Hollywood/Registers

From WiiBrew
< Hollywood(Redirected from Starlet Memory Map)
Jump to navigation Jump to search
Registers
Access
BroadwayPartial
StarletFull
Registers
Address0x0d000000
AHB Mirror0x0d800000
Length0x400
Access size32 bits
Byte orderBig Endian
IRQs
Broadway14
Hollywood0,10,11,17,30,31,...[check]
This box: view • talk • edit

The Hollywood chipset includes a large register area including many miscellaneous controls. Some of these registers can be accessed by the PowerPC. Address bit 23 (0x00800000; aka AHB_TRUSTED_OFFSET) controls the permission: if it is set, then the registers are accessed with Starlet permission (full access). If it is clear, only the PPC subset of the registers is visible. From the PPC, the state of this bit is irrelevant, which suggests that it is forced to zero internally in one of the buses.

See also the MINI source code, especially hollywood.h.

Register list

Hollywood Registers
Address Bits Name Description
0x0d800000 32 HW_IPC_PPCMSG IPC
0x0d800004 32 HW_IPC_PPCCTRL
0x0d800008 32 HW_IPC_ARMMSG
0x0d80000c 32 HW_IPC_ARMCTRL
0x0d800010 32 HW_TIMER Starlet Timer
0x0d800014 32 HW_ALARM
0x0d800018 32 HW_VI1CFG VI-configuration related, unused?
0x0d80001C 32 HW_VIDIM Dims the video output
0x0d800024 32 HW_VISOLID Sets the video output to a solid color
0x0d800030 32 HW_PPCIRQFLAG Hollywood IRQ controller
0x0d800034 32 HW_PPCIRQMASK
0x0d800038 32 HW_ARMIRQFLAG
0x0d80003c 32 HW_ARMIRQMASK
0x0d800040 32 HW_ARMFIQMASK
0x0d800044 32 HW_IOPINTPPC
0x0d800048 32 HW_WDGINTSTS
0x0d80004c 32 HW_WDGCFG
0x0d800050 32 HW_DMAADRINTSTS
0x0d800054 32 HW_CPUADRINTSTS
0x0d800058 32 HW_DBGINTSTS
0x0d80005c 32 HW_DBGINTEN
0x0d800060 32 HW_SRNPROT Probably bus control; includes the SRAM bank swap
0x0d800064 32 HW_AHBPROT Access control for the PPC to access devices on the AHB ("HW_BUSPROT")
0x0d800068 32 HW_I2CIOPINTEN
0x0d80006c 32 HW_I2CIOPINTSTS
0x0d800070 32 HW_AIPPROT EXI PPC enable / control / other; probably related to Flipper interface compatibility
0x0d800074 32 HW_AIPIOCTRL Probably related to Flipper interface compatibility/bus control
0x0d800078 32 HW_VIINTEN
0x0d80007c 32 HW_VIINTSTS
0x0d800080 32 HW_USBDBG0 USB-related, unused?
0x0d800084 32 HW_USBDBG1
0x0d800088 32 HW_USBFRCRST
0x0d80008c 32 HW_USBIOTEST
0x0d800090 32 HW_ELA_REG_ADDR Unknown ("embedded logic-analyzer?!")
0x0d800094 32 HW_ELA_REG_DATA
0x0d800098 32 HW_MEMTSTN
0x0d80009c 32 HW_MEMTSTP
0x0d8000c0 32 HW_GPIOB_OUT Hollywood GPIOs
0x0d8000c4 32 HW_GPIOB_DIR
0x0d8000c8 32 HW_GPIOB_IN
0x0d8000cc 32 HW_GPIOB_INTLVL
0x0d8000d0 32 HW_GPIOB_INTFLAG
0x0d8000d4 32 HW_GPIOB_INTMASK
0x0d8000d8 32 HW_GPIOB_STRAPS
0x0d8000dc 32 HW_GPIO_ENABLE
0x0d8000e0 32 HW_GPIO_OUT
0x0d8000e4 32 HW_GPIO_DIR
0x0d8000e8 32 HW_GPIO_IN
0x0d8000ec 32 HW_GPIO_INTLVL
0x0d8000f0 32 HW_GPIO_INTFLAG
0x0d8000f4 32 HW_GPIO_INTMASK
0x0d8000f8 32 HW_GPIO_STRAPS
0x0d8000fc 32 HW_GPIO_OWNER
0x0d800100 32 HW_ARB_CFG_M0 AHB-related registers?
0x0d800104 32 HW_ARB_CFG_M1
0x0d800108 32 HW_ARB_CFG_M2
0x0d80010c 32 HW_ARB_CFG_M3
0x0d800110 32 HW_ARB_CFG_M4
0x0d800114 32 HW_ARB_CFG_M5
0x0d800118 32 HW_ARB_CFG_M6
0x0d80011c 32 HW_ARB_CFG_M7
0x0d800120 32 HW_ARB_CFG_M8
0x0d800124 32 HW_ARB_CFG_M9
0x0d800130 32 HW_ARB_CFG_MC
0x0d800134 32 HW_ARB_CFG_MD
0x0d800138 32 HW_ARB_CFG_ME
0x0d80013c 32 HW_ARB_CFG_MF
0x0d800140 32 HW_ARB_CFG_CPU
0x0d800144 32 HW_ARB_CFG_DMA
0x0d800148 32 HW_ARB_PCNTCFG
0x0d80014c 32 HW_ARB_PCNTSTS
0x0d800150 32 HW_I2CSCTRL
0x0d800154 32 HW_I2CSSTS
0x0d800158 32 HW_I2CSRDEN
0x0d800160 32 HW_I2CSTRAP
0x0d800164 32 HW_I2CSCTRL
0x0d800168 32 HW_I2CSVISETYUV
0x0d80016C 32 HW_I2CSVISETFILT
0x0d800170 32 HW_SPARE2
0x0d800174 32 HW_SPARE3
0x0d800180 32 HW_COMPAT Some DI stuff and boot code and [check]
0x0d800184 32 HW_RESET_AHB (ACRRSTAHB)
0x0d800188 32 HW_SPARE0 ?
0x0d80018c 32 HW_BOOT0 (ACR_SPARE1) Controls boot0 mapping? [check]
0x0d800190 32 HW_CLOCKS (ACRSYSCTRL) clock stuff?
0x0d800194 32 HW_RESETS (ACRRSTCTRL) System resets / power[check]
0x0d800198 32 HW_IFPOWER (ACRCLKGATE) set to 0xFFFFFF when Wii wakes up ("interfaces")
0x0d80019c 32 HW_PLLDR PLL/Clock configuration (?)
0x0d8001a0 32 HW_PLLSYSEXT1
0x0d8001a4 32 HW_PLLSYSEXT2
0x0d8001a8 32 HW_PLLAIEXT1
0x0d8001ac 32 HW_PLLATEXT2
0x0d8001b0 32 HW_PLLSYS
0x0d8001b4 32 HW_PLLSYSEXT
0x0d8001b8 32 HW_PLLDSK
0x0d8001bc 32 HW_PLLDDR
0x0d8001c0 32 HW_PLLDDREXT
0x0d8001c4 32 HW_PLLVI
0x0d8001c8 32 HW_PLLVIEXT
0x0d8001cc 32 HW_PLLAI
0x0d8001d0 32 HW_PLLAIEXT
0x0d8001d4 32 HW_PLLUSB
0x0d8001d8 32 HW_PLLUSBEXT
0x0d8001dc 32 HW_IOPWRCTRL set to 0xFFFFFFF when Wii wakes up ("subsystems")
0x0d8001e0 32 HW_IOSTRCTRL0 More clock registers?
0x0d8001e4 32 HW_IOSTRCTRL1
0x0d8001e8 32 HW_CLKSTRCTRL
0x0d8001ec 32 HW_OTPCMD (ACREFUSEADDR) OTP
0x0d8001f0 32 HW_OTPDATA (ACREFUSEDATA)
0x0d8001f4 32 HW_DBGCLK Debug registers
0x0d8001f8 32 HW_OBSCLKOCTRL
0x0d8001fc 32 HW_OBSCLKICTRL
0x0d800200 32 HW_DBGPORT
0x0d800204 32 HW_SICLKDIV SI-related, unused?
0x0d800208 32 HW_SICTRL
0x0d80020c 32 HW_SIDATA
0x0d800210 32 HW_SIINT
0x0d800214 32 HW_VERSION (ACRCHIPREVID) Hollywood version
0x0d800218 32 HW_DBGBUSRD
0x0d8b420a 16 MEM_PROT MEM2 protection enable
0x0d8b420c 16 MEM_PROT_START MEM2 protection low address (upper 16 bits)
0x0d8b420e 16 MEM_PROT_END MEM2 protection high address (upper 16 bits)
0x0d8b4228 16 MEM_FLUSHREQ AHB flush request
0x0d8b422a 16 MEM_FLUSHACK AHB flush ack

General Registers

HW_VI1CFG (0x0d800018)
  31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16
Access ? R/W ?
Field A
  15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
Access ?
Field

The purpose of this register is unknown.

Field Description
A Set in System Menu (and BC-NAND on vWii) if game region is set to JP in setting.txt. Corresponds to bit 1 of VISEL.


HW_VIDIM (0x0d80001c)
  31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16
Access ?
Field
  15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
Access ? R/W R/W R/W R/W
Field E Y C

This register controls dimming of the video output.

Field Description
E Turns Dimming on/off
Y Amount to dim luma component (0-7)
C Amount to dim chroma components (0-7)


HW_VISOLID (0x0d800024)
  31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16
Access R/W R/W
Field U V
  15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
Access R/W ? R/W
Field Y E

This register controls the solid color for VI.

Field Description
U U component
V V component
Y Luma component
E Turns solid colour on/off


HW_SRNPROT (0x0d800060)
  31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16
Access U
Field
  15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
Access U R/W R/W R/W R/W R/W R/W R/W
Field H SM U4 U3 C B A

Also known as HW_MEMMIRR. This register controls the visibility of SRAM to various devices or features. The value of the register during normal operation seems to depend on Hollywood revision.

  • In boot1c, set to 0x47 if HWVER (in HW_VERSION) is 0 - otherwise, set to 0x7.
  • When BC is booting, set to 0x67 if HWVER is 0 - otherwise set to 0x27


Field Description
H IOPDBGEN; Set [by boot1, BC, others] if HWVER in HW_VERSION is 0
SM IOUEN; Enables the SRAM mirror at 0xfffe0000 when set
U4 OH1EN; Enables USB access to SRAM?
U3 AHPEN; Enables PPC access to SRAM; Set/cleared by syscall (0x54)
C FLAEN; Enables the Flash/NAND engine access to SRAM
B SHAEN; Enables the SHA-1 engine access to SRAM
A AESEN; Enables the AES engine access to SRAM


HW_AHBPROT (0x0d800064)
  31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16
Access R/W ? R/W R/W R/W R/W R/W R/W R/W R/W ?
Field PPCKERN IOPSD1EN IOPSD0EN IOPOH1EN IOPOH0EN IOPEHCEN IOPSHAEN IOPAESEN IOPFLAEN
  15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
Access ? R/W R/W ? R/W R/W R/W R/W R/W R/W R/W R/W ?
Field PPCAHMEN PPCSREN PPCSD1EN PPCSD0EN PPCOH1EN PPCOH0EN PPCEHCEN PPCSHAEN PPCAESEN PPCFLAEN

This register controls controls the hardware rights (read+write access to various engines/interfaces) for both the PPC (Broadway) and IOP (Starlet/IOS). By default, only Starlet/IOS can write to this register. If a TMD has it's access right bit flipped high, syscall_54 (1) is called from IOS and this register gets logically OR'd with the value of 0x80000DFE, thus giving PPC access to every engine/interface. If the TMD has its access right bit flipped low, syscall_54 (0) is called instead, and the corresponding bits of 0x80000DFE are flipped low. Link - https://hackmii.com/2009/08/of-tmds-and-hardware/

This register has every bit flipped high during the boot stage. Thus if syscall_54 (1) is called, the entire register will have a value of 0xFFFFFFFF.

Flip a bit high to enable read+write access.

Field Description
PPCKERN Gives PPC full read & write access to Hollywood Registers that are normally only accessible to IOS/Starlet. Set/cleared by syscall_54
IOPSD1EN SD Interface #1 IOS/Starlet
IOPSD0EN SD Interface #0 IOS/Starlet
IOPOH1EN Open Host Interface #1 IOS/Starlet
IOPOH0EN Open Host Interface #0 IOS/Starlet
IOPEHCEN Enhanced Host Interface IOS/Starlet
IOPSHAEN SHA-1 Engine IOS/Starlet
IOPAESEN AES Engine IOS/Starlet
IOPFLAEN NAND Engine IOS/Starlet


Field Description
PPCAHMEN ?? Set/cleared by syscall_54
PPCSREN ?? Set/cleared by syscall_54
PPCSD1EN SD Interface #1 PPC. Set/cleared by syscall_54
PPCSD0EN SD Interface #0 PPC. Set/cleared by syscall_54
PPC0H1EN Open Host Interface #1 PPC. Set/cleared by syscall_54
PPC0H0EN Open Host Interface #0 PPC. Set/cleared by syscall_54
PPCEHCEN Enhanced Host Interface PPC. Set/cleared by syscall_54
PPCSHAEN SHA-1 Engine PPC. Set/cleared by syscall_54
PPCAESEN AES Engine PPC. Set/cleared by syscall_54
PPCFLAEN NAND Engine PPC. Set/cleared by syscall_54


HW_AIPPROT (0x0d800070)
  31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16
Access ?
Field
  15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
Access ? R/W ? R/W
Field DI ENAHBIOPI

This register controls at least the current EXI status. It's probably related to bus control/GC compatibility.

Field Description
DI unknown, used with DI-only syscalls 52 and 53, and appears to always be cleared[check]
ENAHBIOPI "Enables the EXI bus." This bit is named in IOS3. It's likely this is related to more than EXI.


HW_AIPIOCTRL (0x0d800074)
  31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16
Access ?
Field
  15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
Access ? ?
Field ENAHBIOMEM

This register is probably related to bus control/GC compatibility.

Field Description
ENAHBIOMEM This bit is named in IOS3.


HW_COMPAT (0x0d800180)
  31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16
Access ? R/W R/W ?
Field DVDVIDEO PPCBOOT
  15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
Access ? ? ? R/W ?
Field B4 B1

This register seems to control some aspects of the PowerPC booting and some DI flags.[check]

Field Description
DVDVIDEO Disables DVD video support. When set to 1, the commands DVDLowReadDVD (0xD0xxxxxx) and DVDLowReadDVDConfig (0xD1xxxxxx) cannot be written to DICMDBUF0. The lower 16 bits of the write go through, but the upper 16 bits of the register keep their previous value.
PPCBOOT needs to be set to allow the PowerPC to read the boot stub.
B4 Potentially related to the IOSTRCTRL registers?
B1 when clear, disables bit 14 in the PPC IRQ flags


HW_BOOT0 (0x0d80018c)
  31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16
Access ?
Field
  15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
Access ? R/W R/W R/W R/W ? R/W ? R/W
Field DSKPLLSRC BOOT0 B11 B10 A3 A0

This register at least controls the boot0 memory mapping and DSK PLL source.

Field Description
BOOT0 Disable boot0 mapping to either x'fffe_0000 or x'ffff_0000 depending on HW_MEMMIRR
DSKPLLSRC According to STM, setting this to 00 "puts DSKPLL back to external reference"
B11 Explicitly set by the [IOS58] kernel on boot
B10 Explicitly set by the [IOS58] kernel on boot
A3 AHB-related? - polled on AHB flush? Related to bit 16 in HW_SPARE0(0x0d800188)?
A0 AHB-related? - polled on AHB flush? Related to bit 16 in HW_SPARE0(0x0d800188)?


HW_CLOCKS (0x0d800190)
  31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16
Access ?
Field
  15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
Access ? R/W R/W
Field SPEED FX

This register is involved in some sort of clocking.

Field Description
FX Unknown, but IOS calls this "FX".
SPEED Sets the Hollywood clock to 243MHz when 0 (Wii mode) or 162MHz when 1 (GC mode)


HW_RESETS (0x0d800194)
  31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16
Access U R/W R/W R/W R/W R/W R/W R/W R/W R/W R/W R/W
Field NLCKB_EDRAM RSTB_EDRAM RSTB_AHB RSTB_IOP RSTB_DSP RSTB_VI1 RSTB_VI RSTB_IOPI RSTB_IOMEM RSTB_IODI RSTB_IOEXI
  15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
Access R/W R/W R/W R/W R/W R/W R/W R/W R/W R/W R/W R/W R/W R/W R/W R/W
Field RSTB_IOSI RSTB_AI_I2S3 RSTB_GFX RSTB_GFXTCPE RSTB_MEM RSTB_DIRSTB RSTB_PI RSTB_MEMRSTB NLCKB_SYSPLL RSTB_SYSPLL SRSTB_CPU RSTB_CPU RSTB_DSKPLL RSTB_MEMRSTB CRSTB RSTBINB

This register seems to contain the RESET control bits for several parts of the system, and possibly power-on stuff too. Reset/off = 0, run/on = 1.

Field Description
NLCKB_EDRAM Unlock external DRAM reset?
RSTB_EDRAM External DRAM reset
RSTB_AHB ARM AHB reset. Kills DI, sets slot LED on, hangs starlet...
RSTB_IOP IOP/Starlet reset
RSTB_VI1 VI1 reset?
RSTB_VI Video Interface reset
RSTB_IOPI Processor Interface IO reset
RSTB_IOMEM MEM IO reset
RSTB_IODI Disk Interface IO reset
RSTB_IOEXI EXI IO reset
RSTB_IOSI SI IO reset
RSTB_AI_I2S3 Audio interface I2S3 reset
RSTB_GFX GFX reset?
RSTB_GFXTCPE GFX TCPE?
RSTB_MEM MEM reset. If cleared, kills EXI-based starlet experimental proxy.
RSTB_DIRSTB Disk Interface reset B


Field Description
NLCKB_SYSPLL Unlock SYSPLL reset?
RSTB_SYSPLL SYSPLL reset. If cleared, kills EXI-based starlet experimental proxy.
SRSTB_CPU PowerPC SRESET (release first)
RSTB_CPU PowerPC HRESET (release second)
RSTB_DSKPLL DSKPLL reset. Is cleared by IOS before modifying 1b8, and set again afterwards
RSTB_MEMRSTB MEM reset B. Also seems to reboot system.
CRSTB CRST? Also seems to reboot system.
RSTBINB System reset. Set to zero to reboot system.


HW_PLLSYS (0x0d8001b0)
  31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16
Access ? R/W? ?
Field clk_0
  15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
Access ?
Field

This register is involved in some sort of clocking.

Field Description
clk_0 Unknown, but IOS calls this "clk_0".


HW_PLLSYSEXT (0x0d8001b4)
  31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16
Access ?
Field
  15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
Access R/W?
Field CPUCLK

This register is involved in some sort of clocking.

Field Description
CPUCLK IOS calls this "clk_1". 100J calls this "CPUCLK". This is probably the bus speed. Bit 8 is never set?

243Mhz - 0x10
216Mhz - 0x12
194Mhz - 0x14
176Mhz - 0x16
162Mhz - 0x18
149Mhz - 0x1a
138Mhz - 0x1c
129Mhz - 0x1e
121Mhz - 0x20
114Mhz - 0x22
108Mhz - 0x24


HW_PLLVIEXT (0x0d8001c8)
  31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16
Access R/W? R/W? ?
Field A B
  15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
Access ?
Field

Probably related to VI clocking.

Field Description
A Related to VI PLL initialization?
B Related to VI PLL initialization?



HW_PLLAIEXT (0x0d8001d0)
  31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16
Access R/W? R/W? ?
Field A B
  15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
Access ?
Field

Probably related to AI clocking.

Field Description
A Related to AI PLL initialization?
B Related to AI PLL initialization?


HW_PLLUSBEXT (0x0d8001d8)
  31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16
Access R/W? R/W? ?
Field A B
  15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
Access ?
Field

Probably related to USB clocking.

Field Description
A Related to USB PLL initialization?
B Related to USB PLL initialization?


HW_VERSION (0x0d800214)
  31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16
Access U
Field
  15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
Access U R R
Field HWVER HWREV

This register contains the hardware revision of the Hollywood chipset. Observed values:

  • Hollywood ES1.x - 0x00 to 0x0f (?)
  • Hollywood ES2.0 - 0x10
  • Hollywood ES2.1 - 0x11
Field Description
HWVER Hollywood Version
HWREV Hollywood Revision
Retrieved from "https://wiibrew.org/w/index.php?title=Hollywood/Registers&oldid=119938"