|
Tag: Redirect target changed |
| (7 intermediate revisions by 5 users not shown) |
| Line 1: |
Line 1: |
| This page lists the known [[Starlet]] I/O registers. Much of this info comes from Segher & tmbinc's private notes.
| | #REDIRECT [[Hollywood/Registers]] |
| | |
| == IO Memory ==
| |
| | |
| {| border="1"
| |
| ! base !! function !! offset !! description !! contents/example
| |
| |-
| |
| ||0x0D800000|| hollywood control || 0x400 bytes of control registers; these registers are mirrored every 0x400 bytes from 0x0D80000 to 0x0D805fff
| |
| |-
| |
| ||0x0D800000||IPC|||| reg 0: request pointer || To make an IOS request, the physical address of an IOS command struct is written here by the Broadway. Then, Broadway sets bit 0 of IPC reg 1 to indicate a request is ready.
| |
| |-
| |
| ||0x0D800004||IPC|||| reg 1: semaphore flags || Broadway sets bits here as "doorbells" to indicate status; Starlet responds by setting flags here.
| |
| |-
| |
| ||0x0D800008||IPC||||reg 2: Reply pointer || When an IOS request has completed, IOS will modify the original command struct passed in IPC reg 0, copy that pointer to reg 2, then set reg 1 to 0x14 to indicate a reply is ready.
| |
| |-
| |
| ||0x0D800010||timer (core clock divided by 128)
| |
| |-
| |
| ||0x0D800014|| alarm (interrupt 0 is fired when the timer reaches this value)
| |
| |-
| |
| ||0x0D800030|| something related to interrupts; typical value is 0x854DA94F. Pressing the RESET button will set the 0x20000 bit.
| |
| |-
| |
| ||0x0D800034||???
| |
| |-
| |
| ||0x0D800038||active interrupts (write 1 to clear). Pressing the RESET button will set the 0x20000 bit (interrupt 18). Pressing the POWER button will set the 0x800 bit (interrupt 11).
| |
| |-
| |
| ||0x0D80003C||enabled interrupts|| || || clear 0x40000 for legacy di
| |
| |-
| |
| ||0x0D800060||???
| |
| |-
| |
| ||0x0D800070||??? || || || set 0x10 for legacy DI; 0x1 to allow write to exi boot buffer
| |
| |-
| |
| ||0x0D8000C0||GPIO || || || probably data: 0x200 for eject; 0x100 sensor bar enable; 0x20 for tray led
| |
| |-
| |
| ||0x0D8000C4||GPIO || || || probably direction
| |
| |-
| |
| ||0x0D8000DC||???
| |
| |-
| |
| ||0x0D8000E0||GPIO || || || 0x08 -- set to enable DC/DC converter,
| |
| |-
| |
| ||0x0D8000E1||GPIO || || ||
| |
| |-
| |
| ||0x0D8000E2||GPIO || || || debug / "POST" port -- connected to 8 testpads. boot0 / 1 / 2 output simple codes to indicate boot status.
| |
| |-
| |
| ||0x0D8000E3||GPIO || || ||
| |
| |-
| |
| ||0x0D8000E4||GPIO || || || probably direction
| |
| |-
| |
| ||0x0D8000EC||???
| |
| |-
| |
| ||0x0D8000F0|| ? typical value is 0x0070FFF6; pressing the POWER button will set the 0x1 bit
| |
| |-
| |
| ||0x0D8000F4||???
| |
| |-
| |
| ||0x0D8000FC||???
| |
| |-
| |
| ||0x0D800100||???
| |
| |-
| |
| ||0x0D80010C||???
| |
| |-
| |
| ||0x0D800110||???
| |
| |-
| |
| ||0x0D800114||???
| |
| |-
| |
| ||0x0D800118||???
| |
| |-
| |
| ||0x0D80011C||???
| |
| |-
| |
| ||0x0D800120||???
| |
| |-
| |
| ||0x0D800130||???
| |
| |-
| |
| ||0x0D800134||???
| |
| |-
| |
| ||0x0D800138||???
| |
| |-
| |
| ||0x0D800180||??? || || || set 0x40 for legacy DI; 0x100000 set after loadEXI (boot code)
| |
| |-
| |
| ||0x0D800188||???
| |
| |-
| |
| ||0x0D80018C||???
| |
| |-
| |
| ||0x0D800190||??? || || || involved in DSKPLL init
| |
| |-
| |
| ||0x0D800194||??? || || || 0x400 is DI reset (low active) / involved in DSKPLL init
| |
| |-
| |
| ||0x0D800198||??? || || || set to 0x00FFFFFF as part of "interface / subsytem powerup"
| |
| |-
| |
| ||0x0D8001B0||??? || || || ACRPLLSYS
| |
| |-
| |
| ||0x0D8001B0||??? || || || ACRPLLSYSEXT
| |
| |-
| |
| ||0x0D8001B8||??? || || || involved in DSKPLL init
| |
| |-
| |
| ||0x0D8001BC||???
| |
| |-
| |
| ||0x0D8001C0||???
| |
| |-
| |
| ||0x0D8001DC||??? || || || set to 0x00FFFFFF as part of "interface / subsytem powerup"
| |
| |-
| |
| ||0x0D8001EC||OTP || || || OTP read address (addresses run from 0x80000000..0x8000001F)
| |
| |-
| |
| || || || || || 0x80000000 - 0x80000004 stores 20 bytes boot1 SHA-1 hash
| |
| |-
| |
| || || || || || 0x80000005 - 0x80000008 common key
| |
| |-
| |
| || || || || || 0x80000009 NG id
| |
| |-
| |
| || || || || || 0x8000000a - 0x80000010 NG private
| |
| |-
| |
| || || || || || 0x80000011 - 0x80000015 NAND HMAC
| |
| |-
| |
| || || || || || 0x80000016 - 0x80000019 NAND AES
| |
| |-
| |
| || || || || || 0x8000001A - 0x8000001D RNG key
| |
| |-
| |
| ||0x0D8001F0||OTP || || || OTP data
| |
| |-
| |
| ||0x0D800214||??? || || || Register is read 223 times while booting boot0 and boot1. Never written by boot0 or boot1.
| |
| |-
| |
| ||0x0D800224 - 03FF || || || unused
| |
| |-
| |
| |0x0D806000|| DI || looks almost identical to the Gamecube DI interface
| |
| |-
| |
| ||0x0D806000|| DISR || || || DI status register
| |
| |-
| |
| ||0x0D806004|| DICVR || || || DI cover register (status2)
| |
| |-
| |
| ||0x0D806008|| DICMDBUF0 || || || DI command buffer 0
| |
| |-
| |
| ||0x0D80600C|| DICMDBUF1 || || || DI command buffer 1
| |
| |-
| |
| ||0x0D806010|| DICMDBUF2 || || || DI command buffer 2
| |
| |-
| |
| ||0x0D806014|| DIMAR || || || DI DMA memory address register
| |
| |-
| |
| ||0x0D806018|| DILENGTH || || || DI DMA transfer length register
| |
| |-
| |
| ||0x0D806020|| DIMMBUF || || || DI immediate data buffer
| |
| |-
| |
| ||0x0D806024|| DICFG || || || DI configuration register
| |
| |-
| |
| ||0x0D806800||EXI
| |
| |-
| |
| || | || 0x40 || ppc boot buffer
| |
| |-
| |
| |0x0D8B4000|| AMBA AHB registers ||
| |
| |-
| |
| ||0x0D8B4000||???
| |
| |-
| |
| ||0x0D8B4002||???
| |
| |-
| |
| ||0x0D8B4004||???
| |
| |-
| |
| ||0x0D8B4006||???
| |
| |-
| |
| ||0x0D8B4008||???
| |
| |-
| |
| ||0x0D8B400A||???
| |
| |-
| |
| ||0x0D8B400C||???
| |
| |-
| |
| ||0x0D8B400E||???
| |
| |-
| |
| ||0x0D8B4026||???
| |
| |-
| |
| ||0x0D8B4074||???
| |
| |-
| |
| ||0x0D8B4076||???
| |
| |-
| |
| ||0x0D8B4228|| || || AHB command || AHB memory flush command. Typical values: 1, 2, 4, 8, 15
| |
| |-
| |
| ||0x0D8B422a|| || || AHB acknowlegde || If AHB memory flush acknowledge, will be set to the command value.
| |
| |}
| |
| [[Category:Wii_Hardware]]
| |