In memory of Ben “bushing” Byer, who passed away on Monday, February 8th, 2016.

Changes

Jump to navigation Jump to search

Starlet memory map (view source)

Revision as of 03:40, 16 September 2008

78 bytes removed ,  03:40, 16 September 2008
m
changed Hex formatting (Looks better now, IMO)
Line 54: Line 54:  
|}
 
|}
   −
I/O is at x'0d80_0000 (Starlet private) and x'0d00_0000 (shared with the Broadway).  That is to say, the contents of 0x0d8x are selectively mirrored to 0x0d0x.  This may change depending on some of the registers (e.g. when MIOS is active).
+
I/O is at 0x0D800000 (Starlet private) and 0x0D000000 (shared with the Broadway).  That is to say, the contents of 0x0D8xxxxx are selectively mirrored to 0x0D0xxxxx.  This may change depending on some of the registers (e.g. when MIOS is active).
   −
There is internal SRAM at x'fffe_0000, 128kB of it; this stores the kernel code and data, minus the crypto code.
+
There is internal SRAM at 0xFFFE0000, 128kB of it; this stores the kernel code and data, minus the crypto code.
   −
The GDDR3 is at x'1000_0000, 64MB of it; the upper 12MB are exclusive for use by the Starlet, the rest is shared with the Broadway.
+
The GDDR3 is at 0x10000000, 64MB of it; the upper 12MB are exclusive for use by the Starlet, the rest is shared with the Broadway.
    
0x0D0xxxxx may be an [http://www.arm.com/products/solutions/amba2overview.html AMBA AHB] bus.
 
0x0D0xxxxx may be an [http://www.arm.com/products/solutions/amba2overview.html AMBA AHB] bus.
Line 67: Line 67:  
| base      || function || offset || description || contents/example
 
| base      || function || offset || description || contents/example
 
|-
 
|-
−
|x'0d01_0000||NAND      ||  
+
|0x0D010000||NAND      ||  
 
|-
 
|-
 
|          ||          || 0000 W  || command || 9F000000 (CMD 00: start read sector)
 
|          ||          || 0000 W  || command || 9F000000 (CMD 00: start read sector)
Line 91: Line 91:  
||          ||          || 0014 W  || ecc addr  || target address for DMA (0x40 spare bytes)
 
||          ||          || 0014 W  || ecc addr  || target address for DMA (0x40 spare bytes)
 
|-
 
|-
−
||x'0d02_0000||AES      ||
+
||0x0D020000||AES      ||
 
|-
 
|-
−
||          ||          || 0000 W  || command || 980000ll to start operation (l = len in 16 byte blocks -1)
+
||          ||          || 0000 W  || command || 980000LL to start operation (L = len in 16 byte blocks -1)
 
|-
 
|-
−
||          ||          ||        ||        || 980010ll start operation and "do not reload IV"??
+
||          ||          ||        ||        || 980010LL start operation and "do not reload IV"??
 
|-
 
|-
 
||          ||          ||        ||        || 00000000 reset
 
||          ||          ||        ||        || 00000000 reset
Line 109: Line 109:  
||          ||          || 0010 W  || IV fifo || write 4 words to set IV
 
||          ||          || 0010 W  || IV fifo || write 4 words to set IV
 
|-
 
|-
−
||x'0d03_0000||SHA-1    ||
+
||0x0D030000||SHA-1    ||
 
|-
 
|-
 
||          ||          || 0000 R  || status || MSB means busy
 
||          ||          || 0000 R  || status || MSB means busy
Line 115: Line 115:  
||          ||          || 0000 W  || command || 0x00000000 Reset?
 
||          ||          || 0000 W  || command || 0x00000000 Reset?
 
|-
 
|-
−
||          ||          ||        ||        || 0x8000001f Calculate hash, then increase address by size 0x800
+
||          ||          ||        ||        || 0x8000001F Calculate hash, then increase address by size 0x800
 
|-
 
|-
 
||          ||          || 0004 W  || address || Physical address of data
 
||          ||          || 0004 W  || address || Physical address of data
Line 125: Line 125:  
||          ||          || 000c R  || hash || 2. part of hash value
 
||          ||          || 000c R  || hash || 2. part of hash value
 
|-
 
|-
−
||          ||          || 000c W  || init || 2. part of hash init value: 0xefcdab89
+
||          ||          || 000c W  || init || 2. part of hash init value: 0xEFCDAB89
 
|-
 
|-
 
||          ||          || 0010 R  || hash || 3. part of hash value
 
||          ||          || 0010 R  || hash || 3. part of hash value
 
|-
 
|-
−
||          ||          || 0010 W  || init || 3. part of hash init value: 0x98badcfe
+
||          ||          || 0010 W  || init || 3. part of hash init value: 0x98BADCFE
 
|-
 
|-
 
||          ||          || 0014 R  || hash || 4. part of hash value
 
||          ||          || 0014 R  || hash || 4. part of hash value
Line 137: Line 137:  
||          ||          || 0018 R  || hash || 5. part of hash value
 
||          ||          || 0018 R  || hash || 5. part of hash value
 
|-
 
|-
−
||          ||          || 0018 W  || init || 5. part of hash init value: 0xc3d2e1f0
+
||          ||          || 0018 W  || init || 5. part of hash init value: 0xC3D2E1F0
 
|-
 
|-
−
||x'0d05_0000||OHC !#0    ||
+
||0x0D050000||OHC !#0    ||
 
|-
 
|-
−
||x'0d06_0000||OHC !#1    ||
+
||0x0D060000||OHC !#1    ||
 
|-
 
|-
−
||x'0d07_0000||SDHC !#0    ||
+
||0x0D070000||SDHC !#0    ||
 
|-
 
|-
−
||x'0d07_0100||SDHC !#1    ||
+
||0x0D070100||SDHC !#1    ||
 
|-
 
|-
−
||x'0d80_0000|| hollywood control || 0x400 bytes of control registers; these registers are mirrored every 0x400 bytes from 0x0d80000 to 0x0d805fff
+
||0x0D800000|| hollywood control || 0x400 bytes of control registers; these registers are mirrored every 0x400 bytes from 0x0D80000 to 0x0D805fff
 
|-
 
|-
−
||x'0d80_0000||IPC|||| reg 0: request pointer || To make an IOS request, the physical address of an IOS command struct is written here by the Broadway.  Then, Broadway sets bit 0 of IPC reg 1 to indicate a request is ready.
+
||0x0D800000||IPC|||| reg 0: request pointer || To make an IOS request, the physical address of an IOS command struct is written here by the Broadway.  Then, Broadway sets bit 0 of IPC reg 1 to indicate a request is ready.
 
|-
 
|-
−
||x'0d80_0004||IPC|||| reg 1: semaphore flags || Broadway sets bits here as "doorbells" to indicate status; Starlet responds by setting flags here.  
+
||0x0D800004||IPC|||| reg 1: semaphore flags || Broadway sets bits here as "doorbells" to indicate status; Starlet responds by setting flags here.  
 
|-
 
|-
−
||x'0d80_0008||IPC||||reg 2: Reply pointer ||  When an IOS request has completed, IOS will modify the original command struct passed in IPC reg 0, copy that pointer to reg 2, then set reg 1 to 0x14 to indicate a reply is ready.
+
||0x0D800008||IPC||||reg 2: Reply pointer ||  When an IOS request has completed, IOS will modify the original command struct passed in IPC reg 0, copy that pointer to reg 2, then set reg 1 to 0x14 to indicate a reply is ready.
 
|-
 
|-
−
||x'0d80_0010||timer (core clock divided by 128)
+
||0x0D800010||timer (core clock divided by 128)
 
|-
 
|-
−
||x'0d80_0014|| alarm (interrupt 0 is fired when the timer reaches this value)
+
||0x0D800014|| alarm (interrupt 0 is fired when the timer reaches this value)
 
|-
 
|-
−
||x'0d80_0030|| something related to interrupts; typical value is 0x854da94f.  Pressing the RESET button will set the 0x20000 bit.
+
||0x0D800030|| something related to interrupts; typical value is 0x854DA94F.  Pressing the RESET button will set the 0x20000 bit.
 
|-
 
|-
−
||x'0d80_0034||???
+
||0x0D800034||???
 
|-
 
|-
−
||x'0d80_0038||active interrupts (write 1 to clear).  Pressing the RESET button will set the 0x20000 bit (interrupt 18).  Pressing the POWER button will set the 0x800 bit (interrupt 11).
+
||0x0D800038||active interrupts (write 1 to clear).  Pressing the RESET button will set the 0x20000 bit (interrupt 18).  Pressing the POWER button will set the 0x800 bit (interrupt 11).
 
|-
 
|-
−
||x'0d80_003C||enabled interrupts|| || || clear 0x40000 for legacy di
+
||0x0D80003C||enabled interrupts|| || || clear 0x40000 for legacy di
 
|-
 
|-
−
||x'0d80_0060||???
+
||0x0D800060||???
 
|-
 
|-
−
||x'0d80_0070||??? || || || set 0x10 for legacy DI; 0x1 to allow write to exi boot buffer
+
||0x0D800070||??? || || || set 0x10 for legacy DI; 0x1 to allow write to exi boot buffer
 
|-
 
|-
−
||x'0d80_00C0||GPIO || || || probably data: 0x200 for eject; 0x100 sensor bar enable; 0x20 for tray led
+
||0x0D8000C0||GPIO || || || probably data: 0x200 for eject; 0x100 sensor bar enable; 0x20 for tray led
 
|-
 
|-
−
||x'0d80_00C4||GPIO || || || probably direction
+
||0x0D8000C4||GPIO || || || probably direction
 
|-
 
|-
−
||x'0d80_00DC||???
+
||0x0D8000DC||???
 
|-
 
|-
−
||x'0d80_00E0||GPIO || || || 0x08 -- set to enable DC/DC converter,  
+
||0x0D8000E0||GPIO || || || 0x08 -- set to enable DC/DC converter,  
 
|-
 
|-
−
||x'0d80_00E1||GPIO || || ||  
+
||0x0D8000E1||GPIO || || ||  
 
|-
 
|-
−
||x'0d80_00E2||GPIO || || || debug / "POST" port -- connected to 8 testpads.  boot0 / 1 / 2 output simple codes to indicate boot status.
+
||0x0D8000E2||GPIO || || || debug / "POST" port -- connected to 8 testpads.  boot0 / 1 / 2 output simple codes to indicate boot status.
 
|-
 
|-
−
||x'0d80_00E3||GPIO || || ||  
+
||0x0D8000E3||GPIO || || ||  
 
|-
 
|-
−
||x'0d80_00E4||GPIO || || || probably direction
+
||0x0D8000E4||GPIO || || || probably direction
 
|-
 
|-
−
||x'0d80_00EC||???
+
||0x0D8000EC||???
 
|-
 
|-
−
||x'0d80_00F0|| ? typical value is 0x0070fff6; pressing the POWER button will set the 0x1 bit
+
||0x0D8000F0|| ? typical value is 0x0070FFF6; pressing the POWER button will set the 0x1 bit
 
|-
 
|-
−
||x'0d80_00F4||???
+
||0x0D8000F4||???
 
|-
 
|-
−
||x'0d80_00FC||???
+
||0x0D8000FC||???
 
|-
 
|-
−
||x'0d80_0100||???
+
||0x0D800100||???
 
|-
 
|-
−
||x'0d80_010C||???
+
||0x0D80010C||???
 
|-
 
|-
−
||x'0d80_0110||???
+
||0x0D800110||???
 
|-
 
|-
−
||x'0d80_0114||???
+
||0x0D800114||???
 
|-
 
|-
−
||x'0d80_0118||???
+
||0x0D800118||???
 
|-
 
|-
−
||x'0d80_011C||???
+
||0x0D80011C||???
 
|-
 
|-
−
||x'0d80_0120||???
+
||0x0D800120||???
 
|-
 
|-
−
||x'0d80_0130||???
+
||0x0D800130||???
 
|-
 
|-
−
||x'0d80_0134||???
+
||0x0D800134||???
 
|-
 
|-
−
||x'0d80_0138||???
+
||0x0D800138||???
 
|-
 
|-
−
||x'0d80_0180||??? || || || set 0x40 for legacy DI; 0x100000 set after loadEXI (boot code)
+
||0x0D800180||??? || || || set 0x40 for legacy DI; 0x100000 set after loadEXI (boot code)
 
|-
 
|-
−
||x'0d80_0188||???
+
||0x0D800188||???
 
|-
 
|-
−
||x'0d80_018C||???
+
||0x0D80018C||???
 
|-
 
|-
−
||x'0d80_0190||??? || || || involved in DSKPLL init
+
||0x0D800190||??? || || || involved in DSKPLL init
 
|-
 
|-
−
||x'0d80_0194||??? || || || 0x400 is DI reset (low active) / involved in DSKPLL init
+
||0x0D800194||??? || || || 0x400 is DI reset (low active) / involved in DSKPLL init
 
|-
 
|-
−
||x'0d80_0198||??? || || || set to 0x00FFFFFF as part of "interface / subsytem powerup"
+
||0x0D800198||??? || || || set to 0x00FFFFFF as part of "interface / subsytem powerup"
 
|-
 
|-
−
||x'0d80_01B0||??? || || || ACRPLLSYS
+
||0x0D8001B0||??? || || || ACRPLLSYS
 
|-
 
|-
−
||x'0d80_01B0||??? || || || ACRPLLSYSEXT
+
||0x0D8001B0||??? || || || ACRPLLSYSEXT
 
|-
 
|-
−
||x'0d80_01B8||??? || || || involved in DSKPLL init
+
||0x0D8001B8||??? || || || involved in DSKPLL init
 
|-
 
|-
−
||x'0d80_01BC||???
+
||0x0D8001BC||???
 
|-
 
|-
−
||x'0d80_01C0||???
+
||0x0D8001C0||???
 
|-
 
|-
−
||x'0d80_01DC||??? || || || set to 0x00FFFFFF as part of "interface / subsytem powerup"
+
||0x0D8001DC||??? || || || set to 0x00FFFFFF as part of "interface / subsytem powerup"
 
|-
 
|-
−
||x'0d80_01EC||OTP || || || OTP read address (addresses run from 0x80000000..0x8000001f)
+
||0x0D8001EC||OTP || || || OTP read address (addresses run from 0x80000000..0x8000001F)
 
|-
 
|-
 
||          ||    || || || 0x80000000 - 0x80000004 stores 20 bytes boot1 SHA-1 hash
 
||          ||    || || || 0x80000000 - 0x80000004 stores 20 bytes boot1 SHA-1 hash
Line 253: Line 253:  
||          ||    || || || 0x80000016 - 0x80000019 NAND AES
 
||          ||    || || || 0x80000016 - 0x80000019 NAND AES
 
|-
 
|-
−
||          ||    || || || 0x8000001a - 0x8000001d RNG key
+
||          ||    || || || 0x8000001A - 0x8000001D RNG key
 
|-
 
|-
−
||x'0d80_01F0||OTP || || || OTP data           
+
||0x0D8001F0||OTP || || || OTP data           
 
|-
 
|-
−
||x'0d80_0214||??? || || || Register is 223 times read while booting boot0 and boot1. Never written by boot0 or boot1.
+
||0x0D800214||??? || || || Register is read 223 times while booting boot0 and boot1. Never written by boot0 or boot1.
 
|-
 
|-
−
||x'0d80_0224 - 03ff || || || unused
+
||0x0D800224 - 03FF || || || unused
 
|-
 
|-
−
|x'0d80_6000|| DI || looks almost identical to the Gamecube DI interface
+
|0x0D806000|| DI || looks almost identical to the Gamecube DI interface
 
|-
 
|-
−
||x'0d80_6000|| DISR || || || DI status register
+
||0x0D806000|| DISR || || || DI status register
 
|-
 
|-
−
||x'0d80_6004|| DICVR || || || DI cover register (status2)
+
||0x0D806004|| DICVR || || || DI cover register (status2)
 
|-
 
|-
−
||x'0d80_6008|| DICMDBUF0 || || || DI command buffer 0
+
||0x0D806008|| DICMDBUF0 || || || DI command buffer 0
 
|-
 
|-
−
||x'0d80_600C|| DICMDBUF1 || || || DI command buffer 1
+
||0x0D80600C|| DICMDBUF1 || || || DI command buffer 1
 
|-
 
|-
−
||x'0d80_6010|| DICMDBUF2 || || || DI command buffer 2
+
||0x0D806010|| DICMDBUF2 || || || DI command buffer 2
 
|-
 
|-
−
||x'0d80_6014|| DIMAR || || || DI DMA memory address register
+
||0x0D806014|| DIMAR || || || DI DMA memory address register
 
|-
 
|-
−
||x'0d80_6018|| DILENGTH || || || DI DMA transfer length register
+
||0x0D806018|| DILENGTH || || || DI DMA transfer length register
 
|-
 
|-
−
||x'0d80_6020|| DIMMBUF || || || DI immediate data buffer
+
||0x0D806020|| DIMMBUF || || || DI immediate data buffer
 
|-
 
|-
−
||x'0d80_6024|| DICFG || || || DI configuration register
+
||0x0D806024|| DICFG || || || DI configuration register
 
|-
 
|-
−
||x'0d80_6800||EXI
+
||0x0D806800||EXI
 
|-
 
|-
−
|| || || 0x40 || ppc boot buffer
+
|| | || 0x40 || ppc boot buffer
 
|-
 
|-
−
|x'0d8b_4000|| AMBA AHB registers      ||
+
|0x0D8B4000|| AMBA AHB registers      ||
 
|-
 
|-
−
||x'0d8b_4000||???
+
||0x0D8B4000||???
 
|-
 
|-
−
||x'0d8b_4002||???
+
||0x0D8B4002||???
 
|-
 
|-
−
||x'0d8b_4004||???
+
||0x0D8B4004||???
 
|-
 
|-
−
||x'0d8b_4006||???
+
||0x0D8B4006||???
 
|-
 
|-
−
||x'0d8b_4008||???
+
||0x0D8B4008||???
 
|-
 
|-
−
||x'0d8b_400a||???
+
||0x0D8B400A||???
 
|-
 
|-
−
||x'0d8b_400c||???
+
||0x0D8B400C||???
 
|-
 
|-
−
||x'0d8b_400e||???
+
||0x0D8B400E||???
 
|-
 
|-
−
||x'0d8b_4026||???
+
||0x0D8B4026||???
 
|-
 
|-
−
||x'0d8b_4074||???
+
||0x0D8B4074||???
 
|-
 
|-
−
||x'0d8b_4076||???
+
||0x0D8B4076||???
 
|-
 
|-
−
||x'0d8b_4228||                ||      || AHB command    || AHB memory flush command. Typical values: 1, 2, 4, 8, 15
+
||0x0D8B4228||                ||      || AHB command    || AHB memory flush command. Typical values: 1, 2, 4, 8, 15
 
|-
 
|-
−
||x'0d8b_422a||                ||      || AHB acknowlegde || If AHB memory flush acknowledge, will be set to the command value.
+
||0x0D8B422a||                ||      || AHB acknowlegde || If AHB memory flush acknowledge, will be set to the command value.
 
|}
 
|}
 
[[Category:Wii_Hardware]]
 
[[Category:Wii_Hardware]]
SquidMan
508

edits

Retrieved from "https://wiibrew.org/wiki/Special:MobileDiff/26931"

Navigation menu