Difference between revisions of "Starlet memory map"
Jump to navigation
Jump to search
(moved info to individual Hardware pages) |
(move memory map) |
||
| Line 1: | Line 1: | ||
This page lists the known [[Starlet]] I/O registers. Much of this info comes from Segher & tmbinc's private notes. | This page lists the known [[Starlet]] I/O registers. Much of this info comes from Segher & tmbinc's private notes. | ||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
== IO Memory == | == IO Memory == | ||
Revision as of 03:52, 26 February 2009
This page lists the known Starlet I/O registers. Much of this info comes from Segher & tmbinc's private notes.
IO Memory
| base | function | offset | description | contents/example |
|---|---|---|---|---|
| 0x0D800000 | hollywood control | 0x400 bytes of control registers; these registers are mirrored every 0x400 bytes from 0x0D80000 to 0x0D805fff | ||
| 0x0D800000 | IPC | reg 0: request pointer | To make an IOS request, the physical address of an IOS command struct is written here by the Broadway. Then, Broadway sets bit 0 of IPC reg 1 to indicate a request is ready. | |
| 0x0D800004 | IPC | reg 1: semaphore flags | Broadway sets bits here as "doorbells" to indicate status; Starlet responds by setting flags here. | |
| 0x0D800008 | IPC | reg 2: Reply pointer | When an IOS request has completed, IOS will modify the original command struct passed in IPC reg 0, copy that pointer to reg 2, then set reg 1 to 0x14 to indicate a reply is ready. | |
| 0x0D800010 | timer (core clock divided by 128) | |||
| 0x0D800014 | alarm (interrupt 0 is fired when the timer reaches this value) | |||
| 0x0D800030 | something related to interrupts; typical value is 0x854DA94F. Pressing the RESET button will set the 0x20000 bit. | |||
| 0x0D800034 | ??? | |||
| 0x0D800038 | active interrupts (write 1 to clear). Pressing the RESET button will set the 0x20000 bit (interrupt 18). Pressing the POWER button will set the 0x800 bit (interrupt 11). | |||
| 0x0D80003C | enabled interrupts | clear 0x40000 for legacy di | ||
| 0x0D800060 | ??? | |||
| 0x0D800070 | ??? | set 0x10 for legacy DI; 0x1 to allow write to exi boot buffer | ||
| 0x0D8000C0 | GPIO | probably data: 0x200 for eject; 0x100 sensor bar enable; 0x20 for tray led | ||
| 0x0D8000C4 | GPIO | probably direction | ||
| 0x0D8000DC | ??? | |||
| 0x0D8000E0 | GPIO | 0x08 -- set to enable DC/DC converter, | ||
| 0x0D8000E1 | GPIO | |||
| 0x0D8000E2 | GPIO | debug / "POST" port -- connected to 8 testpads. boot0 / 1 / 2 output simple codes to indicate boot status. | ||
| 0x0D8000E3 | GPIO | |||
| 0x0D8000E4 | GPIO | probably direction | ||
| 0x0D8000EC | ??? | |||
| 0x0D8000F0 | ? typical value is 0x0070FFF6; pressing the POWER button will set the 0x1 bit | |||
| 0x0D8000F4 | ??? | |||
| 0x0D8000FC | ??? | |||
| 0x0D800100 | ??? | |||
| 0x0D80010C | ??? | |||
| 0x0D800110 | ??? | |||
| 0x0D800114 | ??? | |||
| 0x0D800118 | ??? | |||
| 0x0D80011C | ??? | |||
| 0x0D800120 | ??? | |||
| 0x0D800130 | ??? | |||
| 0x0D800134 | ??? | |||
| 0x0D800138 | ??? | |||
| 0x0D800180 | ??? | set 0x40 for legacy DI; 0x100000 set after loadEXI (boot code) | ||
| 0x0D800188 | ??? | |||
| 0x0D80018C | ??? | |||
| 0x0D800190 | ??? | involved in DSKPLL init | ||
| 0x0D800194 | ??? | 0x400 is DI reset (low active) / involved in DSKPLL init | ||
| 0x0D800198 | ??? | set to 0x00FFFFFF as part of "interface / subsytem powerup" | ||
| 0x0D8001B0 | ??? | ACRPLLSYS | ||
| 0x0D8001B0 | ??? | ACRPLLSYSEXT | ||
| 0x0D8001B8 | ??? | involved in DSKPLL init | ||
| 0x0D8001BC | ??? | |||
| 0x0D8001C0 | ??? | |||
| 0x0D8001DC | ??? | set to 0x00FFFFFF as part of "interface / subsytem powerup" | ||
| 0x0D8001EC | OTP | OTP read address (addresses run from 0x80000000..0x8000001F) | ||
| 0x80000000 - 0x80000004 stores 20 bytes boot1 SHA-1 hash | ||||
| 0x80000005 - 0x80000008 common key | ||||
| 0x80000009 NG id | ||||
| 0x8000000a - 0x80000010 NG private | ||||
| 0x80000011 - 0x80000015 NAND HMAC | ||||
| 0x80000016 - 0x80000019 NAND AES | ||||
| 0x8000001A - 0x8000001D RNG key | ||||
| 0x0D8001F0 | OTP | OTP data | ||
| 0x0D800214 | ??? | Register is read 223 times while booting boot0 and boot1. Never written by boot0 or boot1. | ||
| 0x0D800224 - 03FF | unused | |||
| 0x0D806000 | DI | looks almost identical to the Gamecube DI interface | ||
| 0x0D806000 | DISR | DI status register | ||
| 0x0D806004 | DICVR | DI cover register (status2) | ||
| 0x0D806008 | DICMDBUF0 | DI command buffer 0 | ||
| 0x0D80600C | DICMDBUF1 | DI command buffer 1 | ||
| 0x0D806010 | DICMDBUF2 | DI command buffer 2 | ||
| 0x0D806014 | DIMAR | DI DMA memory address register | ||
| 0x0D806018 | DILENGTH | DI DMA transfer length register | ||
| 0x0D806020 | DIMMBUF | DI immediate data buffer | ||
| 0x0D806024 | DICFG | DI configuration register | ||
| 0x0D806800 | EXI | |||
| | | 0x40 | ppc boot buffer | ||
| 0x0D8B4000 | AMBA AHB registers | |||
| 0x0D8B4000 | ??? | |||
| 0x0D8B4002 | ??? | |||
| 0x0D8B4004 | ??? | |||
| 0x0D8B4006 | ??? | |||
| 0x0D8B4008 | ??? | |||
| 0x0D8B400A | ??? | |||
| 0x0D8B400C | ??? | |||
| 0x0D8B400E | ??? | |||
| 0x0D8B4026 | ??? | |||
| 0x0D8B4074 | ??? | |||
| 0x0D8B4076 | ??? | |||
| 0x0D8B4228 | AHB command | AHB memory flush command. Typical values: 1, 2, 4, 8, 15 | ||
| 0x0D8B422a | AHB acknowlegde | If AHB memory flush acknowledge, will be set to the command value. |