5,579
edits
Changes
m
fixed redirect
Line 1:
Line 1:
−This page lists the known [[Starlet]] I/O registers. Much of this info comes from Segher & tmbinc's private notes.+
−== IO Memory ==
−
−{| class="wikitable"
−! base
−! function
−! offset
−! description
−! contents/example
−|-
−|0x0D800000
−| hollywood control
−| 0x400 bytes of control registers; these registers are mirrored every 0x400 bytes from 0x0D80000 to 0x0D805fff
−|
−|
−|-
−|0x0D800000
−|IPC
−|
−| reg 0: request pointer
−| To make an IOS request, the physical address of an IOS command struct is written here by the Broadway. Then, Broadway sets bit 0 of IPC reg 1 to indicate a request is ready.
−|-
−|0x0D800004
−|IPC
−|
−| reg 1: semaphore flags
−| Broadway sets bits here as "doorbells" to indicate status; Starlet responds by setting flags here.
−|-
−|0x0D800008
−|IPC
−|
−|reg 2: Reply pointer
−| When an IOS request has completed, IOS will modify the original command struct passed in IPC reg 0, copy that pointer to reg 2, then set reg 1 to 0x14 to indicate a reply is ready.
−|-
−|0x0D800010
−|timer (core clock divided by 128)
−|
−|
−|
−|-
−|0x0D800014
−| alarm (interrupt 0 is fired when the timer reaches this value)
−|
−|
−|
−|-
−|0x0D800030
−| something related to interrupts; typical value is 0x854DA94F. Pressing the RESET button will set the 0x20000 bit.
−|
−|
−|
−|-
−|0x0D800034
−|???
−|
−|
−|
−|-
−|0x0D800038
−|active interrupts (write 1 to clear). Pressing the RESET button will set the 0x20000 bit (interrupt 18). Pressing the POWER button will set the 0x800 bit (interrupt 11).
−|
−|
−|
−|-
−|0x0D80003C
−|enabled interrupts
−|
−|
−| clear 0x40000 for legacy di
−|-
−|0x0D800060
−|???
−|
−|
−|
−|-
−|
−0x0D800070
−|???
−|
−|
−| set 0x10 for legacy DI; 0x1 to allow write to exi boot buffer
−|-
−|0x0D8001EC
−|OTP
−|
−|
−| OTP read address (addresses run from 0x80000000..0x8000001F)
−|-
−|
−|
−|
−|
−| 0x80000000 - 0x80000004 stores 20 bytes boot1 SHA-1 hash
−|-
−|
−|
−|
−|
−| 0x80000005 - 0x80000008 common key
−|-
−|
−|
−|
−|
−| 0x80000009 NG id
−|-
−|
−|
−|
−|
−| 0x8000000a - 0x80000010 NG private
−|-
−|
−|
−|
−|
−| 0x80000011 - 0x80000015 NAND HMAC
−|-
−|
−|
−|
−|
−| 0x80000016 - 0x80000019 NAND AES
−|-
−|
−|
−|
−|
−| 0x8000001A - 0x8000001D RNG key
−|-
−|0x0D8001F0
−|OTP
−|
−|
−| OTP data
−|-
−|0x0D800214
−|???
−|
−|
−| Register is read 223 times while booting boot0 and boot1. Never written by boot0 or boot1.
−|-
−|0x0D800224 - 03FF
−|
−|
−| unused
−|
−|-
−|0x0D806800
−|EXI
−| 0x40
−| ppc boot buffer
−|
−|-
−|0x0D8B4000
−| AMBA AHB registers
−|
−|
−|
−|-
−|0x0D8B4000
−|???
−|
−|
−|
−|-
−|0x0D8B4002
−|???
−|
−|
−|
−|-
−|0x0D8B4004
−|???
−|
−|
−|
−|-
−|0x0D8B4006
−|???
−|
−|
−|
−|-
−|0x0D8B4008
−|???
−|
−|
−|
−|-
−|0x0D8B400A
−|???
−|
−|
−|
−|-
−|0x0D8B400C
−|???
−|
−|
−|
−|-
−|0x0D8B400E
−|???
−|
−|
−|
−|-
−|0x0D8B4026
−|???
−|
−|
−|
−|-
−|0x0D8B4074
−|???
−|
−|
−|
−|-
−|0x0D8B4076
−|???
−|
−|
−|
−|-
−|0x0D8B4228
−|
−|
−| AHB command
−| AHB memory flush command. Typical values: 1, 2, 4, 8, 15
−|-
−|0x0D8B422a
−|
−|
−| AHB acknowlegde
−| If AHB memory flush acknowledge, will be set to the command value.
−|}
−[[Category:Wii_Hardware]]
#REDIRECT [[Hollywood/Registers]]
−