Issue with direct PCIe mapping approach

[aurimasniekis]

Issue with direct PCIe mapping approach

Hey! Really cool project idea. I've been looking at your schematic and the SD Express specs, and I think there's going to be an issue with the direct wire-to-wire PCIe approach.

The problem

I've actually seen people try this exact same thing before and it doesn't work with real SD Express hosts. The issue is that the M.2 SSD can't directly respond to the SD Express initialization sequence that the Switch 2 expects.

How SD Express card initialization works

According to the SD Express Design Guide (check out Figure 11 on page 13), here's what happens from the card side:

1. Host starts with regular SD protocol on CMD/CLK/DAT lines
2. Card must respond to CMD0, CMD8, and other SD initialization commands
3. In CMD8 response, card tells host "yes, I support PCIe mode"
4. Host enables VDD2 (1.8V) power after seeing PCIe support
5. Card detects VDD2 and switches its internal mux to PCIe mode
6. Then PCIe communication starts on the DATA lines

Why direct M.2 connection won't work

With your current approach:

• Switch 2 sends CMD8 over SD protocol expecting SD card responses
• M.2 SSD has no idea what SD commands are - it only speaks PCIe/NVMe
• Switch 2 gets garbage/no response and thinks the card is broken
• VDD2 power never gets enabled, so M.2 SSD stays off

The M.2 SSD expects to see PCIe REFCLK and proper PCIe initialization, but the Switch 2 won't provide that until after the SD handshake completes.

The solution

You need a microcontroller on the card side to emulate an SD Express card during initialization. Here's what it needs to do:

During SD mode (first few milliseconds):

• Respond to SD commands (CMD0, CMD8, ACMD41, etc.) like a real SD card
• Tell the host "yes, I support PCIe" in the CMD8 response
• Wait for VDD2 power to be enabled by the host

After VDD2 comes online:

• Switch the mux to connect DAT0/1/2/3 directly to PCIe lanes
• Connect REFCLK to the M.2 SSD
• Assert PERST# to start M.2 initialization
• Get out of the way and let M.2 and Switch 2 talk directly

Additional hardware needed:

• Small MCU (STM32, RP2040, etc.)
• Mux control logic (similar to what you have)
• Basic SD protocol implementation (~100 lines of code)

The SD card emulation is actually pretty minimal - you only need to handle the basic initialization commands before switching over to PCIe passthrough mode.

Why I'm mentioning this

I'd love to work on this myself but don't have a Switch 2 or the bandwidth for a full hardware project right now. But I'm happy to help with:

• MCU firmware for SD card emulation
• SD protocol implementation details
• Code review and debugging
• General technical discussion

Your PCIe routing and M.2 connector selection looks solid, it just needs that SD card personality during the first part of initialization.

References

• SD Express Host Implementation Guide - Figure 11 on page 13 shows the card-side initialization flow
• SD Physical Layer Specs - Simplified version 7.10 has the command details for card implementation

The good news is this doesn't really complicate the design much, and you can test the SD emulation part with any SD reader before even touching the Switch 2.

[NVNTLabs]

Thank you so much for your offer to help! This is exactly why I'm putting all this open-source and transparent, so anyone and everyone can make this happen. Currently, I don't have a Switch 2 yet (mine comes in about 10 days), and this blew up WAY faster than I could ever expect!

I totally agree with your points as well. Currently, there's a adapter on the market which fails to work as it's a direct pin-to-pin approach. This was intended to be the starting point, which is why I'm trying to develop a MicroSD Express Breakout card for attempting to probe what's going on too. I've been digging around in the whitepapers and have seen what you mention, and you've done a stellar job at presenting it way clearer.

Please feel free to help! Is there anything I can do to facilitate this? We're in similar timezones, I see.

[aurimasniekis]

To be honest, I'm not even sure why I did the research and opened this issue - don't have a Switch 2 and wasn't planning to get one either. As my resources are minimal for some DIY 🤣 Was just browsing Twitter on the couch and saw your project!

My pal suggested going full FPGA which would eliminate the MUX complexity, but I think a simple MCU with SDIO capability (maybe even SPI in 1-bit mode) would be enough to trick the Switch2 host controller into PCIe mode. Then it's just a matter of using a basic PCIe analog mux to switch the lanes from SDIO to PCIe like the guidelines show.

The code should be pretty straightforward too - just standard SD card handshake examples with the only difference being telling the host we support PCIe mode in the CMD8 response. Main hope is that the Switch2 doesn't try to use any hybrid mode operations.

Really curious to see how this plays out when you get your Switch 2!

[NVNTLabs]

Your stumbling upon this project has been super helpful already, no worries there!

If you're up for it, please feel free to help out! More minds is better than mine, especially as I have a headache right now 🤣.

Super excited that this is getting attention for sure!

[adokitkat]

Hi. Here is an article about experiments with using microSD Express to access memory using PCI-E bus: https://swarm.ptsecurity.com/new-dog-old-tricks-damagecard-attack-targets-memory-directly-thru-sd-card-reader/ (potential attack surface if the switch doesn't have iommu? But that's another topic)

They used RPi Pico to just bit-bang emulate SD initialization without a hardware SD controller.

[NVNTLabs]

Thanks for the resource! I’ve been looking at their for a bit now, really informative. I’ve reached out to them regarding some details too, to see if they’ll share.

It’s really cool to see how “hacky” it’s able to be accomplished by bitbanging. I’ll definitely update the readme goals for these steps!

[dennis97519]

what about figure 10 on page 13 though? Since it's reported Switch 2 will only support microSD express cards, I think it's possible they didn't implement SDIO at all and just uses PCIe from the get go? (also page 6 section 3 option 3 says non-backward compatible hosts can 'opertate the SD Express card in PCIEe mode only')

[NVNTLabs]

what about figure 10 on page 13 though? Since it's reported Switch 2 will only support microSD express cards, I think it's possible they didn't implement SDIO at all and just uses PCIe from the get go? (also page 6 section 3 option 3 says non-backward compatible hosts can 'opertate the SD Express card in PCIEe mode only')

The lack of info makes for a great investigatory look :P. I’m building a breakout board for both M2 and MicroSD Express so we can start to see into this more. However, it seems that (based on others’ experience), it doesn’t solely operate in PCIe mode, as if it did, it wouldn’t need an MCU to handle logic (a pin to pin adapter, would suffice then).

[shanoor]

what about figure 10 on page 13 though? Since it's reported Switch 2 will only support microSD express cards, I think it's possible they didn't implement SDIO at all and just uses PCIe from the get go? (also page 6 section 3 option 3 says non-backward compatible hosts can 'opertate the SD Express card in PCIEe mode only')

It's backward compatible, it's just disabled by the OS by default (maybe because of licensing?): https://youtu.be/QS0pNW45VwA

[NVNTLabs]

It's a pity that it is disabled :(. Currently, I'm working on getting NVMe drives supported.

[YellowLemon1]

The SD Express spec allows for hosts to operate in NVMe/PCIe-only mode, ie: no SD initialisation required. The spec even has a schematic for a passive adapter connecting a standard PCIe/NVMe interface to an SD Express card, which by design can be initialized through its PCIe interface. This is essentially the reverse of the adapter here, connecting an SD Express Card as a 'standard' NVMe drive.

Whether such hosts exist or will exist out in the real world is unknown. The Switch 2 does implement SD mode and therefore some logic will be required before it will activate PCIe mode.