Starlet memory map: Difference between revisions
Jump to navigation
Jump to search
New page: This page lists the known Starlet I/O registers == DI Interface == Mapped at 0x0D006000 - looks almost identical to the Gamecube DI interface == Unknown == There are a bunch of registers... |
adding content |
||
Line 1: | Line 1: | ||
This page lists the known Starlet I/O registers | This page lists the known Starlet I/O registers. Much of this info comes from Segher & tmbinc's private notes. | ||
== | == Memory map == | ||
== | I/O is at x'0d00_0000 (Starlet private) and x'0d80_0000 (shared with the Broadway). | ||
There is internal SRAM at x'fffe_0000, 128kB of it; this stores the kernel code and data, minus the crypto code. | |||
The GDDR3 is at x'1000_0000, 64MB of it; the upper 12MB are exclusive for use by the Starlet, the rest is shared with the Broadway. | |||
== IO Memory == | |||
{| border=1 | |||
| base || function || offset || description || contents/example | |||
|- | |||
|x'0d00_6000|| DI || looks almost identical to the Gamecube DI interface | |||
|- | |||
|x'0d01_0000||NAND || | |||
|- | |||
| || || 0000 W || command || 9F000000 (CMD 00: start read sector) | |||
|- | |||
|| || || || || 8030B840 (CMD 30: data (starts DMA 0x840 bytes)) | |||
|- | |||
|| || || || || 80FF8000 (CMD FF: reset) | |||
|- | |||
|| || || || || 00008000 means: wait for R/#B to go down | |||
|- | |||
|| || || || || 1F000000 is the mask of the address bytes to send. (10 = AA, 08 = BB, .., 01 = FF in 08,0c) | |||
|- | |||
|| || || 0000 R || status || MSB means busy | |||
|- | |||
|| || || 0004 W || config || | |||
|- | |||
|| || || 0008 W || address #0 || 0000AABB | |||
|- | |||
|| || || 000C W || address #1 || CCDDEEFF | |||
|- | |||
|| || || 0010 W || data addr || target address for DMA (0x800 main bytes) | |||
|- | |||
|| || || 0014 W || ecc addr || target address for DMA (0x40 spare bytes) | |||
|- | |||
||x'0d02_0000||AES || | |||
|- | |||
|| || || 0000 W || command || 980000ll to start operation (l = len in 16 byte blocks -1), | 1000 for "do not reload IV"?? | |||
|- | |||
|| || || 0000 R || status || MSB means busy | |||
|- | |||
|| || || 0004 W || data addr || either source or dst DMA | |||
|- | |||
|| || || 0008 W || data addr|| " | |||
|- | |||
|| || || 000C W || key fifo || write 4 words to set key | |||
|- | |||
|| || || 0010 W || IV fifo || write 4 words to set IV | |||
|- | |||
||x'0d03_0000||SHA-1 || | |||
|- | |||
||x'0d05_0000||OHC !#0 || | |||
|- | |||
||x'0d06_0000||OHC !#1 || | |||
|- | |||
||x'0d07_0000||SDHC !#0 || | |||
|- | |||
||x'0d07_0100||SDHC !#1 || | |||
|- | |||
||x'0d80_0000||memory region is called "ACR" | |||
|- | |||
||x'0d80_0010||timer (core clock divided by 128) | |||
|- | |||
||x'0d80_0034||??? | |||
|- | |||
||x'0d80_0038||active interrupts (write 1 to clear) | |||
|- | |||
||x'0d80_003C||enabled interrupts|| || || clear 0x40000 for legacy di | |||
|- | |||
||x'0d80_0060||??? | |||
|- | |||
||x'0d80_0070||??? || || || set 0x10 for legacy DI; 0x1 to allow write to exi boot buffer | |||
|- | |||
||x'0d80_00C0||GPIO || || || probably data: 0x200 for eject; 0x100 sensor bar enable; 0x20 for tray led | |||
|- | |||
||x'0d80_00C4||GPIO || || || probably direction | |||
|- | |||
||x'0d80_00DC||??? | |||
|- | |||
||x'0d80_00E0||GPIO || || || brought out to 8 testpads --probably used as a debug port during manufacturing. Also, used in 1-100 "panic"-condition: "set, delay, clear, delay"-loop (blinking a led?) | |||
|- | |||
||x'0d80_00E4||GPIO || || || probably direction | |||
|- | |||
||x'0d80_00EC||??? | |||
|- | |||
||x'0d80_00F4||??? | |||
|- | |||
||x'0d80_00FC||??? | |||
|- | |||
||x'0d80_0100||??? | |||
|- | |||
||x'0d80_010C||??? | |||
|- | |||
||x'0d80_0110||??? | |||
|- | |||
||x'0d80_0114||??? | |||
|- | |||
||x'0d80_0118||??? | |||
|- | |||
||x'0d80_011C||??? | |||
|- | |||
||x'0d80_0120||??? | |||
|- | |||
||x'0d80_0130||??? | |||
|- | |||
||x'0d80_0134||??? | |||
|- | |||
||x'0d80_0138||??? | |||
|- | |||
||x'0d80_0180||??? || || || set 0x40 for legacy DI; 0x100000 set after loadEXI (boot code) | |||
|- | |||
||x'0d80_0188||??? | |||
|- | |||
||x'0d80_018C||??? | |||
|- | |||
||x'0d80_0194||??? || || || 0x400 is DI reset (low active) | |||
|- | |||
||x'0d80_01C0||??? | |||
|- | |||
||x'0d80_01BC||??? | |||
|- | |||
||x'0d80_0214||??? | |||
|- | |||
||x'0d80_6800||EXI | |||
|- | |||
|| || || 0x40 || ppc boot buffer | |||
|} |
Revision as of 07:52, 1 June 2008
This page lists the known Starlet I/O registers. Much of this info comes from Segher & tmbinc's private notes.
Memory map
I/O is at x'0d00_0000 (Starlet private) and x'0d80_0000 (shared with the Broadway).
There is internal SRAM at x'fffe_0000, 128kB of it; this stores the kernel code and data, minus the crypto code.
The GDDR3 is at x'1000_0000, 64MB of it; the upper 12MB are exclusive for use by the Starlet, the rest is shared with the Broadway.
IO Memory
base | function | offset | description | contents/example |
x'0d00_6000 | DI | looks almost identical to the Gamecube DI interface | ||
x'0d01_0000 | NAND | |||
0000 W | command | 9F000000 (CMD 00: start read sector) | ||
8030B840 (CMD 30: data (starts DMA 0x840 bytes)) | ||||
80FF8000 (CMD FF: reset) | ||||
00008000 means: wait for R/#B to go down | ||||
1F000000 is the mask of the address bytes to send. (10 = AA, 08 = BB, .., 01 = FF in 08,0c) | ||||
0000 R | status | MSB means busy | ||
0004 W | config | |||
0008 W | address #0 | 0000AABB | ||
000C W | address #1 | CCDDEEFF | ||
0010 W | data addr | target address for DMA (0x800 main bytes) | ||
0014 W | ecc addr | target address for DMA (0x40 spare bytes) | ||
x'0d02_0000 | AES | |||
0000 W | command | 1000 for "do not reload IV"?? | ||
0000 R | status | MSB means busy | ||
0004 W | data addr | either source or dst DMA | ||
0008 W | data addr | " | ||
000C W | key fifo | write 4 words to set key | ||
0010 W | IV fifo | write 4 words to set IV | ||
x'0d03_0000 | SHA-1 | |||
x'0d05_0000 | OHC !#0 | |||
x'0d06_0000 | OHC !#1 | |||
x'0d07_0000 | SDHC !#0 | |||
x'0d07_0100 | SDHC !#1 | |||
x'0d80_0000 | memory region is called "ACR" | |||
x'0d80_0010 | timer (core clock divided by 128) | |||
x'0d80_0034 | ??? | |||
x'0d80_0038 | active interrupts (write 1 to clear) | |||
x'0d80_003C | enabled interrupts | clear 0x40000 for legacy di | ||
x'0d80_0060 | ??? | |||
x'0d80_0070 | ??? | set 0x10 for legacy DI; 0x1 to allow write to exi boot buffer | ||
x'0d80_00C0 | GPIO | probably data: 0x200 for eject; 0x100 sensor bar enable; 0x20 for tray led | ||
x'0d80_00C4 | GPIO | probably direction | ||
x'0d80_00DC | ??? | |||
x'0d80_00E0 | GPIO | brought out to 8 testpads --probably used as a debug port during manufacturing. Also, used in 1-100 "panic"-condition: "set, delay, clear, delay"-loop (blinking a led?) | ||
x'0d80_00E4 | GPIO | probably direction | ||
x'0d80_00EC | ??? | |||
x'0d80_00F4 | ??? | |||
x'0d80_00FC | ??? | |||
x'0d80_0100 | ??? | |||
x'0d80_010C | ??? | |||
x'0d80_0110 | ??? | |||
x'0d80_0114 | ??? | |||
x'0d80_0118 | ??? | |||
x'0d80_011C | ??? | |||
x'0d80_0120 | ??? | |||
x'0d80_0130 | ??? | |||
x'0d80_0134 | ??? | |||
x'0d80_0138 | ??? | |||
x'0d80_0180 | ??? | set 0x40 for legacy DI; 0x100000 set after loadEXI (boot code) | ||
x'0d80_0188 | ??? | |||
x'0d80_018C | ??? | |||
x'0d80_0194 | ??? | 0x400 is DI reset (low active) | ||
x'0d80_01C0 | ??? | |||
x'0d80_01BC | ??? | |||
x'0d80_0214 | ??? | |||
x'0d80_6800 | EXI | |||
0x40 | ppc boot buffer |