Hardware/External Interface

From WiiBrew
Jump to navigation Jump to search
External Interface
Access
BroadwayPartial
StarletFull
Registers
Base0x0d806800
Length0x80
Access size32 bits
Byte orderBig Endian
IRQs
Broadway4
This box: view  talk  edit

The External Interface (EXI) is an interface to communicate with external devices like the Gamecube memory cards slots, which can be used for memory cards, usb gecko, sdgecko, or nintendo's waikiki's debug adaptor.

On the Wii, the PowerPC's reset vector (0xfff00000) is mapped to memory within the EXI while on the GameCube this was mapped to the IPL masked bootrom. Since there is no IPL in the Wii ROM, this memory is written to by IOS when it bootstraps the Broadway.

Register List

EXI
Address Bits Name Description
0x0d806800 32 EXI_CSR EXI Channel 0 Parameter Register (Status?)
0x0d806800 32 EXI_MAR EXI Channel 0 DMA Start Address
0x0d806800 32 EXI_LENGTH EXI EXI Channel 0 DMA Transfer Length
0x0d806800 32 EXI_CR EXI Channel 0 Control Register
0x0d806810 32 EXI_DATA EXI Channel 0 Immediate Data
0x0d806814 32 EXI_CSR EXI Channel 1 Parameter Register (Status?)
0x0d806818 32 EXI_MAR EXI Channel 1 DMA Start Address
0x0d80681c 32 EXI_LENGTH EXI EXI Channel 1 DMA Transfer Length
0x0d806820 32 EXI_CR EXI Channel 1 Control Register (Status?)
0x0d806824 32 EXI_DATA EXI Channel 1 Immediate Data
0x0d806828 32 EXI_CSR EXI Channel 2 Parameter Register (Status?)
0x0d80682c 32 EXI_MAR EXI Channel 2 DMA Start Address
0x0d806830 32 EXI_LENGTH EXI EXI Channel 2 DMA Transfer Length
0x0d806834 32 EXI_CR EXI Channel 2 Control Register (Status?)
0x0d806838 32 EXI_DATA EXI Channel 2 Immediate Data


EXI_CSR
  31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16
Access
Field
  15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
Access R/W R/W R/W R/W R/W R/W R/W R/W R/W R/W
Field ROMDIS EXT EXTINT EXTINTMASK CS CLK TCINT TCINTMASK EXTINT EXTINTMASK

This register at least controls the boot0 memory mapping and DSK PLL source.

Field Description
ROMDIS on GC it masked the ipl, Unknown purpose on the wii
EXT Device Connected Bit (R) 1 if a device is connected on the specific channel
EXTINT External Insertion Interrupt Status

This interrupt indicates than an external EXI device has been removed from channel x. To check whether the device has been inserted or removed, check the EXICPR bit. When this bit is set, the channel's expansion EXI interface outputs go to high.

  • When read 1 or 0 indicates if interrupt is requested
  • When 1 is written to this register, it clears the interrupt
EXTINTMASK EXT Interrupt Mask (1 - enable, 0 - disable) (*5)
CS devices selected on this channel, each bit selecting one device.

Only one of these three bits can be set to signify which device number has been selected on a specific channel.

CLK used frequency
000 = 0.84375MHz
001 = 1.6875MHz
010 = 3.375MHz
011 = 6.75MHz
100 = 13.5MHz
101 = 27MHz
110 = 54MHz
111 = reserved (0.84375MHz)
TCINT Transfer Complete Interrupt Status
  • When read 1 or 0 indicates if interrupt is requested
  • When 1 is written to this register, it clears the interrupt
TCINTMASK Transfer complete interrupt mask (1 - enable, 0 - disable).

Interrupt masking prevents the interrupt from being sent to the main processor, but does not affect the assertion of TCINT

EXTINT Interrupt Status
  • When read 1 or 0 indicates if interrupt is requested
  • When 1 is written to this register, it clears the interrupt
EXTINTMASK EXI interrupt mask (1 - enable, 0 - disable)


EXIMAR
  31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16
Access R/W
Field Data
  15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
Access R/W
Field Data

Physical Startaddress for DMA transfer. Must be aligned to 32 byte boundary.


EXI_LENGTH
  31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16
Access R/W
Field Data
  15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
Access R/W
Field Data

Size of DMA transfer data in bytes. bits 0-4 are always zero (which means the size is 32 byte aligned)


EXI_CR
  31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16
Access
Field
  15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
Access TLEN RW DMA TSTART
Field R/W R/W R/W R/W
Field Description
TLEN (data length-1) for immediate mode
00 = 1 byte
01 = 2 byte
10 = 3 byte
11 = 4 byte
RW transfer type. all immediate transfers are effectively read and write.
00 = read
01 = write
10 = read and write, invalid for DMA
11 = undefined
DMA transfer mode (0 - immediate, 1 - DMA)
TSTART set, to start transfer. will be cleared after transfer completed.


EXI_DATA
  31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16
Access R/W
Field Data
  15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
Access R/W
Field Data

Data for read / write immediate operations (up to 4 bytes long).

EXI boot vector

As mentioned, there is small amount of memory in the EXI that is used as the PowerPC reset vector.

IOS's function to initialize the EXI reset vector has 2 default boot vectors depending on the parameters, but a custom boot vector is used by the IOS_StartPPC syscall. It is 0x40 bytes in size and is accessed through different addresses depending where you are reading from.

Source Start Address End Address
EXI 0x0d806840 0x0d806880
PPC 0xfff00100 0xfff00140

IOS_StartPPC vector

fff00100    3c 60 00 00    lis   r3, 0
fff00104    60 63 34 00    ori   r3, r3, 0x3400
fff00108    7c 7a 03 a6    mtspr SRR0, r3
fff0010c    38 60 00 00    li    r3, 0
fff00110    7c 7b 03 a6    mtspr SRR1, r3
fff00114    4c 00 00 64    rfi

Default vector (with HID4 initialization)

fff00100    7c 63 1a 78    xor   r3, r3, r3
fff00104    64 63 d7 b0    oris  r3, r3, 0xd7b0
fff00108    7c 73 fb a6    mtspr HID4, r3
fff0010c    4c 00 01 2c    isync
fff00110    3c 40 00 00    lis   r2, 0x0
fff00114    60 42 01 00    ori   r2, r2, 0x100
fff00118    7c 5a 03 a6    mtspr SRR0, r2
fff0011c    38 a0 00 00    li    r5, 0
fff00120    7c bb 03 a6    mtspr SRR1, r5
fff00124    4c 00 00 64    rfi
fff00128    60 00 00 00    nop
fff0012c    60 00 00 00    nop
fff00130    60 00 00 00    nop

Default vector (without HID4 initialization)

fff00100    7c 63 1a 78    xor   r3, r3, r3
fff00104    7c 73 fb a6    mtspr HID4, r3
fff00108    4c 00 01 2c    isync
fff0010c    3c 40 00 00    lis   r2, 0
fff00110    60 42 01 00    ori   r2, r2, 0x100
fff00114    7c 5a 03 a6    mtspr SRR0, r2
fff00118    38 a0 00 00    li    r5, 0
fff0010c    7c bb 03 a6    mtspr SRR1, r5
fff00120    4c 00 00 64    rfi
fff00124    60 00 00 00    nop
fff00128    60 00 00 00    nop
fff0012c    60 00 00 00    nop