In memory of Ben “bushing” Byer, who passed away on Monday, February 8th, 2016.

Starlet memory map: Difference between revisions

From WiiBrew
Jump to navigation Jump to search
Marcan (talk | contribs)
New page: This page lists the known Starlet I/O registers == DI Interface == Mapped at 0x0D006000 - looks almost identical to the Gamecube DI interface == Unknown == There are a bunch of registers...
 
adding content
Line 1: Line 1:
This page lists the known Starlet I/O registers
This page lists the known Starlet I/O registers.  Much of this info comes from Segher & tmbinc's private notes.


== DI Interface ==
== Memory map ==
Mapped at 0x0D006000 - looks almost identical to the Gamecube DI interface


== Unknown ==
I/O is at x'0d00_0000 (Starlet private) and x'0d80_0000 (shared with the Broadway).
There are a bunch of registers mapped at 0x0D800000
 
There is internal SRAM at x'fffe_0000, 128kB of it; this stores the kernel code and data, minus the crypto code.
 
The GDDR3 is at x'1000_0000, 64MB of it; the upper 12MB are exclusive for use by the Starlet, the rest is shared with the Broadway.
 
== IO Memory ==
 
{| border=1
| base      || function || offset || description || contents/example
|-
|x'0d00_6000|| DI || looks almost identical to the Gamecube DI interface
|-
|x'0d01_0000||NAND      ||
|-
|          ||          || 0000 W  || command || 9F000000 (CMD 00: start read sector)
|-
||          ||          ||        ||        || 8030B840 (CMD 30: data (starts DMA 0x840 bytes))
|-
||          ||          ||        ||        || 80FF8000 (CMD FF: reset)
|-
||          ||          ||        ||        || 00008000 means: wait for R/#B to go down
|-
||          ||          ||        ||        || 1F000000 is the mask of the address bytes to send. (10 = AA, 08 = BB, .., 01 = FF in 08,0c)
|-
||          ||          || 0000 R  || status || MSB means busy
|-
||          ||          || 0004 W  || config ||
|-
||          ||          || 0008 W  || address #0 ||  0000AABB
|-
||          ||          || 000C W  || address #1 || CCDDEEFF
|-
||          ||          || 0010 W  || data addr  || target address for DMA (0x800 main bytes)
|-
||          ||          || 0014 W  || ecc addr  || target address for DMA (0x40 spare bytes)
|-
||x'0d02_0000||AES      ||
|-
||          ||          || 0000 W  || command || 980000ll to start operation (l = len in 16 byte blocks -1), | 1000 for "do not reload IV"??
|-
||          ||          || 0000 R  || status || MSB means busy
|-
||          ||          || 0004 W  || data addr || either source or dst DMA
|-
||          ||          || 0008 W  || data addr|| "
|-
||          ||          || 000C W  || key fifo || write 4 words to set key
|-
||          ||          || 0010 W  || IV fifo || write 4 words to set IV
|-
||x'0d03_0000||SHA-1    ||
|-
||x'0d05_0000||OHC !#0    ||
|-
||x'0d06_0000||OHC !#1    ||
|-
||x'0d07_0000||SDHC !#0    ||
|-
||x'0d07_0100||SDHC !#1    ||
|-
||x'0d80_0000||memory region is called "ACR"
|-
||x'0d80_0010||timer (core clock divided by 128)
|-
||x'0d80_0034||???
|-
||x'0d80_0038||active interrupts (write 1 to clear)
|-
||x'0d80_003C||enabled interrupts|| || || clear 0x40000 for legacy di
|-
||x'0d80_0060||???
|-
||x'0d80_0070||??? || || || set 0x10 for legacy DI; 0x1 to allow write to exi boot buffer
|-
||x'0d80_00C0||GPIO || || || probably data: 0x200 for eject; 0x100 sensor bar enable; 0x20 for tray led
|-
||x'0d80_00C4||GPIO || || || probably direction
|-
||x'0d80_00DC||???
|-
||x'0d80_00E0||GPIO || || || brought out to 8 testpads --probably used as a debug port during manufacturing. Also, used in 1-100 "panic"-condition: "set, delay, clear, delay"-loop (blinking a led?)
|-
||x'0d80_00E4||GPIO || || || probably direction
|-
||x'0d80_00EC||???
|-
||x'0d80_00F4||???
|-
||x'0d80_00FC||???
|-
||x'0d80_0100||???
|-
||x'0d80_010C||???
|-
||x'0d80_0110||???
|-
||x'0d80_0114||???
|-
||x'0d80_0118||???
|-
||x'0d80_011C||???
|-
||x'0d80_0120||???
|-
||x'0d80_0130||???
|-
||x'0d80_0134||???
|-
||x'0d80_0138||???
|-
||x'0d80_0180||??? || || || set 0x40 for legacy DI; 0x100000 set after loadEXI (boot code)
|-
||x'0d80_0188||???
|-
||x'0d80_018C||???
|-
||x'0d80_0194||??? || || || 0x400 is DI reset (low active)
|-
||x'0d80_01C0||???
|-
||x'0d80_01BC||???
|-
||x'0d80_0214||???
|-
||x'0d80_6800||EXI
|-
|| || || 0x40 || ppc boot buffer
|}

Revision as of 07:52, 1 June 2008

This page lists the known Starlet I/O registers. Much of this info comes from Segher & tmbinc's private notes.

Memory map

I/O is at x'0d00_0000 (Starlet private) and x'0d80_0000 (shared with the Broadway).

There is internal SRAM at x'fffe_0000, 128kB of it; this stores the kernel code and data, minus the crypto code.

The GDDR3 is at x'1000_0000, 64MB of it; the upper 12MB are exclusive for use by the Starlet, the rest is shared with the Broadway.

IO Memory

base function offset description contents/example
x'0d00_6000 DI looks almost identical to the Gamecube DI interface
x'0d01_0000 NAND
0000 W command 9F000000 (CMD 00: start read sector)
8030B840 (CMD 30: data (starts DMA 0x840 bytes))
80FF8000 (CMD FF: reset)
00008000 means: wait for R/#B to go down
1F000000 is the mask of the address bytes to send. (10 = AA, 08 = BB, .., 01 = FF in 08,0c)
0000 R status MSB means busy
0004 W config
0008 W address #0 0000AABB
000C W address #1 CCDDEEFF
0010 W data addr target address for DMA (0x800 main bytes)
0014 W ecc addr target address for DMA (0x40 spare bytes)
x'0d02_0000 AES
0000 W command 1000 for "do not reload IV"??
0000 R status MSB means busy
0004 W data addr either source or dst DMA
0008 W data addr "
000C W key fifo write 4 words to set key
0010 W IV fifo write 4 words to set IV
x'0d03_0000 SHA-1
x'0d05_0000 OHC !#0
x'0d06_0000 OHC !#1
x'0d07_0000 SDHC !#0
x'0d07_0100 SDHC !#1
x'0d80_0000 memory region is called "ACR"
x'0d80_0010 timer (core clock divided by 128)
x'0d80_0034 ???
x'0d80_0038 active interrupts (write 1 to clear)
x'0d80_003C enabled interrupts clear 0x40000 for legacy di
x'0d80_0060 ???
x'0d80_0070 ??? set 0x10 for legacy DI; 0x1 to allow write to exi boot buffer
x'0d80_00C0 GPIO probably data: 0x200 for eject; 0x100 sensor bar enable; 0x20 for tray led
x'0d80_00C4 GPIO probably direction
x'0d80_00DC ???
x'0d80_00E0 GPIO brought out to 8 testpads --probably used as a debug port during manufacturing. Also, used in 1-100 "panic"-condition: "set, delay, clear, delay"-loop (blinking a led?)
x'0d80_00E4 GPIO probably direction
x'0d80_00EC ???
x'0d80_00F4 ???
x'0d80_00FC ???
x'0d80_0100 ???
x'0d80_010C ???
x'0d80_0110 ???
x'0d80_0114 ???
x'0d80_0118 ???
x'0d80_011C ???
x'0d80_0120 ???
x'0d80_0130 ???
x'0d80_0134 ???
x'0d80_0138 ???
x'0d80_0180 ??? set 0x40 for legacy DI; 0x100000 set after loadEXI (boot code)
x'0d80_0188 ???
x'0d80_018C ???
x'0d80_0194 ??? 0x400 is DI reset (low active)
x'0d80_01C0 ???
x'0d80_01BC ???
x'0d80_0214 ???
x'0d80_6800 EXI
0x40 ppc boot buffer