In memory of Ben “bushing” Byer, who passed away on Monday, February 8th, 2016.

Difference between revisions of "Starlet memory map"

From WiiBrew
Jump to navigation Jump to search
m (Fix table alignment)
m (→‎IO Memory: wiki table cleanup)
Line 4: Line 4:
  
 
{| border="1"
 
{| border="1"
−
! base     !! function !! offset !! description !! contents/example
+
! base
 +
! function
 +
! offset
 +
! description
 +
! contents/example
 
|-
 
|-
−
||0x0D800000|| hollywood control || 0x400 bytes of control registers; these registers are mirrored every 0x400 bytes from 0x0D80000 to 0x0D805fff
+
|0x0D800000
 +
| hollywood control
 +
| 0x400 bytes of control registers; these registers are mirrored every 0x400 bytes from 0x0D80000 to 0x0D805fff
 +
|
 +
|
 
|-
 
|-
−
||0x0D800000||IPC|||| reg 0: request pointer || To make an IOS request, the physical address of an IOS command struct is written here by the Broadway.  Then, Broadway sets bit 0 of IPC reg 1 to indicate a request is ready.
+
|0x0D800000
 +
|IPC
 +
|
 +
| reg 0: request pointer
 +
| To make an IOS request, the physical address of an IOS command struct is written here by the Broadway.  Then, Broadway sets bit 0 of IPC reg 1 to indicate a request is ready.
 
|-
 
|-
−
||0x0D800004||IPC|||| reg 1: semaphore flags || Broadway sets bits here as "doorbells" to indicate status; Starlet responds by setting flags here.  
+
|0x0D800004
 +
|IPC
 +
|
 +
| reg 1: semaphore flags
 +
| Broadway sets bits here as "doorbells" to indicate status; Starlet responds by setting flags here.
 
|-
 
|-
−
||0x0D800008||IPC||||reg 2: Reply pointer ||  When an IOS request has completed, IOS will modify the original command struct passed in IPC reg 0, copy that pointer to reg 2, then set reg 1 to 0x14 to indicate a reply is ready.
+
|0x0D800008
 +
|IPC
 +
|
 +
|reg 2: Reply pointer
 +
|  When an IOS request has completed, IOS will modify the original command struct passed in IPC reg 0, copy that pointer to reg 2, then set reg 1 to 0x14 to indicate a reply is ready.
 
|-
 
|-
−
||0x0D800010||timer (core clock divided by 128)
+
|0x0D800010
 +
|timer (core clock divided by 128)
 +
|
 +
|
 +
|
 
|-
 
|-
−
||0x0D800014|| alarm (interrupt 0 is fired when the timer reaches this value)
+
|0x0D800014
 +
| alarm (interrupt 0 is fired when the timer reaches this value)
 +
|
 +
|
 +
|
 
|-
 
|-
−
||0x0D800030|| something related to interrupts; typical value is 0x854DA94F.  Pressing the RESET button will set the 0x20000 bit.
+
|0x0D800030
 +
| something related to interrupts; typical value is 0x854DA94F.  Pressing the RESET button will set the 0x20000 bit.
 +
|
 +
|
 +
|
 
|-
 
|-
−
||0x0D800034||???
+
|0x0D800034
 +
|???
 +
|
 +
|
 +
|
 
|-
 
|-
−
||0x0D800038||active interrupts (write 1 to clear).  Pressing the RESET button will set the 0x20000 bit (interrupt 18).  Pressing the POWER button will set the 0x800 bit (interrupt 11).
+
|0x0D800038
 +
|active interrupts (write 1 to clear).  Pressing the RESET button will set the 0x20000 bit (interrupt 18).  Pressing the POWER button will set the 0x800 bit (interrupt 11).
 +
|
 +
|
 +
|
 
|-
 
|-
−
||0x0D80003C||enabled interrupts|| || || clear 0x40000 for legacy di
+
|0x0D80003C
 +
|enabled interrupts
 +
|
 +
|
 +
| clear 0x40000 for legacy di
 
|-
 
|-
−
||0x0D800060||???
+
|0x0D800060
 +
|???
 +
|
 +
|
 +
|
 
|-
 
|-
−
||0x0D800070||??? || || || set 0x10 for legacy DI; 0x1 to allow write to exi boot buffer
+
|
 +
0x0D800070
 +
|???
 +
|
 +
|
 +
| set 0x10 for legacy DI; 0x1 to allow write to exi boot buffer
 
|-
 
|-
−
||0x0D8001EC||OTP || || || OTP read address (addresses run from 0x80000000..0x8000001F)
+
|0x0D8001EC
 +
|OTP
 +
|
 +
|
 +
| OTP read address (addresses run from 0x80000000..0x8000001F)
 
|-
 
|-
−
||           ||    || || || 0x80000000 - 0x80000004 stores 20 bytes boot1 SHA-1 hash
+
|
 +
|
 +
|
 +
|
 +
| 0x80000000 - 0x80000004 stores 20 bytes boot1 SHA-1 hash
 
|-
 
|-
−
||           ||    || || || 0x80000005 - 0x80000008 common key
+
|
 +
|
 +
|
 +
|
 +
| 0x80000005 - 0x80000008 common key
 
|-
 
|-
−
||           ||    || || || 0x80000009 NG id
+
|
 +
|
 +
|
 +
|
 +
| 0x80000009 NG id
 
|-
 
|-
−
||           ||    || || || 0x8000000a - 0x80000010 NG private
+
|
 +
|
 +
|
 +
|
 +
| 0x8000000a - 0x80000010 NG private
 
|-
 
|-
−
||           ||    || || || 0x80000011 - 0x80000015 NAND HMAC
+
|
 +
|
 +
|
 +
|
 +
| 0x80000011 - 0x80000015 NAND HMAC
 
|-
 
|-
−
||           ||    || || || 0x80000016 - 0x80000019 NAND AES
+
|
 +
|
 +
|
 +
|
 +
| 0x80000016 - 0x80000019 NAND AES
 
|-
 
|-
−
||           ||    || || || 0x8000001A - 0x8000001D RNG key
+
|
 +
|
 +
|
 +
|
 +
| 0x8000001A - 0x8000001D RNG key
 
|-
 
|-
−
||0x0D8001F0||OTP || || || OTP data          
+
|0x0D8001F0
 +
|OTP
 +
|
 +
|
 +
| OTP data
 
|-
 
|-
−
||0x0D800214||??? || || || Register is read 223 times while booting boot0 and boot1. Never written by boot0 or boot1.
+
|0x0D800214
 +
|???
 +
|
 +
|
 +
| Register is read 223 times while booting boot0 and boot1. Never written by boot0 or boot1.
 
|-
 
|-
−
||0x0D800224 - 03FF || || || unused
+
|0x0D800224 - 03FF
 +
|
 +
|
 +
| unused
 +
|
 
|-
 
|-
−
||0x0D806800||EXI
+
|0x0D806800
 +
|EXI
 +
| 0x40
 +
| ppc boot buffer
 +
|
 
|-
 
|-
−
|| | || 0x40 || ppc boot buffer
+
|0x0D8B4000
 +
| AMBA AHB registers
 +
|
 +
|
 +
|
 
|-
 
|-
−
|0x0D8B4000|| AMBA AHB registers      ||
+
|0x0D8B4000
 +
|???
 +
|
 +
|
 +
|
 
|-
 
|-
−
||0x0D8B4000||???
+
|0x0D8B4002
 +
|???
 +
|
 +
|
 +
|
 
|-
 
|-
−
||0x0D8B4002||???
+
|0x0D8B4004
 +
|???
 +
|
 +
|
 +
|
 
|-
 
|-
−
||0x0D8B4004||???
+
|0x0D8B4006
 +
|???
 +
|
 +
|
 +
|
 
|-
 
|-
−
||0x0D8B4006||???
+
|0x0D8B4008
 +
|???
 +
|
 +
|
 +
|
 
|-
 
|-
−
||0x0D8B4008||???
+
|0x0D8B400A
 +
|???
 +
|
 +
|
 +
|
 
|-
 
|-
−
||0x0D8B400A||???
+
|0x0D8B400C
 +
|???
 +
|
 +
|
 +
|
 
|-
 
|-
−
||0x0D8B400C||???
+
|0x0D8B400E
 +
|???
 +
|
 +
|
 +
|
 
|-
 
|-
−
||0x0D8B400E||???
+
|0x0D8B4026
 +
|???
 +
|
 +
|
 +
|
 
|-
 
|-
−
||0x0D8B4026||???
+
|0x0D8B4074
 +
|???
 +
|
 +
|
 +
|
 
|-
 
|-
−
||0x0D8B4074||???
+
|0x0D8B4076
 +
|???
 +
|
 +
|
 +
|
 
|-
 
|-
−
||0x0D8B4076||???
+
|0x0D8B4228
 +
|
 +
|
 +
| AHB command
 +
| AHB memory flush command. Typical values: 1, 2, 4, 8, 15
 
|-
 
|-
−
||0x0D8B4228||                ||      || AHB command    || AHB memory flush command. Typical values: 1, 2, 4, 8, 15
+
|0x0D8B422a
−
|-
+
|
−
||0x0D8B422a||                ||      || AHB acknowlegde || If AHB memory flush acknowledge, will be set to the command value.
+
|
 +
| AHB acknowlegde
 +
| If AHB memory flush acknowledge, will be set to the command value.
 
|}
 
|}
 
[[Category:Wii_Hardware]]
 
[[Category:Wii_Hardware]]

Revision as of 02:54, 1 April 2009

This page lists the known Starlet I/O registers. Much of this info comes from Segher & tmbinc's private notes.

IO Memory

base function offset description contents/example
0x0D800000 hollywood control 0x400 bytes of control registers; these registers are mirrored every 0x400 bytes from 0x0D80000 to 0x0D805fff
0x0D800000 IPC reg 0: request pointer To make an IOS request, the physical address of an IOS command struct is written here by the Broadway. Then, Broadway sets bit 0 of IPC reg 1 to indicate a request is ready.
0x0D800004 IPC reg 1: semaphore flags Broadway sets bits here as "doorbells" to indicate status; Starlet responds by setting flags here.
0x0D800008 IPC reg 2: Reply pointer When an IOS request has completed, IOS will modify the original command struct passed in IPC reg 0, copy that pointer to reg 2, then set reg 1 to 0x14 to indicate a reply is ready.
0x0D800010 timer (core clock divided by 128)
0x0D800014 alarm (interrupt 0 is fired when the timer reaches this value)
0x0D800030 something related to interrupts; typical value is 0x854DA94F. Pressing the RESET button will set the 0x20000 bit.
0x0D800034 ???
0x0D800038 active interrupts (write 1 to clear). Pressing the RESET button will set the 0x20000 bit (interrupt 18). Pressing the POWER button will set the 0x800 bit (interrupt 11).
0x0D80003C enabled interrupts clear 0x40000 for legacy di
0x0D800060 ???

0x0D800070

??? set 0x10 for legacy DI; 0x1 to allow write to exi boot buffer
0x0D8001EC OTP OTP read address (addresses run from 0x80000000..0x8000001F)
0x80000000 - 0x80000004 stores 20 bytes boot1 SHA-1 hash
0x80000005 - 0x80000008 common key
0x80000009 NG id
0x8000000a - 0x80000010 NG private
0x80000011 - 0x80000015 NAND HMAC
0x80000016 - 0x80000019 NAND AES
0x8000001A - 0x8000001D RNG key
0x0D8001F0 OTP OTP data
0x0D800214 ??? Register is read 223 times while booting boot0 and boot1. Never written by boot0 or boot1.
0x0D800224 - 03FF unused
0x0D806800 EXI 0x40 ppc boot buffer
0x0D8B4000 AMBA AHB registers
0x0D8B4000 ???
0x0D8B4002 ???
0x0D8B4004 ???
0x0D8B4006 ???
0x0D8B4008 ???
0x0D8B400A ???
0x0D8B400C ???
0x0D8B400E ???
0x0D8B4026 ???
0x0D8B4074 ???
0x0D8B4076 ???
0x0D8B4228 AHB command AHB memory flush command. Typical values: 1, 2, 4, 8, 15
0x0D8B422a AHB acknowlegde If AHB memory flush acknowledge, will be set to the command value.
Retrieved from "https://wiibrew.org/w/index.php?title=Starlet_memory_map&oldid=48430"