Hardware/External Interface

External Interface
Access
Broadway	Partial
Starlet	Full
Registers
Base	0x0d806800
Length	0x80
Access size	32 bits
Byte order	Big Endian
IRQs
Broadway	4

The External Interface (EXI) is an interface to communicate with external devices like the Gamecube memory cards slots, which can be used for memory cards, usb gecko, sdgecko, or nintendo's waikiki's debug adaptor.

On the Wii, the PowerPC's reset vector (0xfff00000) is mapped to memory within the EXI while on the GameCube this was mapped to the IPL masked bootrom. Since there is no IPL in the Wii ROM, this memory is written to by IOS when it bootstraps the Broadway.

Register List

EXI
Address	Bits	Name	Description
0x0d806800	32	EXI_CSR	EXI Channel 0 Parameter Register (Status?)
0x0d806804	32	EXI_MAR	EXI Channel 0 DMA Start Address
0x0d806808	32	EXI_LENGTH	EXI EXI Channel 0 DMA Transfer Length
0x0d80680c	32	EXI_CR	EXI Channel 0 Control Register
0x0d806810	32	EXI_DATA	EXI Channel 0 Immediate Data
0x0d806814	32	EXI_CSR	EXI Channel 1 Parameter Register (Status?)
0x0d806818	32	EXI_MAR	EXI Channel 1 DMA Start Address
0x0d80681c	32	EXI_LENGTH	EXI EXI Channel 1 DMA Transfer Length
0x0d806820	32	EXI_CR	EXI Channel 1 Control Register (Status?)
0x0d806824	32	EXI_DATA	EXI Channel 1 Immediate Data
0x0d806828	32	EXI_CSR	EXI Channel 2 Parameter Register (Status?)
0x0d80682c	32	EXI_MAR	EXI Channel 2 DMA Start Address
0x0d806830	32	EXI_LENGTH	EXI EXI Channel 2 DMA Transfer Length
0x0d806834	32	EXI_CR	EXI Channel 2 Control Register (Status?)
0x0d806838	32	EXI_DATA	EXI Channel 2 Immediate Data

EXI_CSR
	31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16
Access
Field
	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
Access			R/W	R/W	R/W	R/W	R/W			R/W			R/W	R/W	R/W	R/W
Field			ROMDIS	EXT	EXTINT	EXTINTMASK	CS			CLK			TCINT	TCINTMASK	EXTINT	EXTINTMASK

This register at least controls the boot0 memory mapping and DSK PLL source.

Field	Description
ROMDIS	on GC it masked the ipl, Unknown purpose on the wii
EXT	Device Connected Bit (R) 1 if a device is connected on the specific channel
EXTINT	External Insertion Interrupt Status This interrupt indicates than an external EXI device has been removed from channel x. To check whether the device has been inserted or removed, check the EXICPR bit. When this bit is set, the channel's expansion EXI interface outputs go to high. When read 1 or 0 indicates if interrupt is requested When 1 is written to this register, it clears the interrupt
EXTINTMASK	EXT Interrupt Mask (1 - enable, 0 - disable) (*5)
CS	devices selected on this channel, each bit selecting one device. Only one of these three bits can be set to signify which device number has been selected on a specific channel.
CLK	used frequency 000 = 0.84375MHz 001 = 1.6875MHz 010 = 3.375MHz 011 = 6.75MHz 100 = 13.5MHz 101 = 27MHz 110 = 54MHz 111 = reserved (0.84375MHz)
TCINT	Transfer Complete Interrupt Status When read 1 or 0 indicates if interrupt is requested When 1 is written to this register, it clears the interrupt
TCINTMASK	Transfer complete interrupt mask (1 - enable, 0 - disable). Interrupt masking prevents the interrupt from being sent to the main processor, but does not affect the assertion of TCINT
EXTINT	Interrupt Status When read 1 or 0 indicates if interrupt is requested When 1 is written to this register, it clears the interrupt
EXTINTMASK	EXI interrupt mask (1 - enable, 0 - disable)

EXIMAR
	31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16
Access	R/W
Field	Data
	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
Access	R/W
Field	Data

Physical Startaddress for DMA transfer. Must be aligned to 32 byte boundary.

EXI_LENGTH
	31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16
Access	R/W
Field	Data
	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
Access	R/W
Field	Data

Size of DMA transfer data in bytes. bits 0-4 are always zero (which means the size is 32 byte aligned)

EXI_CR
	31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16
Access
Field
	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
Access											TLEN		RW		DMA	TSTART
Field											R/W		R/W		R/W	R/W

Field	Description
TLEN	(data length-1) for immediate mode 00 = 1 byte 01 = 2 byte 10 = 3 byte 11 = 4 byte
RW	transfer type. all immediate transfers are effectively read and write. 00 = read 01 = write 10 = read and write, invalid for DMA 11 = undefined
DMA	transfer mode (0 - immediate, 1 - DMA)
TSTART	set, to start transfer. will be cleared after transfer completed.

EXI_DATA
	31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16
Access	R/W
Field	Data
	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
Access	R/W
Field	Data

Data for read / write immediate operations (up to 4 bytes long).

EXI boot vector

As mentioned, there is small amount of memory in the EXI that is used as the PowerPC reset vector.

IOS's function to initialize the EXI reset vector has 2 default boot vectors depending on the parameters, but a custom boot vector is used by the IOS_StartPPC syscall. It is 0x40 bytes in size and is accessed through different addresses depending where you are reading from.

Source	Start Address	End Address
EXI	0x0d806840	0x0d806880
PPC	0xfff00100	0xfff00140

IOS_StartPPC vector

fff00100    3c 60 00 00    lis   r3, 0
fff00104    60 63 34 00    ori   r3, r3, 0x3400
fff00108    7c 7a 03 a6    mtspr SRR0, r3
fff0010c    38 60 00 00    li    r3, 0
fff00110    7c 7b 03 a6    mtspr SRR1, r3
fff00114    4c 00 00 64    rfi

Default vector (with HID4 initialization)

fff00100    7c 63 1a 78    xor   r3, r3, r3
fff00104    64 63 d7 b0    oris  r3, r3, 0xd7b0
fff00108    7c 73 fb a6    mtspr HID4, r3
fff0010c    4c 00 01 2c    isync
fff00110    3c 40 00 00    lis   r2, 0x0
fff00114    60 42 01 00    ori   r2, r2, 0x100
fff00118    7c 5a 03 a6    mtspr SRR0, r2
fff0011c    38 a0 00 00    li    r5, 0
fff00120    7c bb 03 a6    mtspr SRR1, r5
fff00124    4c 00 00 64    rfi
fff00128    60 00 00 00    nop
fff0012c    60 00 00 00    nop
fff00130    60 00 00 00    nop

Default vector (without HID4 initialization)

fff00100    7c 63 1a 78    xor   r3, r3, r3
fff00104    7c 73 fb a6    mtspr HID4, r3
fff00108    4c 00 01 2c    isync
fff0010c    3c 40 00 00    lis   r2, 0
fff00110    60 42 01 00    ori   r2, r2, 0x100
fff00114    7c 5a 03 a6    mtspr SRR0, r2
fff00118    38 a0 00 00    li    r5, 0
fff0010c    7c bb 03 a6    mtspr SRR1, r5
fff00120    4c 00 00 64    rfi
fff00124    60 00 00 00    nop
fff00128    60 00 00 00    nop
fff0012c    60 00 00 00    nop