCII BJNB4R
PRVProduct revision 8 [55:48] 00001011 0x0B 0.11 (BCD)
PSNProduct serial number 32 [47:16] Unique 32-bit unsigned Integer
MDTManufacturing date 8 [15:8] 10000011 0x83 August 2016
CRCCRC7 checksum 7 [7:1]
-not used, always “1” 1 [0:0] 0 0x0?

CSD Register

Device-Specific Data register from a Samsung eMMC (Raw: D0 27 01 32 0F 59 03 FF F6 DB FF EF 8E 40 40 00)

NameFieldWidthTypeCSD-sliceData (bin)Data (hex)Meaning
CSD structureCSD_STRUCTURE2R[127:126]110x3Version coded in EXT_CSD
System specification versionSPEC_VERS4R[125:122]01000x4Version 4.1 4.2 4.3 4.4 4.41 4.5 4.51 5.0 5.01 5.1
Reserved-2R[121:120]000x0
Data read access-time 1TAAC8R[119:112]001001110x27Time Unit = 10ms, Mult. = 1.5 (?)
Data read access-time 2NSAC8R[111:104]000000010x01100 clock cycles
Max. bus clock frequencyTRAN_SPEED8R[103:96]001100100x32Freq. Unit = 10MHz, Mult. = 2.6
Device command classesCCC12R[95:84]0000111101010xF5Supports command class 0, 2, 4-7
Max. read data block lengthREAD_BL_LEN4R[83:80]10010x9512 Bytes
Partial blocks for read allowedREAD_BL_PARTIAL1R[79:79]00x0Only allows 512B for block data transfers
Write block misalignmentWRITE_BLK_MISALIGN1R[78:78]00x0Data block must align with physical block
Read block misalignmentREAD_BLK_MISALIGN1R[77:77]00x0Data block must align with physical block
DSR implementedDSR_IMP1R[76:76]00x0Driver stage register is not implemented
Reserved-2R[75:74]000x0
Device sizeC_SIZE12R[73:62]1111111111110xFFFDensity >2GB
Max. read current @ VDD minVDD_R_CURR_MIN3R[61:59]1100x660mA
Max. read current @ VDD maxVDD_R_CURR_MAX3R[58:56]1100x660mA
Max. write current @ VDD minVDD_W_CURR_MIN3R[55:53]1100x680mA
Max. write current @ VDD maxVDD_W_CURR_MAX3R[52:50]1100x680mA
Device size multiplierC_SIZE_MULT3R[49:47]1110x7512 (Density >2GB)
Erase group sizeERASE_GRP_SIZE5R[46:42]111110x1F32 Blocks
Erase group size multiplierERASE_GRP_MULT5R[41:37]111110x1F32 (=1024 blocks)
Write protect group sizeWP_GRP_SIZE5R[36:32]011110x0F16 erase groups
Write protect group enableWP_GRP_ENABLE1R[31:31]10x1Group write protection possible
Manufacturer default ECCDEFAULT_ECC2R[30:29]000x0No ECC
Write speed factorR2W_FACTOR3R[28:26]0110x38x read acces time
Max. write data block lengthWRITE_BL_LEN4R[25:22]10010x9512 Bytes
Partial blocks for write allowedWRITE_BL_PARTIAL1R[21:21]00x0Only allows 512B for block data transfers
Reserved-4R[20:17]
Content protection applicationCONTENT_PROT_APP1R[16:16]00x0content protection application not supported
File format groupFILE_FORMAT_GRP1R/W[15:15]00x0
Copy flag (OTP)COPY1R/W[14:14]10x0Copy
Permanent write protectionPERM_WRITE_PROTECT1R/W[13:13]00x0Not protected
Temporary write protectionTMP_WRITE_PROTECT1R/W/E[12:12]00x0Not protected
File formatFILE_FORMAT2R/W[11:10]000x0Hard disk-like file system with partition table
ECC codeECC2R/W/E[9:8]000x0No ECC
CRCCRC7R/W/E[7:1]00x0?
Not used, always’1’-1—[0:0]00x0?

Extended CSD Register

Device properties and selected modes from a Samsung eMMC

NameFieldSize (Bytes)TypeCSD sliceData (hex)Meaning
Properties Segment
Reserved 6TBD[511:506]6 x 0x00
Extended Security Commands ErrorEXT_SECURITY_ERR1R[505]0x00No Error
Supported Command SetsS_CMD_SET1R[504]0x01Standard MMC
HPI featuresHPI_FEATURES1R[503]0x01HPI mechanism implementation based on CMD13
Background operations supportBKOPS_SUPPORT1R[502]0x01Background operations are supported
Max packed read commandsMAX_PACKED_READS1R[501]0x3FMax. 63 Commands
Max packed write commandsMAX_PACKED_WRITES1R[500]0x3FMax. 63 Commands
Data Tag SupportDATA_TAG_SUPPORT1R[499]0x01System Data Tag mechanism supported
Tag Unit SizeTAG_UNIT_SIZE1R[498]0x024 x Sector Size
Tag Resources SizeTAG_RES_SIZE1R[497]0x00 0 (See 7.4.9 in JESD84-B51)
Context management capabilitiesCONTEXT_CAPABILITIES1R[496]0x05Large unit multiplier = 1; MAX_CONTEXT_ID = 5
Large Unit sizeLARGE_UNIT_SIZE_M11R[495]0x07Large Unit size = 8MB
Extended partitions attribute supportEXT_SUPPORT1R[494]0x3Supported partition attributes: Non-persistent, System code
Supported modesSUPPORTED_MODES1R[493]0x01FFU is supported, Vendor Specific Mode is not supported
FFU featuresFFU_FEATURES1R[492]0x00Device does not support MODE_OPERATION_CODES field
Operation codes timeoutOPERATION_CODE_TIMEOUT1R[491]0x00Not defined
FFU ArgumentFFU_ARG4R[490:487]0xC7 0x81 0x00 0x00
Barrier supportBARRIER_SUPPORT1R[486]0x00Barrier command not supported
Reserved 177TBD[485:309]all 0x00
CMD Queuing SupportCMDQ_SUPPORT1R[308]0x01Command queuing is supported
CMD Queuing DepthCMDQ_DEPTH1R[307]0x0FQueue Depth = 16
Reserved 1TBD[306]0x00
Number of FW sectors correctly programmedNUMBER_OF_FW_SECTORS_ CORRECTLY_PROGRAMMED4R[305:302]all 0x00?
Vendor proprietary health reportVENDOR_PROPRIETARY_ HEALTH_REPORT32R[301:270]all 0x00
Device life time estimation type BDEVICE_LIFE_TIME_EST_TYP_B1R[269]0x010-10% device life time used
Device life time estimation type ADEVICE_LIFE_TIME_EST_TYP_A1R[268]0x010-10% device life time used
Pre EOL informationPRE_EOL_INFO1R[267]0x01Normal
Optimal read sizeOPTIMAL_READ_SIZE1R[266]0x00Not defined
Optimal write sizeOPTIMAL_WRITE_SIZE1R[265]0x1064KB
Optimal trim unit sizeOPTIMAL_TRIM_UNIT_SIZE1R[264]0x014KB
Device versionDEVICE_VERSION2R[263:262]0x00 0x00?
Firmware versionFIRMWARE_VERSION8R[261:254][261:255] = 0x00, [254] = 0x0BVersion 11 or 0.11
Power class for 200MHz, DDR at VCC= 3.6VPWR_CL_DDR_200_3601R[253]0x00?
Cache sizeCACHE_SIZE4R[252:249]0x00 0x01 0x00 0x00Cache size = 262144kb
Generic CMD6 timeoutGENERIC_CMD6_TIME1R[248]0x0A100ms
Power off notification(long) timeoutPOWER_OFF_LONG_TIME1R[247]0x3C600ms
Background operations statusBKOPS_STATUS1R[246]0x00No operations required
Number of correctly programmed sectorsCORRECTLY_PRG_ SECTORS_NUM4R[245:242]all 0x00?
1st initialization time after partitioningINI_TIMEOUT_AP1R[241]0x1E3s
Cache Flushing PolicyCACHE_FLUSH_POLICY1R[240]0x00Cache flushing policy is not provided by the device
Power class for 52MHz, DDR at VCC = 3.6VPWR_CL_DDR_52_3601R[239]0x00
Power class for 52MHz, DDR at VCC = 1.95VPWR_CL_DDR_52_1951R[238]0x00
Power class for 200MHz at VCCQ = 1.95V, VCC = 3.6VPWR_CL_200_1951R[237]0x00
Power class for 200MHz, at VCCQ = 1.3V, VCC = 3.6VPWR_CL_200_1301R[236]0x00
Minimum Write Performance for 8bit at 52MHz in DDR modeMIN_PERF_DDR_W_8_521R[235]0x00For Devices not reaching the 4.8MB/s value (?)
Minimum Read Performance for 8bit at 52MHz in DDR modeMIN_PERF_DDR_R_8_521R[234]0x00For Devices not reaching the 4.8MB/s value (?)
Reserved 1TBD[233]0x00
TRIM MultiplierTRIM_MULT1R[232]0x02600ms
Secure Feature supportSEC_FEATURE_SUPPORT1R[231]0x55Supported: Sanitize, Secure trim, automatic erase on retired blocks, secure purge
Secure Erase MultiplierSEC_ERASE_MULT1R[230]0x1BSecure Erase Timeout = 300ms × ERASE_TIMEOUT_MULT * 27
Secure TRIM MultiplierSEC_TRIM_MULT1R[229]0x11Secure Trim Timeout = 300ms × ERASE_TIMEOUT_MULT x 17
Boot informationBOOT_INFO1R[228]0x07Supported: high speed timing & dual data rate during boot, alternative boot method
Reserved 1TBD[227]0x00
Boot partition sizeBOOT_SIZE_MULT1R[226]0x204096 Kbytes
Access sizeACC_SIZE1R[225]0x0732 Kbytes
High-capacity erase unit sizeHC_ERASE_GRP_SIZE1R[224]0x01512 Kbyte
High-capacity erase timeoutERASE_TIMEOUT_MULT1R[223]0x01300ms
Reliable write sector countREL_WR_SEC_C1R[222]0x01
High-capacity write protect group sizeHC_WP_GRP_SIZE1R[221]0x10 10, Write protect group size = 512KB * HC_ERASE_GRP_SIZE * HC_WP_GRP_SIZE
Sleep current (VCC)S_C_VCC1R[220]0x07
Sleep current (VCCQ)S_C_VCCQ1R[219]0x07128µA
Production state awareness timeoutPRODUCTION_STATE_ AWARENESS_TIMEOUT1R[218]0x00Not defined
Sleep/awake timeoutS_A_TIMEOUT1R[217]0x1113.1072ms
Sleep Notification Timout1SLEEP_NOTIFICATION_TIME1R[216]0x071.280ms
Sector CountSEC_COUNT4R[215:212] 61071360 Sectors = 31268536320 Byte = 32GB
Secure Write Protect InformationSECURE_WP_INFO1R[211]0x01Legacy Write Protection Mode, Secure Write Protection is supported
Minimum Write Performance for 8bit at 52 MHzMIN_PERF_W_8_521R[210]0x00For Devices not reaching the 2.4MB/s value (?)
Minimum Read Performance for 8bit at 52 MHzMIN_PERF_R_8_521R[209]0x00For Devices not reaching the 2.4MB/s value (?)
Minimum Write Performance for 8bit at 26 MHz, for 4bit at 52MHzMIN_PERF_W_8_26_4_521R[208]0x00For Devices not reaching the 2.4MB/s value (?)
Minimum Read Performance for 8bit at 26 MHz, for 4bit at 52MHzMIN_PERF_R_8_26_4_521R[207]0x00For Devices not reaching the 2.4MB/s value (?)
Minimum Write Performance for 4bit at 26 MHzMIN_PERF_W_4_261R[206]0x00For Devices not reaching the 2.4MB/s value (?)
Minimum Read Performance for 4bit at 26 MHzMIN_PERF_R_4_261R[205]0x00For Devices not reaching the 2.4MB/s value (?)
Reserved 1TBD[204]0x00
Power class for 26 MHz at 3.6 V 1 RPWR_CL_26_3601R[203]0x00100mA RMS, 200mA pk
Power class for 52 MHz at 3.6 V 1 RPWR_CL_52_3601R[202]0x00100mA RMS, 200mA pk
Power class for 26 MHz at 1.95 V 1 RPWR_CL_26_1951R[201]0x0065mA RMS, 130mA pk
Power class for 52 MHz at 1.95 V 1 RPWR_CL_52_1951R[200]0x0065mA RMS, 130mA pk
Partition switching timingPARTITION_SWITCH_TIME1R[199]0x0110ms
Out-of-interrupt busy timingOUT_OF_INTERRUPT_TIME1R[198]0x0550ms
I/O Driver StrengthDRIVER_STRENGTH1R[197]0x1FSupported Types: 0-4
Device typeDEVICE_TYPE1R[196]0x57HS at 26 and 52MHz at rated voltage(s), HS DDR at 52MHz 1.8V or 3V, HS200 SDR and HS400 DDR at 200MHz at 1.8V
Reserved 1TBD[195]0x00
CSD STRUCTURECSD_STRUCTURE1R[194]0x02CSD version No. 1.2
Reserved 1TBD[193]0x00
Extended CSD revisionEXT_CSD_REV1R[192]0x08Revision 1.8 (for MMC v5.1)
Modes Segment
Command setCMD_SET1R/W/E_P[191]0x00
Reserved 1TBD[190]0x00
Command set revisionCMD_SET_REV1R[189]0x00v4.0
Reserved 1TBD[188]0x00
Power classPOWER_CLASS1R/W/E_P[187]0x00100mA RMS, 200mA pk
Reserved 1TBD[186]0x00
High-speed interface timingHS_TIMING1R/W/E_P[185]0x01High Speed
Strobe SupportSTROBE_SUPPORT1R[184]0x01Supports Enhanced Strobe mode
Bus width modeBUS_WIDTH1W/E_P[183]0x001 bit mode, default strobe
Reserved 1TBD[182]0x00
Erased memory contentERASED_MEM_CONT1R[181]0x00Erased memory range shall be 0
Reserved 1TBD[180]0x00
Partition configurationPARTITION_CONFIG1R/W/E & R/W/E_P[179]0x00
Boot config protectionBOOT_CONFIG_PROT1R/W & R/W/C_P[178]
Boot bus ConditionsBOOT_BUS_CONDITIONS1R/W/E[177]
Reserved 1TBD[176]
High-density erase group definitionERASE_GROUP_DEF1R/W/E_P[175]
Boot write protection status registersBOOT_WP_STATUS1R[174]
Boot area write protection registerBOOT_WP1R/W & R/W/C_P[173]
Reserved 1TBD[172]
User area write protection registerUSER_WP1R/W, R/W/C_P & R/W/E_P[171]
Reserved 1TBD[170]
FW configurationFW_CONFIG1R/W[169]
RPMB SizeRPMB_SIZE_MULT1R[168]
Write reliability setting registerWR_REL_SET1R/W[167]
Write reliability parameter registerWR_REL_PARAM1R[166]
Start Sanitize operationSANITIZE_START1W/E_P[165]
Manually start background operationsBKOPS_START1W/E_P[164]
Enable background operations handshakeBKOPS_EN1R/W & R/W/E[163]
H/W reset functionRST_n_FUNCTION1R/W[162]
HPI managementHPI_MGMT1R/W/E_P[161]
Partitioning SupportPARTITIONING_SUPPORT1R[160]
Max Enhanced Area SizeMAX_ENH_SIZE_MULT3R[159:157]
Partitions attributePARTITIONS_ATTRIBUTE1R/W[156]
Partitioning SettingPARTITION_SETTING_ COMPLETED1R/W[155]
General Purpose Partition SizeGP_SIZE_MULT12R/W[154:143]
Enhanced User Data Area SizeENH_SIZE_MULT3R/W[142:140]
Enhanced User Data Start AddressENH_START_ADDR4R/W[139:136]
Reserved 1TBD[135]
Bad Block Management modeSEC_BAD_BLK_MGMNT1R/W[134]
Production state awarenessPRODUCTION_STATE_ AWARENESS1R/W/E[133]
Package Case Temperature is controlledTCASE_SUPPORT1W/E_P[132]
Periodic Wake-upPERIODIC_WAKEUP1R/W/E[131]
Program CID/CSD in DDR mode supportPROGRAM_CID_CSD_ DDR_SUPPORT1R[130]
Reserved 2TBD[129:128]
Vendor Specific FieldsVENDOR_SPECIFIC_FIELD64<vendor specific>[127:64]
Native sector sizeNATIVE_SECTOR_SIZE1R[63]
Sector size emulationUSE_NATIVE_SECTOR1R/W[62]
Sector sizeDATA_SECTOR_SIZE1R[61]
1st initialization after disabling sector size emulationINI_TIMEOUT_EMU1R[60]
Class 6 commands controlCLASS_6_CTRL1R/W/E_P[59]
Number of addressed group to be ReleasedDYNCAP_NEEDED1R[58]
Exception events controlEXCEPTION_EVENTS_CTRL2R/W/E_P[57:56]
Exception events statusEXCEPTION_EVENTS_STATUS2R[55:54]
Extended Partitions AttributeEXT_PARTITIONS_ATTRIBUTE2R/W[53:52]
Context configurationCONTEXT_CONF15R/W/E_P[51:37]
Packed command statusPACKED_COMMAND_STATUS1R[36]
Packed command failure indexPACKED_FAILURE_INDEX1R[35]
Power Off NotificationPOWER_OFF_NOTIFICATION1R/W/E_P[34]
Control to turn the Cache ON/OFFCACHE_CTRL1R/W/E_P[33]
Flushing of the cacheFLUSH_CACHE1W/E_P[32]
Control to turn the Barrier ON/OFFBARRIER_CTRL1R/W[31]
Mode configMODE_CONFIG1R/W/E_P[30]
Mode operation codesMODE_OPERATION_CODES1W/E_P[29]
Reserved 2TBD[28:27]
FFU statusFFU_STATUS1R[26]
Pre loading data sizePRE_LOADING_DATA_SIZE4R/W/E_P[25:22]
Max pre loading data sizeMAX_PRE_LOADING_DATA_SIZE4R[21:18]
Product state awareness enablementPRODUCT_STATE_ AWARENESS_ENABLEMENT1R/W/E & R[17]
Secure Removal TypeSECURE_REMOVAL_TYPE1R/W & R[16]
Command Queue Mode EnableCMDQ_MODE_EN1R/W/E_P[15]
Reserved 15TBD[14:0]
1)
http://www.nintendo.com/switch/features/tech-specs/
2)
Teardown by yupferris
3)
Teardown by Uberflup
4)
free of charge, registration required, or grab a login from bugmenot
5)
original data by stuckpixel
hardware/flash.txt · Last modified: 2017/07/11 01:36 by sirocyl

Page Tools

Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki