last modified: Mon, 30 May 2005 03:58:01 Yet Another Gamecube Documentation (but one that's worth printing) images/yagcd_logo.png this is the result of myself pasting together various freely available documents aswell as adding some of my own findings. have fun... additions and corrections welcome :) THIS IS WORK IN PROGRESS! INFORMATION CONTAINED IN THIS DOCUMENT MAY BE MISSING, INCOMPLETE OR EVEN PLAIN WRONG! NO F****N' WARRANTY IMPLIED! IF THE USE OF THE INFORMATION CONTAINED HERE RESULTS IN ULTRA REALISTIC SMOKE EFFECTS, BRAIN DAMAGE OR LOSS OF PHYSICAL AND/OR MENTAL HEALTH PLEASE DON'T COME BACK AND SAY YOU HAVEN'T BEEN WARNED! YOU SHOULDN'T BE USING THIS IN THE FIRST PLACE! groepaz/hitmen (groepaz@gmx.net) Hitmen-Console http://www.hitmen-console.org Contents * 1_Introductional_Rant o 1.1_Things_that_are_in_this_document o 1.2_Things_that_are_not_in_this_document o 1.3_Conventions o 1.4_legal_Babble * 2_Gamecube_Hardware_Introduction o 2.1_enhanced_PowerPC_750_Specification o 2.2_Consumer_Units # 2.2.1_Nintendo # 2.2.2_Panasonic_Q o 2.3_Development_Units o 2.4_Hardware_Parts_List # 2.4.1_Connectors # 2.4.2_Semi-Conductors o 2.5_Details_on_the_motherboard_buses o 2.6_Details_on_the_Macronix_(MX)_Chips o 2.7_DVD_Protection # 2.7.1_Filesystem # 2.7.2_Barcode # 2.7.3_Encryption o 2.8_IPL/BIOS_Encryption # 2.8.1_Flipper_decryption_logic_bug # 2.8.2_Cyphertext_algorithm # 2.8.3_replacing_the_IPL * 3_Gekko_CPU_Overview o 3.1_Registers o 3.2_Calling_conventions o 3.3_PPC_Instructions # 3.3.1_Integer_Instructions # 3.3.2_Floating-Point_Instructions # 3.3.3_Integer_Load_and_Store_Instructions # 3.3.4_Floating-Point_Load_and_Store_Instructions # 3.3.5_Branch_Instructions # 3.3.6_Condition_Register_Logical_Instructions # 3.3.7_Misc_Instructions o 3.4_additional_Gekko_Instructions # 3.4.1_FPR_format_in_paired-single_mode # 3.4.2_Arithmetic_Instructions # 3.4.3_Load_and_Store_Instructions # 3.4.4_modified_floating_point_instructions o 3.5_Programming_Tips_and_additional_information # 3.5.1_Machine_State_Register # 3.5.2_Caches # 3.5.3_branch_unit * 4_Memory_Map o 4.1_Overview o 4.2_RAM_usage # 4.2.1_Dolphin-OS_globals # 4.2.2_Exception_Handlers # 4.2.3_Dolphin-OS_globals # 4.2.4_User_Memory * 5_Hardware_Registers o 5.1_CP_-_Command_Processor # 5.1.1_Token_register o 5.2_PE_-_Pixel_Engine o 5.3_VI_-_Video_Interface # 5.3.1_Video_Modes o 5.4_PI_-_Processor_Interface # 5.4.1_Operation o 5.5_MI_-_Memory_Interface o 5.6_DSP_-_Digital_Signal_Processor_Interface # 5.6.1_internal_DSP_Registers # 5.6.2_Operation o 5.7_DI_-_DVD_Interface # 5.7.1_Drive_Commands # 5.7.2_Drive_Debug_Commands # 5.7.3_Operation # 5.7.4_DVD-ROM_Subsystem o 5.8_SI_-_Serial_Interface # 5.8.1_Operation o 5.9_EXI_-_External_Interface # 5.9.1_Operation o 5.10_AI_-_Audio_Streaming_Interface o 5.11_GX_FIFO_(Graphic_display_lists) # 5.11.1_internal_BP_registers # 5.11.2_internal_CP_Registers # 5.11.3_internal_XF_Memory # 5.11.4_internal_XF_Registers # 5.11.5_GP_packet_description * 6_Exception_and_Interrupt_Processing o 6.1_Hardware_Exception_Sources # 6.1.1_System_Reset_Interrupt # 6.1.2_Machine_Check_Interrupt # 6.1.3_DSI_Interrupt # 6.1.4_ISI_Interrupt # 6.1.5_External_Interrupt # 6.1.6_Alignment_Interrupt # 6.1.7_Program_Interrupt # 6.1.8_FP_unavailable_Interrupt # 6.1.9_Decrementer_Interrupt # 6.1.10_System_Call_Interrupt # 6.1.11_Trace_Interrupt # 6.1.12_Performance_Monitor_Interrupt # 6.1.13_IABR_Interrupt # 6.1.14_Thermal_Interrupt o 6.2_External_Interrupt_Sources # 6.2.1_HSP_-_High_Speed_Port # 6.2.2_Debug # 6.2.3_CP_-_Command_Processor # 6.2.4_PE_-_Pixel_Engine_Finished # 6.2.5_PE_-_Pixel_Engine_Token # 6.2.6_VI_-_Video_Interface # 6.2.7_Memory_Interface # 6.2.8_DSP_Interface # 6.2.9_Audio_Streaming_Interface # 6.2.10_EXI # 6.2.11_Serial_Interface # 6.2.12_DVD_Interface # 6.2.13_Reset_Button # 6.2.14_Error * 7_Video_Processing o 7.1_Used_VI_terms o 7.2_init_VI # 7.2.1_Videomodes o 7.3_render_to_XFB o 7.4_vertical_retrace o 7.5_set_XFB_Address * 8_3D_Graphics_Processing o 8.1_basic_operations # 8.1.1_load_BP_Register # 8.1.2_load_CP_Register # 8.1.3_load_XF_Register # 8.1.4_load_XF_Register_Indexed o 8.2_example_processing_loop # 8.2.1_init_GX # 8.2.2_begin_frame # 8.2.3_draw_frame # 8.2.4_end_frame # 8.2.5_close_GX * 9_Joy-Bus_Devices o 9.1_ID_and_Device_List o 9.2_standard_Controller # 9.2.1_Init # 9.2.2_Read_Controller_Status # 9.2.3_rumble_Motor_On # 9.2.4_rumble_Motor_Off o 9.3_Keyboard # 9.3.1_Types # 9.3.2_Scancodes # 9.3.3_Init # 9.3.4_Read_Keyboard o 9.4_GBA o 9.5_Wavebird o 9.6_steering_wheel o 9.7_DKongas # 9.7.1_Read_Controller_Status o 9.8_Resident_Evil4_Chainsaw * 10_EXI_Devices o 10.1_EXI_Channel_and_Device_List o 10.2_Retrieving_the_ID_of_an_EXI_Device o 10.3_Mask_ROM # 10.3.1_Memory_Map_(Europe/PAL) # 10.3.2_Memory_Map_(USA/NTSC) # 10.3.3_Memory_Map_(Japenese/NTSC) # 10.3.4_Memory_Map_(Japenese/NTSC_-_Panasonic_Q) # 10.3.5_Font_Encoding # 10.3.6_Font_Layout # 10.3.7_Operation o 10.4_RTC_(Real-Time_Clock) # 10.4.1_Operation o 10.5_SRAM # 10.5.1_Memory_Map # 10.5.2_Operation # 10.5.3_Checksums o 10.6_AD16 # 10.6.1_Operation # 10.6.2_Trace-Step_Values o 10.7_Memory_Cards # 10.7.1_Commands # 10.7.2_Operation o 10.8_Ethernet_Adapter # 10.8.1_registers # 10.8.2_command-registers # 10.8.3_Operation o 10.9_UART o 10.10_SD_Cards o 10.11_Viper_'Modchip' o 10.12_Ripper_III_GC_'Modchip' o 10.13_Qoob_'Modchip' o 10.14_NinjaMOD_'Modchip' * 11_HSP_Devices o 11.1_GB_Player * 12_Memory_Card_Structure o 12.1_Overview o 12.2_Header o 12.3_Directory # 12.3.1_Directory_Entries o 12.4_Block_Allocation_Map o 12.5_Checksums * 13_DVD_Structure o 13.1_Disk_header o 13.2_Disk_header_Information o 13.3_Apploader o 13.4_Format_of_the_FST # 13.4.1_Format_of_a_File_Entry * 14_general_File_Formats o 14.1_BNR_(Banner_file_format) o 14.2_DOL_(Gamecube_Executable) o 14.3_ELF_(Executable_and_linkable_Format) o 14.4_GCB_(QOOB_Flash_Files) o 14.5_GCM_(Gamecube_Disc_Image) o 14.6_GCI_(Gamecube_Game_Save) o 14.7_GCP_(Gamecube_Memorycard_Image) o 14.8_TGC # 14.8.1_Header # 14.8.2_embedded_GCM o 14.9_VGC_(Viper_Flash_Files) * 15_Game_File_Formats o 15.1_AFC_(audio_stream) o 15.2_AST_(audio_stream) o 15.3_ARC_(RARC_Archive) # 15.3.1_Header # 15.3.2_Nodes # 15.3.3_File_Entries o 15.4_ARC_(audio_stuff) o 15.5_ASN o 15.6_AW_("audio_wave"?) o 15.7_BAS_("audio_script"_?) o 15.8_BCA o 15.9_BCK_(animation_of_a_.bmd_skeleton) o 15.10_BDL o 15.11_BFN_(font) o 15.12_BIN_(binary_file) o 15.13_BLO_(screen_layout_for_dialog_screens) o 15.14_BMD_(3d_model_with_texture_and_skeleton) o 15.15_BMG o 15.16_BMP_(window_bitmap_(!)) o 15.17_BMT o 15.18_BCK_("Pack"_file) o 15.19_BRK o 15.20_BTI # 15.20.1_Texture_Header o 15.21_BTP o 15.22_BTK o 15.23_COL_(collision_triangles) o 15.24_DZB o 15.25_H4M o 15.26_JPA_(particle_data) o 15.27_JPC o 15.28_MTH_('Mute_thp?') o 15.29_PAD o 15.30_PRM_('Parameters?') o 15.31_REL_(relocatable_module) o 15.32_SB o 15.33_SZS_(packed_RARC_Archive) o 15.34_THP_(video_format) # 15.34.1_Header_data # 15.34.2_Components_structure # 15.34.3_VideoInfo_Structure # 15.34.4_AudioInfo_Structure # 15.34.5_Frame_data # 15.34.6_Video_Frames # 15.34.7_Audio_Frames o 15.35_TPL_(Texture_Palette) o 15.36_YMP_(height_map) * 16_Compression_Formats o 16.1_Yay0 # 16.1.1_compression # 16.1.2_de-compression_Code # 16.1.3_Font_Data o 16.2_Yaz0 # 16.2.1_de-compression_Code * 17_Graphic_Formats o 17.1_YCbYCr o 17.2_I4_(4bit_indexed) o 17.3_IA4_(4bit_indexed_with_alpha) o 17.4_I8_(8bit_indexed) o 17.5_IA8_(8bit_indexed_with_alpha) o 17.6_CI4_(compressed_4bit_indexed) o 17.7_CIA4_(compressed_4bit_indexed_with_alpha) o 17.8_CI8_(compressed_8bit_indexed) o 17.9_CIA8_(compressed_8bit_indexed_with_alpha) o 17.10_RGB4A3 # 17.10.1_RGB4A3_Pixel_Format o 17.11_RGB5A1 # 17.11.1_RGB5A1_Pixel_Format o 17.12_RGB565 # 17.12.1_RGB565_Pixel_Format o 17.13_RGBA8 # 17.13.1_RGBA8_Pixel_Format o 17.14_S3TC # 17.14.1_CMPR * 18_Appendix o 18.1_GCC_Quick_How_To # 18.1.1_compile_ASM_to_object: # 18.1.2_compile_C_to_object: # 18.1.3_compile_C++_to_object: # 18.1.4_link_objects # 18.1.5_remove_unneeded_sections_(debug_info_etc)_from_object # 18.1.6_convert_object_to_plain_binary # 18.1.7_convert_absolute_address_into_filename/line_number/function # 18.1.8_Building_a_Crosscompiler # 18.1.9_Linker_Script # 18.1.10_Startup_Code o 18.2_Boot_Process_Details # 18.2.1_BS_-_Bootstrap_1 # 18.2.2_BS2_-_Bootstrap_2 # 18.2.3_Apploader # 18.2.4_Main_DOL_executable o 18.3_Game_and_Maker_Codes # 18.3.1_Gamecodes # 18.3.2_Game_Serial_ID # 18.3.3_Makercodes o 18.4_Macronix_Chip_IDs o 18.5_chip_simelarities o 18.6_Easter_Eggs * 19_References o 19.1_Sources * 20_Credits 1 Introductional Rant If you don't know what programming a machine down to the metal is all about, go away! no really, this document is not for you! if you are seeking for advice on using existing solutions, such as SDKs or libraries, you will find little to none information that is of any use for you and you might only become frustrated by figuring out how little you know. If you however aren't afraid of numbers and want to dare jumping into the snake-pit of semi-accurate information based on guesswork done by a bunch of freaks - feel invited. this was made to give you what you need in the most compressed and visually pleasing form possible. Stuff that matters. 1.1 Things that are in this document just about everything explicitly and specifically related to the gamecube hard- and software internals and its programming. everything inside the box is subject to be documented, may it be relevant for actual programming or not. its meant as a reference for everyone who wants to know in all possible detail what makes this thing tick. one more thing: please notice that this is a technical documentation which is presented for pure educational purposes and higher learning, and not a moral lesson. i have decided against leaving out any information since i believe that information by itself should not be crippled in any way. if you choose to abuse this information for any kind of illegal activities (PLEASE DON'T!) so be it, but don't bother me with it. 1.2 Things that are not in this document several things were decided to not being put into this document because they didn't fit into the 'technical documentation' type of concept. They may be documented separatly some time but not now and not here. These things are: * Tips on Emulating the Gamecube on another Host system (this kind of information is only useful for a very limited number of people, and additionally might be highly confusing and/or misleading for those who are writing actual gamecube programs) * Explanation of the PSO (Phantasy Star Online) Exploit that lets you run code on the Gamecube * Explanation of the Codes used with Datels Action Replay * Instructions on using any tools that let you upload and execute code on the Gamecube, or any other development related tools except anything related to setting up and using gcc as a cross-compiler targeted to the gamecube. * anything related to gaming, cheat-codes and the like. (this is a tech-doc not a gaming FAQ!) * information on using the datel action replay to patch itself in order to execute code. * detailed and/or complete sourcecode, except when a formal explanation would just over-complicate things. (this is a documentation, not a code library) * building and/or using a custom interface to connect a gamecube memory card to another host and read/write data * anything related to playing/booting/copying pirated games (as you may have noticed, we do not support piracy!) some of these may be arguable, so if you think they should be here - probably along the lines of the appendix - don't hesitate to write the chapter in question and send it to me. i might include it if you write it, but other than that i won't care (there is still enough other stuff to complete). 1.3 Conventions * we count bits starting from 0, the most significant bit of a byte is bit 7. when visualising a byte the most significant bit comes first (left), and the least significant bit comes last (right). * when dealing with 16- or 32 byte values all figures are in big endian byte order. this means that the most significant byte comes first (left), and the least significant byte comes last (right).Please notice that the above is different to what IBM is using in their PPC documents. They have the (to many people strange and wrong) idea of applying 'big endian' to the order of bits and showing them the other way around as we do in this document. * if known (from patents or other freely available sources) we use the same terminology as Nintendo (or Macronix respectively) does, in particular we try to use the same names and abbreviations for hardware registers, signals and the like as a weak attempt of providing consistency with other existing documentation. * absolute memory addresses are shown as if the gamecube had been initialized by the original IPL and address translation had not been changed. For this matter we dont use physical adresses to avoid confusion for the majority of our readers. * code snippets are in either real or pseudo C language. any logical or arithmetic expressions outside code snippets are loosely similar to C notation according to the following table: Description Symbol logical or bitwise AND & logical or bitwise OR - logical or bitwise exclusive OR ^ logical or bitwise NOT (inverse) ! equality or assignment = addition + substraction - multiplication * division / please notice that -outside code- we do not make a difference between logical and bitwise operations. if in doubt the operation is bitwise, it should however be clearly visible from the context. 1.4 legal Babble Everything in this Document has been reverse-engineered from legally aquired software (Games), publicly available Patents and Documentation for the sole purpose of writing interoperable Software. This is explicitly allowed (almost encouraged :)) by Sect. 1201 (f), Reverse Engineering exception of the DMCA. 2 Gamecube Hardware Introduction The GameCube is a powerful piece of hardware. The whole system is based on the IBM PowerPC Gekko processor and the custom ATI Flipper video system. The PowerPC Gekko processor is really just a PowerPC 750 with a few enhancements. 2.1 enhanced PowerPC 750 Specification * 486 MHz internal processor clock * 200 MHz 64-bit bus width to main memory (1.6 Gigabytes per second maximum) * 32KB associative L1 Icache * 32KB associative L1 Dcache with 16KB data scratchpad * Super-scalar microprocessor with five different execution units: o 2 integer units, 1 FPU, and 1 loadstore unit and branch unit * DMA unit servicing 16KB data scratchpad. * DMA request queue - 15-entry. * Write-gather buffer for writing graphics command lists to the video system. * Embedded 256KB 2-way set-associative L2 unified cache. * 2 32-bit Integer Units (IU) * 1 FPU, 32 and 64-bit bus width * The FPU supports Floating Point Paired Singles (FP/PS) * Branch Unit provides static AND dynamic branch prediction * Features Out-Of-Order execution which means that when an instruction delays because of data access, subsequent opcodes can continue to be decoded and executed. The enhanced PowerPC Gekko processor also contains many features for minimization of processor delays because of data accessing and for maximization of processing throughput: * Non-blocking caches * Branch prediction through use of the Branch Unit (BU) * 8-way set-associative caches * 256KB L2 transfer cache * Out-of-order execution capabilities The instruction set of the PowerPC Gekko processor seems to be almost identical to the one of the PowerPC 750 processor.The only visible differences at the moment are that the PowerPC Gekko processor has a few AltiVecSIMD opcodes added to its final instruction set. 2.2 Consumer Units 2.2.1 Nintendo 2.2.1.1 HW1 HW1 was an initial, buggy version of the GameCube hardware that wasnt sold at retail. 2.2.1.2 HW2 HW2 is the first hardware that was sold in stores to the public. 2.2.1.3 HW2 'second edition' The second edition models are missing the "Serial Port 2" that the first edition had. The plastic cover is still on the bottom of the cube, where the port used to be, but there's just a metal plate underneath it, and no connector. 2.2.1.4 HW2 'third edition' The third edition Gamecubes are missing both the "Serial Port 2", and the Digital A/V connector. 2.2.2 Panasonic Q There is a Gamecube combined with dvd-player manufactured by Panasonic called 'Panasonic-Q'. It seems to be exactly the same as HW2 for the Gamecube part, except that the dvd drive is different. 2.3 Development Units Nintendo provides development hardware units to official, licensed GameCube developers. There are namely two different versions: the GDEV and the DDH hardware development kit units. These units are the same as retail GameCube HW2 units with some changes: They have PC communications features (either through SCSI or USB) and they have DVD emulation hardware instead of a proprietary mini-DVD drive. GameCube development units also seem to have slower processor speeds than retail GameCubes, this clock speed ranges from around 150MHz to 400MHz. Development GameCubes also seem to contain more RAM than retail ones, namely around 40MB. SNSystems also provides their own development kit,authorized by Nintendo, called the TDEV. According to specifications directly from SNSystems, the TDEV development hardware contains twice as much memory as retail GameCubes for debugging and a direct PC<->TDEV USB connection for fast uploading of code andor data. Finally, there is also another proprietary development kit called the NR-Reader. NR-Reader's contain less debugging capabilities than the other development kits and are mostly meant for developers to efficiently get their demosgames to beta testers or media. However, SNSystems reports that their ProDG development kit can be used with a special USB adapter of theirs for directly sending program (debug) code to NR- Reader GameCubes. Also, NR-Reader GameCubes contain different mini-DVD drives than retail GameCubes, but still use a proprietary writingreading format which is currently unknown. The DVD drives of NR-Readers can only read special DVDs that can only be written correctly with NR-Writer hardware (which is really just a PanasonicMatshita SW-9501 with modified firmware). Also, the official debug development kits possibly contain J-TAG support, which is a method for debugging hardware. If so, there is a possibility that J-TAG support still remains in retail GameCubes as well, but this is purely hypothesis. If, in fact, retail GameCubes contain J-TAG debugging support then it should be possible for (homebrew) code to be uploaded through a J-TAG cable) directly to a GameCube's RAM and executed. 2.4 Hardware Parts List * "MBU" and "MBB" will be used to refer to parts on the top and bottom sides of the GameCube's mother-board respectively. * "DVDB" will be used to refer to parts on the DVD controller board. * "CB" will be used to refer to parts on the controller pad board. 2.4.1 Connectors The are 10 different connectors on the GameCube's mother-board. The following table contains an ID key and a short functional description. ID Description P1 Motherboard Power Connector - MBB - Top Left P2 Digital Video Output Connector - MBU - Bottom Left P3 Controller Pad Board Connector - MBU - Middle Right P4 Memory Card Slot Connector A - MBU - Top Right P5 Memory Card Slot Connector B - MBU - Bottom Right P6 Serial Port Connector 1 - MBB - Top Right P7 Analog Video Output Connector - MBU - Middle Left P8 Serial Port Connector 2 - MBB - Top Right P9 Mini-DVD Drive Port Connector - MBU - Top Right P10 Hi-Speed Parallel Port Connector - MBB - Bottom Left 2.4.1.1 Memory Card Slots (P4,P5) pin Signal 1 EXTIN 2 GND 3 INT 4 3.3V 5 DO 6 5V 7 DI 8 3.3V 9 CS 10 Ground (Shield) 11 CLK 12 EXTOUT 2.4.1.2 High-speed Port (P8) pin Signal 1 3.3V 2 GND 3 INT 4 CLK 5 DO 6 DI 7 CS 8 Ground (Shield) 2.4.1.3 SDRAM/Parallel Port (P10) pin Signal 1 VCC 2 Ground 3 DQ0 4 DQ7 5 DQ1 6 DQ6 7 DQ2 8 DQ5 9 DQ3 10 DQ4 11 VCC 12 Ground 13 write enable 14 DQM 15 CAS 16 Clock 17 RAS 18 A12 19 CS (Chip Select) 20 A11 21 BA0 22 A9 23 BA1 24 A8 25 A10 26 A7 27 A0 28 A6 29 A1 30 A5 31 A2 32 A4 33 A3 34 INT 35 VCC 36 Ground 2.4.1.4 BBA/Modem Connector (P6) pin Signal 1 EXTIN 2 Ground (Shield) 3 INT 4 CLK 5 12V 6 DO 7 3.3V 8 3.3V 9 DI 10 CS 11 Ground 12 Ground 2.4.1.5 DVD Interface Connector (P9) pin Signal 1 AISLR (audio bus) 2 5V 3 AISD (audio bus) 4 5V 5 AISCLK (audio bus) 6 5V 7 DIHSTRB 8 5V 9 DIERRB 10 Ground 11 DIBRK 12 DICOVER 13 DIDSTBR 14 DIRSTB 15 DIDIR 16 Ground 17 DID7 18 Ground 19 DID6 20 Ground 21 DID5 22 Ground 23 DID4 24 Ground 25 DID3 26 Ground 27 DID2 28 MONI 29 DID1 30 MONOUT 31 DID0 32 Ground 2.4.1.6 Power Supply Connector (P1) pin Signal 1 Ground 2 Ground 3 3.3V 4 3.3V 5 Ground 6 Ground 7 Ground 8 Ground 9 1.8V 10 1.8V 11 1.8V 12 1.8V 13 1.55V 14 1.55V 15 1.55V 16 Ground 17 Ground 18 Ground 19 Thermo detect 20 12V 21 5V 22 5V 2.4.2 Semi-Conductors ID Description U1 Customized NEC Flipper Chip - MBU - Middle U2 Customized IBM PowerPC Gekko Chip - MBU - Bottom U3 MoSys (MS3M23B-5 A) 12MB 1-T SRAM - MBU - Top Right U4 MoSys (MS3M23B-5 A) 12MB 1-T SRAM - MBU - Top Right U5 NEC (D4891281G5 0125XU621) 16MB ARAM - MBU - Top Left U6 AV Encoder (AVE N -DOL RS5C5828) - MBB - Middle Left U7 Amplifier? (AMP - DOL 128 124) - MBB - Top Left U8 MX Clock Generator (Part Number?) - MBU - Bottom Left U9 MX Clock Generator (Part Number?) - MBU - Bottom Right U10 MX RTC/IPL (8013108-M RTCN-DOL 1R6022A1) 2.4.2.1 IPL (U10) Pin Signal 1 Clock 2 3 4 5 CS 6 serial in 7 Ground 8 9 serial out 10 11 12 osc - xtal2 13 osc - xtal1 14 2.5 Details on the motherboard buses The GameCube has three main external buses on its mother-board: the North- Bridge, the South-Bridge, and the East-Bridge. The fastest bus is the South- Bridge which connects the two 12MB 1T-SRAM chips to the Flipper. The South- Bridge bus has a bus-width of 64 bits, and data is exchanged through it at rates of about 324MHz. The North-Bridge bus connects the IBM PowerPC Gekko processor to the Flipper and is another 64 bit bus-width bus, however, it is only half as fast as the South-Bridge bus and is clocked at around 162MHz. Finally, the East-Bridge bus connects the 16MB Audio RAM chip to the Flipper chip. This bus only has a bus-width of 8 bits and is by far the slowest one, clocked at only 81MHz. 2.6 Details on the Macronix (MX) Chips An outer inspection of the two MX chips does not reveal anything of much interest. Both chips are TSOP packages containing 14 pins each. One of the chips has "CLK" inscripted on it, and the other "RTC". It can be easily inferred that the "CLK" chip functions as some sort of a clock controllergenerator and the "RTC" chip contains the GameCube's Real-Time Clock unit. Two of the RTC chip's pins are connected to an external crystal which regulates the RTC's timing rate. Another pin is connected to a battery located on the controller board. At least two pins are used for both VCC and GND. That leaves nine unknown pins. The RTC MX chip also contains the GameCube's BIOS. While 14 pins is not nearly enough for parallel Flash ROM, EEPROM, mask ROM, etc., it is quite adequate for a serial connection. 2.7 DVD Protection The DVD Protection is based on a custom data format on an otherwhise pretty standard dvd. 2.7.1 Filesystem The custom Filesystem (which is described somewhere else in this Document) by itself is not related to the actual protection mechanism. However, since it is not standard, that alone would already make it hard to read (and create) in a regular (pc-) environment. 2.7.2 Barcode The Barcode is used to authenticate the Disc in the Drive. 2.7.3 Encryption The entire content of a Gamecube DVD is XORed with a constant cyphertext and it is transparently decrypted by the Disc-Controller when reading from the DVD. 2.7.3.1 Cyphertext algorithm todo 2.8 IPL/BIOS Encryption if you XOR an NTSC with a PAL bios (or any other two different ones), you will notice that because they have different sizes, there are some obviously zero encoded areas in one files, giving you plaintext in the other one which proves: * encryption is a simple XOR with a constant ciphertext. * the key used to generate the cyphertext is the same for different bios's so we do the math: given Ci = ciphertext, Cl = cleartext, K = key encoding data goes like: Ci1 = Cl1 ^ K Ci2 = Cl2 ^ K If Cl1 or Cl2 is nothing but zero, the resultant Ci is just K decoding it would be: Cl = Ci ^ K for the areas where Cl is nothing but zeroes in one bios, we know K 2.8.1 Flipper decryption logic bug The hardware decryption logic has a really nasty bug which allows us to read almost the full Cleartext (and thus a large part of the cyphertext, by XORing it with encrypted data). This, combined with the features of the XOR encryption makea the whole encryption useless (at least very insecure) and implementing a new bios is a straight-forward task (provided that "high speed" (30Mhz) programmable logic with enough memory attached to it is available.). The Bios chip, which also includes sram and rtc (but that won't matter here), is attached to the EXI0 bus. The Exi bus (nothing new here, just to refresh it is an SPI-like bus. SPI is nothing complicated, just four interesting lines: CS (used mainly for syncing, since you need a defined start point, and you can easily attach multiple devices (memory card, ...) to the same bus with seperate CS lines), SI (aka MOSI, master out, slave in - the CPU is always master, the IPL-chip is slave. so SI is gamecube -> device), SO (device -> gamecube, tristated when a device is not active), and CLK (generated by the master). a transfer is basically: - lower CS (it's low active) for every bit do: - set SI bit - clock - read SO bit then: - put CS high again. (the exact timing (WHEN to sample SO, clock polarity) is different for different SPI modes, and the one descriped here is not necessarily the one used in the GC. anyway, it doesn't matter here) so, based on that, we can transfer n-bit messages in BOTH DIRECTIONS. technically this is implemented with a 32bit shift register, with every clock cycle one bit is shifted out (to SI), and one bit is shifted in (to SO). so after n clock cycles, you have n new bits in the shift register and shifted n bits out. the used protocol on the Bus is in most cases very simple but device dependant. In the case of the IPL chip, it's the following: GC -> IPL 1 bit read/write (0 for read, 1 for write, the latter only valid for RTC/Sram of course) 1 unknown bit 1 bits selection (0 for ROM, 1 for RTC/Sram) 23 bits address 6 bits dummy after that, the data transfer starts. the 6 dummy cycles are mainly to give the IPL time to read out the first byte. So you send 32 bits of data (the "address"), and start receiving the ROM bytes. but hey - we said the SPI bus always transfers 2 bits per clock cycle (in marketing terms), since it's fullduplex (in technical terms). we transfer one bit TO the device, and one BACK. we HAVE to. there's no way to NOT send a bit - but it doesn't matter, since for example the bits send from the IPL to the GC in the first 32bits are just ignored - they would contain most probably only zeros, ones, or the bus might be tristate. it's simply not defined, so there's no data to be expected. the same goes for the transfer of the data. the IPL chip sets the correct data at the SO line, but the gamecube - well, sends dummy bits, too. normally you would send zeros, ones, or whatever. it's ignored by the IPL chip anyway (unless it's a write, that would turn the whole thing upside down) now since technically the SPI port is implemented by a shifting register of 32bit length. after transferring 32bits, we would have to read out the new value, store it into memory, and "start the next transfer". but what's about CLEARING the register before? yes, they didn't. in the next transfer, the last 32bit are shifted out as dummy bits. well, one might say, it's just the data just shifted in, so it's completely uninteresting. BUT: the decryption of the loader is done in hardware. it's a part between the SO line of the IPL and the DI port of the shift register. (the encryption is build into the flipper, so no way to intercept the content AFTER decryption).so because the (decrypted) data just shifted in (and stored into memory) is shifted out again - we can get the decrypted data. if you sniff the SI line to the IPL chip, you will get a log like this: 00 00 40 00 (address written to the IPL, in this case: 0x100) FF FF FF FF (well just dummy data) xx xx xx xx (the data from the last 4 bytes, decrypted) xx xx xx xx (the data from the n-1 transfer, decrypted) so in the end you get every 32bit words except one. For every transfered block you miss 32bits of plaintext data, but you'll get the rest. This should be enough to decrypt huge parts of the bios, and thus recover a large part of K. 2.8.2 Cyphertext algorithm todo 2.8.3 replacing the IPL using the above gained knowledge it is possible to create a small bootrom replacement (using the, yet incomplete, cyphertext), and get more (most) of the IPL Cleartext. The Gekko boots from 0x100, that's what you read in almost any ppc instruction manual - the reset vector. well, this isn't the complete truth - it boots from it's exception base + 0x100. And the exception base is normally zero, BUT, as the ppc manual states: there's a bit in a HID (i think) register, which turns the exception base to 0xFFF00000. and this bit is "set usually at boot time". So the processor starts to fetch instructions at 0xFFF000100. If you read a bit further, you'll notice that the CPU always reads 64bits at once for code. The memory at 0xFFF00000 is mapped inside the flipper to an automated exi transfer (with that shift register), with the decryption logic active. so the processor starts executing the decrypted instructions, reading 8 bytes at a time, of which we get 4 bytes in plain - not much, (although enough to make some funny experiments, but that's another topic). Luckily, the IPL itself (the cube menu) isn't executed this way since that wouldn't be possible thanks to the "dumb" decryption logic The first ~0x800 bytes start to read data out of the IPL chip and store it to memory (still using the hardware decryption logic), and jump there. they read 1024 bytes at once. Well - now we know 1020 bytes of each transfer, enough to have a complete block of code we can exchange (we have the ciphertext Cl^K = Ci on SO, and the plaintext (delayed by 32bits on SI), and can XOR them to get Cl^K^Ci = K. now we can encrypt our code with K). so now we can make a small code which just dumps the whole IPL - well, to the EXI bus or whereever you can receive it. Now we have all Cl, and thus we can compute all K, thus we can get the complete Plaintext of all available IPLs aswell as encode a larger custom IPL ourselves. a small note on why you can not recover the plaintext of the original loader this way: The decryption logic is, whatever it is, a PRNG. It generates a stream of ciphertext ("K"), which has random properties (non-repeating, at least not in the range of some MB), but is always the same. it is incremented with every EXI-transfer. the address is NOT used in the calculation. thus reading from 0xFFF00100 more than one time will give you each time another result. the first time you get Ci(0)^K(0) (the correct result), the second time you get Ci(0)^K (1) etc., i.e. wrong results. Since we never get the K(n) for odd n, i see no chance of recovering it this way, even if we can read at 0xFFF00000+x (and we can do this if we don't set a specific bit to disable the logic). 3 Gekko CPU Overview 3.1 Registers * General purpose registers (r0-r31) o r1 sp stackpointer o r2 rtoc global pointer to _SDA2_BASE_ o r13 global pointer to _SDA_BASE_ * Floating point registers (fp0-fp31) * Segment registers (sr0-sr15) - unused in regular (SDK/DolphinOS) applications * Special purpose registers (spr0-spr1023) o spr8 (lr) - link register o spr920 - HID2 o spr1010 - instruction breakpoint address o spr1013 - data breakpoint address spr920 4 r/w HID2 31 24 23 16 15 8 7 0 bit(s) description 2 PSE - Paired-Single load and store instructions enabled 1 0 LSQE - Paired-Single mode enabled 3.2 Calling conventions parameters are passed in r3 (1st) r4 (2nd) and r5 (third) up to r12 (9th), further parameters are passed through the stack. 3.3 PPC Instructions 3.3.1 Integer Instructions Mnemonic Opcode Description addi addis add addo subf subfo addic subfic addc addco subfc subfco adde addeo subfe subfeo addme addmeo subfme subfmeo addze addzeo subfze subfzeo neg nego mulli mullw mullwo mulhw mulhwu divw divwo divwu divwuo cmpi cmp cmpli cmpl Mnemonic Opcode Description andi andis ori oris xori xoris and or xor nand nor eqv andc orc Mnemonic Opcode Description extsb extsh cntlzw rlwinm rlwnm rlwimi slw srw srawi sraw 3.3.2 Floating-Point Instructions Mnemonic Opcode Description fadd fadds (*) fsub fsubs (*) fmul fmuls (*) fdiv fdivs fres (*) frsqrte fsel (*) fmadd fmadds (*) fmsub fmsubs (*) fnmadd fnmadds (*) fnmsub fnmsubs (*) frsp (*) fctiw fctiwz fcmpu fcmpo mffs mcrfs mtfsfi mtfsf mtfsb0 mtfsb1 fmr (*) fneg fabs fnabs (*) - modified for paired singles 3.3.3 Integer Load and Store Instructions Mnemonic Opcode Description lbz lbzx lbzu lbzux lhz lhzx lhzu lhzux lha lhax lhau lhaux lwz lwzx lwzu lwzux stb stbx stbu stbux sth sthx sthu sthux stw stwx stwu stwux lhbrx lwbrx sthbrx stwbrx lmw stmw lswi lswx stswi stswx 3.3.4 Floating-Point Load and Store Instructions Mnemonic Opcode Description lfs lfsx lfsu lfsux lfd lfdx lfdu lfdux stfs stfsx stfsu stfsux stfd stfdx stfdu stfdux stfiwx 3.3.5 Branch Instructions Mnemonic Opcode Description b unconditional Jump ba bl branch and link bla bc bca bcl bcla bclr bclrl bcctr bcctrl 3.3.6 Condition Register Logical Instructions Mnemonic Opcode Description crand cror crxor crnand crnor creqv crandc crorc mcrf 3.3.7 Misc Instructions Mnemonic Opcode Description twi tw sc rfi mtcrf mcrxr mfcr mtmsr mfmsr mtspr mfspr lwarx stwcx. sync mftb eieio isync dcbt dcbtst dcbz dcbz_l dcbst dcbf dcbi icbi eciwx ecowx mtsr mtsrin mfsr mfsrin tlbie tlbsync 3.4 additional Gekko Instructions The Gekko has some additional (and some modified respectivly) instructions in its Paired-single mode which are useful for fast vector and matrix calculations and which are analog to Intel (and other x86 series) processors "streamed instructions", known as SSE. This extension is unique for the Gekko processor and used to calculate two single-precision numbers ("floats" in C) in one clock cycle. The floating-Point Registers of the Gekko (FPRs) are modified in the following way : one half is used for the first single number, and other for the second. These parts are named as "PS0" and "PS1". PS instructionset is divided into two parts : Load and Store Quantization and Paired-Single Arithmetic instructions. Load and Store Quantization instructions are used for fast integer-float type casting and some specific memory operations, using PS0 and PS1 parts of FPR. If you try to execute any PS instruction without HID2[PSE] and HID2[LSQE] bit set, an illegal instruction exception will be generated. 3.4.1 FPR format in paired-single mode 63 56 55 48 57 40 39 32 1111 1111 1111 1111 1111 1111 1111 1111 31 24 23 16 15 8 7 0 0000 0000 0000 0000 0000 0000 0000 0000 bit(s) description 32-63 1 PS1 0-31 0 PS0 3.4.2 Arithmetic Instructions Mnemonic Opcode Description ps_abs 000100 DDDDD 00000 BBBBB 01000 01000 absolute value R ps_add 000100 DDDDD AAAAA BBBBB 00000 10101 add R ps_cmpo0 000100 DDD00 AAAAA BBBBB 00001 00000 compare ordered high 0 ps_cmpo1 000100 DDD00 AAAAA BBBBB 00011 00000 compare ordered low 0 ps_cmpu0 000100 DDD00 AAAAA BBBBB 00000 00000 compare unordered high 0 ps_cmpu1 000100 DDD00 AAAAA BBBBB 00010 00000 compare unordered low 0 ps_div 000100 DDDDD AAAAA BBBBB 00000 10010 divide R ps_merge00 000100 DDDDD AAAAA BBBBB 10000 10000 merge high R ps_merge01 000100 DDDDD AAAAA BBBBB 10001 10000 merge direct R ps_merge10 000100 DDDDD AAAAA BBBBB 10010 10000 merge swapped R ps_merge11 000100 DDDDD AAAAA BBBBB 10011 10000 merge low R ps_mr 000100 DDDDD 00000 BBBBB 00010 01000 move register R ps_nabs 000100 DDDDD 00000 BBBBB 00100 01000 negate absolute value R ps_neg 000100 DDDDD 00000 BBBBB 00001 01000 negate R ps_res 000100 DDDDD 00000 BBBBB 00000 11000 reciprocal estimate R ps_rsqrte 000100 DDDDD 00000 BBBBB 00000 11010 reciprocal square root estimate R ps_sub 000100 DDDDD AAAAA BBBBB 00000 10100 substract R ps_madd 000100 DDDDD AAAAA BBBBB CCCCC 11101 multiply and add R ps_madds0 000100 DDDDD AAAAA BBBBB CCCCC 01110 multiply and add scalar high R ps_madds1 000100 DDDDD AAAAA BBBBB CCCCC 01111 multiply and add scalar low R ps_msub 000100 DDDDD AAAAA BBBBB CCCCC 11100 multiply and substract R ps_mul 000100 DDDDD AAAAA 00000 CCCCC 11001 multiply R ps_muls0 000100 DDDDD AAAAA 00000 CCCCC 01100 multiply scalar high R ps_muls1 000100 DDDDD AAAAA 00000 CCCCC 01101 multiply scalar low R ps_nmadd 000100 DDDDD AAAAA BBBBB CCCCC 11111 negative multiply and add R ps_nmsub 000100 DDDDD AAAAA BBBBB CCCCC 11110 negative multiply and substract R ps_sel 000100 DDDDD AAAAA BBBBB CCCCC 10111 select R ps_sum0 000100 DDDDD AAAAA BBBBB CCCCC 01010 vector sum high R ps_sum1 000100 DDDDD AAAAA BBBBB CCCCC 01011 vector sum low R Note : R opcode field (comparsion of result with zero) is unused. (=0) 3.4.2.1 PS_ABS absolute value Clear bit 0 of PS0[B] and copy result to PS0[D] Clear bit 0 of PS1[B] and copy result to PS1[D] 3.4.2.2 PS_ADD add PS0[D] = PS0[A] + PS0[B] PS1[D] = PS1[A] + PS1[B] 3.4.2.3 PS_CMPO0 compare ordered high "c" holds result of comparsion If (PS0[A] is NaN or PS0[B] is NaN) then c = 0001b Else if (PS0[A] < PS0[B]) then c = 1000b Else if (PS0[A] > PS0[B]) then c = 0100b Else c = 0010b Save result in D field of condition register (CR[D] = c). 3.4.2.4 PS_CMPO1 compare ordered low "c" holds result of comparsion If (PS1[A] is NaN or PS1[B] is NaN) then c = 0001b Else if (PS1[A] < PS1[B]) then c = 1000b Else if (PS1[A] > PS1[B]) then c = 0100b Else c = 0010b Save result in D field of condition register (CR[D] = c). 3.4.2.5 PS_CMPU0 compare unordered high "c" holds result of comparsion If (PS0[A] is NaN or PS0[B] is NaN) then c = 0001b Else if (PS0[A] < PS0[B]) then c = 1000b Else if (PS0[A] > PS0[B]) then c = 0100b Else c = 0010b Save result in D field of condition register (CR[D] = c). 3.4.2.6 PS_CMPU1 compare unordered low "c" holds result of comparsion If (PS1[A] is NaN or PS1[B] is NaN) then c = 0001b Else if (PS1[A] < PS1[B]) then c = 1000b Else if (PS1[A] > PS1[B]) then c = 0100b Else c = 0010b Save result in D field of condition register (CR[D] = c). These four compare instructions looks same, because I omitted some unecessary FPSCR stuff. 3.4.2.7 PS_DIV divide PS0[D] = PS0[A] / PS0[B] PS1[D] = PS1[A] / PS1[B] 3.4.2.8 PS_MERGE00 merge high PS0[D] = PS0[A] PS1[D] = PS0[B] 3.4.2.9 PS_MERGE01 merge direct PS0[D] = PS0[A] PS1[D] = PS1[B] 3.4.2.10 PS_MERGE10 merge swapped PS0[D] = PS1[A] PS1[D] = PS0[B] 3.4.2.11 PS_MERGE11 merge low PS0[D] = PS1[A] PS1[D] = PS1[B] 3.4.2.12 PS_MR move register PS0[D] = PS0[B] PS1[D] = PS1[B] 3.4.2.13 PS_NABS negate absolute value Set bit 0 of PS0[B] and copy result to PS0[D] Set bit 0 of PS1[B] and copy result to PS1[D] 3.4.2.14 PS_NEG negate Invert bit 0 of PS0[B] and copy result to PS0[D] Invert bit 0 of PS1[B] and copy result to PS1[D] 3.4.2.15 PS_RES reciprocal estimate PS0[D] = 1 / PS0[B] PS1[D] = 1 / PS1[B] 3.4.2.16 PS_RSQRTE reciprocal square root estimate PS0[D] = 1 / SQRT(PS0[B]) PS1[D] = 1 / SQRT(PS1[B]) 3.4.2.17 PS_SUB subtract PS0[D] = PS0[A] - PS0[B] PS1[D] = PS1[A] - PS1[B] 3.4.2.18 PS_MADD multiply-add PS0[D] = PS0[A] * PS0[C] + PS0[B] PS1[D] = PS1[A] * PS1[C] + PS1[B] 3.4.2.19 PS_MADDS0 multiply-add scalar high PS0[D] = PS0[A] * PS0[C] + PS0[B] PS1[D] = PS1[A] * PS0[C] + PS1[B] 3.4.2.20 PS_MADDS1 multiply-add scalar low PS0[D] = PS0[A] * PS1[C] + PS0[B] PS1[D] = PS1[A] * PS1[C] + PS1[B] 3.4.2.21 PS_MSUB multiply-subtract PS0[D] = PS0[A] * PS0[C] - PS0[B] PS1[D] = PS1[A] * PS1[C] - PS1[B] 3.4.2.22 PS_MUL multiply PS0[D] = PS0[A] + PS0[C] PS1[D] = PS1[A] + PS1[C] 3.4.2.23 PS_MULS0 multiply scalar high PS0[D] = PS0[A] + PS0[C] PS1[D] = PS1[A] + PS0[C] 3.4.2.24 PS_MULS1 multiply scalar low PS0[D] = PS0[A] + PS1[C] PS1[D] = PS1[A] + PS1[C] 3.4.2.25 PS_NMADD negative multiply-add PS0[D] = - (PS0[A] * PS0[C] + PS0[B]) PS1[D] = - (PS1[A] * PS1[C] + PS1[B]) 3.4.2.26 PS_NMSUB negative multiply-subtract PS0[D] = - (PS0[A] * PS0[C] - PS0[B]) PS1[D] = - (PS1[A] * PS1[C] - PS1[B]) 3.4.2.27 PS_SEL select If (PS0[A] >= 0) then PS0[D] = PS0[C] else PS0[D] = PS0[B] If (PS1[A] >= 0) then PS1[D] = PS1[C] else PS1[D] = PS1[B] 3.4.2.28 PS_SUM0 vector sum high PS0[D] = PS0[A] + PS1[B] PS1[D] = PS1[C] 3.4.2.29 PS_SUM1 vector sum low PS0[D] = PS0[C] PS1[D] = PS0[A] + PS1[B] 3.4.3 Load and Store Instructions Mnemonic Opcode Description psq_lx 000100 DDDDD AAAAA BBBBB WIII Paired Singles Quantized Load 000110 0 indexed psq_lux 000100 DDDDD AAAAA BBBBB WIII Paired Singles Quantized Load with 100110 0 Update indexed psq_stx 000100 SSSSS AAAAA BBBBB WIII Paired Singles Quantized Store 000111 0 indexed psq_stux 000100 SSSSS AAAAA BBBBB WIII Paired Singles Quantized Store with 100111 0 Update indexed Mnemonic Opcode Description psq_l 111000 DDDDD AAAAA WIII Paired Singles Quantized Load dddddddddddd psq_lu 111001 DDDDD AAAAA WIII Paired Singles Quantized Load with dddddddddddd Update psq_st 111100 SSSSS AAAAA WIII Paired Singles Quantized Store dddddddddddd psq_stu 111101 SSSSS AAAAA WIII Paired Singles Quantized Store with dddddddddddd Update 3.4.3.1 psq_lx Paired Singles Quantized Load indexed 3.4.3.2 psq_lux Paired Singles Quantized Load with Update indexed 3.4.3.3 psq_stx Paired Singles Quantized Store indexed 3.4.3.4 psq_stux Paired Singles Quantized Store with Update indexed 3.4.3.5 psq_l Paired Singles Quantized Load 3.4.3.6 psq_lu Paired Singles Quantized Load with Update 3.4.3.7 psq_st Paired Singles Quantized Store 3.4.3.8 psq_stu Paired Singles Quantized Store with Update 3.4.4 modified floating point instructions In paired single mode (HID2[PSE] = 1), all the double-precision floating point instructions are still valid, and execute as in non-paired single mode. All single-precision floating-point instructions (fadds, fsubs, fmuls, fdivs, fmadds, fmsubs, fnmadds, fnmsubs, fres, frsp) switch their meaning and operate on the ps0 operand. Mnemonic Opcode Description fadds fsubs fmuls fdivs fmadds fmsubs fnmadds fnmsubs fres frsp fsel fmr 3.4.4.1 fadds 3.4.4.2 fsubs 3.4.4.3 fmuls 3.4.4.4 fdivs 3.4.4.5 fmadds 3.4.4.6 fmsubs 3.4.4.7 fnmadds 3.4.4.8 fnmsubs 3.4.4.9 fres 3.4.4.10 frsp 3.4.4.11 fsel 3.4.4.12 fmr 3.5 Programming Tips and additional information 3.5.1 Machine State Register to do 3.5.2 Caches to do 3.5.3 branch unit to flush branch unit's dynamic prediction logic, you must sequentially execute 3 branches b label1 label1: b label2 label2: b label3 label3: 4 Memory Map 4.1 Overview start end size description 0x00000000 0x017fffff 24MB Physical address of the RAM 0x80000000 0x817fffff 24MB Logical address of the RAM, cached 0xC0000000 0xC17fffff 24MB Logical address of the RAM, not cached 0xc8000000 2MB Embedded Framebuffer (EFB) 0xCC000000 Hardware registers 0xCC000000 CP - Command Processor 0xCC001000 PE - Pixel Engine 0xCC002000 VI - Video Interface 0xCC003000 PI - Processor Interface (Interrupt Interface) 0xCC004000 MI - Memory Interface 0xCC005000 AI - Audio Interface 0xCC006000 DI - DVD Interface 0xCC006400 SI - Serial Interface 0xCC006800 EXI - External Interface 0xCC006C00 Streaming Interface 0xCC008000 GX FIFO (Graphic display lists) 0xe0000000 0xe0003fff 16k L2 Cache 0xfff00000 1MB IPL (mapped here at bootup) 4.2 RAM usage Variables that are marked as B are changed by bootrom or IPL. Variables marked as A are changed lately in apploader when a game is booting. Variables, which are marked as O are changed after an OSInit call. Remember that the IPL also has a hard-linked Dolphin OS inside, so those variables that are marked as O are also changed in the IPL. 4.2.1 Dolphin-OS globals In PowerPC architectures the lower 256 bytes of main memory are reserved for internal OS use. This map describes all known OS low memory variables. Dolphin OS accesses low memory as 0x80000000 + offset (cached). 4.2.1.1 Boot Info 4.2.1.1.1 DVD Disc ID start size description 0x80000000 0x04 B Gamecode 0x80000004 0x02 B Company 0x80000006 0x01 B Disk ID 0x80000007 0x01 B Version 0x80000008 0x01 B Streaming 0 audio streaming off 1 audio streaming on 0x80000009 0x01 B StreamBufSize 0x8000000a 0x0f padding zeros 4.2.1.1.2 system Info start size description 0x8000001c A DVD magic word 0xc2339f3d Nintendo Game Disc 0x80000020 4 A Magic word (how did the console boot?) value description 0x0D15EA5E normal boot 0xE5207C22 booted from jtag 0x80000024 4 A Version (usually set to 1 by apploader) 0x80000028 4 B physical Memory Size 0x01800000 24MB on retail console 0x8000002C 4 B Console type value Description 0x00000001 Retail1 0x00000002 HW2 production board 0x00000003 The latest production board 0x00000004 Reserved 0x1XXXXXXX Devkits 0x10000000 MAC emulator 0x10000001 PC Emulator 0x10000002 'Arthur' 0x10000003 'Minnow' 0x10000004 1st Devkit HW 0x10000005 2nd Devkit HW 0x10000006 latest Devkit HW 0x10000007 Reserved 0x2XXXXXXX TDEV-kits 0x20000005 HW2 TDEV system 0x20000006 The latest TDEV system 0x20000007 Reserved 0x80000030 4 O ArenaLo (==0x00000000) 0x80000034 4 O ArenaHi (==0x817fe8c0) 0x80000038 4 FST Location in ram (==0x817fe8c0) 0x8000003C 4 FST Max Length (==0x00000024) 4.2.1.2 Debugger info start size description 0x80000040 4 A flag for "debugger present" (used by __OSIsDebuggerPresent) 0x80000044 4 A Debugger Exception mask Bitmap, set to 0 at sdk lib start 0x80000048 4 A Exception hook destination (physical address) 0x8000004c 4 A Temp for LR, Return from exception address (to return from hook) 0x80000050 16 padding zeros 4.2.1.3 Debugger Hook .>80000060 38 a0 00 40 li r5,0x40 _______ |r5=0x40| .>80000064 7c 68 02 a6 mflr r3 _____ |r3=lr| .>80000068 90 65 00 0c stw r3,0x0c(r5) .>8000006c 80 65 00 08 lwz r3,0x08(r5) .>80000070 64 63 80 00 oris r3,r3,0x8000 .>80000074 7c 68 03 a6 mtlr r3 _____ |lr=r3| .>80000078 38 60 00 30 li r3,0x30 .>8000007c 7c 60 01 24 mtmsr r3 ________ |msr=0x30| .>80000080 4e 80 00 20 blr _________ |jump_(lr)| 4.2.1.4 Dolphin OS Globals start end size description 0x80000084 0x800000bf padding zeros 0x800000c0 4 O Current OS context (physical address) 0x800000C4 4 O Previous OS interrupt mask 0x800000C8 4 O current OS interrupt mask 0x800000CC TV Mode value description 0 ntsc 1 pal 2 debug 3 debug pal 4 mpal 5 pal 60 0x800000d0 B ARAM size (internal+expansion) in bytes. set by ARAM driver, usually 16mb. 0x800000D4 O current OS Context (logical address) 0x800000D8 O default OS thread (logical address) 0x800000Dc O active Thread queue, head thread (logical address) 0x800000e0 O active Thread queue, tail thread (logical address) 0x800000e4 O Current OS thread 0x800000e8 A Debug monitor size (in bytes) 0x800000ec A Debug monitor location (usually at the top of main memory) 0x800000F0 A Console Simulated Memory Size, 0x01800000 (usually same as physical memory size) 0x800000F4 A DVD BI2 location in main memory (size of BI2 is 0x2000 bytes) 0x800000F8 Bus Clock Speed, 162 MHz (=0x09a7ec80, 162000000) 0x800000FC CPU Clock Speed, 486 MHz (=0x1cf7c580, 486000000) 4.2.2 Exception Handlers start end size description 0x80000100 System Reset Interrupt 0x80000200 Machine Check Interrupt 0x80000300 DSI Interrupt 0x80000400 ISI Interrupt 0x80000500 External Interrupt 0x80000600 Alignment Interrupt 0x80000700 Program Interrupt 0x80000800 FP unavailable Interrupt 0x80000900 Decrementer Interrupt 0x80000C00 System Call Interrupt 0x80000d00 Trace Interrupt 0x80000f00 Performance Monitor Interrupt 0x80001300 IABR Interrupt 0x80001400 reserved 0x80001700 Thermal Interrupt 0x80001800 0x80002fff unused/reserved (*) (*) note: psoload v2 uses this area to stay resident in memory, it is unused by Dolphin-OS 4.2.3 Dolphin-OS globals start end size Description 0x80003000 exception handler vectors (from sdk libs & ipl) 0x8000303c 4 padding/unused 0x80003040 external interrupt handler vectors (from sdk libs & ipl) 0x800030a4 padding/unused 0x800030c0 4 ? 0x800030c4 4 ? 0x800030c8 4 First Module Header Pointer in Module Queue 0x800030cc 4 Last Module Header Pointer in Module Queue 0x800030d0 4 Module String Table Pointer 0x800030d4 4 A DOL size (total size of text/data sections), in bytes (*1) 0x800030d8 4 B OS system time (set, when console is powered up) 0x800030dc 4 ? 0x800030E0 4 ? (6=production pads ?) 0x800030e4 2 ? 0x800030e6 1 ? 0x800030e7 1 ? 0x800030e8 1 O set by OsInit() (debugger stuff?) 0x800030e9 1 O set by OsInit() (debugger stuff?) 0x800030ea 2 ? 0x800030ec 4 ? 0x800030F0 2 ? 0x800030F2 1 Boot status value description 0 first boot 1 already booted 0x800030F3 1 ? 0x800030F4 4 ? 0x800030F8 4 ? 0x800030Fc 4 ? (*1) If FST on DVD is placed after DOL, then BB2 FSTLength is added to this value. 4.2.4 User Memory 4.2.4.1 user program area start end size description 0x80003100 Start of code (usually) 0x80003140 Entry point (early SDK v1.0 applications) 0x81200000 Load Address of the Apploader 0x81300000 Load Address of Bootrom/IPL note: of course the entrypoint of an application can be anything, those listed here are just some typical examples. Retail game start dol-files are usually located below the apploader. 4.2.4.2 stack area start end size description Bottom of Stack Top of Stack 4.2.4.3 heap area start end size description ? O ArenaLo - Bottom of Heap 0x817fe8c0 O ArenaHi - Top of Heap note: the address of ArenaHi is not a constant, but should be set to the bottom of the FST which is read from the DVD so its size depends on the application. the value given here is just an example. 4.2.4.4 'high memory' start end size description 0x817fe8c0 24 O FST (used by Dolphin-OS) 0x817fffff Memory Top 5 Hardware Registers 5.1 CP - Command Processor Registerblock Base Size of Registerblock common access size 0xcc000000 0x80 2 0xCC000000 2 R/W SR - Status Register 15 8 7 0 bit(s) description 5-15 unused/reserved 4 BP (breakpoint?) interrupt 3 GP is idle for commands (1: idle) 2 GP is idle for reading (1: idle) 1 gx fifo underflow (ptrhi watermark) 0xCC000002 2 R/W CR - Control Register 15 8 7 0 ..bl .mig bit(s) description 6-15 unused/reserved 5 b bp enable 4 l gp link enable (enable for linking of cp/pe FIFO) 3 FIFO underflow irq enable (?) 2 m FIFO overflow irq enable? / cp irq (clear to acknowledge) ? 1 i cp irq enable (?) (write 1 to clear bp irq?) 0 g gp FIFO read enable 0xCC000004 2 W Clear Register bit(s) description 2-15 unused/reserved 1 write 1 to clear FIFO underflow 0 write 1 to clear FIFO overflow 0xCC00000E 2 R/W token register 0xCC000010 2 R/W bounding box - left 0xCC000012 2 R/W bounding box - right 0xCC000014 2 R/W bounding box - top 0xCC000016 2 R/W bounding box - bottom 0xCC000020 2 R/W cp FIFO base lo 0xCC000022 2 R/W cp FIFO base hi 0xCC000024 2 R/W cp FIFO end lo 0xCC000026 2 R/W cp FIFO end hi 0xCC000028 2 R/W cp FIFO high watermark lo 0xCC00002a 2 R/W cp FIFO high watermark hi 0xCC00002c 2 R/W cp FIFO low watermark lo 0xCC00002e 2 R/W cp FIFO low watermark hi the low and high watermark control the assertion of the CP interrupt 0xCC000030 2 R/W cp FIFO read/write distance lo 0xCC000032 2 R/W cp FIFO read/write distance hi 0xCC000034 2 R/W cp FIFO write pointer lo 0xCC000036 2 R/W cp FIFO write pointer hi 0xCC000038 2 R/W cp FIFO read pointer lo 0xCC00003a 2 R/W cp FIFO read pointer hi 0xCC00003c 2 R/W cp FIFO bp lo 0xCC00003e 2 R/W cp FIFO bp hi 5.1.1 Token register You can insert this dirty marker, at the end of command list, by this way : *(u32 *)GXFIFO = 0x4800XXXX *(u32 *)GXFIFO = 0x4700XXXX Where XXXX is the token value. When command processor reaches this stage, it writes XXXX into PE token register (see above), and then raise "PE TOKEN" interrupt. Thus you can monitor the completion of your drawing tasks. note: its probably a good idea to send a BP 'drawing complete' command (0x45000002) before the insertion of the token. 5.2 PE - Pixel Engine Registerblock Base Size of Registerblock common access size 0xcc001000 0x100 2 0xcc001000 2 R/W Z configuration 15 8 7 0 bit(s) description 4 Z update enable 1-3 function 0 z-comperator enable 0xcc001002 2 R/W Alpha configuration 15 8 7 0 bit(s) description 12-15 blend operator (?) 11 substractive / additive toggle (?) 8-10 source 5-7 destination 4 alpha update enable 3 color update enable 2 dither enable (?) 1 arithmetic blending enable (?) 0 boolean blending enable (?) 0xcc001004 2 R/W destination alpha 15 8 7 0 bit(s) description 8 enable 0-7 alpha 0xcc001006 2 R/W Alpha Mode 15 8 7 0 bit(s) description 8-15 mode 0-7 threshold 0xcc001008 2 R/W Alpha Read (?) 15 8 7 0 bit(s) description mode 2 ? 0xcc00100a 2 R/W Interrupt Status Register 15 8 7 0 bit(s) description 3 PE Finish (set to acknowledge) 2 PE Token (set to acknowledge) 1 PE Finish enable (?) 0 PE Token enable (?) 0xcc00100e 2 R/W PE Token ? 15 8 7 0 tttt tttt tttt tttt bit(s) description 0-15 t PE Token (asserted from last PE Token Interrupt) 5.3 VI - Video Interface Registerblock Base Size of Registerblock common access size 0xcc002000 0x100 4 0xCC002000 2 R/W VTR - Vertical Timing Register 15 8 7 0 00aa aaaa aaaa eeee bit(s) description 4-13 a ACV - Active Video (in full Lines) ? other source says halflines 0-3 e EQU - Equalization pulse in half lines pal50/pal60/ntsc: 0x11F5, 0x0F06, 0x0F06 The value in ACV is double buffered 0xCC002002 2 R/W DCR - Display Configuration Register 15 8 7 0 0000 00pp lltt dire bit(s) description p FMT - Current Video Format 0 NTSC 1 PAL 2 MPAL 3 Debug l LE1 - Enables Display Latch 1 0 Off 1 On for 1 field 2 On for 2 fields 3 Always On t LE0 - Enables Display Latch 0 0 Off 1 On for 1 field 2 On for 2 fields 3 Always On d DLR - Selects 3D Display Mode i NIN - Interlace Selector 0 Interlaced 1 Non-Interlaced, top field drawn at field rate and bottom field is not displayed r RST - Reset - Clears all data requests and puts VI into its idle state. e ENB - Enable - Enables video timing generation and data request. pal50/pal60/ntsc: 0x0101, 0x0001, 0x0001 0xCC002004 4 R/W HTR0 - Horizontal Timing 0 31 24 23 16 15 8 7 0 0sss ssss 0eee eeee 0000 000w wwww wwww bit(s) description s HCS - Horizontal Sync Start to Color Burst Start e HCE - Horizontal Sync Start to Color Burst End w HLW - Halfline Width (W*16 = Width (720)) pal50/pal60/ntsc: 0x4B6A01B0, 0x476901AD, 0x476901AD 0xCC002008 4 R/W HTR1 - Horizontal Timing 1 31 24 23 16 15 8 7 0 0000 0sss ssss ssse eeee eeee ewww wwww bit(s) description s HBS - Half line to horizontal blanking start e HBE - Horizontal Sync Start to horizontal blank end w HSY - Horizontal Sync Width pal50/pal60/ntsc: 0x02F85640, 0x02EA5140, 0x02EA5140 Setting bit 0 seems to blackout the screen. (Similar to ViBlack?) 0xCC00200C 4 R/W VTO - Odd Field Vertical Timing Register 31 24 23 16 15 8 7 0 .... ..ss ssss ssss .... ..rr rrrr rrrr bit(s) description 16-25 s PSB - Post blanking in half lines 0-9 r PRB - Pre-blanking in half lines pal50/pal60/ntsc: 0x00010023, 0x00030018, 0x00030018 This register sets up the pre-blanking and post-blanking interval of odd fields, PRB and PSB are double-buffered. 0xCC002010 4 R/W VTE - Even Field Vertical Timing Register 31 24 23 16 15 8 7 0 .... ..ss ssss ssss .... ..rr rrrr rrrr bit(s) description 16-25 s PSB - post-blanking in halflines 0-9 r PRB - pre-blanking in halflines pal50/pal60/ntsc: 0x00000024, 0x00020019, 0x00020019 This register sets up the pre-blanking and post-blanking intervals of even fields. PRB and PSB are double-buffered. 0xCC002014 4 R/W BBEI - Odd Field Burst Blanking Interval Register 31 24 23 16 15 8 7 0 bit(s) description 21-31 BE3 - Field 3 start to burst blanking end in halflines 16-20 BS3 - Field 3 start to burst blanking start in halflines 5-15 BE1 - Field 1 start to burst blanking end in halflines 0-4 BS1 - Field 1 start to burst blanking start in halflines pal50/pal60/ntsc: 0x4D2B4D6D, 0x410C410C, 0x410C410C 0xCC002018 4 R/W BBOI - Even Field Burst Blanking Interval Register 31 24 23 16 15 8 7 0 bit(s) description 21-31 BE4 - Field 4 start to burst blanking end in halflines 16-20 BS4 - Field 4 start to burst blanking start in halflines 5-15 BE2 - Field 2 start to burst blanking end in halflines 0-4 BS2 - Field 2 start to burst blanking start in halflines pal50/pal60/ntsc: 0x4D8A4D4C, 0x40ED40ED, 0x40ED40ED 0xCC00201c 4 R/W TFBL - Top Field Base Register (L) (External Framebuffer Half 1) 31 24 23 16 15 8 7 0 yyy? zzzz aaaa aaaa aaaa aaax xxxx xxxx bit(s) description 29-31 y always zero (maybe some write only control register stuff?, setting bit 31 clears bits 31-28 (?)) 28 page offset bit (*1) 24-27 z XOF - Horizontal Offset of the left-most pixel within the first word of the fetched picture. 9-23 a FBB - bit 23 - bit 9 of XFB Address (*2) 0-8 x unused (?) pal50/pal60/ntsc: 0x00435A4E, 0x00435A4E, 0x00435A4E This register specifies the display origin of the top field of a picture in 2D mode or for the left picture in 3D mode (*1) when this bit is set, the framebuffer address is calculated as (address> >5) (*2) if bit 28 is cleared, highest possible Address: 0x80fffe00 (set register to 0x00fffe00) (aligned to 9bit) 0xCC002020 4 R/W TFBR - Top Field Base Register (R) (Only valid in 3D Mode) 31 24 23 16 15 8 7 0 0000 0000 ffff ffff ffff fff0 0000 0000 bit(s) description f FBB - External Memory Address of frame buffer pal50/pal60/ntsc: 0x00000000, 0x00000000, 0x00000000 This register specifies the base address of the top field for the right picture in 3D mode. 0xCC002024 4 R/W BFBL - Bottom Field Base Register (L) (External Framebuffer Half 2) 31 24 23 16 15 8 7 0 yyyy yyyy aaaa aaaa aaaa aaax xxxx xxxx bit(s) description y always zero (maybe some write-only control register stuff?) 28 page offset bit (*1) a FBB - bit 23 - bit 9 of XFB Address x unused (?) pal50/pal60/ntsc: 0x00435A4E, 0x00435A4E, 0x00435A4E This register specifies the display origin of the bottom field of a picture in 2D mode or for the left picture in 3D mode (*1) when this bit is set, the framebuffer address is calculated as (address> >5) 0xCC002028 4 R/W BFBR - Bottom Field Base Register (R) (Only valid in 3D Mode) 31 24 23 16 15 8 7 0 0000 0000 ffff ffff ffff fff0 0000 0000 bit(s) description f FBB - External Memory Address of frame buffer pal50/pal60/ntsc: 0x00000000, 0x00000000, 0x00000000 specifies the base address of the bottom field for the right picture in 3D mode. 0xCC00202C 2 R DPV - current vertical Position 15 8 7 0 0000 0vvv vvvv vvvv bit(s) description v VCT - current vertical Position of Raster beam pal50/pal60/ntsc: 0x013C, 0x0005, 0x0000 0xCC00202E 2 R DPH - current horizontal Position (?) 15 8 7 0 0000 0hhh hhhh hhhh bit(s) description h HCT - current horizontal Position of Raster beam (?) pal50/pal60/ntsc: 0x0144, 0x0176, 0x0000 The Horizontal Count is in pixels and runs from 1 to # pixels per line. It is reset to 1 at the beginning of every line. The Vertical Count is in lines (on a frame basis) and runs from 1 to # lines per frame. It is 1 at the beginning of pre-equalization. This is a frame line count. So for example: for NTSC vcount=264 is the first (full) line in the second field and vcount=525 is the last line in the frame (fields being numbered 1-4). For non-interlaced modes vcount is on a field-by-field basis (for NTSC vcount ranges from 1-263). This counting scheme applies the Display Position, Display Interrupt, and Display Latch registers. 0xCC002030 4 R/W DI0 - Display Interrupt 0 31 24 23 16 15 8 7 0 i00e 00vv vvvv vvvv 0000 00hh hhhh hhhh bit(s) description 31 i INT - Interrupt Status (1=Active) (Write to clear) 28 e ENB - Interrupt Enable Bit 16-25 v VCT - Vertical Position 0-9 h HCT - Horizontal Position pal50/pal60/ntsc: 0x113901B1, 0x110701AE, 0x110701AE There are a total of four display interrupt registers (0-3). They are used to generate interrupts to the main processor at different positions within a field. Each register has a separate enable bit. The interrupt is cleared by writing a zero to the status flag (INT). 0xCC002034 4 R/W DI1 - Display Interrupt 1 pal50/pal60/ntsc: 0x10010001, 0x10010001, 0x10010001 Refer to Display Interrupt 0 0xCC002038 4 R/W DI2 - Display Interrupt 2 pal50/pal60/ntsc: 0x00010001, 0x00010001, 0x00010001 Refer to Display Interrupt 0 0xCC00203C 4 R/W DI3 - Display Interrupt 3 pal50/pal60/ntsc: 0x00010001, 0x00010001, 0x00010001 Refer to Display Interrupt 0 0xCC002040 4 R/W DL0 - Display Latch Register 0 bit(s) Description 31 TRG - Trigger Flag 16-26 VCT - Vertical Count 0-10 HCT - Horizontal Count pal50/pal60/ntsc: 0x0000, 0x0000, 0x0000 The Display Latch Register 0 latches the value of the Display Position Register at the rising edge of the gt0 signal. The trigger flag is set if a gun trigger is detected. Writing a zero to the register clears the trigger flag. 0xCC002044 4 R/W DL1 - Display Latch Register 1 pal50/pal60/ntsc: 0x0000, 0x0000, 0x0000 See the description of Display Latch Register 0. This register is latched on the rising edge of the gt1 signal. 0xCC002048 2 R/W HSW - Scaling Width Register 15 8 7 0 bit(s) description 0-9 SRCWIDTH - Horizontal Stepping size pal50/pal60/ntsc: 0x2850, 0x2850, 0x2850 This register is the number of source pixels to be scaled. This is only used when the Horizontal Scaler is enabled. For example, if the image is to be scaled from 320x240 to 640x240, 320 would be written into this register. 0xCC00204a 2 R/W HSR - Horizontal Scaling Register 15 8 7 0 000e 000v vvvv vvvv bit(s) description 12 e HS_EN - Enable Horizontal Scaling 0-8 v STP - Horizontal stepping size (U1.8 Scaler Value) (0x160 Works for 320) pal50/pal60/ntsc: 0x0100, 0x0100, 0x0100 This register sets up the step size of the horizontal stepper. 0xCC00204C 4 R/W FCT0 - Filter Coefficient Table 0 (AA stuff) 31 24 23 16 15 8 7 0 bit(s) description 20-29 T2 - Tap2 10-19 T1 - Tap1 0-9 T0 - Tap0 pal50/pal60/ntsc: 0x1AE771F0, 0x1AE771F0, 0x1AE771F0 sets up part of the low-pass filter. Taps 0 to 9 are in the range (0.0, 2.0) 0xcc002050 4 R/W FCT1 - Filter Coefficient Table 1 (AA stuff) 31 24 23 16 15 8 7 0 bit(s) description 20-29 T5 - Tap5 10-19 T4 - Tap4 0-9 T3 - Tap3 pal50/pal60/ntsc: 0x0DB4A574, 0x0DB4A574, 0x0DB4A574 0xcc002054 4 R/W FCT2 - Filter Coefficient Table 2 (AA stuff) 31 24 23 16 15 8 7 0 bit(s) description 20-29 T8 - Tap8 10-19 T7 - Tap7 0-9 T6 - Tap6 pal50/pal60/ntsc: 0x00C1188E, 0x00C1188E, 0x00C1188E sets up part of the low-pass filter 0xcc002058 4 R/W FCT3 - Filter Coefficient Table 3 (AA stuff) 31 24 23 16 15 8 7 0 bit(s) description 24-31 T12 - Tap12 16-23 T11 - Tap11 8-15 T10 - Tap10 0-7 T9 - Tap9 pal50/pal60/ntsc: 0xC4C0CBE2, 0xC4C0CBE2, 0xC4C0CBE2 sets up part of the low-pass filter. Taps 9 to tap 24 are in the Rage (-0.125, 0.125) 0xcc00205c 4 R/W FCT4 - Filter Coefficient Table 4 (AA stuff) 31 24 23 16 15 8 7 0 bit(s) description 24-31 T16 - Tap16 16-23 T15 - Tap15 8-15 T14 - Tap14 0-7 T13 - Tap13 pal50/pal60/ntsc: 0xFCECDECF, 0xFCECDECF, 0xFCECDECF 0xcc002060 4 R/W FCT5 - Filter Coefficient Table 5 (AA stuff) 31 24 23 16 15 8 7 0 bit(s) description 24-31 T20 - Tap20 16-23 T19 - Tap19 8-15 T18 - Tap18 0-7 T17 - Tap17 pal50/pal60/ntsc: 0x13130F08, 0x13130F08, 0x13130F08 0xcc002064 4 R/W FCT6 - Filter Coefficient Table 6 (AA stuff) 31 24 23 16 15 8 7 0 bit(s) description 24-31 T24 - Hardwired to zero 16-23 T23 - Tap23 8-15 T22 - Tap22 0-7 T21 - Tap21 pal50/pal60/ntsc: 0x00080C0F, 0x00080C0F, 0x00080C0F sets up part of the low-pass filter 0xcc002068 4 R/W ? (AA stuff) pal50/pal60/ntsc: 0x00FF0000, 0x00FF0000, 0x00FF0000 0xCC00206C 2 R/W VICLK - VI Clock Select Register 15 8 7 0 0000 0000 0000 000s bit(s) description s 0 27 MHz video CLK 1 54 MHz video CLK (used in Progressive Mode) pal50/pal60/ntsc: 0x0000, 0x0000, 0x0000 0xCC00206e 2 R/W VISEL - VI DTV Status Register 15 8 7 0 bit(s) description 2 VISEL - don't care pal50/pal60/ntsc: 0x0000, 0x0000, 0x0000 this register allows software to read the status of two i/o pins 0xCC002070 2 R/W ? Holds 0x280, but has no effect on change (maybe for Progressive ?) pal50/pal60/ntsc: 0x0280, 0x0280, 0x0280 0xCC002072 2 r/w HBE - Border HBE 15 8 7 0 bit(s) description 15 BRDR_EN - Border Enable 0-9 HBE656 - Border Horizontal Blank End pal50/pal60/ntsc: 0x0000, 0x0000, 0x0000 This register (in conjunction with the border HBS) sets up a black border around the actual active pixels in debug mode. This was done in order to accommodate certain encoders that only support 720 active pixels. The border HBE and HBS can be programmed for 720 active pixels while the regular HBE and HBS can be programmed to the actual active width. This allows the frame buffer to be of any width without having to manually set up a border in memory. These registers will only take effect if enabled and in debug mode. 0xcc002074 2 r/w HBS - Border HBS 15 8 7 0 bit(s) description 0-9 HBS656 - Border Horizontal Blank start pal50/pal60/ntsc: 0x0000, 0x0000, 0x0000 0xcc002076 2 ?/? ? (unused?) pal50/pal60/ntsc: 0x00FF, 0x00FF, 0x00FF 0xcc002078 4 ?/? ? (unused?) pal50/pal60/ntsc: 0x00FF00FF, 0x00FF00FF, 0x00FF00FF 0xcc00207c 4 ?/? ? (unused?) pal50/pal60/ntsc: 0x00FF00FF 0x00FF00FF, 0x00FF00FF 5.3.1 Video Modes Mode TV Norm / Region Framerate Columns Lines NTSC ntsc (usa, japan) 60Hz 640 480 PAL pal (europe) 50Hz 640 574 DEBUG DEBUG PAL MPAL pal (brazil) 60Hz 640 480 PAL60 pal 60Hz 640 480 note: other modes may be possible using VGA output, although its unlikely. 5.4 PI - Processor Interface Registerblock Base Size of Registerblock common access size 0xcc003000 0x100 4 0xCC003000 4 r INTSR - interrupt cause 31 24 23 16 15 8 7 0 .... .... .... ...r .... .... .... .... bit Description 17-31 unused/reserved 16 r RSWST Reset Switch State (1 when pressed) 14-15 unused/reserved 13 HSP High Speed Port 12 DEBUG External Debugger 11 CP Command FIFO 10 PE FINISH Frame is Ready 9 PE TOKEN Token Assertion in Command List 8 VI Video Interface 7 MEM Memory Interface 6 DSP DSP 5 AI Streaming 4 EXI EXI 3 SI Serial 2 DI DVD 1 RSW Reset Switch 0 ERROR GP runtime error 0xCC003004 4 r/w INTMR - interrupt mask 31 24 23 16 15 8 7 0 bit Description 13 HSP High Speed Port 12 DEBUG External Debugger 11 CP Command FIFO 10 PE FINISH Frame is Ready 9 PE TOKEN Token Assertion in Command List 8 VI Video Interface 7 MEM Memory Interface 6 DSP DSP 5 AI Streaming 4 EXI EXI 3 SI Serial 2 DI DVD 1 RSW Reset Switch 0 ERROR GP runtime error 0xCC00300c 4 r/w FIFO Base Start 0xCC003010 4 ?/? FIFO Base End? 0xCC003014 4 ?/? PI (cpu) FIFO current Write Pointer? 0xCC003018 4 ?/? ? 0xCC00301c 4 ?/? ? 0xCC003020 4 ?/? ? 0xCC003024 4 ?/? Reset? Writing anything here seems to cause a complete reset. 0xCC00302c 4 ?/? ? 31 24 23 16 15 8 7 0 bit(s) Description 28-31 console type (2: hw2) 5.4.1 Operation 5.4.1.1 FIFO/Write Gather Pipe when CPU writes a byte to 0xcc008000, it is written to mem[writeptr], and writeptr is increased automatically. 0xcc008000 is the write gather pipe, a way for the CPU to blast sequences of things of various sizes to memory without having to keep track of the write pointer and wrapping manually. the gp then reads what the CPU has written to memory. It is used for Display Lists. it will disconnect the GP from the writegatherpipe (cc000002 & 0x10 = 0), and change the write ptr to where it wants to write a display list.. then use ordinary GX commands to build it. there's a Call Displaylist GX command.. so it will store render commands for rendering a certain object (for example) in a display list in memory, then send the CallDL with the address to the list instead of sending all the vertices over the FIFO. 5.4.1.2 Interrupts Each interrupt has one or more "source" devices. It means that some kind of device may generate a couple of different interrupts, represented by a single bit in interrupt registers. To "enable" interrupt, set bit in mask register. To ignore all interrupts write 0 to interrupt mask register. Raising of any interrupt will set corresponding bit in interrupt cause register. Interrupt cause register resets to 0, when read (i.e. you must read it to clear pending interrupts). Interrupt mask register isn't controlled by hardware logic. Note that masking of interrupt in INTMR doesn't disable it at all. It is only causing masked interrupt to be ignored in the software interrupt handler. You must clear corresponding "source" device registers, to completely disable interrupt. 5.4.1.3 hotreset this code snippet will reset the machine almost as if powered off/on lis r3,0 lis r9,0xCC00 sth r3, 0x2000(r9) li r4, 3 stw r4, 0x3024(r9) stw r3, 0x3024(r9) nop loop__: b loop__ 5.5 MI - Memory Interface Protection can be enabled only for pages (page size is 1024 bytes), and you can specify only 4 protected regions of memory. External interrupt will be raised, if CPU try to wrong access in protected region. Because it's allowed to enable protection for 4 regions only, there are a total of 4 possible interrupts which are called MEM_0, MEM_1, MEM_2 and MEM_3. Registerblock Base Size of Registerblock common access size 0xcc004000 0x80 4 0xCC004000 4 r/w Protected Region No1 0xCC004004 4 r/w Protected Region No2 0xCC004008 4 r/w Protected Region No3 0xCC00400c 4 r/w Protected Region No4 31 24 23 16 15 8 7 0 llll llll llll llll hhhh hhhh hhhh hhhh bit(s) Description 16-31 l Page Address Lo 0-15 h Page Address Hi note: the page address can be calculated as (physical_address> >10) 0xCC004010 2 r/w type of the protection, 4*2 bits 15 8 7 0 .... .... 3322 1100 bit(s) Description unused/reserved 6 3 Channel 3 0 access denied 1 read only (break on write) 2 write only (break on read) 3 read / write (no protection, full access) 4 2 Channel 2 (see Channel 3) 2 1 Channel 1 (see Channel 3) 0 0 Channel 0 (see Channel 3) 0xCC00401c 2 ?/w MI interrupt mask 15 8 7 0 .... .... ...m 3210 bit(s) Description 4 m mask all MI interrupts (1 - enable) 3 3 mask MEM3 interrupt (1 - enable) 2 2 mask MEM2 interrupt (1 - enable) 1 1 mask MEM1 interrupt (1 - enable) 0 0 mask MEM0 interrupt (1 - enable) 0xCC00401e 2 r/w interrupt cause 15 8 7 0 .... .... ...m 3210 bit(s) Description 4 m all MI interrupts 3 3 MEM3 interrupt read 0 irq has not been requested 1 irq has been requested write 0 no effect 1 clear pending irq assertion 2 2 MEM2 interrupt read 0 irq has not been requested 1 irq has been requested write 0 no effect 1 clear pending irq assertion 1 1 MEM1 interrupt read 0 irq has not been requested 1 irq has been requested write 0 no effect 1 clear pending irq assertion 0 0 MEM0 interrupt read 0 irq has not been requested 1 irq has been requested write 0 no effect 1 clear pending irq assertion 0xCC004020 2 ?/? ? 15 8 7 0 .... .... .... ..m. bit(s) Description 1 1 ? (set when MI interrupt has been asserted) 0 0 ? note: assume to be zero, after init, and should be cleared by interrupt handler. 0xCC004022 2 r/? ADDRLO - address which failed protection rules 15 8 7 0 bit(s) Description 5-15 bit 5-bit 15 of address 0-4 zero 0xCC004024 2 r/? ADDRHI - address, which failed protection rules 15 8 7 0 bit(s) Description 14-15 zero 0-13 bit 16-bit 29 of address 0xCC004032 2 r/? TIMERHI 0xCC004034 2 r/? TIMERLO 0xCC004036 2 r/? TIMERHI 0xCC004038 2 r/? TIMERLO 0xCC00403a 2 r/? TIMERHI 0xCC00403c 2 r/? TIMERLO 0xCC00403e 2 r/? TIMERHI 0xCC004040 2 r/? TIMERLO 0xCC004042 2 r/? TIMERHI 0xCC004044 2 r/? TIMERLO 0xCC004046 2 r/? TIMERHI 0xCC004048 2 r/? TIMERLO 0xCC00404a 2 r/? TIMERHI 0xCC00404c 2 r/? TIMERLO 0xCC00404e 2 r/? TIMERHI 0xCC004050 2 r/? TIMERLO 0xCC004052 2 r/? TIMERHI 0xCC004054 2 r/? TIMERLO 0xCC004056 2 r/? TIMERHI 0xCC004058 2 r/? TIMERLO note: writing anything to the timer register resets it to zero 0xCC00405a 2 r/? ? 15 8 7 0 .... .xxx xxxx xxxx bit(s) Description 11-15 unused ? 5.6 DSP - Digital Signal Processor Interface At the heart of the GCN audio hardware is a custom digital signal processor (DSP) which is largely dedicated to pitch modulation and the mixing of voices and effects data. The DSP is augmented by a large quantity of auxiliary RAM (ARAM) which may be used to store audio samples.The GCN audio hardware features a custom digital signal processor (DSP) which has the following characteristics: * 81MHz instruction clock. * 16-bit data words and addressing. * 8KB (4Kword) Data RAM. * 4KB (2Kword) Data ROM. * 8KB (4Kword) Instruction RAM. * 8KB (4Kword) Instruction ROM. * 40-bit add-and-multiply-result registers. * Hardware ADPCM decoder. * Cached memory interface to ARAM. * DMA interface to main memory. * "Mailbox" registers for communicating with the CPU. Register block Base Size of Register block common access size 0xCC005000 0x200 bytes 16bit words 0xCC005000 2 r/w DSP Mailbox High (to DSP) 0xCC005002 2 r/w DSP Mailbox Low (to DSP) bit31 of DSP Mailbox shows mail delivery status. (it will be cleared when the transfer is done) to send mail just write data, high word first, with bit31 set. 0xCC005004 2 r CPU Mailbox High (from DSP) 0xCC005006 2 r CPU Mailbox Low (from DSP) bit31 of CPU Mailbox shows mail delivery status. 0xCC00500a 2 ?/w AI DSP CSR - Control Status Register (DSP Status) 15 8 7 0 bit(s) Description 11 Reset DSP (?) 10 9 DSP DMA Int Status 8 DSPINTMSK - DSP interrupt mask (*1) 7 DSPINT read 0 no interrupts 1 interrupt is active write 0 no effect 1 clear interrupt 6 ARINTMSK - ARAM interupt mask (*2) 5 ARINT - read 0 no interrupts 1 interrupt is active write 0 no effect 1 clear interupt 4 AIDINTMASK - AI interrupt mask (*3) 3 AIDINT read 0 no interrupts 1 interrupt is active write 0 no effect 1 clear interrupt 2 HALT - Halt DSP (?) read 0 1 write 0 unhalt DSP 1 halt DSP (stop task execution) 1 PIINT - DSP Interrupt Assertion (?) read 0 1 write 0 1 assert PI DSP interrupt 0 RES - Reset DSP (?) read 0 1 write 0 1 reset DSP (*1) disables only PI interrupt, doesnt effect assertion of DSPINT. (*2) disables only PI interrupt, doesnt effect assertion of ARINT. (*3) disables only PI interrupt, doesnt effect assertion of AIDINT. 0xCC005012 2 ?/? AR_SIZE 0xCC005016 2 ?/? AR_MODE 0xCC00501a 2 ?/? AR_REFRESH 0xCC005020 2 ?/? AR_DMA_MMADDR_H 0xCC005022 2 ?/? AR_DMA_MMADDR_L 0xCC005024 2 ?/? AR_DMA_ARADDR_H 0xCC005026 2 ?/? AR_DMA_ARADDR_L 0xCC005028 2 ?/? AR_DMA_CNT_H bit(s) description 15 type of transfer (0: write to aram 1: read from aram) 0-14 high bits of transfer length 0xCC00502a 2 ?/? AR_DMA_CNT_L 0xCC005030 2 ?/w DMA Start address (High) Start of Audio Data 0xCC005032 2 ?/w DMA Start address (Low) Start of Audio Data 0xCC005036 2 ?/w DMA Control/DMA length (Length of Audio Data) 15 8 7 0 axxx xxxx xxxx xxxx bit(s) Description a 0=stop sample 1=play sample x length/32 (max len is 0x000fffe0) 0xCC00503a 2 r/? DMA Bytes left Counts down to zero showing how any bytes are left 5.6.1 internal DSP Registers Registerblock Base Size of Registerblock common access size 0xffc9 2 0xFFC9 2 r/w DSCR - DSP dma Control Register 15 8 7 0 bit(s) description 3-15 unused/reserved 2 DSP DMA busy read 0 1 Block length counter not yet zero, DMA is still busy write 0 no effect ? 1 no effect ? 1 DSP source/destination (DMA involved DSP memory) 0 DSP data memory 1 DSP instruction memory 0 transfer direction 0 from main memory to DSP memory 1 from DSP memory to main memory 0xFFCB 2 r/w DSBL - DSp dma Block Length 15 8 7 0 bit(s) description 2-15 block length - This register is used to specify DSP DMA transfer length from bit 15 to bit 2 0-1 r: 2 bit of its LSBs - The transfer length is a multiple of 4 bytes 0xFFCD 2 r/w DSPA - DSp dma dsP memory Address High 15 8 7 0 bit(s) description 1-15 DSP memory address - This register is used to specify DSP memory starting/current address from bit 15 to bit 1 0 r: 1 bit of its LSBs - The DSP memory address should be located at 2 word boundary 0xFFCE 2 r/w DSMAH - DSp dma Main memory Address High 15 8 7 0 bit(s) description 10-15 r: 6 bits of its MSBs - This register is used to specify DSP DMA main memory starting/current address from bit 31 to bit 26, and always 0 0-9 main memory address high word - This register is used to specify DSP DMA main memory starting/current address from bit 25 to bit 16 0xFFCF 2 r/w DSMAL - DSp dma Main memory Address Low 15 8 7 0 bit(s) description 2-15 main memory address - This register is used to specify DSP DMA main memory starting/current address from bit 15 to bit 2 0-1 r: 2 bits of its LSBs - The main memory address of this DMA should be located at 4 byte boundary 0xFFD4 2 r/w ACSAH - Accelerator aram Starting Address High 15 8 7 0 bit(s) description 11-15 unused/reserved 0-10 wtarting address high-word - Bit 26 to bit 16 of ARAM starting address 0xFFD5 2 r/w ACSAL - Accelerator aram Starting Address Low 15 8 7 0 bit(s) description 0-15 Starting address low-word - Bit 15 to bit 0 of ARAM starting address 0xFFD6 2 w ACEAH - Accelerator aram Ending Address High 15 8 7 0 bit(s) description 15-11 unused/reserved 0-10 ending address high-word - Bit 26 to bit 16 of ARAM ending address 0xFFD7 2 w ACEAL - Accelerator aram Ending Address Low 15 8 7 0 bit(s) description 0-15 ending address low-word - Bit 15 to bit 0 of ARAM ending address 0xFFD8 2 r/w ACCAH - Accelerator aram Current Address High 15 8 7 0 bit(s) description 15 direction 0 accelerator read ARAM 1 accelerator write ARAM 11-14 unused/reserved 0-10 current address high-word - Bit 26 to bit 16 of ARAM current address 0xFFD9 2 r/w ACCAL - Accelerator aram Current Address Low 15 8 7 0 bit(s) description 0-15 Bit 15 to Bit 0 of ARAM current address 0xFFEF 2 r/w AMDM - ARAM-Dma request Mask 15 8 7 0 bit(s) description 1-15 unused/reserved 0 0 DMA request ARAM is unmasked 1 DMA request ARAM is masked 5.6.2 Operation 5.6.2.1 play raw audio sample * load DMA Start Address * setup DMA Control/DMA length 5.6.2.2 transfer from/to ARAM * set main memory address in AR_DMA_MMADDR_H and AR_DMA_MMADDR_L * set aram address in AR_DMA_ARADDR_H and AR_DMA_ARADDR_L * set length and transfer type in AR_DMA_CNT_H and AR_DMA_CNT_L * wait until bit 9 of AI DSP Control register gets cleared 5.6.2.3 reset DSP * set bit0 and bit11 of AI DSP Control Register 5.6.2.4 Boot DSP Task * send mail to DSP: 0x80F3A001, ram_mmem_addr * send mail to DSP: 0x80F3C002, ram_addr * send mail to DSP: 0x80F3A002, ram_length * send mail to DSP: 0x80F3B002, aram_mmem_addr (==0 ?) * send mail to DSP: 0x80F3D001, dsp_init_vector 5.7 DI - DVD Interface Register block Base Size of Register block common access size 0xCC006000 0x40 4 0xCC006000 4 r/w DISR - DI Status Register 31 24 23 16 15 8 7 0 bit(s) description 7-31 reserved 6 BRKINT - Break Complete Interrupt Status (*1) read 0 Interrupt has not been requested 1 Interrupt has been requested write 0 no effect 1 clear Interrupt 5 BRKINTMASK - Break Complete Interrupt Mask. 0:masked, 1:enabled (*2) 4 TCINT - Transfer Complete Interrupt Status (*3) read 0 Interrupt has not been requested 1 Interrupt has been requested write 0 no effect 1 clear Interrupt 3 TCINTMASK - Transfer Complete Interrupt Mask. 0:masked, 1:enabled (*4) 2 DEINT - Device Error Interrupt Status (*5) read 0 Interrupt has not been requested 1 Interrupt has been requested write 0 no effect 1 clear Interrupt 1 DEINTMASK - Device Error Interrupt Mask. 0:masked, 1:enabled (*6) 0 BRK - DI Break (*7) read 0 break not requested or break complete 1 break requested and pending write 0 no effect 1 request break (*1) On read this bit indicates the current status of the break complete interrupt. This interrupt is asserted when a Break cycle has completed (break acknowledge received from mass storage access device). When a `1` is written to this register, the interrupt is cleared. (*2) Interrupt masking prevents the interrupt from being sent to the main processor, but does not affect the assertion of DISR[BRKINT] (*3) On read this bit indicates the current status of the transfer complete interrupt. The Transfer Complete interrupt is asserted under the following conditions: a DMA mode transfer has completed (DMA finished) or an Immediate mode transfer has completed (transfer to/from DIIMMBUF has completed). When a `1` is written to this register, the interrupt is cleared. The assertion of TCIT is delayed until the DIDSTRBb (low) in order to guarantee the error interrupt occurs before transfer complete interrupt. If DIERRb is asserted during the current transaction, the transaction will be halted and TCINT will not be asserted. (*4) Interrupt masking prevents the interrupt from being sent to the main processor, but does not affect the assertion of DISR[TCINT] (*5) On read this bit indicates the current status of the mass storage access device error interrupt. To clear this interrupt, two actions must occur. When a `1` is written to this register, the internal interrupt is cleared. To reset the DIERRb signal, a command must be issued to the external DI device. If error occurs during the command packet, the drive has to delay the error assertion until the completion of the 12 bytes command transfer. In immediate mode, if error occurs during the data packet, the error assertion has to be delayed until the completion of the 4 bytes data transfer. In DMA mode, it has to be delayed until the completion of any 32 bytes data transfer. (*6) Interrupt masking prevents the interrupt from being sent to the main processor, but does not affect the assertion of DISR[DEINT] (*7) When a `1` is written to this bit, the DI controller interrupts the current command and sends a break signal to the mass storage access device. The break signal interrupts the current command on the mass storage access device. After the break sequence is complete (see TCINT), a new command may be sent to the mass storage access device. This bit is cleared after the break command is complete. Note that DI controller will delay the break signal assertion if it is in the middle of the command transfer. Hence break can only occur during the data transfer or when it is idle. 0xCC006004 4 r/w DICVR - DI Cover Register (status2) 31 24 23 16 15 8 7 0 .... .... .... .... .... .... .... .smc bit(s) Description 2 s CVRINT - Cover Interrupt Status (*1) read 0 cover interrupt has not been requested 1 cover interrupt has been requested write 0 no effect 1 clear cover interrupt 1 m CVRINTMASK - Cover Interrupt Mask. 0: masked, 1: enabled (*2) 0 c CVR - State of the DICOVER signal. 0: cover closed, 1: cover opened (*1) On read this bit indicates the current status of the Mass Storage Device Cover interrupt. When a `1` is written to this register, the internal interrupt is cleared. The Mass Storage Device Cover Interrupt is asserted when the status of the DICOVER signal changes (e.g., when the cover is opened or closed). (*2) Interrupt masking prevents the interrupt from being sent to the main processor, but does not affect the assertion of DISR[CVRINT]. 0xCC006008 4 r/w DICMDBUF0 - DI Command Buffer 0 31 24 23 16 15 8 7 0 cccc cccc 1111 1111 2222 2222 2222 2222 bit(s) Description 24-31 c command 16-23 1 subcommand 1 0-15 2 subcommand 2 0xCC00600c 4 r/w DICMDBUF1 - DI Command Buffer 1 (offset in 32 bit words) 0xCC006010 4 r/w DICMDBUF2 - DI Command Buffer 2 (source length) 0xCC006014 4 r/w DIMAR - DMA Memory Address Register 31 24 23 16 15 8 7 0 bit(s) description 26-31 reserved/unused 5-25 DIMAR - Address of source/destination buffer in main Memory 0-4 always zero (Address must be 32 byte aligned) 0xCC006018 4 r/w DILENGTH - DI DMA Transfer Length Register 31 24 23 16 15 8 7 0 bit(s) description 26-31 reserved/unused 5-25 DILENGTH - length of DMA data transfer in bytes (*1) 0-4 always zero (transfer length must be 32 byte aligned) (*1) If a DMA command is interrupted by a break cycle, this register indicates the amount of data that was left to transfer before the DMA command was interrupted. If the length equals zero, it is a special case with command transfer only. 0xCC00601c 4 r/w DICR - DI Control Register 31 24 23 16 15 8 7 0 .... .... .... .... .... .... .... .mbe bit(s) Description 2 m RW - access mode, 0:read, 1:write 1 b DMA - 0: immediate mode, 1: DMA mode (*1) 0 e TSTART - transfer start. write 1: start transfer, read 1: transfer pending (*2) (*1) The only mass storage device packet command which can use immediate mode is the `Register Access` command. When in immediate mode, the DIMAR and DILENGTH registers are ignored. (*2) When read this bit represents the current command status. This bit is also cleared after the break completion and after DIERRb is asserted. 0xCC006020 4 r/w DIIMMBUF - DI immediate data buffer (error code ?) 31 24 23 16 15 8 7 0 bit(s) description 24-31 REGVAL0 - data of register address+0 16-23 REGVAL1 - data of register address+1 8-15 REGVAL2 - data of register address+2 0-7 REGVAL3 - data of register address+3 0xCC006024 4 r DICFG - DI Configuration Register 31 24 23 16 15 8 7 0 bit(s) description 8-31 reserved/unused 0-7 CONFIG - during reset this register latches DIDD bus (only bit 0 used) 5.7.1 Drive Commands DICMDBUF0 DICMDBUF1 DICMDBUF2 DIMAR DILENGTH DIIMMBUF DICR Description ret: DMA 0x12000000 0x00000000 0x00000020 Drive- 0x00000020 - read Inquiry Info Data- Data- ret: Data- DMA 0xa8000000 Position> >2 Length Sector- Length - read read Sector Data ret: DMA read Disc 0xa8000040 0x00000000 0x00000020 Disc-ID 0x00000020 - read ID/Init Drive 0xa8000080 ? ? ? ? ? ? ? 0xa80000C0 ? ? ? ? ? ? ? 0xab000000 Position> >2 - - - - imm seek (read) ret: imm request 0xe0000000 - - - - Error- read error Code Status 0xe1??0000 Stream- Stream- - - - imm play Audio Position> >2 Length read Stream (?) ret: imm request 0xe2??0000 - - - - Status read Audio (?) Status 0xe3000000 - - - - - imm stop Motor (read) 0xe4000000 - - - - - imm DVD Audio (read) disable 0xe4010000 - - - - - imm DVD Audio (read) enable 5.7.2 Drive Debug Commands DICMDBUF0 DICMDBUF1 DICMDBUF2 DIMAR DILENGTH DIIMMBUF DICR Description 0xfe00???? ? ? ? ? ? ? ? ret: 0xfe010000 offset 0x00010000 - - 32bit imm (read) read memory value 0xfe010100 offset 0x00010000 - - 32bit imm write cache value (write) ret: 0xfe018000 offset 0xff000000 - - 32bit imm (read) read cache value 0xfe018100 offset 0xff000000 - - 32bit imm write cache value (write) 0xfe100000 ? ? - - - imm (read) ? 0xfe110000 - - - - - imm (read) stop drive 0xfe110100 - - - - - imm (read) start drive 0xfe114000 - - - - - imm (read) accept copy 0xfe118000 - - - - - imm (read) do disc- (*) check 24bit jsr to 0xfe120000 address 0x66756e63 - - - imm (read) address 'func' 0xff004456 0x442d4741 0x4d450300 - - - imm (read) unlock 2 'DVD-GAME' 0xff014d41 0x54534849 0x5441024f - - - imm (read) unlock 1 'MATSHITA' (*) commands can be ORed to perform several actions at once 5.7.3 Operation 5.7.3.1 Drive Info (Inquiry) 5.7.3.1.1 Structure of the Drive Info Data start end size Description 0x0000 0x0001 0x02 revision level 0x0002 0x0003 0x02 device code 0x0004 0x0007 0x04 release date 0x0008 0x001F 0x18 padding zeros 5.7.3.2 Read Disc ID / Init Disc 5.7.3.3 Read Sector 5.7.3.4 Seek 5.7.3.5 Request Error 5.7.3.5.1 Error Codes 31 24 23 16 15 8 7 0 aaaa aaaa nnnn nnnn nnnn nnnn nnnn nnnn bit(s) description 0x00 ok 0x01 lid open a 0x02 no disc/disc changed 0x03 no disc 0x04 motor off 0x05 disc not initialized/disc id not read 0x000000 ok 0x020400 Motor stopped 0x020401 Disk ID not read 0x023A00 Medium not present / Cover opened 0x030200 No Seek complete 0x031100 UnRecoverd read error 0x040800 Transfer protocol error n 0x052000 Invalid command operation code 0x052001 Audio Buffer not set 0x052100 Logical block address out of range 0x052400 Invalid Field in command packet 0x052401 Invalid audio command 0x052402 Configuration out of permitted period 0x056300 End of user area encountered on this track 0x062800 Medium may have changed 0x0B5A01 Operator medium removal request 5.7.3.6 Play Audio Stream 5.7.3.7 Request Audio Status 5.7.3.8 Stop Motor 5.7.3.9 DVD Audio Disable 5.7.3.10 DVD Audio Enable * Command/Subcommand/Padding <- E4010000 * Action <- 1 * ACK (???) * Status2 <- Status2 * INIT (???) * Status1 <- 2Ah * Status2 <- 0 5.7.4 DVD-ROM Subsystem * Matsushita MN103S13BGA Optical Disk Controller * Matsushita MN102H60GFA MicroComputer 5.7.4.1 Memory Map start end size description 0x00008000 4kb internal (cpu) ram 0x00080000 128kb firmware rom (*) 0x00400000 internal (controller) ram (*) note: reading the firmware at its real location is prevented by the debug commands (imm buffer will not be changed at all). however you can read its contents from the memory mirrors, ie 0x000a0000-. 5.8 SI - Serial Interface Register block Base Size of Register block common access size 0xCC006400 0x100 4 0xCC006400 4 r/w SIC0OUTBUF - SI Channel 0 Output Buffer (Joy-channel 1 Command) 0xCC00640c 4 r/w SIC1OUTBUF - SI Channel 1 Output Buffer (Joy-channel 2 Command) 0xCC006418 4 r/w SIC2OUTBUF - SI Channel 2 Output Buffer (Joy-channel 3 Command) 0xCC006424 4 r/w SIC3OUTBUF - SI Channel 3 Output Buffer (Joy-channel 4 Command) 31 24 23 16 15 8 7 0 bit(s) description 24-31 unused/reserved 16-23 CMD - (*1) 8-15 OUTPUT0 - (*2) 0-7 OUTPUT1 - (*3) This register is double buffered, so main processor writes to the SIC0OUTBUF will not interfere with the serial interface output transfer. Internally, a second buffer is used to hold the output data to be transferred across the serial interface. To check if SIC0OUTBUF has been transferred to the second buffer, main processor polls the SISR[WRST0] register. When SICOOUTBUF is transferred, SISR[WRST0] is cleared. (*1) This byte is the opcode for the command sent to the controller during each command/response packet. This is the first data byte sent from the SI I/F to the game controller in the command/response packet. (*2) This is the first data byte of the command packet. It is the second data byte sent from the SI I/F to the game controller in the command/response packet. (*3) This is the second data byte of the command packet. It is the third data byte sent from the SI I/F to the game controller in the command/response packet. 0xCC006404 4 r Joy-channel 1 Buttons 1 0xCC006410 4 r SIC1INBUFH - SI Channel 1 Input Buffer High (Joy-channel 2 Buttons 1) 0xCC00641c 4 r Joy-channel 3 Buttons 1 0xCC006428 4 r Joy-channel 4 Buttons 1 31 24 23 16 15 8 7 0 ...s yxba ..LR udrl xxxx xxxx yyyy yyyy bit(s) Description 31 ERRSTAT - Error Status (*1) 0 no error on last transfer 1 error on last transfer 30 ERRLATCH - Error Latch (*2) 0 no error latched 1 error latched (check SISR) 24-29 bit 0-5 of input byte 0 (bit 6 and 7 are assumed to be 0) 16-23 input byte 1 8-15 input byte 2 0-7 input byte 3 (*1) This bit represents the current error status for the last SI polling transfer on this channel. This register is updated after each polling transfer on this channel. (*2) This bit is an error status summary of the SISR error bits for this channel. If an error has occurred on a past SI transfer (polling or Com transfer), this bit will be set. To determine the exact error, read the SISR register. This bit is actually an `or` of the latched error status bits for this channel in the SISR. The bit is cleared by clearing the appropriate error status bits latched in the SISR. The no response error indicates that a controller is not present on thischannel. 0xCC006408 4 r/w Joy-channel 1 Buttons 2 0xCC006414 4 r/w Joy-channel 2 Buttons 2 0xCC006420 4 r/w Joy-channel 3 Buttons 2 0xCC00642c 4 r SIC3INBUFL - SI Channel 3 Input Buffer Low (Joy-channel 4 Buttons 2) 31 24 23 16 15 8 7 0 xxxx xxxx yyyy yyyy llll llll rrrr rrrr bit(s) Description 24-31 x input byte 4 16-23 y input byte 5 8-15 l input byte 6 0-7 r input byte 7 SIC0INBUFH and SIC0INBUFL are double buffered to prevent inconsistent data reads due to main processor conflicting with incoming serial interface data. To insure data read from SIC0INBUFH and SIC0INFUBL are consistent, a locking mechanism prevents the double buffer from copying new data to these registers. Once SIC0INBUFH is read, both SIC0INBUFH and SIC0INBUFL are `locked` until SIC0INBUFL is read. While the buffers are `locked`, new data is not copied into the buffers. When SIC0INBUFL is read, the buffers become unlocked again. 0xCC006430 4 r/w SIPOLL - SI Poll Register (Joy-channel Control (?) (Calibration gun ?)) 31 24 23 16 15 8 7 0 .... .... ???? .??? .... ..?. eeee .... bit(s) description 26-31 unused/reserved 16-25 X - 7 X lines register (*1) 8-15 Y - y times register (*2) 4-7 e EN - controller port enable (1 bit per port, 1: enabled) (*3) 0-3 VBCPY - Vblank copy output channel (1 bit per port) (*4) 0 copy SICOUTBUF to output buffer after writing 1 copy SICOUTBUF to output buffer only on vblank (*1) 7 X lines register: determines the number of horizontal video lines between polling (the polling interval). The polling begins at vsync. 7 is the minimum setting (determined by the time required to complete a single polling of the controller). The maximum setting depends on the current video mode (number of lines per vsync) and the SIPOLL[Y] register. This register takes affect after vsync. (*2) This register determines the number of times the SI controllers are polled in a single frame. This register takes affect after vsync. (*3) Enable polling of channel. When the channel is enabled, polling begins at the next vblank. When the channel is disabled, polling is stopped immediately after the current transaction. The status of this bit does not affect communication RAM transfers on this channel. (*4) Normally main processor writes to the SIC0OUTBUF register are copied immediately to the channel 0 output buffer if a transfer is not currently in progress. When this bit is asserted, main processor writes to channel 0's SIC0OUTBUF will only be copied to the outbuffer on vblank. This is used to control the timing of commands to 3D LCD shutter glasses connected to the VI. 0xCC006434 4 r/w SICOMCSR - SI Communication Control Status Register (command) 31 24 23 16 15 8 7 0 r?.. ?ccs .mmm mmmm .nnn nnnn eb.. ...? bit(s) description 31 r TCINT - Transfer Complete Interrupt Status read 0 transfer complete interrupt not requested 1 transfer complete interrupt has been requested write 0 no effect 1 clear transfer complete interrupt 30 TCINTMSK - Transfer Complete Interrupt Mask (*1) 0 interrupt masked 1 interrupt enabled 29 COMERR - Communication Error 0 ok 1 error (see SiSr for the cause) 28 RDSTINT - Read Status Interrupt Status (*2) read 0 Transfer Complete Interrupt not requested 1 Transfer Complete Interrupt has been requested write 0 1 27 RDSTINTMSK - Read Status interrupt Mask (*3) 0 masked 1 enabled 25-26 c Channel Number (?) 24 s Channel Enable (?) 23 unused/reserved 16-22 m OUTLNGTH - Communication Channel Output Length (*4) 15 unused/reserved 8-14 n INLNGTH - Communication Channel Input Length (*4) 7 e Command Enable (?) 6 b callback enable bit Description 0 no callback 1 callback enabled 1-2 CHANNEL - (*5) 00 Channel 1 01 Channel 2 10 Channel 3 11 Channel 4 0 TSTART - Transfer Start (*6) read 0 Command Complete 1 Command Pending write 0 Do not start command 1 Start command (*1) Interrupt masking prevents the interrupt from being sent to the main processor, but does not affect the assertion of SICOMCSR[TCINT] (*2) On read this bit indicates the current status of the Read Status interrupt. The interrupt is set whenever SISR[RDSTn] bits are set. The interrupt is cleared when all of the RdSt bits in the SISR are cleared by reading from the Si Channel Input Buffers. This interrupt can be used to indicate that a polling transfer has completed and new data is captured in the input registers (*3) Interrupt masking prevents the interrupt from being sent to the main processor, but does not affect the assertion of SICOMCSR[RDSTINT] (*4) Minimum transfer is 1 byte. A value of 0 will transfer 128 bytes. These bits should not be modified while SICOM transfer is in progress. (*5) These bits should not be modified while SICOM transfer is in progress. (*6) When a `1` is written to this register, the current communication transfer is executed. The transfer begins immediately after the current transaction on this channel has completed. When read this bit represents the current transfer status. Once a communication transfer has been executed, polling will resume at the next vblank if the channel's SIPOLL[ENn] bit is set. When programming the SICOMCSR after a SICOM transfers has already started (e.g., SICOMCSR[TSTART] is set), the software should read the current value first, then and/or in the proper data and then write the new data back. The software should not modify any of the transfer parameters (OUTLNGTH, INLNGTH, CHANNEL) until the current transfer is complete. This is done to prevent a SICOM transfer already in progress from being disturbed. When writing the data back, the software should not set the TSTART bit again unless the current transfer is complete and another transfer is required. 0xCC006438 4 r/w SISR - SI Status Register (channel select & status2) 31 24 23 16 15 8 7 0 r??? aaaa ???? bbbb ???? cccc ???? dddd bit(s) description 31 r WR - Write SICnOUTBUF Register (*1) read 0 buffer copied 1 buffer not copied write 0 no effect 1 copy all buffers 30 reserved/unused 29 RDST0 - Read Status SIC0OINBUF Register (*2) 0 New data available, not read by main processor 1 No new data available, already read by main processor 28 WRST0 - Write Status SIC0OUTBUF Register (*3) 0 Buffer copied 1 Buffer not copied 27 NOREP0 - No Response Error Channel 0 (*4) read 0 No Response Error not asserted 1 No Response Error asserted write 0 No effect 1 Clear No Response Error 26 COLL0 - Collision Error Channel 0 (*5) read 0 Collision Error not asserted 1 Collision Error asserted write 0 No effect 1 Clear Collision Error 25 OVRUN0 - Over Run Error Channel 0 (*6) read 0 Over Run Error not asserted 1 Over Run Error asserted write 0 No effect 1 Clear Over Run Error 24 UNRUN - Under Run Error Channel 0 (*7) read 0 Under Run not asserted 1 Under Run asserted write 0 No effect 1 Clear Under Run Error 22-23 reserved/unused 16-21 b Joy-channel 1 bits 14-15 reserved/unused 8-13 c Joy-channel 2 bits 6-7 reserved/unused 0-5 d Joy-channel 3 bits (*1) Write SICnOUTBUF Register: This register controls and indicates whether the SICnOUTBUFs have been copied to the double buffered output buffers. This bit is cleared after the buffers have been copied. (*2) This register indicates whether the SIC0INBUFs have been captured new data and whether the data has already been read by the main processor (read indicated by main processor read of SIC01NBUF[ERRSTAT, ERRLATCH, INPUT0, INPUT1)] (*3) This register indicates whether the SIC0OUTBUFs have been copied to the double buffered output buffers. This bit is cleared after the buffers have been copied. (*4) This register indicates that a previous transfer resulted in no response from the controller. This can also be used to detect whether a controller is connected. If no controller is connected, this bit will be set. Once set this bit remains set until it is cleared by the main processor. To clear this bit write `1` to this register. (*5) This register indicates data collision between controller and main unit. Once set this bit remains set until it is cleared by the main processor. To clear this bit write `1` to this register. (*6) This register indicates that the main unit has received more data than expected. Once set this bit remains set until it is cleared by the main processor. To clear this bit write `1' to this register. (*7) This register indicates that the main unit has received less data than expected. Once set this bit remain set until it is cleared by the main processor. To clear this bit write `1` to this register. 0xcc00643c 4 R/W SIEXILK - SI EXI Clock Lock 31 24 23 16 15 8 7 0 bit(s) description 31 LOCK - prevents CPU from setting EXI clock to 32MHz 0 32MHz EXI clock setting permitted 1 32MHz EXI clock setting not permitted 0-30 unused/reserved (always zero) 0xCC006480 0x80 r/w SI i/o buffer (access by word) 5.8.1 Operation 5.8.1.1 Serial Send Buffer * select channel: unset all bits in 0xcc006438 that are not corresponding to your channel and leave the others untouched. * Put output data into SI buffer (128 bytes maximum), word by word. * Send command: fill in 'c','m','n' and 'b' bits of 0xcc006434 accordingly, and set bits 's' and 'e'. leave other bits untouched. 5.8.1.2 Serial Get Result * simply read the SI buffer 5.9 EXI - External Interface Upper memory (0xCC000000 and above) can't keep enough data for extra-large arrays, it's limited up to 0xFFFF bytes (suppose to be). EXI was designed to remove this limitation. EXI is used for access to big, unmapped areas of HW memory (such as bootrom or SRAM). This is the main task of EXI. Put another way, EXI can be used for providing access to slow, serial devices, such as memory cards. EXI is a complex of different devices, mapped to a single bus. The EXI bus is divided on 3 channels. Each channel has 3 unique devices. Each device is defined by its ID, and has its own address space. EXI can be accessed in immediate mode, or via DMA channel. Each EXI device can generate up to 3 interrupts. They are called EXI, TC and EXT : EXI Device EXI Interrupt TC Transfer Completed (any mode) EXT Device Attached / Device Detached Each EXI channel have its own register set, 5 32bit Registers each. Register block Base Size of Register block common access size 0xCC006800 0x40 4 0xCC006800 4 EXI0CSR - EXI Channel 0 Parameter Register (Status?) 0xCC006814 4 EXI1CSR - EXI Channel 1 Parameter Register 0xCC006828 4 EXI2CSR - EXI Channel 2 Parameter Register 31 24 23 16 15 8 7 0 bit(s) Description 14-31 unused 13 ROMDIS - (EXI0 only) 1: rom de-scramble logic disabled (*1) 12 d EXT - Device Connected Bit (R) 1 if a device is connected on the specific channel 11 x EXTINT - External Insertion Interrupt Status (R) : check to poll EXT interrupt (or to detect device detach) (*4) read 0 External Insertion Interrupt has not been requested 1 External Insertion Interrupt has been requested write 0 No effect 1 Clear External Insertion Interrupt 10 m EXTINTMASK - EXT Interrupt Mask (1 - enable, 0 - disable) (*5) 7-9 210 CS - devices selected on this channel, each bit selecting one device. (*) 4-6 f CLK - used frequency (0-5) 000 1MHz 001 2MHz 010 4MHz 011 8MHz 100 16MHz 101 32MHz 110 reserved 111 reserved 3 t TCINT - Transfer Complete Interrupt Status read 0 Transfer Complete Interrupt has not been requested 1 Transfer Complete Interrupt has been requested write 0 No effect 1 Clear Transfer Complete Interrupt 2 m TCINTMASK - Transfer complete interrupt mask (1 - enable, 0 - disable) (*2) 1 e EXTINT - Interrupt Status (*6) read 0 EXI Interrupt has not been requested 1 EXI Interrupt has been requested write 0 No effect 1 Clear EXI Interrupt 0 m EXTINTMASK - EXI interrupt mask (1 - enable, 0 - disable) (*)Only one of these three bits can be set to signify which device number has been selected on a specific channel. (*6) This bit indicates the current status of the EXI0 interrupt. The interrupt is cleared by accessing the expansion device and clearing the interrupt on the device itself and cleared locally when a `1` is written to this register. This interrupt input is edge triggered. (*1) This bit disables access to the IPL Mask ROM attached to CS1. Once this bit is enabled, it can only be disabled again by global reset. The ROM de- scramble logic will become disabled and any reads to the memory mapped ROM area will return all 0.When de-scrambler is enabled all EXI0 data will be de- scrambled, so only the IPL ROM may be accessed through EXI0 until ROMDIS is set to `1'. (this is usually done by the Bootstrap, see Boot process details) (*2) Interrupt masking prevents the interrupt from being sent to the main processor, but does not affect the assertion of TCINT (*3) Interrupt masking prevents the interrupt from being sent to the main processor, but does not affect the assertion of EXIINT (*5) Interrupt masking prevents the interrupt from being sent to the main processor, but does not affect the assertion of EXICPR[EXTINT] (*4) This interrupt indicates than an external EXI device has been removed from channel 1. To check whether the device has been inserted or removed, check the EXICPR[EXT] bit. When this bit is set, the channel's expansion EXI interface outputs go to high. 0xCC006804 4 r/w EXI0MAR - EXI Channel 0 DMA Start Address 0xCC006818 4 r/w EXI1MAR - EXI Channel 1 DMA Start Address 0xCC00682c 4 r/w EXI2MAR - EXI Channel 2 DMA Start Address 31 24 23 16 15 8 7 0 .... ..dd dddd dddd dddd dddd ddd. .... Physical Startaddress for DMA transfer. Must be aligned to 32 byte boundary . (*) The memory address is the destination address when EXICR[RW] is set to `read` and is the source address when set to `write`. 0xCC006808 4 r/w EXI0LENGTH - EXI Channel 0 DMA Transfer Length 0xCC00681c 4 EXI Channel 1 DMA Transfer Length 0xCC006830 4 EXI Channel 2 DMA Transfer Length 31 24 23 16 15 8 7 0 .... ..dd dddd dddd dddd dddd ddd. .... Size of DMA transfer data in bytes. bits 0-4 are always zero (which means the size is 32 byte aligned) 0xCC00680c 4 r/w EXI0CR - EXI Channel 0 Control Register 0xCC006820 4 r/w EXI1CR - EXI Channel 1 Control Register 0xCC006834 4 r/w EXI2CR - EXI Channel 2 Control Register 31 24 23 16 15 8 7 0 .... .... .... .... .... .... ..ll ttme bit(s) Description 6-31 . unused 4-5 l TLEN - (data length-1) for immediate mode 00 1 byte 01 2 bytes 10 3 bytes 11 4 bytes 2-3 t RW - transfer type 00 read 01 write 10 read and write, invalid for DMA 11 undefined 1 m DMA - transfer mode (0 - immediate, 1 - DMA) 0 e TSTART - set, to start transfer. will be cleared after transfer completed. 0xCC006810 4 r/w EXI0DATA - EXI Channel 0 Immediate Data 0xCC006824 4 r/w EXI1DATA - EXI Channel 1 Immediate Data 0xCC006838 4 r/w EXI2DATA - EXI Channel 2 Immediate Data 31 24 23 16 15 8 7 0 dddd dddd dddd dddd dddd dddd dddd dddd Data for read / write immediate operations (up to 4 bytes long). The EXICPR must be configured to assert one of the devices CS, before the read or write operation can be performed. The actual read/write operation is triggered by the EXI0CR[TSTART] register and EXI0CR[DMA] set to `0`. Data is sent with MSB (bit 31) first. 5.9.1 Operation 5.9.1.1 Initializing the EXI Bus * clear all EXIs status registers (set to 0) * eventually initialize interrupt callbacks. If you want to use DMA with EXI, you need your own properly installed EXI interrupt handlers. There is no need in callbacks and interrupts, if you are using EXI in immediate mode (just mask all TCs, to prevent unhandled interrupts). 5.9.1.2 Selecting a Specific EXI Device on an EXI Channel * set selected device number and frequency ('210' and f fields in status register) * eventually enable any existing callbacks 5.9.1.3 Deselecting EXI Devices on an EXI Channel * deselect device (clear corresponding '210' field) * eventually disable any existing callbacks 5.9.1.4 Performing an IMM Operation on a EXI Device 5.9.1.4.1 IMM Read * setup EXI Control Register (bit4-5:data length-1, bit2: 0 for read, bit1: 0 for immediate, bit1: 1 to start transfer) * wait until transfer has been completed (until bit 0 in EXI Control Register has been cleared) * get data from EXI IMM Data Register (up to 4 bytes) 5.9.1.4.2 IMM Write * write data to EXI IMM Data Register (up to 4 bytes) * setup EXI Control Register (bit4-5:data length-1, bit2: 1 for write, bit1: 0 for immediate, bit1: 1 to start transfer) * wait until transfer has been completed (until bit 0 in EXI Control Register has been cleared) 5.9.1.5 Performing a DMA Operation on a EXI Device 5.9.1.5.1 DMA Read * setup DMA buffer address * setup DMA length * setup EXI Control Register (bit4-5:data length-1, bit2: 0 for read, bit1: 1 for DMA, bit1: 1 to start transfer) * wait until transfer has been completed (until bit 0 in EXI Control Register has been cleared) 5.9.1.5.2 DMA Write * setup DMA buffer address * setup DMA length * setup EXI Control Register (bit4-5:data length-1, bit2: 1 for write, bit1: 1 for DMA, bit1: 1 to start transfer) * wait until transfer has been completed (until bit 0 in EXI Control Register has been cleared) 5.9.1.6 Wait for EXI transfer completed To detect the end of a transfer on a specific channel either setup a 'transfer completed' callback (only works with DMA transfer) or periodically check bit 0 of the EXI Control Register (until cleared). 5.10 AI - Audio Streaming Interface Registerblock Base Size of Registerblock common access size 0xcc006c00 0x20 4 0xCC006C00 r/w 4 AICR - Audio Interface Control Register 31 24 23 16 15 8 7 0 bit(s) Description 7-31 reserved/unused 6 DSP Sample Rate 0 48 kHz sample rate 1 32 kHz sample rate 5 SCRESET Sample Counter Reset: When a `1` is written to this bit the AISLRCNT register is reset to 0 4 AIINTVLD Audio Interface Interrupt Valid. This bit controls whether AIINT is affected by the AIIT register matching AISLRCNT. Once set, AIINT will hold its last value. 0 Match affects AIINT 1 AIINT hold last value. 3 AIINT Audio Interface Interrupt Status and clear. (*3) r 0 Audio Interface Interrupt has not been requested 1 Audio Interface Interrupt has been requested. w 0 No effect 1 Clear Audio Interface interrupt 2 AIINTMSK Audio interface Interrupt Mask 0 interrupt masked 1 Interrupt enabled 1 AFR: Auxiliary Frequency Register (*1) 0 48 kHz sample rate 1 32 kHz sample rate 0 PSTAT: Playing Status 0 Stop or Pause streaming audio (AISLR clock disabled) 1 Play streaming audio (AISLR clock enabled) (*3 ) On read this bit indicates the current status of the audio interface interrupt. When a `1` is written to this register, the interrupt is cleared. This interrupt indicates that the AIIT register matches the AISLRCNT. This bit asserts regardless of the setting of AICR[AIMSK]. (*1 ) Controls the sample rate of the streaming audio data. When set to 32 kHz sample rate, the SRC will convert the streaming audio data to 48 kHz. This bit should only be changed when Streaming Audio is stopped (AICR[PSTAT] set to 0). (*0) This bit enables the AISLR clock which controls the playing/stopping of audio streaming. When this bit is 1 AISLRCNT register will increment for every stereo pair of samples output. 0xCC006C04 r/w 4 AIVR - Audio Interface Volume Register 31 24 23 16 15 8 7 0 .... .... .... .... rrrr rrrr llll llll bit(s) description 16-31 unused/reserved 8-15 r AVRR - Volume Right Channel (0x00 is muted,0xff is max) 0-7 l AVRL - Volume Right Channel (0x00 is muted,0xff is max) 0xCC006C08 r 4 AISCNT - Audio Interface Sample Counter Audio interface Sample Counter: This register counts the number of AIS stereo samples that have been output. It is enabled by AICR[PSTAT]. It can be cleared by the AICR[SCRESET] register. 0xCC006C0C r/w 4 AIIT - Audio Interface Interrupt Timing This register indicates the stereo sample count to issue an audio interface interrupt to the main processor. The interrupt is issued when the value of the AISLRCNT register matches the content of this register. 5.11 GX FIFO (Graphic display lists) GP have mapped 32-byte FIFO buffer, at 0xCC008000, which is controlled by write gather pipe (WPAR). when FIFO is filled (or overloaded by 32-bytes), WPAR performs burst transaction of primitive data to GP command FIFO. WPAR API also keeps watching for wrapping it on 32-buffer. You can think, that data is always looped and flows like in circle. Registerblock Base Size of Registerblock common access size 0xcc008000 4 any To access FIFO, you should just write data of any size to 0xCC008000, WPAR will control circularity and gathering automatically. By "data of any size" are assumed command types, vertices, vertex attributes etc stuff. All commands and primitive data are sending through mapped GP FIFO. GP task is only to draw primitives in embedded frame buffer, and then send it to XFB, for VI rendering. All render rules are stored in VI. GP can only change some copy rules, using pixel engine setup. GP primitives also can be drawn, using Display List. In that case, GP FIFO takes only "CALL_DL" command with pointer to list data, and then GP command FIFO sequentially parsing primitive data from the main memory. Primitives can contains both direct and indexed vertexes as well. In first case, vertex attributes are sent directly using GP FIFO, in the other case the CPU sends only the pointer to vertex attribute data which is located in main memory. 5.11.1 internal BP registers Registerblock Base Size of Registerblock common access size 0x00 0x100 4 (1+3) Register Description 0x00 GEN_MODE 0x01 display copy filter 0x02 display copy filter 0x03 display copy filter 0x04 display copy filter 0x05 ? 0x06 IND_MTXA0 0x07 IND_MTXB0 0x08 IND_MTXC0 0x09 IND_MTXA1 0x0a IND_MTXB1 0x0b IND_MTXC1 0x0c IND_MTXA2 0x0d IND_MTXB2 0x0e IND_MTXC2 0x0f IND_IMASK 0x10 IND_CMD0 - tev indirect 0 0x11 IND_CMD1 - tev indirect 1 0x12 IND_CMD2 - tev indirect 2 0x13 IND_CMD3 - tev indirect 3 0x14 IND_CMD4 - tev indirect 4 0x15 IND_CMD5 - tev indirect 5 0x16 IND_CMD6 - tev indirect 6 0x17 IND_CMD7 - tev indirect 7 0x18 IND_CMD8 - tev indirect 8 0x19 IND_CMD9 - tev indirect 9 0x1a IND_CMDA - tev indirect 10 0x1b IND_CMDB - tev indirect 11 0x1c IND_CMDC - tev indirect 12 0x1d IND_CMDD - tev indirect 13 0x1e IND_CMDE - tev indirect 14 0x1f IND_CMDF - tev indirect 15 0x20 scissor x0,y0 (0x20156156) 0x21 scissor x1,y1 (0x213d5335) 0x22 SU_LPSIZE - field mode .. line width - point width 0x23 SU Counter (?) (0x23000000) 0x24 RAS Counter (?) (0x24000000) 0x25 RAS1_SS0 - ind tex coord scale 0 0x26 RAS1_SS1 - ind tex coord scale 1 0x27 RAS1_IREF 0x28 RAS1_TREF0 - tev order 0 0x29 RAS1_TREF1 - tev order 1 0x2a RAS1_TREF2 - tev order 2 0x2b RAS1_TREF3 - tev order 3 0x2c RAS1_TREF4 - tev order 4 0x2d RAS1_TREF5 - tev order 5 0x2e RAS1_TREF6 - tev order 6 0x2f RAS1_TREF7 - tev order 7 Register Description 0x30 SU_SSIZE0 - texture offset 0 (Texture Size X, Y ?) 0x31 SU_TSIZE0 - 0x32 SU_SSIZE1 - texture offset 1 0x33 SU_TSIZE1 - 0x34 SU_SSIZE2 - texture offset 2 0x35 SU_TSIZE2 - 0x36 SU_SSIZE3 - texture offset 3 0x37 SU_TSIZE3 - 0x38 SU_SSIZE4 - texture offset 4 0x39 SU_TSIZE4 - 0x3a SU_SSIZE5 - texture offset 5 0x3b SU_TSIZE5 - 0x3c SU_SSIZE6 - texture offset 6 0x3d SU_TSIZE6 - 0x3e SU_SSIZE7 - texture offset 7 0x3f SU_TSIZE7 - 0x40 PE_ZMODE set z mode 0x41 PE_CMODE0 dithering / blend mode/color_update/alpha_update/set_dither 0x42 PE_CMODE1 destination alpha 0x43 PE_CONTROL comp z location z_comp_loc(0x43000040)pixel_fmt(0x43000041) 0x44 field mask (0x44000003) 0x45 PE_DONE - draw done (end of list marker) ? 0x46 some clock ? (0x46000000 - (((162000000/500)/4224) - 0x0200)) 0x47 PE_TOKEN token B (16 bit) 0x48 PE_TOKEN_INT token A (16 bit) 0x49 EFB source rectangle top left 0x4a EFB source rectangle width, height-1 0x4b XFB target address 0x4c ? 0x4d stride ? 0x4e DispCopyYScale 0x4f PE copy clear AR - set clear alpha and red components 0x50 PE copy clear GB - green and blue 0x51 PE copy clear Z - 24-bit Z value 0x52 pe copy execute? 0x53 copy filter 0x54 copy filter 0x55 bounding box (0x550003ff) 0x56 bounding box (0x560003ff) 0x57 ? 0x58 ? (0x5800000f) 0x59 scissor-box offset (0x5902acab) 0x5a ? 0x5b ? 0x5c ? 0x5d ? 0x5e ? 0x5f ? Register Description 0x60 ? 0x61 ? 0x62 ? 0x63 ? 0x64 TX_LOADTLUT0 0x65 TX_LOADTLUT1 0x66 ? 0x67 metric ? (0x67000000) 0x68 field mode 0x69 some clock ? (0x69000000 - ((((162000000/500)> >11)&0x00ffffff)) - 0x0400) 0x6a ? 0x6b ? 0x6c ? 0x6d ? 0x6e ? 0x6f ? 0x70 ? 0x71 ? 0x72 ? 0x73 ? 0x74 ? 0x75 ? 0x76 ? 0x77 ? 0x78 ? 0x79 ? 0x7a ? 0x7b ? 0x7c ? 0x7d ? 0x7e ? 0x7f ? 0x80 TX_SETMODE0_I0 - 0x90 for linear 0x81 TX_SETMODE0_I1 0x82 TX_SETMODE0_I2 0x83 TX_SETMODE0_I3 0x84 TX_SETMODE1_I0 0x85 TX_SETMODE1_I1 0x86 TX_SETMODE1_I2 0x87 TX_SETMODE1_I3 0x88 TX_SETIMAGE0_I0 - texture size ? 0x89 TX_SETIMAGE0_I1 0x8a TX_SETIMAGE0_I2 0x8b TX_SETIMAGE0_I3 0x8c TX_SETIMAGE1_I0 0x8d TX_SETIMAGE1_I1 0x8e TX_SETIMAGE1_I2 0x8f TX_SETIMAGE1_I3 Register Description 0x90 TX_SETIMAGE2_I0 0x91 TX_SETIMAGE2_I1 0x92 TX_SETIMAGE2_I2 0x93 TX_SETIMAGE2_I3 0x94 TX_SETIMAGE3_I0 - Texture Pointer 0x95 TX_SETIMAGE3_I1 0x96 TX_SETIMAGE3_I2 0x97 TX_SETIMAGE3_I3 0x98 TX_LOADTLUT0 0x99 TX_LOADTLUT1 0x9a TX_LOADTLUT2 0x9b TX_LOADTLUT3 0x9c ? 0x9d ? 0x9e ? 0x9f ? 0xa0 TX_SETMODE0_I4 0xa1 TX_SETMODE0_I5 0xa2 TX_SETMODE0_I6 0xa3 TX_SETMODE0_I7 0xa4 TX_SETMODE1_I4 0xa5 TX_SETMODE1_I5 0xa6 TX_SETMODE1_I6 0xa7 TX_SETMODE1_I7 0xa8 TX_SETIMAGE0_I4 0xa9 TX_SETIMAGE0_I5 0xaa TX_SETIMAGE0_I6 0xab TX_SETIMAGE0_I7 0xac TX_SETIMAGE1_I4 0xad TX_SETIMAGE1_I5 0xae TX_SETIMAGE1_I6 0xaf TX_SETIMAGE1_I7 0xb0 TX_SETIMAGE2_I4 0xb1 TX_SETIMAGE2_I5 0xb2 TX_SETIMAGE2_I6 0xb3 TX_SETIMAGE2_I7 0xb4 TX_SETIMAGE3_I4 0xb5 TX_SETIMAGE3_I5 0xb6 TX_SETIMAGE3_I6 0xb7 TX_SETIMAGE3_I7 0xb8 TX_SETTLUT_I4 0xb9 TX_SETTLUT_I5 0xba TX_SETTLUT_I6 0xbb TX_SETTLUT_I7 0xbc ? 0xbd ? 0xbe ? 0xbf ? Register Description 0xc0 TEV_COLOR_ENV_0 - tev op 0 0xc1 TEV_ALPHA_ENV_0 - tev op 1 0xc2 TEV_COLOR_ENV_1 - 0xc3 TEV_ALPHA_ENV_1 0xc4 TEV_COLOR_ENV_2 - 0xc5 TEV_ALPHA_ENV_2 0xc6 TEV_COLOR_ENV_3 - 0xc7 TEV_ALPHA_ENV_3 0xc8 TEV_COLOR_ENV_4 - 0xc9 TEV_ALPHA_ENV_4 0xca TEV_COLOR_ENV_5 - 0xcb TEV_ALPHA_ENV_5 0xcc TEV_COLOR_ENV_6 - 0xcd TEV_ALPHA_ENV_6 0xce TEV_COLOR_ENV_7 - 0xcf TEV_ALPHA_ENV_7 0xd0 TEV_COLOR_ENV_8 - 0xd1 TEV_ALPHA_ENV_8 0xd2 TEV_COLOR_ENV_9 - 0xd3 TEV_ALPHA_ENV_9 0xd4 TEV_COLOR_ENV_A - 0xd5 TEV_ALPHA_ENV_A 0xd6 TEV_COLOR_ENV_B - 0xd7 TEV_ALPHA_ENV_B 0xd8 TEV_COLOR_ENV_C - 0xd9 TEV_ALPHA_ENV_C 0xda TEV_COLOR_ENV_D - 0xdb TEV_ALPHA_ENV_D 0xdc TEV_COLOR_ENV_E - 0xdd TEV_ALPHA_ENV_E 0xde TEV_COLOR_ENV_F - 0xdf TEV_ALPHA_ENV_F 0xe0 TEV_REGISTERL_0 0xe1 TEV_REGISTERH_0 0xe2 TEV_REGISTERL_1 0xe3 TEV_REGISTERH_1 0xe4 TEV_REGISTERL_2 0xe5 TEV_REGISTERH_2 0xe6 TEV_REGISTERL_3 0xe7 TEV_REGISTERH_3 0xe8 Fog Range (0xe8000156) 0xe9 ? 0xea ? 0xeb ? 0xec ? (guessed: tev_range_adj_c) 0xed ? (guessed: tev_range_adj_k) 0xee TEV_FOG_PARAM_0 (0xee03ce38) 0xef TEV_FOG_PARAM_1 (0xef471c82) Register Description 0xf0 TEV_FOG_PARAM_2 (0xf0000002) 0xf1 TEV_FOG_PARAM_3 (0xf1000000) 0xf2 TEV_FOG_COLOR (0xf2000000) 0xf3 TEV_ALPHAFUNC - alpha compare (0xf33f0000) 0xf4 TEV_Z_ENV_0 - z texture 0 0xf5 TEV_Z_ENV_1 - z texture 1 0xf6 TEV_KSEL_0 - Tev Swap Mode Table 0 (0xf6018064) 0xf7 TEV_KSEL_1 - Tev Swap Mode Table 1 (0xf701806e) 0xf8 TEV_KSEL_2 - Tev Swap Mode Table 2 (0xf8018060) 0xf9 TEV_KSEL_3 - Tev Swap Mode Table 3 (0xf901806c) 0xfa TEV_KSEL_4 - Tev Swap Mode Table 4 (0xfa018065) 0xfb TEV_KSEL_5 - Tev Swap Mode Table 5 (0xfb01806d) 0xfc TEV_KSEL_6 - Tev Swap Mode Table 6 (0xfc01806a) 0xfd TEV_KSEL_7 - Tev Swap Mode Table 7 (0xfd01806e) 0xfe SS_MASK - BP Mask Register 0xff ? 0x00 4 w GEN_MODE 31 24 23 16 15 8 7 0 bit(s) description 24 RID 19 ZFREEZE 16 NBMP - Number of Bumpmaps 14-15 REJECT_EN - Culling Mode 0 none 1 negative 2 positive 3 all 10 NTEV 9 MS_EN 4 NCOL - Number of Colors 0 NTEX - Number of Texture Coords 0x01 4 w display copy filter 0x02 4 w display copy filter 0x03 4 w display copy filter 0x04 4 w display copy filter 0x05 4 w ? 0x06 4 w IND_MTXA0 0x09 4 w IND_MTXA1 0x0c 4 w IND_MTXA2 31 24 23 16 15 8 7 0 bit(s) description 24 RID 22 S 11 MB 0 MA 0x07 4 w IND_MTXB0 0x0a 4 w IND_MTXB1 0x0d 4 w IND_MTXB2 31 24 23 16 15 8 7 0 bit(s) description 24 RID 22 S 11 MD 0 MC 0x08 4 w IND_MTXC0 0x0b 4 w IND_MTXC1 0x0e 4 w IND_MTXC2 31 24 23 16 15 8 7 0 bit(s) description 24 RID 22 S 11 MF 0 ME 0x0f 4 w IND_IMASK 31 24 23 16 15 8 7 0 bit(s) description 24 RID 0 IMASK 0x10 4 w IND_CMD0 0x11 4 w IND_CMD1 0x12 4 w IND_CMD2 0x13 4 w IND_CMD3 0x14 4 w IND_CMD4 0x15 4 w IND_CMD5 0x16 4 w IND_CMD6 0x17 4 w IND_CMD7 0x18 4 w IND_CMD8 0x19 4 w IND_CMD9 0x1a 4 w IND_CMDA 0x1b 4 w IND_CMDB 0x1c 4 w IND_CMDC 0x1d 4 w IND_CMDD 0x1e 4 w IND_CMDE 0x1f 4 w IND_CMDF 31 24 23 16 15 8 7 0 bit(s) description 24 RID 21-23 PAD0 - padding zeros 20 FB - addprev 19 LB - utclod 16-18 TW - Wrap T 0 ITW_OFF 1 ITW_256 2 ITW_128 3 ITW_64 4 ITW_32 5 ITW_16 6 ITW_0 7 13-15 SW - Wrap S 0 ITW_OFF 1 ITW_256 2 ITW_128 3 ITW_64 4 ITW_32 5 ITW_16 6 ITW_0 7 9-12 M - Matrix ID 0 ITM_OFF 1 ITM_0 2 ITM_1 3 ITM_2 5 ITM_S0 6 ITM_S1 7 ITM_S2 9 ITM_T0 10 ITM_T1 11 ITM_T2 7-8 BS - Alpha Selection 0 ITBA_OFF 1 ITBA_S 2 ITBA_T 3 ITBA_U 4-6 BIAS 0 ITB_NONE 1 ITB_S 2 ITB_T 3 ITB_ST 4 ITB_U 5 ITB_SU 6 ITB_TU 7 ITB_STU 2-3 FMT - Format 0 ITF_8 1 ITF_5 2 ITF_4 3 ITF_3 0-1 BT - Indirect Tex Stage ID (0-3) 0x20 4 w SU_SCIS0 - Scissorbox Top Left Corner 31 24 23 16 15 8 7 0 bit(s) description 24 RID 12 X0 - Scissorbox X0 offset + 342 0 Y0 - Scissorbox Y0 offset + 342 0x21 4 w SU_SCIS1 - Scissorbox Bottom Right Corner 31 24 23 16 15 8 7 0 bit(s) description 24 RID 12 X1 - Scissorbox X1 offset + 342 0 Y1 - Scissorbox Y1 offset + 342 0x22 4 w SU_LPSIZE 31 24 23 16 15 8 7 0 bit(s) description 24 RID 23 PAD0 22 LINEASPECT 19 PTOFF 0 to 0 1 to 16th 2 to 8th 3 to 4th 4 to half 5 to 1 16 LTOFF 0 to 0 1 to 16th 2 to 8th 3 to 4th 4 to half 5 to 1 8 PSIZE 0 LSIZE 0x23 4 w SU Counter ? 0x24 4 w RAS Counter ? 0x25 4 w RAS1_SS - ind tex coord scale 0 31 24 23 16 15 8 7 0 bit(s) description 24 RID 12 TS1 - Ind. Tex Stage 1 8 SS1 - Ind. Tex Stage 1 4 TS0 - Ind. Tex Stage 0 0 SS0 - Ind. Tex Stage 0 0x26 4 w RAS1_SS - ind tex coord scale 1 31 24 23 16 15 8 7 0 bit(s) description 24 RID 12 TS1 - Ind. Tex Stage 3 8 SS1 - Ind. Tex Stage 3 4 TS0 - Ind. Tex Stage 2 0 SS0 - Ind. Tex Stage 2 0x27 4 w RAS1_IREF 31 24 23 16 15 8 7 0 bit(s) description 24 RID 21 BC3 - Ind. Tex Stage 3 NTexCoord 18 BI3 - Ind. Tex Stage 3 NTexMap 15 BC2 - Ind. Tex Stage 2 NTexCoord 12 BI2 - Ind. Tex Stage 2 NTexMap 9 BC1 - Ind. Tex Stage 1 NTexCoord 6 BI1 - Ind. Tex Stage 1 NTexMap 3 BC0 - Ind. Tex Stage 0 NTexCoord 0 BI0 - Ind. Tex Stage 0 NTexMap 0x28 4 w RAS1_TREF0 0x29 4 w RAS1_TREF1 0x2a 4 w RAS1_TREF2 0x2b 4 w RAS1_TREF3 0x2c 4 w RAS1_TREF4 0x2d 4 w RAS1_TREF5 0x2e 4 w RAS1_TREF6 0x2f 4 w RAS1_TREF7 31 24 23 16 15 8 7 0 bit(s) description 24 RID 22 PAD1 19-21 CC1 - Ind. Tex Stage 1 Channel ID 0 Color0 1 Color1 2 Alpha0 3 Alpha1 4 Color0A0 5 Color1A1 6 ColorZero 7 Bump 18 TE1 - Ind. Tex Stage 1 TexMap enable 15 TC1 - Ind. Tex Stage 1 TexCoord 12 TI1 - Ind. Tex Stage 1 TexMap 10 PAD0 7 CC0 - Ind. Tex Stage 0 Color ID 6 TE0 - Ind. Tex Stage 0 TexMap enable 3 TC0 - Ind. Tex Stage 0 TexCoord 0 TI0 - Ind. Tex Stage 0 TexMap 0x30 4 w SU_SSIZE0 0x32 4 w SU_SSIZE1 0x34 4 w SU_SSIZE2 0x36 4 w SU_SSIZE3 0x38 4 w SU_SSIZE4 0x3a 4 w SU_SSIZE5 0x3c 4 w SU_SSIZE6 0x3e 4 w SU_SSIZE7 31 24 23 16 15 8 7 0 bit(s) description 24 RID 19 PF - texcoord offset for points enable 18 LF - texcoord offset for lines enable 17 WS - s-cylindrical texcoord wrapping enable 16 BS - s-range bias enable 0 SSIZE - s-scale value -1 (U16) 0x31 4 w SU_TSIZE0 0x33 4 w SU_TSIZE1 0x35 4 w SU_TSIZE2 0x37 4 w SU_TSIZE3 0x39 4 w SU_TSIZE4 0x3b 4 w SU_TSIZE5 0x3d 4 w SU_TSIZE6 0x3f 4 w SU_TSIZE7 31 24 23 16 15 8 7 0 bit(s) description 24 RID 17 WT - t-cylindrical texcoord wrapping enable 16 BT - t-range bias enable 0 TSIZE - t-scale value -1 (U16) 0x40 4 w PE_ZMODE 31 24 23 16 15 8 7 0 bit(s) description 24 RID 4 MASK - Update enable 1 FUNC - Z-Buffer Compare Function 0 NEVER 1 LESS 2 EQUAL 3 LEQUAL 4 GREATER 5 NEQUAL 6 GEQUAL 7 ALWAYS 0 ENABLE - Z-Buffer enable 0x41 4 w PE_CMODE0 31 24 23 16 15 8 7 0 bit(s) description 24 RID 12 LOGICOP 0 CLEAR 1 AND 2 REVAND 3 COPY 4 INVAND 5 NOOP 6 XOR 7 OR 8 NOR 9 EQUIV 10 INV 11 REVOR 12 INVCOPY 13 INVOR 14 NAND 15 SET 11 BLENDOP 8 SFACTOR 5 DFACTOR 4 ALPHA_MASK 3 COLOR_MASK 2 DITHER_ENABLE 1 LOGICOP_ENABLE 0 BLEND_ENABLE 0x42 4 w PE_CMODE1 31 24 23 16 15 8 7 0 bit(s) description 24 RID 8 CONSTANT_ALPHA_ENABLE 0 CONSTANT_ALPHA 0x43 4 w PE_CONTROL 31 24 23 16 15 8 7 0 bit(s) description 24 RID 7-23 unused ? 6 Z Comp Loc (1: before tex) 3-5 Z Format 0 linear 1 near 2 mid 3 far 0-2 Pixel Format 0 RGB8_ Z24 1 RGBA6_Z24 2 RGB565_Z16 3 Z24 4 Y8 5 U8 6 V8 7 YUV420 0x44 4 w field mask ? 31 24 23 16 15 8 7 0 bit(s) description 24 RID 0x45 4 w PE_DONE - draw done 31 24 23 16 15 8 7 0 bit(s) description 24 RID 1 1=end of list 0 ? 0x46 4 w ? (some clock?) 31 24 23 16 15 8 7 0 bit(s) description 24 RID 9 ? (must be 1) 0 ((162000000/500)/4224) 0x47 4 w PE_TOKEN 31 24 23 16 15 8 7 0 bit(s) description 24 RID 0 Token 0x48 4 w PE_TOKEN_INT 31 24 23 16 15 8 7 0 bit(s) description 24 RID 0 0x49 4 w EFB Address Top Left 31 24 23 16 15 8 7 0 bit(s) description 10 Y coordinate 0 X coordinate 0x4a 4 w EFB Address Width, Height-1 31 24 23 16 15 8 7 0 bit(s) description 10 Height-1 0 Width 0x4b 4 w XFB Address 31 24 23 16 15 8 7 0 bit(s) description 24 RID 0 physical XFB Address > > 5 0x4c 4 w ? 0x4d 4 w stride ? 0x4e 4 w DispCopyYScale 31 24 23 16 15 8 7 0 bit(s) Description 24 RID 0 YSCALE - ((u32)(256.0/YSCALEIN))&0x1ff 0x4f 4 w PE copy clear AR - set clear alpha and red components 31 24 23 16 15 8 7 0 bit(s) Description 24 RID 8 A 0 R 0x50 4 w PE copy clear GB - green and blue 31 24 23 16 15 8 7 0 bit(s) Description 24 RID 8 G 0 B 0x51 4 w PE copy clear Z - 24-bit Z value 31 24 23 16 15 8 7 0 bit(s) Description 24 RID 0-23 Z - 24bit Z-Value 0x52 4 w pe copy execute? 31 24 23 16 15 8 7 0 bit(s) Description 24 RID 14 execute ? (1: to XFB 0: to texture ?!) 12-13 Frame 2 Field Mode 11 clear (1: clear EFB) 10 1: (256-(u32)(256.0/YSCALEIN)) > 0 9 ? 7-8 disp copy gamma 4 target (XFB) pixel format 1 clamp 0 clamp 0x53 4 w copy filter 0x54 4 w copy filter 0x55 4 w bounding box 0x56 4 w bounding box 0x57 4 w ? 0x58 4 w ? 0x59 4 w Scissorbox Offset 31 24 23 16 15 8 7 0 bit(s) description 24 RID 10 YO - ((Scissorbox Y offset + 342)> >1) 0 XO - ((Scissorbox X offset + 342)> >1) note: regs 0x5a-0x63 are left out (all unknown) 0x64 4 w TX_LOADTLUT0 31 24 23 16 15 8 7 0 bit(s) description 24- rid 21- pad0 0- tlut base 0x65 4 w TX_LOADTLUT1 31 24 23 16 15 8 7 0 bit(s) description 24- rid 21- pad0 10- count 0 tmem offset 0x66 4 w 0x67 4 w metric ? 0x68 4 w field mode 0x69 4 w ? 31 24 23 16 15 8 7 0 bit(s) description 24 RID 10 ? (must be 1) 0 ((162000000/500)> >11) note: regs 0x6a-0x7f are left out (all unknown) 0x80 4 w TX_SETMODE0_I0 - Texture lookup and filtering mode 0x81 4 w TX_SETMODE0_I1 - Texture lookup and filtering mode 0x82 4 w TX_SETMODE0_I2 - Texture lookup and filtering mode 0x83 4 w TX_SETMODE0_I3 - Texture lookup and filtering mode 0xa0 4 w TX_SETMODE0_I4 - Texture lookup and filtering mode 0xa1 4 w TX_SETMODE0_I5 - Texture lookup and filtering mode 0xa2 4 w TX_SETMODE0_I6 - Texture lookup and filtering mode 0xa3 4 w TX_SETMODE0_I7 - Texture lookup and filtering mode 31 24 23 16 15 8 7 0 bit(s) description 24 RID 21 LODCLAMP / BIASCLAMP 0 off 1 on 19 MAXANISO 0 1 1 2 (requires edge LOD) 2 4 (requires edge LOD) 3 unused/reserved 9 LODBIAS (s2.5) 8 DIAGLOAD 0 edge LOD 1 diagonal LOD 5 MIN FILTER 0 near 1 near mip near 2 near mip lin 3 unused/reserved 4 linear 5 lin mip near 6 lin mip lin 7 unused/reserved 4 MAG FILTER 0 near 1 linear 2 WRAP T 0 clamp 1 repeat (*) 2 mirror (*) 3 unused/reserved 0 WRAP S (same as WRAP T) (*) requires the texture size to be a power of two. (wrapping is implemented by a logical AND (SIZE-1)) 0x84 4 w TX_SETMODE1_I0 - LOD Info 0x85 4 w TX_SETMODE1_I1 - LOD Info 0x86 4 w TX_SETMODE1_I2 - LOD Info 0x87 4 w TX_SETMODE1_I3 - LOD Info 0xa4 4 w TX_SETMODE1_I4 - LOD Info 0xa5 4 w TX_SETMODE1_I5 - LOD Info 0xa6 4 w TX_SETMODE1_I6 - LOD Info 0xa7 4 w TX_SETMODE1_I7 - LOD Info 31 24 23 16 15 8 7 0 bit(s) description 24 RID 8 MAX LOD (U4.4) 0 MIN LOD (U4.4) 0x88 4 w SETIMAGE0_I0 - Texture width, height, format 0x89 4 w SETIMAGE0_I1 - Texture width, height, format 0x8a 4 w SETIMAGE0_I2 - Texture width, height, format 0x8b 4 w SETIMAGE0_I3 - Texture width, height, format 0xa8 4 w SETIMAGE0_I4 - Texture width, height, format 0xa9 4 w SETIMAGE0_I5 - Texture width, height, format 0xaa 4 w SETIMAGE0_I6 - Texture width, height, format 0xab 4 w SETIMAGE0_I7 - Texture width, height, format 31 24 23 16 15 8 7 0 bit(s) description 24- rid 20- format 0 I4 1 I8 2 IA4 3 IA8 4 RGB565 5 RGB5A3 6 RGBA8 7 unused/reserved 8 C4 9 C8 10 C14X2 11 unused/reserved 12 unused/reserved 13 unused/reserved 14 CMP 15 unused/reserved 10- height - 1 0- width - 1 0x8c 4 w TX_SETIMAGE1_I0 - even LOD address in TMEM 0x8d 4 w TX_SETIMAGE1_I1 - even LOD address in TMEM 0x8e 4 w TX_SETIMAGE1_I2 - even LOD address in TMEM 0x8f 4 w TX_SETIMAGE1_I3 - even LOD address in TMEM 0xac 4 w TX_SETIMAGE1_I4 - even LOD address in TMEM 0xad 4 w TX_SETIMAGE1_I5 - even LOD address in TMEM 0xae 4 w TX_SETIMAGE1_I6 - even LOD address in TMEM 0xaf 4 w TX_SETIMAGE1_I7 - even LOD address in TMEM 31 24 23 16 15 8 7 0 bit(s) description 24 RID 21 IMAGE_TYPE 0 cached 1 preloaded 18 CACHE_HEIGHT 0 unused/reserved 1 unused/reserved 2 unused/reserved 3 32kb 4 128kb 5 512kb 6 unused/reserved 7 unused/reserved 15 CACHE_WIDTH (must be equal to CACHE_HEIGHT) 0 TMEM_OFFSET (address in TMEM > > 5) 0x90 4 w TX_SETIMAGE2_I0 - odd LOD address in TMEM 0x91 4 w TX_SETIMAGE2_I1 - odd LOD address in TMEM 0x92 4 w TX_SETIMAGE2_I2 - odd LOD address in TMEM 0x93 4 w TX_SETIMAGE2_I3 - odd LOD address in TMEM 0xb0 4 w TX_SETIMAGE2_I4 - odd LOD address in TMEM 0xb1 4 w TX_SETIMAGE2_I5 - odd LOD address in TMEM 0xb2 4 w TX_SETIMAGE2_I6 - odd LOD address in TMEM 0xb3 4 w TX_SETIMAGE2_I7 - odd LOD address in TMEM 31 24 23 16 15 8 7 0 bit(s) description 24 RID 18 CACHE_HEIGHT 0 none (if odd LOD is unused) 1 unused/reserved 2 unused/reserved 3 32kb 4 128kb 5 512kb 6 unused/reserved 7 unused/reserved 15 CACHE_WIDTH (must be equal to CACHE_HEIGTH) 0 TMEM_OFFSET - (address in TMEM > > 5) 0x94 4 w TX_SETIMAGE3_I0 - Address of Texture in main memory 0x95 4 w TX_SETIMAGE3_I1 - Address of Texture in main memory 0x96 4 w TX_SETIMAGE3_I2 - Address of Texture in main memory 0x97 4 w TX_SETIMAGE3_I3 - Address of Texture in main memory 0xb4 4 w TX_SETIMAGE3_I4 - Address of Texture in main memory 0xb5 4 w TX_SETIMAGE3_I5 - Address of Texture in main memory 0xb6 4 w TX_SETIMAGE3_I6 - Address of Texture in main memory 0xb7 4 w TX_SETIMAGE3_I7 - Address of Texture in main memory 31 24 23 16 15 8 7 0 bit(s) description 24 RID 0 IMAGE_BASE (physical address > > 5) 0x98 4 w TX_SETTLUT_0 0x99 4 w TX_SETTLUT_1 0x9a 4 w TX_SETTLUT_2 0x9b 4 w TX_SETTLUT_3 0xb8 4 w TX_SETTLUT_4 0xb9 4 w TX_SETTLUT_5 0xba 4 w TX_SETTLUT_6 0xbb 4 w TX_SETTLUT_7 31 24 23 16 15 8 7 0 bit(s) description 24 RID 10 FORMAT 0 IA8 1 RGB565 2 RGB5A3 3 reserved/unused 0 TMEM_OFFSET (offset of TLUT from start of TMEM high bank > > 5) 0x9c 4 w ? 0x9d 4 w ? 0x9e 4 w ? 0x9f 4 w ? 0xbc 4 w ? 0xbd 4 w ? 0xbe 4 w ? 0xbf 4 w ? 0xc0 4 w TEV_COLOR_ENV_0 0xc2 4 w TEV_COLOR_ENV_1 0xc4 4 w TEV_COLOR_ENV_2 0xc6 4 w TEV_COLOR_ENV_3 0xc8 4 w TEV_COLOR_ENV_4 0xca 4 w TEV_COLOR_ENV_5 0xcc 4 w TEV_COLOR_ENV_6 0xce 4 w TEV_COLOR_ENV_7 0xd0 4 w TEV_COLOR_ENV_8 0xd2 4 w TEV_COLOR_ENV_9 0xd4 4 w TEV_COLOR_ENV_A 0xd6 4 w TEV_COLOR_ENV_B 0xd8 4 w TEV_COLOR_ENV_C 0xda 4 w TEV_COLOR_ENV_D 0xdc 4 w TEV_COLOR_ENV_E 0xde 4 w TEV_COLOR_ENV_F 31 24 23 16 15 8 7 0 bit(s) description 24 RID 22 DEST 20 SHIFT 19 CLAMP 18 SUB 16 BIAS 12 SELA 8 SELB 4 SELC 0 SELD SELA - SELD Format: 0x0 CC_CPREV 0x1 CC_APREV 0x2 CC_C0 0x3 CC_A0 0x4 CC_C1 0x5 CC_A1 0x6 CC_C2 0x7 CC_A2 0x8 CC_TEXC 0x9 CC_TEXA 0xA CC_RASC 0xB CC_RASA 0xC CC_ONE 0xD CC_HALF 0xE CC_KONST 0xF CC_ZERO 0xc1 4 w TEV_ALPHA_ENV_0 0xc3 4 w TEV_ALPHA_ENV_1 0xc5 4 w TEV_ALPHA_ENV_2 0xc7 4 w TEV_ALPHA_ENV_3 0xc9 4 w TEV_ALPHA_ENV_4 0xcb 4 w TEV_ALPHA_ENV_5 0xcd 4 w TEV_ALPHA_ENV_6 0xcf 4 w TEV_ALPHA_ENV_7 0xd1 4 w TEV_ALPHA_ENV_8 0xd3 4 w TEV_ALPHA_ENV_9 0xd5 4 w TEV_ALPHA_ENV_A 0xd7 4 w TEV_ALPHA_ENV_B 0xd9 4 w TEV_ALPHA_ENV_C 0xdb 4 w TEV_ALPHA_ENV_D 0xdd 4 w TEV_ALPHA_ENV_E 0xdf 4 w TEV_ALPHA_ENV_F 31 24 23 16 15 8 7 0 bit(s) description 24 RID 22 DEST 20 SHIFT 19 CLAMP 18 SUB 16 BIAS 13 SELA 10 SELB 7 SELC 4 SELD 2 TSWAP 0 RSWAP SELA - SELD Format: 0 CA_APREV 1 CA_A0 2 CA_A1 3 CA_A2 4 CA_TEXA 5 CA_RASA 6 CA_KONST 7 CA_ZERO 0xe0 4 w TEV_REGISTERL_0 0xe2 4 w TEV_REGISTERL_1 0xe4 4 w TEV_REGISTERL_2 0xe6 4 w TEV_REGISTERL_3 31 24 23 16 15 8 7 0 bit(s) description 24 RID 23 TYPE 0 Color (?) 1 Constant (?) 12 A 0 R 0xe1 4 w TEV_REGISTERH_0 0xe3 4 w TEV_REGISTERH_1 0xe5 4 w TEV_REGISTERH_2 0xe7 4 w TEV_REGISTERH_3 31 24 23 16 15 8 7 0 bit(s) description 24 RID 23 TYPE 0 Color (?) 1 Constant (?) 12 G 0 B 0x88 4 w Fog Range 0x89 4 w 0x8A 4 w 0x8B 4 w 0xec (guessed) 4 w tev_range_adj_c 31 24 23 16 15 8 7 0 bit(s) description 24 RID 10 CENTER - Screen X Center for range Adjustment 0 ENB - Range-Adjustment enable 0 TEV_ENB_DISABLE 1 TEV_ENB_ENABLE 0xed (guessed) 4 w tev_range_adj_k 31 24 23 16 15 8 7 0 bit(s) description 24 RID 0-11 r2k (u4.8) - specifies the range adjustment function range adjustment = sqr((x*x)+(k*k))/k 0xee 4 w TEV_FOG_PARAM_0 - "a" parameter of the screen to eye space conversion function 31 24 23 16 15 8 7 0 bit(s) description 24 RID 19 A_SIGN_SHIFT 11 A_EXPN 0 A_MANT (signed 11e8) 0xef 4 w TEV_FOG_PARAM_1 - the "b" parameter of the z screen to eye space conversion function 31 24 23 16 15 8 7 0 bit(s) description 24 RID 0 B_MAG (unsigned 0.24) 0xf0 4 w TEV_FOG_PARAM_2 - amount to pre-shift screen z 31 24 23 16 15 8 7 0 bit(s) description 24 RID 0-4 B_SHF - equivalent to the value of "b" parameter's exponent + 1 The Z-Screen to Eyespace conversion is defined as: Ze = A / (B_MAG - (Zs > > B_SHF)) 0xf1 4 w TEV_FOG_PARAM_3 - fog type 31 24 23 16 15 8 7 0 bit(s) description 24 RID 21-23 FSEL 0 FSEL_OFF; No fog 1 reserved 2 FSEL_LIN; linear Fog 3 reserved 4 FSEL_EXP; Exponential Fog 5 FSEL_EX2; Exponential Squared Fog 6 FSEL_BXP; Backward Exp Fog 7 FSEL_BX2 Backward Exp Squared Fog 20 PROJ 0 PERSP; Perspective projection 1 ORTHO; Orthographic projection 19 C_SIGN (*) 11 C_EXPN (*) 0-10 C_MANT (*) (*) Specifies the amount to subtract from eye-space Z after range adjustment. 0xf2 4 w TEV_FOG_COLOR - Value of Fog Color 31 24 23 16 15 8 7 0 bit(s) description 24 RID 16 R 8 G 0 B 0xf3 4 w TEV_ALPHAFUNC 31 24 23 16 15 8 7 0 bit(s) description 24 RID 22 LOGIC 0 AND 1 OR 2 XOR 3 XNOR 19 OP1 16 OP0 8 A1 0 A0 0xf4 4 w TEV_Z_ENV_0 31 24 23 16 15 8 7 0 bit(s) description 24 RID - 0-23 ZOFF/BIAS - 0xf5 4 w TEV_Z_ENV_1 31 24 23 16 15 8 7 0 bit(s) description 24 RID 2-3 OP 0 disable 1 add 2 replace 3 unused/reserved 0-1 TYPE/FORMAT 0 u8 1 u16 2 u24 3 unused/reserved 0xf6 4 w TEV_KSEL_0 0xf7 4 w TEV_KSEL_1 0xf8 4 w TEV_KSEL_2 0xf9 4 w TEV_KSEL_3 0xfa 4 w TEV_KSEL_4 0xfb 4 w TEV_KSEL_5 0xfc 4 w TEV_KSEL_6 0xfd 4 w TEV_KSEL_7 31 24 23 16 15 8 7 0 bit(s) description 24 RID 19 KASEL1 14 KCSEL1 9 KASEL0 4 KCSEL0 2 XGA 0 XRB KCSEL - tev const color sel 0 1 1 7_8 2 3_4 3 5_8 4 1_2 5 3_8 6 1_4 7 1_8 8 9 10 11 12 K0 13 K1 14 K2 15 K3 16 K0_R 17 K1_R 18 K2_R 19 K3_R 20 K0_G 21 K1_G 22 K2_G 23 K3_G 24 K0_B 25 K1_B 26 K2_B 27 K3_B 28 K0_A 29 K1_A 30 K2_A 31 K3_A KASEL - tev const alpha sel 0 1 1 7_8 2 3_4 3 5_8 4 1_2 5 3_8 6 1_4 7 1_8 8 9 10 11 12 13 14 15 16 K0_R 17 K1_R 18 K2_R 19 K3_R 20 K0_G 21 K1_G 22 K2_G 23 K3_G 24 K0_B 25 K1_B 26 K2_B 27 K3_B 28 K0_A 29 K1_A 30 K2_A 31 K3_A 0xfe 4 w SS_MASK - BP Mask Register 31 24 23 16 15 8 7 0 bit(s) description 24 * RID 0-23 MASK (*) (*) This Register can be used to limit to which bits of BP registers is actually written to. the mask is only valid for the next BP command, and will reset itself. 0xff 4 w ? 5.11.2 internal CP Registers Registerblock Base Size of Registerblock common access size 0x20 0xa0 4 Register description 0x20 ? 0x30 MATINDEX_A - Texture Matrix Index 0-3 0x40 MATINDEX_B - Texture Matrix Index 4-7 0x50 VCD_LO - Vertex Descriptor (VCD) low, format 0 0x51 VCD_LO - Vertex Descriptor (VCD) low, format 1 0x52 VCD_LO - Vertex Descriptor (VCD) low, format 2 0x53 VCD_LO - Vertex Descriptor (VCD) low, format 3 0x54 VCD_LO - Vertex Descriptor (VCD) low, format 4 0x55 VCD_LO - Vertex Descriptor (VCD) low, format 5 0x56 VCD_LO - Vertex Descriptor (VCD) low, format 6 0x57 VCD_LO - Vertex Descriptor (VCD) low, format 7 0x60 VCD_HI - Vertex Descriptor (VCD) high, format 0 0x61 VCD_HI - Vertex Descriptor (VCD) high, format 1 0x62 VCD_HI - Vertex Descriptor (VCD) high, format 2 0x63 VCD_HI - Vertex Descriptor (VCD) high, format 3 0x64 VCD_HI - Vertex Descriptor (VCD) high, format 4 0x65 VCD_HI - Vertex Descriptor (VCD) high, format 5 0x66 VCD_HI - Vertex Descriptor (VCD) high, format 6 0x67 VCD_HI - Vertex Descriptor (VCD) high, format 7 0x70 VAT_A - Vertex Attribute Table (VAT) group 0, format 0 0x71 VAT_A - Vertex Attribute Table (VAT) group 0, format 1 0x72 VAT_A - Vertex Attribute Table (VAT) group 0, format 2 0x73 VAT_A - Vertex Attribute Table (VAT) group 0, format 3 0x74 VAT_A - Vertex Attribute Table (VAT) group 0, format 4 0x75 VAT_A - Vertex Attribute Table (VAT) group 0, format 5 0x76 VAT_A - Vertex Attribute Table (VAT) group 0, format 6 0x77 VAT_A - Vertex Attribute Table (VAT) group 0, format 7 0x80 VAT_B - Vertex Attribute Table (VAT) group 1, format 0 0x81 VAT_B - Vertex Attribute Table (VAT) group 1, format 1 0x82 VAT_B - Vertex Attribute Table (VAT) group 1, format 2 0x83 VAT_B - Vertex Attribute Table (VAT) group 1, format 3 0x84 VAT_B - Vertex Attribute Table (VAT) group 1, format 4 0x85 VAT_B - Vertex Attribute Table (VAT) group 1, format 5 0x86 VAT_B - Vertex Attribute Table (VAT) group 1, format 6 0x87 VAT_B - Vertex Attribute Table (VAT) group 1, format 7 0x90 VAT_C - Vertex Attribute Table (VAT) group 2, format 0 0x91 VAT_C - Vertex Attribute Table (VAT) group 2, format 1 0x92 VAT_C - Vertex Attribute Table (VAT) group 2, format 2 0x93 VAT_C - Vertex Attribute Table (VAT) group 2, format 3 0x94 VAT_C - Vertex Attribute Table (VAT) group 2, format 4 0x95 VAT_C - Vertex Attribute Table (VAT) group 2, format 5 0x96 VAT_C - Vertex Attribute Table (VAT) group 2, format 6 0x97 VAT_C - Vertex Attribute Table (VAT) group 2, format 7 Register description 0xA0 ARRAY_BASE - vertices ptr 0xa1 ARRAY_BASE - normals ptr 0xa2 ARRAY_BASE - color 0 ptr 0xa3 ARRAY_BASE - color 1 ptr 0xa4 ARRAY_BASE - texture 0 coordinate ptr 0xa5 ARRAY_BASE - texture 1 coordinate ptr 0xa6 ARRAY_BASE - texture 2 coordinate ptr 0xa7 ARRAY_BASE - texture 3 coordinate ptr 0xa8 ARRAY_BASE - texture 4 coordinate ptr 0xa9 ARRAY_BASE - texture 5 coordinate ptr 0xaa ARRAY_BASE - texture 6 coordinate ptr 0xab ARRAY_BASE - texture 7 coordinate ptr 0xac ARRAY_BASE - IndexRegA - general purpose array 0 ptr 0xad ARRAY_BASE - IndexRegB - general purpose array 1 ptr 0xae ARRAY_BASE - IndexRegC - general purpose array 2 ptr 0xaf ARRAY_BASE - IndexRegD - general purpose array 3 ptr 0xB0 ARRAY_STRIDE - size of vertices 0xb1 ARRAY_STRIDE - size of normals 0xb2 ARRAY_STRIDE - size of colors 0 0xb3 ARRAY_STRIDE - size of colors 1 0xb4 ARRAY_STRIDE - size of texture 0 coordinates 0xb5 ARRAY_STRIDE - size of texture 1 coordinates 0xb6 ARRAY_STRIDE - size of texture 2 coordinates 0xb7 ARRAY_STRIDE - size of texture 3 coordinates 0xb8 ARRAY_STRIDE - size of texture 4 coordinates 0xb9 ARRAY_STRIDE - size of texture 5 coordinates 0xba ARRAY_STRIDE - size of texture 6 coordinates 0xbb ARRAY_STRIDE - size of texture 7 coordinates 0xbc ARRAY_STRIDE - IndexRegA - general purpose array 0 stride 0xbd ARRAY_STRIDE - IndexRegB - general purpose array 1 stride 0xbe ARRAY_STRIDE - IndexRegC - general purpose array 2 stride 0xbf ARRAY_STRIDE - IndexRegD - general purpose array 3 stride 0x20 4 w ? 0x30 4 w MATIDX_REG_A 31 24 23 16 15 8 7 0 bit(s) description 24 TEX3IDX - Index for Texture 3 matrix 18 TEX2IDX - Index for Texture 2 matrix 12 TEX1IDX - Index for Texture 1 matrix 6 TEX0IDX - Index for Texture 0 matrix 0 POSIDX - Index for Position/Normal matrix 0x40 4 w MATIDX_REG_B 31 24 23 16 15 8 7 0 bit(s) description 18 TEX7IDX - Index for Texture 7 matrix 12 TEX6IDX - Index for Texture 6 matrix 6 TEX5IDX - Index for Texture 5 matrix 0 TEX4IDX - Index for Texture 4 matrix 0x50 4 R/W VCD_LO - Vertex Descriptor low Format 0 0x51 4 R/W VCD_LO - Vertex Descriptor low Format 1 0x52 4 R/W VCD_LO - Vertex Descriptor low Format 2 0x53 4 R/W VCD_LO - Vertex Descriptor low Format 3 0x54 4 R/W VCD_LO - Vertex Descriptor low Format 4 0x55 4 R/W VCD_LO - Vertex Descriptor low Format 5 0x56 4 R/W VCD_LO - Vertex Descriptor low Format 6 0x57 4 R/W VCD_LO - Vertex Descriptor low Format 7 31 24 23 16 15 8 7 0 bit(s) description 17-31 unused 15-16 COL1 - Color1 (Specular) 13-14 COL0 - Color0 (Diffused) 11-12 NRM - Normal or Normal/Binormal/Tangent 9-10 POS - Position 8 T7MIDX 7 T6MIDX 6 T5MIDX 5 T4MIDX 4 T3MIDX 3 T2MIDX 2 T1MIDX 1 T0MIDX - Texture Coordinate 0 Matrix Index 0 PMIDX - Position/Normal Matrix Index (*1) (*1) position and normal matrices are stored in 2 seperate areas of internal XF memory, but there is a one to one correspondence between normal and position index.If index 'A' is used for the position, then index 'A' needs to be used for the normal as well. 0x60 4 R/W VCD_HI - Vertex Descriptor high Format 0 0x61 4 R/W VCD_HI - Vertex Descriptor high Format 1 0x62 4 R/W VCD_HI - Vertex Descriptor high Format 2 0x63 4 R/W VCD_HI - Vertex Descriptor high Format 3 0x64 4 R/W VCD_HI - Vertex Descriptor high Format 4 0x65 4 R/W VCD_HI - Vertex Descriptor high Format 5 0x66 4 R/W VCD_HI - Vertex Descriptor high Format 6 0x67 4 R/W VCD_HI - Vertex Descriptor high Format 7 31 24 23 16 15 8 7 0 ..tt bit(s) description 16- unused 14-15 TEX7 - texture coordinate 7 12-13 TEX6 - texture coordinate 6 10-11 TEX5 - texture coordinate 5 8-9 TEX4 - texture coordinate 4 6-7 TEX3 - texture coordinate 3 4-5 TEX2 - texture coordinate 2 2-3 TEX1 - texture coordinate 1 0-1 t TEX0 - texture coordinate 0 vertex descriptor data value Vertex/Color Pos/Tex Matrix Index 0 no data present no data present 1 direct direct 2 i8 - indirect/8 bit index n/a 3 i16 - indirect/16 bit index n/a 0x70 4 w CP_VAT_REG_A - Format 0 0x71 4 w CP_VAT_REG_A - Format 1 0x72 4 w CP_VAT_REG_A - Format 2 0x73 4 w CP_VAT_REG_A - Format 3 0x74 4 w CP_VAT_REG_A - Format 4 0x75 4 w CP_VAT_REG_A - Format 5 0x76 4 w CP_VAT_REG_A - Format 6 0x77 4 w CP_VAT_REG_A - Format 7 31 24 23 16 15 8 7 0 bit(s) description 31 NORMALINDEX3 (*1) 0 single index per normal 1 triple-index per nine-normal 30 BYTEDEQUANT (should always be 1) 0 shift does not apply to u8/s8 components 1 shift applies to u8/s8 components 25 TEX0SHFT 22 TEX0FMT 21 TEX0CNT 18 COL1FMT (Specular) 17 COL1CNT (Specular) 14 COL0FMT (Diffused) 13 COL0CNT (Diffused) 10 NRMFMT 9 NRMCNT 4 POSSHFT 1 POSFMT 0 POSCNT (*1) when nine-normals are selected in indirect mode, input will be treated as three staggered indices (one per triple biased by components size), into normal table (note: first index internally biased by 0, second by 1, third by 2) 0x80 4 w CP_VAT_REG_B - Format 0 0x81 4 w CP_VAT_REG_B - Format 1 0x82 4 w CP_VAT_REG_B - Format 2 0x83 4 w CP_VAT_REG_B - Format 3 0x84 4 w CP_VAT_REG_B - Format 4 0x85 4 w CP_VAT_REG_B - Format 5 0x86 4 w CP_VAT_REG_B - Format 6 0x87 4 w CP_VAT_REG_B - Format 7 31 24 23 16 15 8 7 0 bit(s) description 31 VCACHE_ENHANCE (must always be 1) 28 TEX4FMT 27 TEX4CNT 22 TEX3SHFT 19 TEX3FMT 18 TEX3CNT 13 TEX2SHFT 10 TEX2FMT 9 TEX2CNT 4 TEX1SHFT 1 TEX1FMT 0 TEX1CNT 0x90 4 w CP_VAT_REG_C - Format 0 0x91 4 w CP_VAT_REG_C - Format 1 0x92 4 w CP_VAT_REG_C - Format 2 0x93 4 w CP_VAT_REG_C - Format 3 0x94 4 w CP_VAT_REG_C - Format 4 0x95 4 w CP_VAT_REG_C - Format 5 0x96 4 w CP_VAT_REG_C - Format 6 0x97 4 w CP_VAT_REG_C - Format 7 31 24 23 16 15 8 7 0 bit(s) description 27 TEX7SHFT 24 TEX7FMT 23 TEX7CNT 18 TEX6SHFT 15 TEX6FMT 14 TEX6CNT 9 TEX5SHFT 6 TEX5FMT 5 TEX5CNT 0 TEX4SHFT Vertex Attribute Data Formats CompCount value coords normals tex coords colors 0 two (x,y) three one (s) three (r,g,b) 1 three (x,y,z) nine two (s,t) four (r,g,b,a) CompSize value coords normals colors 0 u8 n/a 16 bit rgb565 1 s8 s8 24 bit rgb888 2 u16 n/a 32 bit rgb888x 3 s16 s16 16 bit rgba4444 4 f32 f32 24 bit rgba6666 5 n/a n/a 32 bit rgba8888 6 unused unused unused 7 unused unused unused Shift coords normals colors location of decimal point n/a (byte: 6, short: 14) n/a This shift applies to all s16/u16 components, and all s8/s8 components when ByteDequant is asserted. 0xA0 4 w ARRAY_BASE 0xA1 4 w ARRAY_BASE 0xA2 4 w ARRAY_BASE 0xA3 4 w ARRAY_BASE 0xA4 4 w ARRAY_BASE 0xA5 4 w ARRAY_BASE 0xA6 4 w ARRAY_BASE 0xA7 4 w ARRAY_BASE 0xA8 4 w ARRAY_BASE 0xA9 4 w ARRAY_BASE 0xAA 4 w ARRAY_BASE 0xAB 4 w ARRAY_BASE 0xAC 4 w ARRAY_BASE 0xAD 4 w ARRAY_BASE 0xAE 4 w ARRAY_BASE 0xAF 4 w ARRAY_BASE 31 24 23 16 15 8 7 0 bit(s) description 26- unused 0-25 array base addres in main memory 0xB0 4 w ARRAY_STRIDE 0xB1 4 w ARRAY_STRIDE 0xB2 4 w ARRAY_STRIDE 0xB3 4 w ARRAY_STRIDE 0xB4 4 w ARRAY_STRIDE 0xB5 4 w ARRAY_STRIDE 0xB6 4 w ARRAY_STRIDE 0xB7 4 w ARRAY_STRIDE 0xB8 4 w ARRAY_STRIDE 0xB9 4 w ARRAY_STRIDE 0xBa 4 w ARRAY_STRIDE 0xBb 4 w ARRAY_STRIDE 0xBc 4 w ARRAY_STRIDE 0xBd 4 w ARRAY_STRIDE 0xBe 4 w ARRAY_STRIDE 0xBf 4 w ARRAY_STRIDE 31 24 23 16 15 8 7 0 bit(s) description 8- unused 0-7 array stride 5.11.3 internal XF Memory Every register in the transform unit is mapped to a unique 32b address. All addresses are available to the xform register load command (command 0x30). The first block is formed by the matrix memory. Its address range is 0 to 1 k, but only 256 entries are used. This memory is organized in a 64 entry by four 32b words. Each word has a unique address and is a single precision floating point number. For block writes, the addresses auto increment. The memory is implemented in less than 4-32b rams, then it is possible that the memory writes to this block will require a minimum write size larger than 1 word. start end size description 0x0000 32 Matrix Ram word 0 0x0001 0x00ff Matrix Ram word (n) 0x0100 0x03ff 0x300 not used 0 - position matrix (4*3) 0xF0 - (texture?) transform matrix (4*3) The second block of memory is the normal matrix memory. It is organized as 32 rows of 3 words. Each word has a unique address and is a single precision floating point number. Also, each word written is 32b, but only the 20 most significant bits are kept. For simplicity, the minimum granularity of writes will be 3 words: start end size description 0x0400 0x0402 20 Normal Ram words 0,1,2 0x0403 0x045f Normal Ram word (n) 0x0460 0x05ff not used 0x400 - normal transform matrix (3*3) The third block of memory holds the dual texture transform matrices. The format is identical to the first block of matrix memory. There are also 64 rows of 4 words for these matrices. These matrices can only be used for the dual transform of regular textures: start end size description 0x0500 32 Matrix Ram word 0 0x0501 0x05ff Matrix Ram word (n) 0x5F4 - dual texture transform matrix (4*3) The fourth block of memory is the light memory. This holds all the lighting information (light vectors, light parameters, etc.). Both global state and ambient state are stored in this memory. Each word written is 32b, but only the 20 most significant bits are kept. Each row is 3 words wide. Minimum word write size is 3 words. start end size description 0x0600 reserved 0x0601 reserved 0x0602 reserved 0x0603 32 bit Light0 - RGBA 0x0604 20 bit Light0A0 - cos atten. A-0 0x0605 20 bit Light0A1 - cos atten. A-1 0x0606 20 bit Light0A2 - cos atten. A-2 0x0607 20 bit Light0K0 - dist atten. A-0 0x0608 20 bit Light0K1 - dist atten. A-1 0x0609 20 bit Light0K2 - dist atten. A-2 0x060a 20 bit Light0Lpx - x light pos, or inf ldir x 0x060b 20 bit Light0Lpy - y light pos, or inf ldir y 0x060c 20 bit Light0Lpz - z light pos, or inf ldir z 0x060d 20 bit Light0Dx/Hx - light dir x, or 1/2 angle x 0x060e 20 bit Light0Dy/Hy - light dir y, or 1/2 angle y 0x060f 20 bit Light0Dz/Hz - light dir z, or 1/2 angle z 0x0610 0x067f Light(n)data - see Light0 data 0x0680 0x07ff not used 5.11.4 internal XF Registers Registerblock Base Size of Registerblock common access size 0x1000 0x54 4 Register description 0x1000 Error (=0x3f) 0x1001 Diagnostics 0x1002 State0 - Internal State Register 0 0x1003 State1 - Internal State Register 1 0x1004 Xf_clock - Enables Power Saving Mode 0x1005 ClipDisable - clip mode (=0) 0x1006 Perf0 - Performance monitor selects (=0) 0x1007 Perf1 - Xform target performance register 0x1008 InVertexSpec - INVTXSPEC - (=0x01) 0x1009 NumColors - NUMCOLORS - (=0x00) 0x100a Ambient0 - chan Ambient color 0 (=0x00) 0x100b Ambient1- chan Ambient color 1 (=0x00) 0x100c Material0 - chan Material ID 0 (=0xffffffff) 0x100d Material1 - chan Material ID 1 (=0xffffffff) 0x100e COLOR0CNTRL (=0x0401) 0x100f COLOR1CNTRL (=0x0401) 0x1010 ALPHA0CNTRL (=0x0401) 0x1011 ALPHA1CNTRL (=0x0401) 0x1012 DualTexTrans - (=0x01) 0x1013 ? 0x1014 ? 0x1015 ? 0x1016 ? 0x1017 ? 0x1018 MatrixIndex0 - MATINDEX A 0x1019 MatrixIndex1 - MATINDEX B 0x101a ScaleX - Viewport Scale X 0x101b ScaleY - Viewport Scale Y 0x101c Scale Z - Viewport Scale Z 0x101d OffsetX - Viewport Offset X 0x101e OffsetY - Viewport Offset Y 0x101f OffsetZ - Viewport Offset Z 0x1020 ProjectionA - A parameter in projection equations 0x1021 ProjectionB - B parameter in projection equations 0x1022 ProjectionC - C parameter in projection equations 0x1023 ProjectionD - D parameter in projection equations 0x1024 ProjectionE - E parameter in projection equations 0x1025 ProjectionF - F parameter in projection equations 0x1026 ProjectOrtho Register description 0x103f NUMTEX - Number of active Textures 0x1040 TEX0 0x1041 TEX1 0x1042 TEX2 0x1043 TEX3 0x1044 TEX4 0x1045 TEX5 0x1046 TEX6 0x1047 TEX7 Register description 0x1050 DUALTEX0 0x1051 DUALTEX1 0x1052 DUALTEX2 0x1053 DUALTEX3 0x1054 DUALTEX4 0x1055 DUALTEX5 0x1056 DUALTEX6 0x1057 DUALTEX7 0x1000 4 w Error 0x1001 4 w Diagnostics 0x1002 4 w State 0 - Internal State Register 0 0x1003 4 w State 1 - Internal State Register 1 0x1004 4 w Xf_clock 31 24 23 16 15 8 7 0 bit(s) description 0 0 no power saving when idle 1 enable Power saving when idle 0x1005 4 w ClipDisable 31 24 23 16 15 8 7 0 bit(s) description 2 when set, disable cpoly clipping acceleration (default==0) 1 when set, disable trivial rejection (default==0) 0 when set, disable clipping detection (default==0) 0x1006 4 w Perf0 - Performance monitor selects 0x1007 4 w Perf1 - Xform target performance Register 31 24 23 16 15 8 7 0 bit(s) description 0-6 Xform internal target performance (Cycles per Vertex) 0x1008 4 w INVTXSPEC 31 24 23 16 15 8 7 0 bit(s) description 4-7 HOST_TEXTURES - number of host supplied texture coordinates 0 no host supplied textures 1 1 host supplied texture pair (S0, T0) 2-8 2-8 host supplied texturepairs 9-15 reserved/unused 2-3 HOST_NORMAL - host supplied normal 0 no host supplied normal 1 host supplied normal 2 host supplied normal and binormals 0-1 HOST_COLORS - host supplied color0 usage 0 no host supplied color information 1 host supplied color 0 2 host supplied color 0 and color 1 0x1009 4 w NUMCOLORS 31 24 23 16 15 8 7 0 value description 0 No colors 1 One color - Xform supplies 1 color (host supplied or computed) 2 Two colors - Xform supplies 2 colors (host supplied or computed) Selects the number of output colors 0x100a 4 w XF_AMBIENT0 - Ambient color 0 specifications 31 24 23 16 15 8 7 0 bit(s) description 24 RED 16 GREEN 8 BLUE 0 ALPHA 0x100b 4 w XF_AMBIENT1 - Ambient color 1 specifications 31 24 23 16 15 8 7 0 bit(s) description 24 RED 16 GREEN 8 BLUE 0 ALPHA 0x100c 4 w XF_MATERIAL0 - global color0 material specification 31 24 23 16 15 8 7 0 bit(s) description 24 RED 16 GREEN 8 BLUE 0 ALPHA 0x100d 4 w XF_MATERIAL1 - global color1 material specification 31 24 23 16 15 8 7 0 bit(s) description 24 RED 16 GREEN 8 BLUE 0 ALPHA 0x100e 4 w COLOR0CNTRL 31 24 23 16 15 8 7 0 bit(s) description 14 LIGHT7 - Light 7 is source 0 Do not use Light 1 Use light 13 LIGHT6 - Light6 is source 0 Do not use Light 1 Use light 12 LIGHT5 - Light5 is source 0 Do not use Light 1 Use light 11 LIGHT4 - Light4 is source 0 Do not use Light 1 Use light 10 ATTENSELECT - Attenuation Select function 0 Select specular (N.H) attenuation 1 Select diffuse spotlight (L.Ldir) attenuation 9 ATTENENABLE - Attenuation Enable function 0 Select 1.0 1 Select Attenuation fraction 7-8 DIFFUSEATTEN - Diffuse Attenuation function 00 Select 1.0 01 Select N.L, signed 10 Select N.L clamped to [0,1.0] 11 6 AMBIENT_SRC - Ambient source 0 Use register Ambient0 register 1 Use CP supplied vertex color 0 5 LIGHT3 - Light3 is source 0 Do not use light 1 Use light 4 LIGHT2 - Light2 is source 0 Do not use light 1 Use light 3 LIGHT1 - Light1 is source 0 Do not use light 1 Use light 2 LIGHT0 - Light0 is source 0 Do not use light 1 Use light 1 LIGHTFUNC - Color0 Light Function 0 Use 1.0 1 Use Illum0 0 MATERIAL_SRC - Color0 Material source 0 Use register (Material 0) 1 Use CP supplied Vertex color 0 0x100f 4 w COLOR1CNTRL 31 24 23 16 15 8 7 0 bit(s) description 14 LIGHT7 - Light 7 is source 0 Do not use Light 1 Use light 13 LIGHT6 - Light6 is source 0 Do not use Light 1 Use light 12 LIGHT5 - Light5 is source 0 Do not use Light 1 Use light 11 LIGHT4 - Light4 is source 0 Do not use Light 1 Use light 10 ATTENSELECT - Attenuation Select function 0 Select specular (N.H) attenuation 1 Select diffuse spotlight (L.Ldir) attenuation 9 ATTENENABLE - Attenuation Enable function 0 Select 1.0 1 Select Attenuation fraction 7-8 DIFFUSEATTEN - Diffuse Attenuation function 00 Select 1.0 01 Select N.L, signed 10 Select N.L clamped to [0,1.0] 11 6 AMBIENT_SRC - Ambient source 0 Use register Ambient1 register 1 Use CP supplied vertex color 1 5 LIGHT3 - Light3 is source 0 Do not use light 1 Use light 4 LIGHT2 - Light2 is source 0 Do not use light 1 Use light 3 LIGHT1 - Light1 is source 0 Do not use light 1 Use light 2 LIGHT0 - Light0 is source 0 Do not use light 1 Use light 1 LIGHTFUNC - Color1 Light Function 0 Use 1.0 1 Use Illum1 0 MATERIAL_SRC - Color1 Material source 0 Use register (Material 1) 1 Use CP supplied Vertex color 1 0x1010 4 w ALPHA0CNTRL 31 24 23 16 15 8 7 0 bit(s) description 14 LIGHT7 - Light 7 alpha is source 0 Do not use Light 1 Use light 13 LIGHT6 - Light6 alpha is source 0 Do not use Light 1 Use light 12 LIGHT5 - Light5 alpha is source 0 Do not use Light 1 Use light 11 LIGHT4 - Light4 alpha is source 0 Do not use Light 1 Use light 10 ATTENSELECT - Attenuation Select function 0 Select specular (N.H) attenuation 1 Select diffuse spotlight (L.Ldir) attenuation 9 ATTENENABLE - Attenuation Enable function 0 Select 1.0 1 Select Attenuation fraction 7-8 DIFFUSEATTEN - Diffuse Attenuation function 00 Select 1.0 01 Select N.L, signed 10 Select N.L clamped to [0,1.0] 11 6 AMBIENT_SRC - Ambient source 0 Use register Ambient0 alpha register 1 Use CP supplied vertex color 0 alpha 5 LIGHT3 - Light3 alpha is source 0 Do not use light 1 Use light 4 LIGHT2 - Light2 alpha is source 0 Do not use light 1 Use light 3 LIGHT1 - Light1 alpha is source 0 Do not use light 1 Use light 2 LIGHT0 - Light0 alpha is source 0 Do not use light 1 Use light 1 LIGHTFUNC - Color0 alpha Light Function 0 Use 1.0 1 Use Illum0 0 MATERIAL_SRC - Color0 alpha Material source 0 Use register (Material 0 alpha) 1 Use CP supplied Vertex color 0 alpha 0x1011 4 w ALPHA1CNTRL 31 24 23 16 15 8 7 0 bit(s) description 14 LIGHT7 - Light 7 alpha is source 0 Do not use Light 1 Use light 13 LIGHT6 - Light6 alpha is source 0 Do not use Light 1 Use light 12 LIGHT5 - Light5 alpha is source 0 Do not use Light 1 Use light 11 LIGHT4 - Light4 alpha is source 0 Do not use Light 1 Use light 10 ATTENSELECT - Attenuation Select function 0 Select specular (N.H) attenuation 1 Select diffuse spotlight (L.Ldir) attenuation 9 ATTENENABLE - Attenuation Enable function 0 Select 1.0 1 Select Attenuation fraction 7-8 DIFFUSEATTEN - Diffuse Attenuation function 00 Select 1.0 01 Select N.L, signed 10 Select N.L clamped to [0,2.0] 11 6 AMBIENT_SRC - Ambient source 0 Use register Ambient1 alpha register 1 Use CP supplied vertex color 1 alpha 5 LIGHT3 - Light3 alpha is source 0 Do not use light 1 Use light 4 LIGHT2 - Light2 alpha is source 0 Do not use light 1 Use light 3 LIGHT1 - Light1 alpha is source 0 Do not use light 1 Use light 2 LIGHT0 - Light0 alpha is source 0 Do not use light 1 Use light 1 LIGHTFUNC - Color0 alpha Light Function 0 Use 1.0 1 Use Illum0 0 MATERIAL_SRC - Color0 alpha Material source 0 Use register (Material 0 alpha) 1 Use CP supplied Vertex color 0 alpha 0x1012 4 w DualTexTrans 31 24 23 16 15 8 7 0 bit(s) description 0 0 disable dual texture transform feature 1 enable dual transform for all texture coordinates 0x1013 4 w ? 0x1014 4 w ? 0x1015 4 w ? 0x1016 4 w ? 0x1017 4 w ? 0x1018 4 w MatrixIndex0 31 24 23 16 15 8 7 0 bit(s) description 24-29 Tex3 matrix index 23-18 Tex2 matrix index 12-17 Tex1 matrix index 6-11 Tex0 matrix index 0-5 Geometry matrix index 0x1019 4 w MatrixIndex1 31 24 23 16 15 8 7 0 bit(s) description 18-23 Tex7 matrix index 12-17 Tex6 matrix index 6-11 Tex5 matrix index 0-5 Tex4 matrix index 0x101A 4 w Viewport 0x101B 4 w Viewport 0x101C 4 w Viewport 0x101D 4 w Viewport 0x101E 4 w Viewport 0x101F 4 w Viewport Viewport Matrix description 0x101A f32 wd / 2 0x101B f32 -ht / 2 0x101C f32 ZMAX * (farZ - nearZ) 0x101D f32 xOrig + wd / 2 + 342 0x101E f32 yOrig + ht / 2 + 342 0x101F f32 ZMAX * farZ ZMAX is 16777215.0 (maximum 24-bit Z buffer value, or 'infinite') 0x1020 4 w Projection Matrix 0x1021 4 w Projection Matrix 0x1022 4 w Projection Matrix 0x1023 4 w Projection Matrix 0x1024 4 w Projection Matrix 0x1025 4 w Projection Matrix Projection Matrix orthogonal perspective 0x1020 f32 2.0 / (r - l) (1.0f / tanf(fovy * 0.5F)) / aspect 0x1021 f32 -(r+l) / (r-l) 0 0x1022 f32 2.0 / (t-b) (1.0f / tanf(fovy * 0.5F)) 0x1023 f32 -(t+b)/(t-b) 0 0x1024 f32 -1.0/(f-n) -n * 1.0f / (f-n) 0x1025 f32 -(f)/(f-n) -(f*n) * 1.0f / (f-n) 0x1026 4 w ProjectOrtho 31 24 23 16 15 8 7 0 bit(s) description If set selects orthographic otherwise non-orthographic (Zh or 1.0 select) note: regs 0x1027-0x103e skipped (all unknown) 0x103f 4 w NUMTEX - Number of active Textures 0x1040 4 w TEX0 0x1041 4 w TEX1 0x1042 4 w TEX2 0x1043 4 w TEX3 0x1044 4 w TEX4 0x1045 4 w TEX5 0x1046 4 w TEX6 0x1047 4 w TEX7 31 24 23 16 15 8 7 0 bit(s) description 15-17 EMBOSS_LIGHT - Bump mapping source light (*1) 12-14 EMBOSS_SOURCE - bump mapping source texture (*2) 7-11 SOURCE_ROW - regular texture source row (*3) 0 GEOM_INROW - 1 NORMAL_INROW - 2 COLORS_INROW - 3 BINORMAL_T_INROW - 4 BINORMAL_B_INROW - 5 TEX0_INROW - 6 TEX1_INROW - 7 TEX2_INROW - 8 TEX3_INROW - 9 TEX4_INROW - a TEX5_INROW - b TEX6_INROW - c TEX7_INROW - d e f 4-6 TEXGEN_TYPE 0 REGULAR - Regular transformation (transform incoming data) 1 EMBOSS_MAP - texgen bump mapping 2 COLOR_STRGBC0 - Color texgen: (s,t)=(r,g:b) (g and b are concatenated), color 0 3 COLOR_STRGBC1 - Color texgen: (s,t)=(r,g:b) (g and b are concatenated), color 1 3 reserved/unused 2 INPUT_FORM - format of source input data for regular textures 0 AB11 - (A, B, 1.0, 1.0) (used for regular texture source) 1 ABC1 - (A, B, C, 1.0) (used for geometry or normal source) 1 PROJECTION 0 ST - (s,t): texmul is 2x4 1 STQ - (s,t,q): texmul is 3x4 0 reseved/unused (*1) n: use light #n for bump map direction source (10 to 17) (*2) n: use regular transformed tex(n) for bump mapping source (*3) Specifies location of incoming textures in vertex (row specific) (i.e.: geometry is row0, normal is row1, etc . . . ) for regular transformations note: regs 0x1048-104f skipped (all unknown) 0x1050 4 w DUALTEX0 0x1051 4 w DUALTEX1 0x1052 4 w DUALTEX2 0x1053 4 w DUALTEX3 31 24 23 16 15 8 7 0 bit(s) description 8 NORMAL_ENABLE - specifies if texture coordinate should be normalized before send transform. 6-7 unused 0-5 DUALMTX - base row of the dual transform matrix for regular texture coordinate0 (63 max, simelar to 0x1018/0x1019) 5.11.5 GP packet description The first thing in a GP Packet is the command type (8 bit).Next follows actual primitive data. It may vary on each opcode type. 5.11.5.1 Command Type 7 0 oooo ovvv bit(s) description o Opcode v Vertex Attribute Table Index (VAT) 5.11.5.1.1 opcodes opcode Description 0x00 NOP - No Operation 0x08 Load CP REG 0x10 Load XF REG 0x20 Load INDX A 0x28 Load INDX B 0x30 Load INDX C 0x38 Load INDX D 0x40 CALL DL - Call Displaylist 0x48 Invalidate Vertex Cache 0x61 Load BP REG (SU_ByPassCmd) 0x80 QUADS - Draw Quads (*) 0x90 TRIANGLES - Draw Triangles (*) 0x98 TRIANGLESTRIP - Draw Triangle Strip (*) 0xA0 TRIANGLEFAN - Draw Triangle Fan (*) 0xA8 LINES - Draw Lines (*) 0xB0 LINESTRIP - Draw Line Strip (*) 0xB8 POINTS - Draw Points (*) (*) all draw opcodes must be Or-ed with used VAT index (0...7) 5.11.5.2 Drawing Commands 8 bits 16 bits n opcode number of vertices vertex data Vertex data may be in one of many formats. The VCD tells wether data for a component exists (and if yes, if it is direct or indexed) and the VAT tells the actual format of the respective component. Each individual component may or may not exist, but the order is fixed as follows: 1. PNMTXIDX - Position/Normal Matrix Index 2. TEX0MTXIDX - Texture 0 Matrix Index 3. TEX1MTXIDX - Texture 1 Matrix Index 4. TEX2MTXIDX - Texture 2 Matrix Index 5. TEX3MTXIDX - Texture 3 Matrix Index 6. TEX4MTXIDX - Texture 4 Matrix Index 7. TEX5MTXIDX - Texture 5 Matrix Index 8. TEX6MTXIDX - Texture 6 Matrix Index 9. TEX7MTXIDX - Texture 7 Matrix Index 10. POS - Position Vector 11. NRM - Normal or NBT - Binormal vector (T, B) 12. CLR0 - Color0 (Diffused) 13. CLR1 - Color1 (Specular) 14. TEX0 - Texture 0 data 15. TEX1 - Texture 1 data 16. TEX2 - Texture 2 data 17. TEX3 - Texture 3 data 18. TEX4 - Texture 4 data 19. TEX5 - Texture 5 data 20. TEX6 - Texture 6 data 21. TEX7 - Texture 7 data Notice that the Position/Normal and Texture Matrix Indices are different from the other data in that they are 8 bit and must always be sent as direct data. 5.11.5.2.1 Quads draws a series of non planar quads, using v0,v1,v2,v3 then v4,v5,v6,v7 and so on. (the quad is actually drawn using 2 triangles so the 4 vertices do not have to be coplanar). The minimum number of vertices is 4. 5.11.5.2.2 Triangles draws a series of triangles, from v0,v1,v2 then v3,v4,v5 and so on. The number of vertices should be a multiple of 3 5.11.5.2.3 Trianglestrip draws a series of triangles, from v0,v1,v2 then v1,v3,v2, then v2,v3,v4 amd so on. The number of vertices must be at least 3. 5.11.5.2.4 TriangleFan draws a series of triangles, from v0,v1,v2 then v0,v2,v3 and so on. The number of vertices must be at least 3. 5.11.5.2.5 Lines draws a series of unconnected lines, from v0 to v1, then from v2 to v3 and so on. The number of vertices should be a multiple of 2 5.11.5.2.6 Linestrip draws a series of connected lines, from v0 to v1, then from v1 to v2 and so on. If n vertices are drawn, n-1 lines are drawn 5.11.5.2.7 Points draws a Point at each of the n vertices 5.11.5.3 NOP - No Operation Use it to pad primitive data to 32-byte boundaries and to terminate a display list. 5.11.5.4 CALL DL - Call Display List used to call one display list from another. 8 bits 7 0 0100 0000 opcode == 0x40 32 bits 31 24 23 16 15 8 7 0 0000 000. .... .... .... .... .... .... list address 32 bits 31 24 23 16 15 8 7 0 0000 000. .... .... .... .... .... .... list size in bytes (32 bit words?) 5.11.5.5 Invalidate Vertex Cache 8 bits opcode == 0x48 5.11.5.6 BP command (Bypass Raster State Registers) 8 bits 8 bits 24 bits opcode == 0x61 reg. addr. reg. value 5.11.5.7 CP command (Command Processor Registers) 8 bits 8 bits 32 bits opcode == 0x08 reg. addr. reg. value 5.11.5.8 XF command (Transform Unit Registers) 8 bits 16 bits 16 bits 32 bits * length opcode == 0x10 length - 1 1st addr. reg. value(s) note : "length" is limited to 16. 5.11.5.9 Indexed XF command 8 bits 16 bits 4 bits 12 bits opcode index value length-1 1st address note : "length" is limited to 16. There are 4 different XF index units, which are typically used as follows: A: pos. mtx's B: nrm. mtx's C: tex. mtx's D: light obj's. 6 Exception and Interrupt Processing 6.1 Hardware Exception Sources Handler Start Exception 0x80000100 System Reset Interrupt 0x80000200 Machine Check Interrupt 0x80000300 DSI Interrupt 0x80000400 ISI Interrupt 0x80000500 External Interrupt 0x80000600 Alignment Interrupt 0x80000700 Program Interrupt 0x80000800 FP unavailable Interrupt 0x80000900 Decrementer Interrupt 0x80000C00 System Call Interrupt 0x80000d00 Trace Interrupt 0x80000f00 Performance Monitor Interrupt 0x80001300 IABR Interrupt 0x80001700 Thermal Interrupt 6.1.1 System Reset Interrupt Triggered at a system reset 6.1.2 Machine Check Interrupt 6.1.3 DSI Interrupt Triggered if an attempt to store or read data from/to an illegal address was made 6.1.4 ISI Interrupt Triggered if an attempt to fetch an instruction from an illegal address was made. 6.1.5 External Interrupt 14 sources, triggered by external chips (you may look at it as the traditional IRQ). 6.1.5.1 Setup * set corresponding bit(s) in PI Interrupt Mask Register (0xcc003004) * enable external Interrupts in the Machine State Register 6.1.5.2 Handling * check PI Interrupt Cause Register (0xcc003000) for flags * acknowledge by setting corresponding bits in PI Interrupt Cause Register (0xcc003000) * handle different interrupt sources bit Description 13 HSP High Speed Port 12 DEBUG External Debugger 11 CP Command FIFO 10 PE FINISH Frame is Ready 9 PE TOKEN Token Assertion in Command List 8 VI Video Interface 7 MEM Memory Interface 6 DSP DSP 5 AI Audio Streaming 4 EXI EXI 3 SI Serial 2 DI DVD 1 RSW Reset Switch 0 ERROR GP runtime error 6.1.6 Alignment Interrupt 6.1.7 Program Interrupt Triggered if the instruction that was about to execute is invalid. 6.1.8 FP unavailable Interrupt 6.1.9 Decrementer Interrupt Triggered by an underflow of the decrementer register. 6.1.10 System Call Interrupt Triggered when the PowerPC instruction 'sc' is executed. 6.1.11 Trace Interrupt 6.1.12 Performance Monitor Interrupt 6.1.13 IABR Interrupt 6.1.14 Thermal Interrupt 6.2 External Interrupt Sources 6.2.1 HSP - High Speed Port 3 Sources 6.2.1.1 TX Mailbox Interrupt 6.2.1.2 RX Mailbox Interrupt 6.2.1.3 ID Interrupt 6.2.2 Debug 1 Source 6.2.3 CP - Command Processor 2 Sources (read/write pointer watermark over- and underflow) check bit 0 and bit 1 of 0xcc000000 6.2.3.1 FIFO underflow 6.2.3.1.1 setup * setup CP FIFO low watermark * set bit 1 of CP interrupt status register (0xcc000002) to enable 6.2.3.1.2 handling * clear bit 3 of CP interrupt status register (0xcc000002) to acknowledge 6.2.3.2 FIFO overflow 6.2.3.2.1 setup * setup CP FIFO high watermark * set bit 0 of CP interrupt status register (0xcc000002) to enable 6.2.3.2.2 handling * clear bit 2 of CP interrupt status register (0xcc000002) to acknowledge 6.2.4 PE - Pixel Engine Finished 1 Source (Frame finished) 6.2.4.1 setup * set bit 1 in PE Interrupt status register (0xcc001000a) 6.2.4.2 handling * set bit 3 in PE Interrupt status register (0xcc001000a) to acknowledge the interrupt 6.2.5 PE - Pixel Engine Token 1 Source (Token in GP Command List) 6.2.5.1 setup * set bit 0 in PE Interrupt status register (0xcc001000a) 6.2.5.2 handling * check PE Token Register (0xCC00000E) for the token that triggered the interrupt. * set bit 2 in PE Interrupt status register (0xcc001000a) to acknowledge the interrupt 6.2.6 VI - Video Interface 4 Sources, check (0xcc002030) (0xcc002034) (0xcc002038) (0xcc00203c) for flags 6.2.6.1 Setup * setup desired position of the interrupt * set enable bit in Display Interrupt Register (0xcc002030) (0xcc002034) (0xcc002038) (0xcc00203c) 6.2.6.2 Handling * clear Status bit in Display Interrupt Register (0xcc002030) (0xcc002034) (0xcc002038) (0xcc00203c) to acknowledge the interrupt. 6.2.7 Memory Interface 4 sources (4 regions of memory can be protected independently) 6.2.7.1 protection fault 6.2.7.1.1 Setup * clear (0xCC004020) * setup the regions in (0xCC004000)(0xCC004004)(0xCC004008) (0xCC00400c) * setup type of protection in (0xCC004010) * enable protecting of regions in irq mask (0xCC00401c) 6.2.7.1.2 Handling * clear (0xCC004020) * read status bits from (0xCC00401e) to check what region triggered the protection fault * set status bits in (0xCC00401e) to acknowledge the interrupt * read the address that triggered the protection fault from (0xCC004022) and (0xCC004024) 6.2.8 DSP Interface 3 Sources, check (0xcc00500a) for flags 6.2.8.1 Audio DMA finished asserted when audio DMA transfer has been completed. 6.2.8.1.1 Setup * set bit 4 of DSP Control Register (0xcc00500a) 6.2.8.1.2 Handling * set bit 3 of DSP Control Register (0xcc00500a) to acknowledge the interrupt. 6.2.8.2 ARAM transfer complete asserted when a transfer from/to auxiliary ram has been completed. 6.2.8.3 DSP 6.2.9 Audio Streaming Interface 1 Source, check (0xcc006c00) for flag. asserted based on the disk streaming sample counter. 6.2.10 EXI 3 Sources each EXI Channel (TCINT,EXTINT,EXIIRQ), making 9 total, check (0xcc006800) (0xcc006814) (0xcc006828) for flags. 6.2.10.1 DMA Transfer finished (TCINT channel 0, channel 1) 6.2.10.2 Ethernet Adapter (EXIIRQ channel 2) 6.2.10.2.1 setup 6.2.10.2.2 handling * check command register 3 (irq status) for the exact source (MX chip, killing irq,cmd error, challenge/response request, challange/response status) * if from MX chip, check register 8 and 9 for the exact cause 6.2.10.3 Memory Card removed (EXTINT channel 0, channel 1) 6.2.10.3.1 setup 6.2.10.3.2 handling * To check whether the device has been inserted or removed, check the EXICPR [EXT] bit. 6.2.11 Serial Interface 6.2.12 DVD Interface 4 Sources (Break Complete, DMA finished, Device Error, Cover state changed), check (0xcc006000)(0xcc006004) for flags. 6.2.12.1 Break Complete 6.2.12.2 DMA finished 6.2.12.3 Device Error 6.2.12.4 Cover State changed 6.2.13 Reset Button 1 Source (Reset Button pressed) 6.2.13.1 setup * no further setup required 6.2.13.2 handling * nothing special required, its however recommended to clear the PI Interrupt Mask to avoid multiple interrupts. 6.2.14 Error 1 Source (GP runtime error) 7 Video Processing 7.1 Used VI terms * XFB - external Framebuffer The external framebuffer resides in main memory and can be directly displayed by the video processor. 7.2 init VI 7.2.1 Videomodes 7.3 render to XFB 7.4 vertical retrace 7.5 set XFB Address 8 3D Graphics Processing images/gx_overview.png 8.1 basic operations 8.1.1 load BP Register * write byte 0x61 to GXFIFO * write 4 bytes of data to GXFIFO 8.1.2 load CP Register * write byte 0x08 to GXFIFO * write 1 byte address to GXFIFO * write 4 bytes of data to GXFIFO 8.1.3 load XF Register * write byte 0x10 to GXFIFO * write 0x0000 (16 bit) to GXFIFO * write addr (16 bit) to GXFIFO * write 4 bytes of data to GXFIFO 8.1.4 load XF Register Indexed * write byte 0x10 to GXFIFO * write n-1 (16 bit) to GXFIFO * write addr (16 bit) to GXFIFO * write n bytes of data to GXFIFO 8.2 example processing loop gx_init(); while(running) gx_begin(); drawframe(); gx_end(); waitvsync(); gx_close(); 8.2.1 init GX 8.2.1.1 setup the fifos * fifo start/end must be 32 byte aligned * minimum fifo size is 64kb * typical size for the hi watermark is fifo size - 16kb 8.2.1.2 enable gx command processing while (mfwpar () & 1); PI[3] = 0x100000; PI[4] = 0x110000; PI[5] = 0x100000; mtwpar(0xC008000); // GXFIFO physical address mtspr(920, mfspr(920) - 0x40000000); 8.2.1.3 send setup frame after setting up and enabling gx command processing it is recommended to send a first initial 'frame' to setup the various internal registers to useful values. 8.2.1.3.1 Videomodes remember that depending on the videomode some things must be setup differently (such as the scissor, viewport, ...) 8.2.2 begin frame 8.2.3 draw frame 8.2.4 end frame * load draw-done to BP register (0x45000002) * copy EFB to XFB * terminate the list by writing 32 zeroes 8.2.4.1 copy EFB to XFB #define XY(x, y) (((y) < < 10) - (x)) GX_LOAD_BP_REG(0x4000001f); // set z mode GX_LOAD_BP_REG(0x410004bc); // set color mode 0 GX_LOAD_BP_REG(0x49000000 - XY(0, 0)); // set source top left GX_LOAD_BP_REG(0x4a000000 - XY(639, 479)); // set source bottom right GX_LOAD_BP_REG(0x4d000028); // stride? (0x1280> >5) ... 640*2 ; 320*YuYv GX_LOAD_BP_REG(0x4b000000 - (0xC00000 > > 5)); // xfb target address GX_LOAD_BP_REG(PE_COPY_CLEAR_AR - 0x0000); GX_LOAD_BP_REG(PE_COPY_CLEAR_GB - 0x0000); GX_LOAD_BP_REG(PE_COPY_CLEAR_Z - 0xFFFFFF); GX_LOAD_BP_REG(0x52004803); // do it (efb copy execution command?) 8.2.4.2 copy EFB to Texture simelar to copying EFB to XFB, setup BP registers 0x4a,0x4a,0x4d,0x4b and then (0x52000003 - (format< <4)) 8.2.5 close GX 9 Joy-Bus Devices 9.1 ID and Device List The device ID can be read by sending the SI Command 0x00, and then reading 3 bytes from the respective device. The response-data looks like this: first comes a 16bit device id: ID Device 0x0500 ? N64 Controller 0x0001 ? N64 Microphone 0x0002 ? N64 Keyboard 0x0200 ? N64 Mouse 0x0004 GBA 0x0800 GBA (n/a) 0x0900 GC Standard Controller 0xe960 ? GC Wavebird Receiver 0xe9a0 ? GC Wavebird 0xa800 ? GC Wavebird 0xebb0 ? GC Wavebird 0x0820 GC Keyboard 0x0800 ? GC Steering Wheel 0x0900 DKongas (same as std Controller) ? Resident Evil4 Chainsaw bit(s) description 15 wireless (1: wireless Controller) 14 wireless receive (0: not wireless 1: wireless) 13 Rumble Motor (0: available 1: not available) 12 Type of Controller (always 0 ?) 11 Type of Controller (0: N64 1: Dolphin) 10 wireless type (0:IF 1:RF) 9 wireless state (0: variable 1: fixed) 8 0: non standard Controller 1: Dolphin Standard Controller 7 6 5 wireless origin (0:invalid 1:valid) 4 wireless fix id (0:not fixed 1:fixed) 3 wireless type - 0:normal 1: non-controller (?) 2 wireless type - 0:normal 1: lite controller 1 wireless type - 0 wireless type - the device id is followed by 8 status bits: bit(s) description 7 ? 6 ? 5 ? 4 ? 3 ? rumble motor running 2 ? 1 ? 0 ? 9.2 standard Controller 9.2.1 Init * enable all controllers in 0xcc006430 * set Joy-channel 1-4 Command Register to 0x00400300 * clear SI i/o buffer * wait until bit 31 of 0xCC006434 is 0, then set it to 1 Command Word 0x00400000 - enable polling 0x00000300 - ? 0x00000100 - ? 0x00000001 - enable rumble motor Commands: 0x00 - get id+status 0x40 - ? 0x41 - get origins 0x42 - calibrate ? 9.2.2 Read Controller Status * simply read all Joy-channel registers and extract the info you want first input word bit(s) Description 31 ERRSTAT - (assumed 0) 30 ERRLATCH - (assumed 0) 29 unused (?) 28 s Start Button 27 y Y Button 26 x X Button 25 b B Button 24 a A Button 23 unused (?) 22 L L Trigger 21 R R Trigger 20 Z Trigger 19 u D-Pad Up 18 d D-Pad Down 17 r D-Pad Right 16 l D-Pad Left 8-15 x Analog Stick X (8bit unsigned, ~32...128...~224) 0-7 y Analog Stick Y (8bit unsigned, ~32...128...~224) second input word bit(s) Description 24-31 x Analog C Stick X (8bit unsigned, ~32...128...~224) 16-23 y Analog C Stick Y (8bit unsigned, ~32...128...~224) 8-15 l L Trigger Analog (8bit unsigned, ~32...~224) 0-7 r R Trigger Analog (8bit unsigned, ~32...~224) 9.2.3 rumble Motor On *(volatile unsigned long*)0xCC006400 = 0x00400001; *(volatile unsigned long*)0xCC006438 = 0x80000000; 9.2.4 rumble Motor Off *(volatile unsigned long*)0xCC006400 = 0x00400000; *(volatile unsigned long*)0xCC006438 = 0x80000000; 9.3 Keyboard 9.3.1 Types 9.3.1.1 ASCII Official Nintendo/SEGA keyboard for the GameCube. It has 80 keys plus an Fn key, some of the keys have Japanese labelings. It has an LShift and an RShift key, but only a single Ctrl and Alt key. The Fn key is internal to the keyboard. It makes the keyboard send different scancodes if it is pressed, and an Fn keypress alone cannot be detected. 9.3.1.2 Datel A British IBM PS/2 keyboard that ships with an adapter. 9.3.1.3 Tototek Adapter Converts the IBM PS/2 protocol to the GameCube SI protocol and also converts the PS/2 scancodes into GameCube scancodes. The keys that have Japanese labelings on the ASCII keyboard get mapped to keys like PrintScreen and Pause. * 0-9 and Enter send the scancodes of their counterparts on the alphanumeric part of the keyboard, regardless of the status of NumLock, so the Numpad cannot be used as cursor keys. * The key right of LShift on non-US keyboards sends no scancode. * The Pause/SysReq key only sends the keycode of 0x37 once, even if it's pressed down continuously. * Numpad-* sends 0x37, the same as Pause/SysReq, but this one continues sending it. * All combinations of Pause/SysReq with other keys are possible, except for these: LStrg or LStrg together with Pause/SysReq doesn't send anything. This would have been SysReq. * The adapter easily gets confused by two keys for which it produces the same GameCube scancodes: If you hold down LStrg and press RStrg, the LStrg scancode will disappear even though LStrg is srill pressed down. The same is true for Ctrl and Alt. 9.3.2 Scancodes .0 .1 .2 .3 .4 .5 .6 .7 0. Home End 1. A B C D E F G H 2. Q R S T U V W X 3. 7 8 9 0 -_ () =+ PrntScrn Pause/ SysReq NP 7 NP 8 NP 9 NP 0 NP - NP / NP * 4. F1 F2 F3 F4 F5 F6 F7 F8 5. Backspace Tab CapsLock LShift LCtrl (*56) LAlt (*57) (*54) 6. Enter NP Enter .8 .9 .A .B .C .D .E .F 0. PgUp PgDn ScrollLock 1. I J K L M N O P 2. Y Z 1 2 3 4 5 6 NP 1 NP 2 NP 3 NP 4 NP 5 NP 6 3. [{ ;: " ]} ,< .> /? - NP + (*39) NP . 4. F9 F10 F11 F!2 ESC Ins Del `~ 5. LWin space RWin Menu Left Down Up Right 6. NumLock (*6a) (*39) Tototek adapter: makes only sence for japenese ASCII labeling (*54) Tototek adapter sends this code for LShift and RShift (*56) Tototek adapter sends this code for LCtrl and RCtrl (*57) Tototek adapter sends this code for LAlt and RAlt (*6a) Tototek adapter: undefined for GameCube 9.3.3 Init * enable controller in 0xcc006430 * set Joy-channel Command Register to 0x00540000 * clear SI i/o buffer * wait until bit 31 of 0xCC006434 is 0, then set it to 1 Command Word 0x00540000 - enable polling 9.3.4 Read Keyboard first input word bit(s) Description 31 ERRSTAT - (assumed 0) 30 ERRLATCH - (assumed 0) 24-29 ? 16-23 ? 8-15 ? 0-7 ? second input word bit(s) Description 24-31 key1 16-23 key2 8-15 key3 0-7 ? 9.4 GBA to do 9.5 Wavebird to do 9.6 steering wheel to do 9.7 DKongas These work exactly like the standard controllers from the programmers point of view, and they even have the same ID. 9.7.1 Read Controller Status * simply read all Joy-channel registers and extract the info you want first input word bit(s) Description 31 ERRSTAT - (assumed 0) 30 ERRLATCH - (assumed 0) 29 unused (?) 28 s Start Button 27 y left Konga, top/left (Y Button) 26 x right Konga, top/left (X Button) 25 b left Konga, bottom/right (B Button) 24 a right Konga, bottom/right (A Button) 23 unused (?) 22 L unused (L Trigger) 21 R unused ? (R Trigger) 20 unused (Z Trigger) 19 u unused (D-Pad Up) 18 d unused (D-Pad Down) 17 r unused (D-Pad Right) 16 l unused (D-Pad Left) 8-15 x unused (Analog Stick X) 0-7 y unused (Analog Stick Y) second input word bit(s) Description 24-31 x unused (Analog C Stick X) 16-23 y unused (Analog C Stick Y) 8-15 l unused (L Trigger Analog) 0-7 r Microphone (R Trigger Analog) (8bit unsigned, ~16...?) 9.8 Resident Evil4 Chainsaw to do 10 EXI Devices 10.1 EXI Channel and Device List The following table shows the GameCube devices which use the EXI bus and their channel and device numbers, the EXI frequency commonly used with them and their virtual offset in EXI mapping. channel device freq offset Description 0 0 4 Memory Card (Slot A) 0 1 3 0x00000000 Mask ROM 0 1 3 0x20000000 Real-Time Clock (RTC) 0 1 3 0x20000100 SRAM 0 1 0x20010000 UART 1 0 4 Memory Card (Slot B) 2 0 AD16 (trace step) 0 2 Serial Port 1 0 2 5 Ethernet Adapter (SP1) Note: The Real-Time Clock (RTC), SRAM, and Mask ROM are actually one device mapped to different address offsets. The SRAM should only be accessed by the IPL and contains non-volatile system data. The Mask ROM contains the IPL itself (encrypted) and the system font data. 10.2 Retrieving the ID of an EXI Device To retrieve the ID of an EXI Device, an EXI IMM write operation must be used to send the ID command (0x0000) and an EXI IMM read operation should follow it to read the actual 4 byte ID. ID Device 0x00000004 Memory Card 59 0x00000008 Memory Card 123 0x00000010 Memory Card 251 0x00000020 Memory Card 507 0x00000040 Memory Card 1019 0x00000080 Memory Card 2043 0x01010000 USB Adapter 0x01020000 NPDP GDEV 0x05070000 IS Viewer 0x04120000 AD16 0x03010000 Marlin (?) 0x02020000 Modem 0x04020200 Ethernet Adapter 10.3 Mask ROM Mask ROM also referred as bootrom or IPL. Total size of bootrom is 2 MB. 10.3.1 Memory Map (Europe/PAL) Start End Size Description 0x00000000 0x000000ff 0x00000100 Copyright message (*1) 0x00000100 0x001aeee8 0x001aede8 BIOS data (*2) 0x001AFF00 0x001FA0E0 0x0004D000 'Yay0' - ROM Fonts #1 (SJIS) 0x61 bytes of 0xFF, 0x62 , followed by zeros until 0x1FCF00 0x001FCF00 0x001FF474 0x00003000 'Yay0' - ROM Fonts #2 (ANSI) 0x001FF474 0x001FFEF0 filled with 0x00 0x001FFF00 0x001FFFFF filled with 0xff (*1) "(C) 1999-2001 Nintendo. All rights reserved.(C) 1999 ArtX Inc. All rights reserved.PAL Revision 1.0 " and zeros up to 0x100. (*2) encrypted by an XOR cyphertext which is generated by a yet unknown algorithm (probably not a single LFSR) 10.3.2 Memory Map (USA/NTSC) Start End Size Description 0x00000000 0x0015ee40 0x0015ee40 BIOS data (*1) 0x001AFF00 0x0004D000 ROM Fonts #1 (SJIS) 0x001FCF00 0x00003000 ROM Fonts #2 (ANSI) 0x001FFF00 0x001FFFFF filled with 0x00 (*1) encrypted by an XOR cyphertext which is generated by a yet unknown algorithm (probably not a single LFSR) note: all unused space is filled with 0x00, no pieces with 0xFF. 10.3.3 Memory Map (Japenese/NTSC) 10.3.4 Memory Map (Japenese/NTSC - Panasonic Q) 10.3.5 Font Encoding The 'Yay0' data is compressed similar to the the Zelda 64 'Yaz0' compression. Besides the Raw Font data it also contains some information about the Font. 10.3.6 Font Layout 10.3.6.1 SJIS Font (ROM Font #1) 10.3.6.2 ANSI Font (ROM Font #2) The ANSI Font is a 512x512 Pixel Texture in I4 Format. It consists of 21 colums and 11 rows of characters which are in a 24x24 pixel grid. ! ' # $ % & ´ ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F G H I J K L M N O P Q R S T U V W X Y Z [ ] ^ _ ' a b c d e f g h i j k l m n o p q r s t u v w x y z 10.3.7 Operation 10.3.7.1 read * IMM write 32 bit: (offset< <6) * DMA read X bytes max offset is 2*1024*1024, max block len is ? 10.4 RTC (Real-Time Clock) Real-Time Clock (RTC) is 32-bit value, counting time intervals in seconds. To get the real time (seconds since January 1st, 2000 12am) add the counter bias saved in SRAM. 10.4.1 Operation 10.4.1.1 read * IMM write 32 : 0x20000000 - (0< <6) (RTC offset) * IMM read 32-bit RTC value Since it is uncertain if the hardware prevents fragmented reads of the time interval (eg byte 1 from tick n and byte 2-4 from tick n+1) it is recommended to repeatedly retrieve the value until there is no difference between two consecutive reads. 10.4.1.2 write * IMM write 32 : 0xA0000000 (== 0x20000000 - 0x80000000 (write flag) - (0< <6) (RTC offset)) * IMM write 32-bit RTC value 10.5 SRAM SRAM is battery backed memory, used for saving some non volatile settings. Size of SRAM is 64 bytes. 10.5.1 Memory Map offset end size Description 0x00 2 Checksum 1 0x02 2 Checksum 2 0x04 4 ead 0 0x08 4 ead 1 0x0c 4 counter Bias (add to RTC value to get actual time) 0x10 1 display offset H (signed value, -32...32) 0x11 1 ntd 0x12 1 language value Description 0 english 1 german 2 french 3 spanish 4 italian 5 dutch 0x13 1 flags bit(s) Description 7 ? (=0) 6 ? (=0) 5 ? (=1) 4 ? (=0) 3 ? (=1) 2 0: mono 1: stereo 1 ? (=0) 0 ? (=0) 0x14 2*12 Flash ID 0x2c 4 wireless Keyboard ID 0x30 4*2 wireless PAD ID 0x38 1 last DVD Errorcode 0x39 1 padding/unused/reserved 0x3a 2*2 Flash ID checksum 0x3e 2 padding/unused/reserved 10.5.2 Operation 10.5.2.1 read * IMM write 32 : 0x20000100 (== 0x20000000 - (8 < < 6) (SRAM offset)) * DMA read 64 bytes. 10.5.2.2 write * IMM write 32 : 0xa0000100 (== 0x20000000 - 0x80000000 (write flag) - (8 < < 6) (SRAM offset)) * use sequential IMM writes 10.5.3 Checksums the SRAM data is protected against corruption by a simple additive checksum which is calculated like this: void checksums (unsigned short *buf, unsigned short *c1, unsigned short *c2) int i; *c1 = 0; *c2 = 0; for (i = 0;i<4;++i) *c1 += buf[0x06 + i]; *c2 += (buf[0x06 + i] ^ 0xFFFF); 10.6 AD16 AD16 is on channel 2, as device 0. Probably its used for debugging purposes. AD16 is the 32-bit register, keeping bootrom "trace-step". 10.6.1 Operation 10.6.1.1 init * IMM write : 0x0000 * IMM read 32 bit ID and check it for error (it should be 0x04120000) 10.6.1.2 write * IMM write : 0xa0 * IMM write 32-bit value (trace-step) 10.6.1.3 read * IMM write : 0xa2 * IMM read 32-bit AD16 register value 10.6.2 Trace-Step Values 10.6.2.1 BS 0x01000000 AD16 Inited, cache lines 320, 340,360, 380, 3a0 prefetched 0x02000000 cache line 0x3e0 prefetched 0x03000000 rest of cachelines prefetched 0x04000000 ramtest passed 0x05000000 ramtest error 0x06000000 ramtest error 10.6.2.2 BS2 0x00000800 System Init 0x00000900 DVD Init 0x00000a00 Card Init 0x00000b00 video init 0x00000c00 final before menu 10.7 Memory Cards Product Blocks Mega bits Mega bytes Vendor Chip Memory Card 59 64 4 0.5 Nintendo Macronix MX25L4001 Serial Flash ROM Action Replay Macronix MX25L4004 memory card 64 4 0.5 Datel 4M-Bit(4Mx1) Serial Flash ROM WINBOND 512K*8 CMOS Memory Card '4 64 4 0.5 3rd Party flash memory Mega' (Winbond,W29C040P- 90,215275901,216GJRA) Memory Card 123 128 8 1 Nintendo (*) Memory Card '8 128 8 1 3rd Party Mega' Memory Card 251 256 16 2 Nintendo Memory Card 507 512 32 4 Nintendo (*) Memory Card 1019 1024 64 8 Nintendo Memory Card '64 1024 64 8 3rd Party Mega' USB Memory Adaptor 64M / 1024 64 8 EMS 1019 blocks Memory Card 2043 2048 128 16 Nintendo (*) (*) never seen those, appearently supported but never manufactured. as you can see the products are named in reference to their useable capacity in blocks or total size in mega bits. The theoretical maximum size for a memory card is 128 mega bits (16 mega bytes, 2048 blocks). 10.7.1 Commands Command len indata len outdata len Description 0x8500 2 - - ID 2 get ID 0x8300 2 - - Status 1 get Card Status 0x89 1 - - - - clear Card Status 0x52 1 offset, 0x00000000 8 Block Data <=0x200 read Block 0xf40000 3 - - - - erase Card 0xf1 1 Sector 2 - - erase Sector 0xf2 1 Block offset 4 Block Data <=0x80 write Block 10.7.2 Operation 10.7.2.1 unlocking original memory cards (those manufactured by nintendo) need to be 'unlocked' before they can be accessed. this is appearently done by a small dsp program. to do 10.7.2.2 get ID * IMM write 0x85,00 * IMM read 2 bytes ID 10.7.2.2.1 Card IDs 10.7.2.3 get Status * IMM write 0x83,00 * IMM read 1 byte Status 10.7.2.3.1 Status Bits 7 0 x... ...r bit(s) description 7 x 1: erase in Progress (?) 0 r 1: Card ready (?) 10.7.2.4 clear Status * IMM write 0x89 10.7.2.5 read Block * select * IMM write: 0x52 * IMM write: (offset > > 17), (offset > > 9), (offset > > 7) & 3, offset & 0x7F * IMM write: 0x00, 0x00, 0x00, 0x00 * read 8 bit values * deselect max offset is 16*1024*1024, max block len is 512 bytes. 10.7.2.6 erase Card * select * IMM write 0xf4,0x00,0x00 * deselect 10.7.2.7 erase Sector * select * IMM write 0xf1 * IMM write (sector > > 17) & 0x7F, (sector > > 9) & 0xFF * deselect * wait until bit 7 of card status is cleared 10.7.2.8 write Block * wait while bit 0 of card status is cleared (= card ready) * select * IMM write 0xf2 * IMM write (offset > > 17) & 0x3F, (offset > > 9) & 0xFF, (offset > > 7) & 3, offset & 0x7F * write 0x80 bytes * deselect 10.8 Ethernet Adapter The Macronix chip found in the ethernet adapter (mx98730ec) seems to be a reenginered version of the mx98726 or mx98728 (or the ec type respectivly). 10.8.1 registers Registerblock Base Size of Registerblock common access size 0x00 0x1000 1 These are the actual Chip Registers which match with the descriptions in MXs documents. 0x00 1 r/w NCRA - Network Control Register A (0x08 ?) 7 0 ???? ?ep? bit(s) description 7 INTCLK - must be 0 for normal operation. 6 INTMODE - Interrupt Mode: Set for the active high interrupt, reset for the active low interrupt case. 5 LB1 - Loopback mode 4 LB0 LB1 LB0 description 0 0 Mode0 - Normal mode 0 1 Mode1 - internal FIFO Loopback 1 0 Mode2 - internal NWAY Loopback 1 1 Mode3 - internal PMD Loopback 3 SR - Start Receive : Enable the MAC to receive packets. Default is disabled. 2 e ST1 - Start Transmit Command/Status 1 p ST0 0 RESET - Software reset. bit 1 and bit 2 will get cleared after a packet has been sent 0x01 1 r/w NCRB - Network Control Register (0x11, 0x12 ?) 7 0 bit(s) description 6-7 RXINTC - Recieve Interrupt Counter 5 HBD - Heart Beat Check Disable 4 AB - "pass all broadcast frames" 3 PB - "pass bad frames" 2 PM - "pass all multicast" 1 CA - capture effect mode 0 PR - promiscuous mode 0x02 1 r/w GMAC Test Register A : TRA bit(s) Description 7 SB - Start/Stop Back-off counter 6 FC - Forced Collision 5 RWD - Receive Watchdog Disable 4 RWR - Recieve Watchdog Release 1-3 TMODE - Test Moder Select bits 0 TEST - Test mode enable 0x03 1 r/w GMAC Test Register B : TRB bit(s) Description 7 BFSTATUS 6 BFS1 5 BKCNTLB 4 BFS0 3 COLCNTCB 2 RDNCNTSB 1 RDNCNTCB 0 FKD - Flaky Oscillator Disable 0x04 1 r/w LTPS - Last Transmitted Packet Status (transmit error code ?) bit(s) Description 7 TERR - Transmit Error 6 OWC - Out of Window Collision 5 UF - TX FIFO Underflow 4 CRSLOST - Carrier Sense Lost 3 CC3 - Collision Count Bit 3 2 CC2 1 CC1 0 CC0 0x05 1 r/w LRPS - Last Recieved Packet Status bit(s) Description 7 RERR - Recieve Error 6 RF - Runt Frame 5 MF - Multicast Frame address 4 RW - Recieve Watchdog 3 FO - FIFO Overrun 2 FAE - Frame Alignment Error 1 CRC - CRC error 0 BF - RX Packet Buffer Full Error 0x06 1 r/w MPCL - Missed Packet Counter bit(s) Description 0-7 MISSCNT - Miss Packet Counter LSB 0x07 1 r/w MPCL - Missed Packet Counter bit(s) Description 0-7 MISSCNT - Miss Packet Counter MSB 0x08 1 r/w IMR - Interrupt Mask Register (IRQ Mask) bit(s) Description 7 RBFIM - RX Buffer Full Interrupt Mask 6 BUSEIM - Bus Error Interrupt Mask 5 FIFOEIM - FIFO Error Interrupt Mask 4 TEIM - Transmit Error Interrupt Mask 3 REIM - Receive Error Interrupt Mask 2 TIM - Transmit Interrupt Mask 1 RIM - Recieved Interrupt Mask 0 FRAGIM - Fragment Counter Interrupt Mask 0x09 1 r/w IR - Interrupt Register (irq status) 7 0 ???t esr? bit(s) description 7 RBFI - RX Buffer Full Interrupt 6 BUSEI - Bus Error Interrupt 5 FIFOEI - FIFO Error Interrupt 4 t TEI - Transmit Error Interrupt (1: transmit error) 3 e REI - Recieve Error Interrupt (1: receive error ?) 2 s TI - Transmit OK Interrupt (1: packet sent ?) 1 r RI - Receive OK Interrupt (1: packet received ?) 0 FRAGI - Fragment Counter Interrupt 0x0a 2 r/w BP - Boundary Page Pointer Register (0x0100 ?) 0x0c 2 r/w TLBP - TX Low Boundary Page Pointer Register 0x0e 2 r/w TWP - Transmit Buffer Write Page Pointer Register 0x10 2 ?/? unused/reserved 0x12 2 r/w TRP - Transmit Buffer Read Page Pointer Register 0x14 2 r/w RXINTT - Receive Interrupt Timer 0x16 2 r/w RWP - Receive Buffer Write Page Pointer Register 0x18 2 r/w RRP - Receive Buffer Read Page Pointer Register 0x1a 2 r/w RHBP - RX High Boundary Page Pointer Register (0x0f00 ?) 0x1c 1 r/w EEPROM Interface Register: bit(s) Description 6-7 unused/reserved 5 EELD - 4 EESEL - 3 EEDO - Serial Data Output from external EEPROM clock device 2 EEDI - Serial Data Input to external EEPROM clock device 1 EECK - Serial Clock output to external EEPROM clock device (< 1 MHz) 0 EECS - Chip Select output to external EEPROM clock device 0x1d 1 r/w BICT - Bus Integrity Check Timer 0x1e 2 r/? IORDP - IO Data Port Page Pointer Register 0x20 6 r/w PAR0-PAR5 Network Address Filtering Registers - Physical (MAC) Address 0x26 8 r/w MAR0-PAR7 Network Address Filtering Registers - Hash Table Register 0x2e 1 r/w ANALOG - Transceiver Control Register bit(s) Description 6-7 unused/reserved (must be 0) 5 RST100 - Reset for NORMAL mode 4 RSQ - Reduced SQuelch Enable 3 PWD100 - Reset for NORMAL mode 2 PWD10B - Set for NORMAL mode 1 DS130 - Must be 1 for NORMAL mode with auto-compensation 0 DS120 - Must be 1 for NORMAL mode with auto-compensation 0x2f 1 r/w DINTVAL - DMA Interval Timer 0x30 1 r/w NWAYC - NWAY Configuration Register bit(s) Description 7 LTE - Link Test Enable 6 NTTEST - reserved 3-5 ANS - Autonegotiation Status 2 ANE - Autonegotiation Enable 1 PS100/10 - Port Select 100/10 Mbit 0 FD - Full Duplex Mode 0x31 1 r/- NWAYS - NWAY Status Register bit(s) description 7 10TXH - NWAY 10 TX Half duplex Mode 6 10TXF - NWAY 10 TX Full duplex Mode 5 100TXH - NWAY 100 Half duplex Mode 4 100TXF - NWAY 100 TX Full duplex Mode 3 ANCLPT - Auto-negotiation Completion 2 LPNWAY - Link Partner NWAY Status 1 LS100 - Physical Link Status of 100Mbps TP 0 LS10 - Physical Link Status of 10 Mbps TP 0x32 1 r/w GCA - GMAC Configuration A Register (0x08 ?) bit(s) description 7 unused/reserved (must be 0) 6 TXFIFOCNTEN 5 AUTOPUB - Auto Page Update option 4 unused/reserved 3 ARXERRB - Accept RX packet with error 2 SLOWSRAM 1 PBW - Packet Buffer Data Width 0 BPSCRM - Bypass Scrambler 0x33 1 r/w GCB - GMAC Configuration B Register bit(s) description 4-7 unused/reserved 2-3 RTHD - Recieve FIFO Threshold 0-1 TTHD - Transmit FIFO Threshold 0x34 4 -/w TWD - IO Mapped Data Port 0x38 2 -/- unused/reserved 0x3a 1 r/w Host Interface Protocol Register (0x08 ?) 7 0 bit(s) description 2 DREQB - DREQB-pin status bit 1 STIORD/RRDYB - (no data available ?) 0 WRDYB - Write Packet Memory Ready Bar Status Indication 0x3b 1 r/- LPC - Link Partner Link Code Register 0x3c 1 r/w TX/RX DMA Status Register 0x3d 1 r/w MISC1 - MISC Control Register 1 0x3e 2 r/w TXFIFOCNT - TX FIFO Byte Counter 0x40 4 r/- RRD - RX Burst Read Data Port 0x44 2 r/- ID1 - 'MX' 0x46 2 r/- ID2 - '0001' 0x48 4 w WRTXFIFOD - Write TX FIFO Data Port Register (output queue) 0x4c 4 r/- IORD - IO Read Data Port Register 0x50 1 r/w MISC2 - MISC Control Register 2 (0x80 ?) 0x51 1 ? (?) note: register 0x51 is not documented in mx98728 datasheet 0x52 2 r/- HRPKTCNT - Host Recieve Packet Counter 0x54 3 r/w FRAGCNT - Host DMA Fragment Counter note: 0x56 is the last reg of a mx98726 and mx98728 0x5b ? ?/? (?) 0x5c ? ?/? (?) 0x36 = disconnect network 0x5e ? ?/? (0x01 ?) 0x60 ? ?/? (0x00 ?) 0x100 0xf00 ?/w input queue (?) - select for reading - IMM read block 10.8.2 command-registers Registerblock Base Size of Registerblock common access size 0x00 0x10 1 These Registers are related to the EXI Interface on the Ethernet-Adapter, not to the actual Ethernet Chip. 0x00 ? ?/? EXI id - select register for reading - IMM read 4 bytes (0x04,0x02,0x02,0x00) 0x01 ? ?/? ? 0x02 ? ?/? irq mask 0x03 ? ?/? irq status 7 0 r??p h??? bit(s) description 7 r irq from MX chip 6 ? 'killing' irq (should not get this one) 5 ? command error 4 p challange/response request 3 h challange/response status 0x04 ? ?/? ? (revid_eth) - select register for writing - IMM write 0xd1,0x07 (16bit) 0x05 ? ?/? ? (0x4e ?) 0x06 ? ?/? ? 0x07 ? ?/? ? 0x08 ? ?/? Challenge - select for reading - IMM read 4 bytes 0x09 ? ?/? Response - select for writing - IMM write 4 bytes 0x0a ? ?/? ? 0x0b ? ?/? Status 1: challenge/response ok 2: challenge/response failed 0x0c ? ?/? ? 0x0d ? ?/? ? 0x0e ? ?/? ? 0x0f ? ?/? ? (0x00 ?) 10.8.3 Operation 10.8.3.1 selecting a register for reading * IMM write 0x80000000 - (register< <8) 10.8.3.2 selecting a register for writing * IMM write 0xc0000000 - (register< <8) 10.8.3.3 selecting command-register for reading * IMM write (register< <8) (16 bits) 10.8.3.4 selecting command-register for writing * IMM write 0x4000 - (register< <8) (16 bits) 10.8.3.5 init * write reg - 1 byte to 0x60, 0x00 * read reg - 1 byte from 0x0f (?) * delay * write reg - 1 byte to 0x00, 0x01 * write reg - 1 byte to 0x00, 0x00 (not necessary ?) * read reg - 1 byte from 0x01, 0x00 * read reg - 1 byte from 0x5b * write reg - 1 byte to 0x5b, write back previously read value AND ~(1< <7) * write reg - 1 byte to 0x5e, 0x01 (or same as 0x5b ?!) * read reg - 1 byte from 0x5c * write reg - 1 byte to 0x5c, write back previously read value OR 4 * write reg - 1 byte to 0x01, 0x11 * write reg - 1 byte to 0x50, 0x80 (?) * write reg - 1 byte to 0x08, 0xff * write reg - 1 byte to 0x09, 0xff * write reg - 1 byte to 0x02, 0x00 (?) * write reg - 1 byte to 0x00, 0x08 * delay * write reg - 2 bytes to 0x16, 0x0100 (recv buffer write ptr) * write reg - 2 bytes to 0x18, 0x0100 (recv buffer read ptr) 10.8.3.6 challenge/response calculation u32 ETHChallResp(u32 val,u32 revid_0,u32 revid_eth_0,u32 revid_eth_1) u32 c0,c1,c2,c3; c0=( ( ((val&0xff000000)> >24) + ((val&0x00ff0000)> >16) * 0xc1 + 0x18 + revid_0 ) ^ ( ((val&0x000000ff) * ((val&0x0000ff00)> >8)) + 0x90 ) ) & 0xff; c1=( ( ((val&0x00ff0000)> >16) + ((val&0x0000ff00)> >8) + 0x90 ) ^ ( c0 + ((val&0xff000000)> >24) - 0xc1 ) ) & 0xff; c2=( ( ((val&0x0000ff00)> >8) + 0xc8 ) ^ ( c0 + ((revid_eth_0 + revid_0 * 0x23) ^ 0x19) ) ) & 0xff; c3=( ( ((val&0xff000000)> >24) + 0xc1 ) ^ ( (val&0x000000ff) + ((revid_eth_1 + 0xc8) ^ 0x90) ) ) & 0xff; return ((c0 < < 24) - (c1 < < 16) - (c2 < < 8) - (c3)); 10.8.3.7 send packet (outside interrupt) * write reg - X bytes to 0x48, (X must be >=0x3c!) * read reg - 1 byte from 0x00, status ? * write reg - 1 byte to 0x00, 0x00 * write reg - 1 byte to 0x00, previously read status OR 0x04 (set bit3, ACK error?) * read reg - 1 byte from 0x00,status ;do while (status AND 0x06)!=0 (wait until packet sent) 10.8.3.8 poll received packets (outside interrupt) * read reg - 2 bytes from 0x16, write_ptr * read reg - 2 bytes from 0x18, read_ptr * if write_ptr==read_ptr, no more packets are available * write reg - 1 byte to 0x3a, 0x02 * read reg - 1 byte from 0x3a, if (value&2)!=0, no more data is available * read reg- 4 bytes from read_ptr, packet descriptor * read reg - X bytes from 0x100+read_ptr, (X must be >=0x3c! ; wrap around to 0x100 if read_ptr=0xf00) * write reg - 2 bytes to 0x18, first byte of packet descriptor, 0x00 (advance read pointer) * write reg - 1 byte to 0x09, 0x02 * write cmd - 1 byte to 0x02, 0xf8 (ACK?) 10.8.3.9 received packet format first 4 bytes of a received packet contains a descriptor about the packet that has been received 31 24 23 16 15 8 7 0 .... .... yyyy .... xxxx xxxx .... .... bit(s) Description 20-23 y length of received packet lo bits (shift 4 down) 8-15 x length of received packet hi bits (shift 4 up and OR with lo bits) length is inclusive the 4 byte descriptor! 10.9 UART (note: the existance of an UART is highly speculative and was never proved for a fact) to do 10.10 SD Cards SD cards support an SPI mode, which is essentially the same hardware protocol that official memory cards use. Notice the use of the word hardware, not software. SD cards uses the MMC command set for communication and data transfer, while Nintendo memory cards use a custom Macronix command set. This means that you should not waste your time trying to get standard GC programs to recognize the SD card as a normal memory card, because it will not work without specific code to access the SD card. Even if you make the raw sector data on the SD card the same as the Nintendo memory card, the low-level commands to access the sectors differ between the two. However, since the hardware bus and protocol are the same, an SD adapter can essentially be made with straight- through connections from the EXI bus to the SD card signals. to do 10.11 Viper 'Modchip' this is a 3rd-Party 'modchip' used to override the IPL with a custom program. todo 10.12 Ripper III GC 'Modchip' todo 10.13 Qoob 'Modchip' todo 10.14 NinjaMOD 'Modchip' todo 11 HSP Devices HSP devices seem to be accessable through the ARAM interface with offsets beyond 16MB. 11.1 GB Player to do 12 Memory Card Structure 12.1 Overview one "block" on memcard equals 0x2000 bytes, the first 5 blocks are used for the filesystem (0xa000 bytes). Offset Size Description 0x0000 0x2000 Header 0x2000 0x2000 Directory 0x4000 0x2000 Directory backup (*) 0x6000 0x2000 Block Allocation Map 0x8000 0x2000 Block Allocation Map backup (*) 0xa000 file(s) data (*) If a change is to be made that will alter the Master File Table, such as moving or deleting a file, copying a file from another memory card, or creating a new save game file, the GameCube will first backup the Master File Table to this location. Presumably, if the operation fails for certain reasons, the GameCube will restore the Backup File Table to the Master File Table. 12.2 Header Offset Size Description 0x0000 ? 0x000c 8 time of format (OSTime value) 0x0014 unique card id (?) 0x0020 2 padding zeroes 0x0022 2 size of memcard in Mbits 0x0024 2 encoding (ASCII or japanese) 0x0026 unused (0xff) 0x01fa 2 update Counter (?, probably unused) 0x01fc 2 Checksum 1 (?) 0x01fe 2 Checksum 2 (?) 0x0200 0x1e00 unused (0xff) 12.3 Directory Offset Size Description 0x0000 Directory Entries (max 127) 0x0ffa 2 update Counter 0x0ffc 2 Checksum 1 0x0ffe 2 Checksum 2 12.3.1 Directory Entries offset length description 0x00 0x04 Gamecode 0x04 0x02 Makercode 0x06 0x01 reserved/unused (always 0xff, has no effect) 0x07 0x01 banner gfx format and icon animation (Image Key) bit(s) description 2 Icon Animation 0: forward 1: ping-pong 1 0: No Banner 1: Banner present 0 Banner Color 0: RGB5A3 1: CI8 0x08 0x20 filename 0x28 0x04 Time of file's last modification in seconds since 12am, January 1st, 2000 0x2c 0x04 image data offset 0x30 0x02 icon gfx format (2bits per icon) bits Description 00 no icon 01 CI8 with a shared color palette after the last frame 10 RGB5A3 11 CI8 with a unique color palette after itself 0x32 0x02 animation speed (2bits per icon) (*1) bits Description 00 no icon 01 Icon lasts for 4 frames 10 Icon lasts for 8 frames 11 Icon lasts for 12 frames 0x34 0x01 file-permissions bit permission Description 4 no move File cannot be moved by the IPL 3 no copy File cannot be copied by the IPL 2 public Can be read by any game 0x35 0x01 copy counter (*2) 0x36 0x02 block no of first block of file (0 == offset 0) 0x38 0x02 file-length (number of blocks in file) 0x3a 0x02 reserved/unused (always 0xffff, has no effect) 0x3c 0x04 Address of the two comments within the file data (*3) (*1) Clearly, the animation rate is unimportant when there is only one frame of icon data; nevertheless, a value for that one frame must still be set, or that one frame will not be shown. It is illegal to specify that a frame does not exist if it does; a value of 00 indicates that no frame exists, and should not be mistaken for meaning that this frame should not be shown. If you specify blank frames to slow the frame rate, these also cannot be 00. (*2) This byte contains an 8-bit integer that indicates how many times the file has been copied from one memory card to another. (*3) Each file has two 32 character strings which the IPL displays at the bottom of the memory card screen, next to the banner. The two strings (64 bytes) must fit within one block (8192 bytes), they are not allowed to cross sector boundaries. 12.3.1.1 Image Data Image data consists of a banner image and an icon. The banner image is not required, dependant on the value of the Image Key. If the banner image is not present, the icon image is displayed where the banner image would be displayed (centered horizontally). The icon image is required, and immediately follows the banner if present. Otherwise, it is located at the start of the image data. 12.3.1.1.1 Banner Image The banner size is 96*32 pixels, making 3072 pixels in total (= 0x0c00 bytes in 8bit, 0x1800 bytes in 16bit mode). If the Banner is in CI8 mode, the palette follows immediately after the banners pixel data. 12.3.1.1.2 Icon Image Immediately following the banner (if present) is the Icon Image. This can have a variable number of frames (up to eight), each 32*32 pixels, making 1024 pixels per frame in total. (= 0x0400 bytes in 8bit, 0x0800 byte in 16bit mode). If the Icon is in CI8 mode, its palette either follows immediately after its pixel data or after the pixel data of all 8 icons, depending on the icon gfx format field. 12.3.1.1.3 Palettes Palettes in the image data are in RGB5A3 pixel format, and are 0x100 entries large. (= 0x200 bytes) 12.4 Block Allocation Map Offset Size Description 0x0000 2 Checksum 1 0x0002 2 Checksum 2 0x0004 2 update Counter 0x0006 2 free Blocks 0x0008 2 last allocated Block 0x000a 0x1ff8 Map of allocated Blocks This is an array of 0x0ffc 16 bit values, each holding info about one allocated block on the memory card. (thus the maximum memcard size is limited to 2048 blocks (16 Megabytes, 128Mbit)) each 16 bit value at position X in the array has the following meaning: value Description 0x0000 block is not allocated (ie, free) 0xffff last allocated block of a file any other allocated block, usually equals (x+1) (==next block of file) scan through a file like this: thisblock=firstblock; do // process block // next block thisblock=((unsigned short*)0x6000)[thisblock]; while (thisblock!=0xffff); note: although this scheme could do it, i have never stumbled about a file yet that is NOT linear on the memcard anyway. from this point of view using this allocation map seems to be a bit stupid...more testing needed :) 12.5 Checksums The Checksums for the Directory and Block Allocation Map are simple 16bit additive checksums (ie nothing fancy or particular safe) which can be easily calculated like this: void checksums(unsigned short *buf, int num, unsigned short *c1, unsigned short *c2) int i; *c1 = 0;*c2 = 0; for (i = 0; i < num; ++i) *c1 += buf[i]; *c2 += (buf[i] ^ 0xffff); if (*c1 == 0xffff) *c1 = 0; if (*c2 == 0xffff) *c2 = 0; 13 DVD Structure total capacity of disc data is 1,459,978,240 bytes (1.5 GB approx.). that's exactly 712880 DVD raw sectors (each 2048 bytes). start end size Description 0x00000000 0x0440 Disk header ("boot.bin") 0x00000440 0x2000 Disk header Information ("bi2.bin") 0x00002440 (0x2000 ?) Apploader ("appldr.bin") FST ('fst.bin') 13.1 Disk header start end size Description 0x0000 0x0003 0x0004 Game Code 1 Console ID 2 Gamecode 1 Country Code 0x0004 0x0005 0x0002 Maker Code 0x0006 0x0001 Disk ID 0x0007 0x0001 Version 0x0008 0x0001 Audio Streaming 0x0009 0x0001 Stream Buffer Size 0x000a 0x001b 0x0012 unused (zeros) 0x001c 0x001f 0x0004 DVD Magic Word (0xc2339f3d) 0x0020 0x03ff 0x03e0 Game Name 0x0400 0x0403 0x0004 offset of debug monitor (dh.bin) ? 0x0404 0x0407 0x0004 addr (?) to load debug monitor ? 0x0408 0x041f 0x0018 unused (zeros) 0x0420 0x0423 0x0004 offset of main executable DOL (bootfile) 0x0424 0x0427 0x0004 offset of the FST ("fst.bin") 0x0428 0x042B 0x0004 size of FST 0x042C 0x042F 0x0004 maximum size of FST (usually its same as FST size) (*) 0x0430 0x0433 0x0004 user position (?) 0x0434 0x0437 0x0004 user length (?) 0x0438 0x043b 0x0004 (?) 0x043c 0x043f 0x0004 unused (zeros) (*) multiple DVDs must use it, to properly reside all FSTs. 13.2 Disk header Information this is loaded to the Address in 0x800000f4 when a disc is initialized by the IPL offset end size Description 0x0000 4 Debug-monitor Size 0x0004 4 Simulated Memory Size 0x0008 4 Argument offset 0x000c 4 Debug flag 0x0010 4 Track Location 0x0014 4 Track size 0x0018 4 Countrycode 0x001c 4 ? 13.3 Apploader offset end size Description 0x0000 0x0009 Date (version) of the apploader in ASCII 0x000A 0x000F padding (0) 0x0010 0x0013 4 Apploader entrypoint 0x0014 0x0017 4 size of the apploader (32 bit) (usually 0x2000) 0x0018 0x001b 4 trailer size 0x0020 Apploader code (loaded to 0x81200000 in RAM) 13.4 Format of the FST start end size Description 0x00 0x0c 0x0c Root Directory Entry 0x0c ... 0x0c more File- or Directory Entries ... ... ... String table 13.4.1 Format of a File Entry start end size Description 0x00 1 flags; 0: file 1: directory 0x01 3 filename, offset into string table 0x04 4 file_offset or parent_offset (dir) 0x08 4 file_length or num_entries (root) or next_offset (dir) 14 general File Formats 14.1 BNR (Banner file format) this is the format of the file 'opening.bnr' (file size: always 6.496 bytes) found in the root directory of every Gamecube disc. This file is the little image that is displayed in the cube menu when inserting a disc into the gamecube, when in menu mode. start end size Description 0x0000 0x0003 0x0004 Magic Word "BNR1" (US/JP) or 'BNR2' (EU) 0x0004 0x001f padding zeroes 0x0020 0x181f 0x1800 Graphical Data (Pixel-format is RGB5A1) 0x1820 0x183f 0x0020 Gamename (*) 0x1840 0x185f 0x0020 Company/Developer (*) 0x1860 0x189f 0x0040 Full Game Title (*) 0x18a0 0x18df 0x0040 Company/Developer Full name, or description (*) 0x18e0 0x195f 0x0080 Game Description (*) (*) All Text is all stored in either SHIFT-JIS or ASCII, depending on the region of the Game. note: In the filesystem of european Games with multi-lingual text there may be several .bnr files (opening.bnr, openingUS.bnr, openingEU.bnr, openingJP.bnr). The opening.bnr is a BNR2 file, it is just like a regular BNR file, except that the metadata at the end repeats several times in different languages. 0x1820 through 0x1960 are the first, and it continues in blocks of 0x0140. 14.2 DOL (Gamecube Executable) This is a custom GameCube program file format, which is directly booted by GameCubes' BIOS (to be exact, by the apploader on retail discs. a different apploader could well load a binary in whatever different format.). start end size description 0x0000 0x001B Text[0..6] sections File Positions 0x001C 0x0047 Data[0..10] sections File Positions 0x0048 0x0063 Text[0..6] sections Mem Address 0x0064 0x008F Data[0..10] sections Mem Address 0x0090 0x00AB Text[0..6] sections Sizes 0x00AC 0x00D7 Data[0..10] sections Sizes 0x00D8 0x04 BSS Mem address 0x00DC 0x04 BSS Size 0x00E0 0x04 Entry Point 0x00e4 0x1c unused 0x0100 Start of sections data (body) 14.3 ELF (Executable and linkable Format) The ELF format is a standard, known format for debugging target specific code, etc. GCC targeted for the PPC 750 processor or even for the specialized Gekko processor has a final output of ELF format files. The exact GameCube ELF file format details are currently unknown, but they should be similar to the standard specification. 14.4 GCB (QOOB Flash Files) start end size description 0x00 0x03 4 ID, indicates whats in the block 0x28432920 '(C) ' - qoob bios file 0x454c4600 'ELF0' - ELF File 0x42494e00 (not yet) 'BIN0' 0x444f4c00 (not yet) 'DOL0' 0x04 0xf7 description, will be shown in boot menu (by the qoob bios) 0xf8 0xfb 4 reserved 0xfc 0xff 4 size of block 0x100 ... data 14.5 GCM (Gamecube Disc Image) These files are always 1.4GB's exactly and each contains a complete binary image of a proprietary format GameCube DVD. This file format is used for the NR-Writer DVD writing software which writes special DVDs that can only be read by NR-Reader GameCubes. The GCM file format can probably be closely compared to the ISO file format for CDs in its purpose. 14.6 GCI (Gamecube Game Save) Used by the EMS Memory Adapter. 64 byte header (equal to FST entry on memcard), followed by the file data (as on memory card) 14.7 GCP (Gamecube Memorycard Image) Used by the EMS Memory Adapter. this is a raw image of all blocks of a memory card. 14.8 TGC a proprietary image format found on demo discs and eg the zelda n64 emu note: there seem to be tgc files on european discs that follow a different layout (no header). 14.8.1 Header start end size description 0x0000 0x0003 0x0004 TGC-Magic (0xae0f38a2) 0x0004 0x0007 0x0004 ? (=0x00000000) 0x0008 0x000b 0x0004 TGC-Header Size (=0x00008000) 0x000c 0x000f 0x0004 ? (=0x00100000) 0x0010 0x0013 0x0004 Offset to FST inside embedded GCM 0x0014 0x0017 0x0004 FST Size 0x0018 0x001b 0x0004 max FST Size 0x001c 0x001f 0x0004 Offset to Boot-DOL inside embedded GCM 0x0020 0x0023 0x0004 Boot-DOL Size 0x0024 0x0027 0x0004 ? 0x0028 0x002b 0x0004 ? 0x002c 0x002f 0x0004 Offset to Banner inside embedded GCM ? 0x0030 0x0033 0x0004 Banner Size ? 0x0034 0x0037 0x0004 ? 14.8.2 embedded GCM usually starts at offset 0x00008000 (after the TGC Header) and follows exactly the same layout as a GCM file, with the following exceptions: * Boot-DOL offset, FST offset contain bogus data and must be substituted by the data found in the TGC header * offsets within the embedded GCM file must be calculated relative to the start of the embedded GCM (obviously) 14.9 VGC (Viper Flash Files) start end size description 0x00 0x03 4 Viper Magic ('VIPR') 0x04 1 Configuration Flags bit(s) description 7 GC_FLASH_ACCESS - allows access to the flashrom 6 ? 5 ? 4 ? 3 COMMAND_MODE - enables modchip command mode (requires extended mode) 2 EXTENDED_MODE - allows reading of original IPL 1 COBRA_ENCRYPTION - enables additional encryption mode 0 DISABLE_CHIP - disables the modchip 0x05 1 Lid Sensor Status at Boot Time (*2) 0 LID_OPEN 1 LID_CLOSED 2 LID_PASSTHROUGH 0x06 0x0f 10 padding (zeros) 0x10 0x1f 16 BIOS Name in Ascii 0x20 ... Encrypted (*1) BIOS, loaded to 0x81300000 (*1) encrypted with the IPL XOR-Stream (*2) original docs state that the default value is 0xff, however actually using this value seems to cause problems. 15 Game File Formats This Section contains information about files used in, or produced by the official SDK, and thus is primarily useful for those who are hacking retail games. 15.1 AFC (audio stream) 15.2 AST (audio stream) like afc but with tags? 15.3 ARC (RARC Archive) This file is an archive file and contains several other files. 15.3.1 Header The file starts with an Rarc-Header: start end size description 4 type - 'RARC' 4 size, size of the file 4 unknown 4 dataStartOffset, where does the actual data start? You have to add 0x20 to this value. 16 unknown 4 numNodes 8 unknown 4 fileEntriesOffset 4 unknown 4 stringTableOffset, where is the string table stored? You have to add 0x20 to this value. 8 unknown 15.3.2 Nodes Next are RarcHeader.numNodes Node structures: start end size description 4 type 4 filenameOffset, directory name, offset into string table 2 unknown 2 numFileEntries, how many files belong to this node? 4 firstFileEntryOffset Each RARC file contains at least one Node, the 'ROOT' node. For each subdirectory in the archive, there's another Node (so each Node represents a directory). Each Node contains files and directories, represented by FileEntry structures: 15.3.3 File Entries start end size description 2 id, file id. If this is 0xFFFF, then this entry is a subdirectory link 2 unknown 2 unknown 2 filenameOffset, file/subdir name, offset into string table 4 dataOffset, offset to file data (for subdirs: index of Node representing the subdir) 4 dataSize, size of data 4 zero, seems to be always '0' To read the archive, you read the root node and its file entries. For each subdir in the root node's fileentries, you read the corresponding node and its file entries. For each file in the fileentries, you dump its data. 15.4 ARC (audio stuff) if a .arc file doesnt start with 'RARC' it may contain audio data 15.5 ASN audio related, contains strings 15.6 AW ("audio wave"?) 15.7 BAS ("audio script" ?) seems to have to do with audio (check mkdd file names...) 15.8 BCA looks very similar to a .col file, only with some tags in it 15.9 BCK (animation of a .bmd skeleton) 15.10 BDL same as .bmd 15.11 BFN (font) images of characters + mapping from character code to corresponding image part 15.12 BIN (binary file) scene.bin in sms contains scene layout 15.13 BLO (screen layout for dialog screens) 15.14 BMD (3d model with texture and skeleton) 15.15 BMG messages, subtitles, ... (text) 15.16 BMP (window bitmap (!)) 15.17 BMT seems to contain a MAT3 block of a .bmd file 15.18 BCK ("Pack" file) 15.19 BRK animation stuff? rotation keys? 15.20 BTI Note: some .bti files are Yaz0-compressed (if the first 4 bytes are 'Yaz0'), if this is the case you have to uncompress them first. A .bti file stores a single image, but can store several mipmaps. The file starts with a texture-header (which is used in the TEX! section of bmd/bdl and jpa files to store textures aswell): 15.20.1 Texture Header start end size description 0x00 1 format 0 I4 (4 bit intensity, 8x8 tiles) 1 I8 (8 bit intensity, 8x4 tiles) 2 IA4 (4 bit intensity with 4 bit alpha, 8x4 tiles) 3 IA8 (8 bit intensity with 8 bit alpha, 4x4 tiles) 4 RGB565 (4x4 tiles) 5 RGB5A3 (*) (4x4 tiles) 6 RGBA8 (4x4 tiles in two cache lines - first is AR and second is GB) 8 CI4 (4 bit color index, 8x8 tiles) 9 CI8 (8 bit color index, 8x4 tiles) 10 CI14X2 (14 bit color index, 4x4 tiles) 14 CMP (S3TC compressed, 2x2 blocks of 4x4 tiles) 0x01 1 unknown 0x02 0x03 2 width 0x04 0x05 2 height 0x06 0x07 2 unknown 0x08 1 unknown 0x09 1 Palette Format 0 IA8 1 RGB565 2 RGB5A3 (*) 0x0a 0x0b 2 Palette Entries - number of entries in the Palette 0x0c 0x0f 4 Palette Offset - offset to Palette Data 0x10 0x13 4 unknown 0x14 0x15 2 unknown 0x16 0x17 2 unknown 0x18 1 mipmap count 0x19 1 unknown 0x1a 0x1b 2 unknown 0x1c 0x1f 4 Data Offset - offset to image Data (*) RGB5A3 is RGB5 if color value is negative and RGB4A3 otherwise. Offsets are relative to the Texture Header (this is important in bmd/bdl files). 15.21 BTP 99% sure that this contains texture animation (NOT texture coordinate animation) 15.22 BTK (curves??? kinematics??) translation keys? probably some material animation as well (texture coord anim?) 15.23 COL (collision triangles) 15.24 DZB collision data ? 15.25 H4M a proprietary Movie Format found on some Gamecube Game DVDs. Probably related to the HVQ (Hirarchical Vector Quantization) format developed by Hudson. 15.26 JPA (particle data) (TEX1 section contains .bti images) 15.27 JPC collection of .jpa files ("Particle paCk"?) 15.28 MTH ('Mute thp?') video format, has the same video frame format as thp, but headers are a bit different 15.29 PAD recorded controller data? 15.30 PRM ('Parameters?') 15.31 REL (relocatable module) some kind of .dll or similar, contains text and data sections and relocation info 15.32 SB ?, contains a stringtable 15.33 SZS (packed RARC Archive) This is a Yaz0-compressed RARC archive 15.34 THP (video format) .thp is a video format on the gamecube. The video frames are independent "quasi-jpegs", and if audio frames are present, they are in an adpcm format (described below). 15.34.1 Header data The file starts with a thp header: start end size description 0x00 0x03 4 Magic Bytes, 0x54485000 ('THP0') 0x04 0x07 4 Version 0x00010000 v1.0 0x00011000 v1.1 0x08 0x0b 4 maxBufferSize - maximal buffer size needed for one complete frame (header + video + audio) 0x0c 0x0f 4 maxAudioSamples - != 0 if sound is stored in file, maximal number of samples in one frame. 0x10 0x13 4 FPS (float value) 0x41efc28f ~29; NTSC 0x14 0x17 4 numFrames - number of frames in the thp file 0x18 0x1b 4 firstFrameSize - size of first frame (header + video + audio) 0x1c 0x1f 4 dataSize - size of all frames (not counting the thp header structures) 0x20 0x23 4 componentDataOffset - ThpComponents stored here (see below) 0x24 0x27 4 offsetsDataOffset - if != 0, offset to table with offsets of all frames? 0x28 0x2b 4 firstFrameOffset - offset to first frame's data 0x2c 0x2f 4 lastFrameOffset - offset to last frame's data 15.34.2 Components structure At ThpHeader.componentDataOffset, a ThpComponents structure is stored: start end size description 0x00 0x03 4 numComponents - usually 1 or 2 (video or video + audio) 0x04 0x13 16 componentTypes - each byte specifies the type of one component as follows: 0x00 video 0x01 audio 0xff no component The first ThpComponents.numComponents entries of ThpComponents.componentTypes are valid. For each component, an information structure is stored after the ThpComponents struct. 15.34.3 VideoInfo Structure Component type 0 is video, a ThpVideoInfo struct looks like this: start end size description 0x00 0x03 4 width 0x04 0x07 4 height 0x08 0x0b 4 unknown (only v1.1 files) 15.34.4 AudioInfo Structure Component type 1 is audio (not always included), a ThpAudioInfo struct looks like this: start end size description 0x00 0x03 4 numChannels 0x04 0x07 4 frequency 0x08 0x0b 4 numSamples 0x0c 0x0f 4 numData (only for v1.1 files) - amount of audio blocks stored after each video block 15.34.5 Frame data A frame is made up of a frame header followed by a video frame followed by ThpAudioInfo.numData audio frames (only if the video contains sound). The frame header consists of 3 (or 4, if the video contains sound) 32bit values: start end size description 0x00 0x03 4 nextTotalSize - total size of NEXT frame (frame header, video and audio) 0x04 0x07 4 prevTotalSize - total size of PREVIOUS frame 0x08 0x0b 4 imageSize - size of image frame of THIS frame 0x0c 0x0f 4 audioSize - size of one audio frame of THIS frame (only if the file contains audio) Directly after the frame header FrameHeader.imageSize bytes video information follow. Directly after the video information, ThpAudioInfo.numData audio frames follow, each Frameheader.audioSize bytes large (only if the file contains audio). 15.34.6 Video Frames A video frame is more or less a jpeg image. A jpeg file is structured by several markers. A marker is a two-byte code, the first of the two bytes is 0xff. The jpeg standard states that if you want to store the value 0xff, you have to store it as 0xff 0x00 (else it would be confused with a marker). This is NOT the case in .thp files, the value 0xff is stored simply as 0xff in the image data. So if you want to use jpeglib to read the frame, you have to convert the thp "quasi-jpeg" to a real jpeg by converting 0xff values to 0xff 0x00 in the image data. You have to be careful that you don't convert the terminating End-Of-Image marker, though. - search for Start-Of-Image marker (0xff 0xda) - search for End-Of-Image marker (0xff 0xd9) (start search at end of buffer and search backwards!) - convert each 0xff between image data start and image data end to 0xff 0x00 - the resulting buffer can be passed to jpeglib to let it decode the image for you 15.34.7 Audio Frames An audio frame starts with a ThpAudioFrameHeader (total size is 80 bytes) start end size description 0x00 0x03 4 channelSize - size of one channel in bytes (*1) 0x04 0x07 4 numSamples - number of samples/channel 0x08 0x27 32 table for first channel (*2) 0x28 0x47 32 table for second channel (stored for one channel videos as well) (*2) 0x48 0x49 2 signed value, channel1Prev1 0x4a 0x4b 2 signed value, channel1Prev2 0x4c 0x4d 2 signed value, channel2Prev1 0x4e 0x4f 2 signed value, channel2Prev2 (*1) audio frame size = sizeof(ThpAudioFrameHeader) + ThpAudioInfo.numChannels * ThpAudioFrameHeader.channelSize (*2) tables stored as 16bit signed 5.11 fixed point numbers Directly after the ThpAudioFrameHeader ThpAudioFrameHeader.channelSize bytes follow for the first channel, and if the video is stereo (ThpAudioInfo.numChannels = 2), that many bytes follow for the second channel. The audio data is made up of small packets of 8 byte, each packet contains 14 samples. Some kind of adpcm coding is used. A sample is calculated like this: newSample = previousSample*factor1 + sampleBeforePreviousSample*factor2 + (sampleData * 2^exponent); For each packet, the first byte stores factor1, factor2 and exponent: u8 index = (firstByte > > 4) & 0x7; //highest bit of byte is ignored u8 exponent = firstByte & 0xf; float factor1 = ThpAudioFrameHeader.table[2*index]/pow(2.f, 11); float factor2 = ThpAudioFrameHeader.table[2*index + 1]/pow(2.f, 11); The following 7 bytes store 14 sampleData (each 4 bit, interpreted as a signed two's complement number). 15.35 TPL (Texture Palette) Another custom GameCube file format that holds texture and texture palette data. Many textures can be stored in one TPL file format, and it is commonly used by the SDK to hold texture data for GameCube games. note: appearently there are different formats of .TPL files, the following applies only to those with the magic 0x00,0x20,0xaf,0x30. TPL Header start end size description 0x0000 0x0003 4 Magic (0x00, 0x20, 0xAF, 0x30) 0x0004 0x0007 4 ntextures - Number of Textures in File 0x0008 0x000b 4 size of Header (always 0x0c in files with this structure) TPL Texture After the header goes 'ntextures' times the TPLTexture structure: start end size description 4 Texture Header Offset 4 Texture Palette Offset (0 if no palette) TPL Texture Header For every texture at position 'Texture Header Offset' there is the TPL Texture Header: start end size description 2 height 2 width 4 format 0 I4 (4 bit intensity, 8x8 tiles) 1 I8 (8 bit intensity, 8x4 tiles) 2 IA4 (4 bit intensity with 4 bit alpha, 8x4 tiles) 3 IA8 (8 bit intensity with 8 bit alpha, 4x4 tiles) 4 RGB565 (4x4 tiles) 5 RGB5A3 (*) (4x4 tiles) 6 RGBA8 (4x4 tiles in two cache lines - first is AR and second is GB) 8 CI4 (4 bit color index, 8x8 tiles) 9 CI8 (8 bit color index, 8x4 tiles) 10 CI14X2 (14 bit color index, 4x4 tiles) 14 CMP (S3TC compressed, 2x2 blocks of 4x4 tiles) 4 offset to Texture Data 4 wrap s 4 wrap t 4 min filter 4 mag filter 4 lod bias (float value) 1 edge lod 1 min lod 1 max lod 1 unpacked TPL Palette Header For every palette (not every texture has one) there is the TPL Palette Header: start end size description 2 nitems 1 unpacked 1 pad 4 format 0 IA8 1 RGB565 2 RGB5A3 (*) 4 offset to Palette Data (*) RGB5A3 is RGB5 if color value is negative and RGB4A3 otherwise. 15.36 YMP (height map) 16 Compression Formats 16.1 Yay0 This format is used to store the fonts in the BIOS/IPL. It is compressed similar to the the Zelda 64 'Yaz0' compression. 16.1.1 compression start end size description 0x0000 4 'Yay0' signature 0x0004 4 size of decoded data in bytes 0x0008 4 offset to link table 0x000c 4 offset to non-linked chunks and count modifiers table 0x0010 packed data (32 bit words) The packed data is a bitstream (padded to a multiple of 32bits), with each bit having the following meaning: 0 linked chunk, copy block from the link table (offset 0x0008) 1 non linked chunk, copy next byte from non-linked chunks and count modifiers table (offset at 0x000c) todo 16.1.2 de-compression Code void Decode(void *s, void *d) u32 i, j, k; u32 p, q; u32 cnt; i = r21 = *(u32 *)(s + 4); // size of decoded data j = r29 = *(u32 *)(s + 8); // link table k = r23 = *(u32 *)(s + 12); // byte chunks and count modifiers q = r31 = 0; // current offset in dest buffer cnt = r28 = 0; // mask bit counter p = r24 = 16; // current offset in mask table do // if all bits are done, get next mask if(cnt == 0) // read word from mask data block r22 = *(u32 *)(s + p); p += 4; cnt = 32; // bit counter // if next bit is set, chunk is non-linked if(r22 & 0x80000000) // get next byte *(u8 *)(d + q) = *(u8 *)(s + k); k++; q++; // do copy, otherwise else // read 16-bit from link table r26 = *(u16 *)(s + j); j += 2; // 'offset' r25 = q - (r26 & 0xfff); // 'count' r30 = r26 > > 12; if(r30 == 0) // get 'count' modifier r5 = *(u8 *)(s + k); k++; r30 = r5 + 18; else r30 += 2; // do block copy r5 = d + r25; for(i=0; i > 4; if(numBytes == 0) numBytes = src[srcPlace] + 0x12; srcPlace++; else numBytes += 2; //copy run for(int i = 0; i < numBytes; ++i) dst[dstPlace] = dst[copySource]; copySource++; dstPlace++; //use next bit from "code" byte currCodeByte < <= 1; validBitCount-=1; 17 Graphic Formats 17.1 YCbYCr This is the Format used for image data in the external framebuffer (XFB). It exploits the fact that the resolution of color on a PAL/NTSC screen is lower than the resolution of luminance (brightness), and thus stores only separate luminance info for each pixel and combines the color information of two pixels each, saving 2 bytes versus traditional RGB-per-pixel framebuffers. This means that in XFB you cant modify the color of a single pixel without affecting its neighbour. (you can however, seperatly modify its luminance/brightness). It also means that you can not accurately convert one single pixel into XFB framebuffer format, you will always have to convert two pixels at once. To convert two pixels to YCbYCr, first average their RGB values R = (R1+R2)/2 G = (G1+G2)/2 B = (B1+B2)/2 now calculate the luminance portion of each pixel Y1 = (77/256)R1 + (150/256)G1 + (29/256)B1 Y2 = (77/256)R2 + (150/256)G2 + (29/256)B2 then calculate the combined color portion Cb = -(44/256)R - (87/256)G + (131/256)B + 128 Cr = (131/256)R - (110/256)G - (21/256)B + 128 now a 32 bit value to be written to XFB (to a 32 bit aligned address of course) can be made up like this 31 24 23 16 15 8 7 0 1111 1111 bbbb bbbb 2222 2222 rrrr rrrr bit(s) description 24-31 1 Y1 - luminance Portion of first Pixel 16-23 b Cb - combined color 8-15 2 Y2 - luminance Portion of first Pixel 0-7 r Cr - combined color converting a single pixel back to RGB looks like this R = Y + 1.371(Cr - 128) G = Y - 0.698(Cr - 128) - 0.336(Cb - 128) B = Y + 1.732(Cb - 128) 17.2 I4 (4bit indexed) 17.3 IA4 (4bit indexed with alpha) 17.4 I8 (8bit indexed) 17.5 IA8 (8bit indexed with alpha) 17.6 CI4 (compressed 4bit indexed) 17.7 CIA4 (compressed 4bit indexed with alpha) 17.8 CI8 (compressed 8bit indexed) Used for Icons and Banners on Memory Card. This Format uses a palette in RGB5A1 Format, the Pixel data is stored in 8x4 pixel tiles. 17.9 CIA8 (compressed 8bit indexed with alpha) 17.10 RGB4A3 Used for Icons and Banners on Memory Card. This Format uses no palette and is stored in 4x4 pixel tiles. 17.10.1 RGB4A3 Pixel Format 15 8 7 0 .ttt rrrr gggg bbbb bit(s) description 15 unused (?) 12-14 t transparency 8-11 r red channel 4-7 g green channel 0-3 b blue channel 17.11 RGB5A1 Used for Icons and Banners on Memory Card. This Format uses no palette and is stored in 4x4 pixel tiles. 17.11.1 RGB5A1 Pixel Format 15 8 7 0 trrr rrgg gggb bbbb bit(s) description 15 t transparency 10-14 r red channel 5-9 g green channel 0-4 b blue channel 17.12 RGB565 17.12.1 RGB565 Pixel Format 15 8 7 0 rrrr rggg gggb bbbb bit(s) description 11-15 r red channel 5-10 g green channel 0-4 b blue channel 17.13 RGBA8 17.13.1 RGBA8 Pixel Format 31 24 23 16 15 8 7 0 rrrr rrrr gggg gggg bbbb bbbb aaaa aaaa bit(s) description 24-31 r red channel 16-23 g green channel 8-15 b blue channel 0-7 a alpha channel 17.14 S3TC WARNING: this section is screwed! any advice/corrections/help/etcblabla welcomed! (thanx to Aaron Kaluszka for pointing this out) S3TC is a compression method for textures, developed by S3 and licenced by Nintendo for the Gamecube (and also by Microsoft for DirectX 6.0). It basically gives you one more MIP level for free, with relatively small quality loss and a simple implementation in hardware. You basically store 2 colour values and then you have a few bits per pixel to interpolate between them. It works in blocks of 4x4 pixel. There are 5 variants: DXT1 allows one bit of alpha DXT2/3 allows 4 bits of alpha DXT4/5 stores 2 alpha values and has 3 bits to interpolate between them The difference between DXT2/3 and 4/5 is, if colour values are pre-multiplied with alpha. The blending equation is normally (c*(1-a))+(t*a)), so with pre- multiplied alpha the texture contains (t*a) in each colour channel and the blending becomes (c*(1-a) + t). Each image is made up of tiles placed linearly from left to right then top to bottom. Each tile is made up of 4 blocks 0 1 2 3 Each block is made up of 8 words. These 8 words represent 16 pixels using S3TC compression. RRRRRGGG - GGGBBBBB - rrrrrggg - gggbbbbb - 00112233 - 44556677 - 8899UUVV- WWXXYYZZ R = Color 0 Red G = Color 0 Green B = Color 0 Blue r = Color 3 Red g = Color 3 Green b = Color 3 Blue 0 - 9, U - Z = Pixel color (2-bits each) Colors 1 and 2 are interpolated from colors 0 and 3 The tiles are 32 bytes each. Depending on the image format the width and height of the tiles will differ. A 16bit format (ie RGB5 or RGB4A3) will have a 4x4 pixel tile since 4 * 4 * 2 bytes = 32. An 8bit format (ie Color Indexed) will have a 8x4 pixel tile since 8 * 4 * 1 byte = 32. So a 32x32 image (like a memory card icon) that is in RGB5 format would be 8 tiles across and 8 tiles down. 17.14.1 CMPR Like a usual texture, a CMPR-texture is divided on tiles, each 32-bytes to fit a texture cache line. Every tile is sub-tiled into four parts, in zigzag order 0 1 2 3 The format of the sub-tiles is pretty simple, and looks like DXT1. First two base colors in RGB565, followed by 16 sub-tile texels. Every texel is 2-bit wide, to lookup from four colors : 00, 01, 10 and 11. First two are given already, and last two are interpolated from first ones, by the following rule : * COLOR0 and COLOR1 are base colors. * RGB0 <- unpack RGB565 COLOR0 * A0 = 255 * RGB1 <- unpack RGB565 COLOR1 * A1 = 255if COLOR0 > COLOR1 o RGB2 = (2 * RGB0 + RGB1) / 3 o A2 = 255 o RGB3 = (2 * RGB1 + RGB0) / 3 o A3 = 255 else o RGB2 = (RGB0 + RGB1) / 2 o A2 = 255 o RGB3 = (2 * RGB1 + RGB0) / 3 o A3 = 0 18 Appendix 18.1 GCC Quick How To 18.1.1 compile ASM to object: /bin/powerpc-eabi-elf-as -c -I /powerpc-eabi-elf/include -I testasm.s -o testasm.o 18.1.2 compile C to object: /bin/powerpc-eabi-elf-gcc -c -I /powerpc-eabi-elf/include -I -nostdlib testc.c -o testc.o 18.1.3 compile C++ to object: /bin/powerpc-eabi-elf-g++ -c -I /powerpc-eabi-elf/include -I -nostdlib -fno-exceptions testcpp.cpp -o testcpp.o 18.1.4 link objects /bin/powerpc-eabi-elf-ld -T ppc-ngcbin.x -o test.elf crt0.o /lib/gcc-lib/powerpc-eabi-elf/3.3/crtbegin.o /lib/gcc-lib/powerpc-eabi-elf/3.3/crtend.o testasm.o testc.o testcpp.o -lg -lstdc++ -lm -lc -lnosys you only need to link against crtbegin.o/crtend.o if you are using c++, and you only need -lg,-lstdc++,-lc,-lm if you are actually using these libraries (of course:)). however if you do so, linking against -lnosys as well is essential. 18.1.5 remove unneeded sections (debug info etc) from object /bin/powerpc-eabi-elf-strip -s test.elf 18.1.6 convert object to plain binary /bin/powerpc-eabi-elf-objcopy -O binary test.elf test.bin 18.1.7 convert absolute address into filename/line number/function compile with "-g" flag, then use /bin/powerpc-eabi-elf-addr2line -f -e test.elf 0x80003100 18.1.8 Building a Crosscompiler configure options: --target=powerpc-eabi-elf --with-cpu=750 --disable-threads --enable-languages=c --disable-shared --disable-nls --with-newlib 18.1.9 Linker Script to do 18.1.10 Startup Code to do 18.2 Boot Process Details The IPL (Initial Program Loader), or Bootrom, is located inside one Macronix chip (near Flipper, U10) and connected to the EXI bus. When the Gamecube is powered on, bit 25 (IP) in the Machine State Register is set, which means the system exception vector offset is 0xfff00000. Then a small (about 0x0700 bytes) program called 'BS' will be mapped to 0xfff00100 (the hardware reset vector) and control will be returned to the Gamecube like after a normal reset, which means 'BS' will be started. 18.2.1 BS - Bootstrap 1 * copies the Bootstrap 2 code (BS2) from Bootrom to 0x81300000 * disables the IPL decryption logic by clearing bit 17 of 0xcc006800 * sets IP of Machine State Register so exception vectors are pointing to lower memory * jumps to BS2 code 18.2.2 BS2 - Bootstrap 2 BS2 is the Program that loads the game or shows the menus when the gamecube has been powered on without a game inserted. It was written in C, using official SDK libraries, probably earlier than 1.0. __start.c seems to be same as usual, except that there is no OSInit() call (old versions must call OSInit() in main, instead of __start). note: this has been reversed from a PAL gamecube and looks different on a NTSC one. 18.2.2.1 short description of start() routine. // 81300000 __start: __init_registers() // set stack pointer and static bases (r2, r13) __init_hardware() // paired-singles and cache init __init_data() // clear bss ? . // here goes Debug Monitor stuff DBInit() // debug monitor init :) __init_user() // cpp init main() // that's actually, IPL (BS2) code jmp exit() // halt CPU 18.2.2.2 IPL main() reversing // 813006D4 main() BS2Init(); OSInit(); AD16Init(); AD16WriteReg(0x800); DVDInit(); AD16WriteReg(0x900); CARDInit(); AD16WriteReg(0xa00); 0x81302104(); // SRAM, real-time clock (check ?) __VIInit(0); VIInit(); AD16WriteReg(0xb00); 0x813004e4(); // setup performance. monitor 0x8130222c(); // update time-base by SRAM clock 0x813022c0(); // perform initial DVD actions and fall back into menu PADSetSpec(5); // sed PAD type ('spec') to 'production' PADInit(); AD16WriteReg(0xc00); BS2Menu(); // here goes intro and main menu... (BIG one!) OSPanic(__FILE__, __LINE__, "BS2 ERROR > > > SHOULD NEVER REACH HERE"); float NaN; // 8130045C void BS2Init() // clear LoMem and OSMem memset(0x80000000, 0, 256); memset(0x80003000, 0, 256); BATInit(); // set memory size to 24MB *0x80000028 = 0x01800000; // set console type to default retail 1 *0x8000002c = 1; // upgrade retail *0x8000002c += *0xcc00302c > > 28; (u32)NaN = -1; FPUInit(); // 813003A0 void BATInit() __asm isync li r4, 0 mtspr DBAT2L, r4 mtspr DBAT2U, r4 mtspr DBAT3L, r4 mtspr DBAT3U, r4 mtspr IBAT1L, r4 mtspr IBAT1U, r4 mtspr IBAT2L, r4 mtspr IBAT2U, r4 mtspr IBAT3L, r4 mtspr IBAT3U, r4 isync // 813003D8 void FPUInit() // FPU already initialized in __start(), // so just invalidate all FPRs. __asm lfs f0, NaN fmr f1, f0 fmr f2, f0 fmr f3, f0 . e . t . c fmr f31, f0 // maybe later 0x81302104() __OSLockSram(); __OSCheckSram(); __OSGetRTC(); OSTickToCalendarTime(); memset(); __OSUnlockSram(); __OSSyncSram(); // maybe later 0x813004e4() OSDisableInterrupts(); OSGetTick(); OSGetTick(); OSGetTick(); __div2i(); __div2i(); PPCMtpmc1(); PPCMtmmcr0(); OSGetTick(); OSGetTick(); PPCMtmmcr0(); PPCMfpmc1(); __div2i(); __div2i(); __div2i(); OSRestoreInterrupts(); // maybe later 0x8130222c() __OSLockSram(); __OSGetRTC(); __OSSetTime(); __OSUnlockSram(); static int BS2State = 0; // just layer.. 0x813022c0() BS2State = BS2Mach(); // 81300A70 // located in __FILE__ = "BS2Mach.c" int BS2Mach() static int state = 0; BOOL level = OSDisableInterrupts(); switch(state) case 0: [r13 - 0x7dc8] = 0x800030d4; state = 1; case 1: __OSGetSystemTime(); ... some checks if(fail) break; state = 2; // Install DVD cover callback case 2: if([r13 - 0x7da8] == 0) r3 = [r13 - 0x7dc8] [r3] = 0 [r13 - 0x7dc4] = 0 [r13 - 0x7dac] = 1 DVDLowSetResetCoverCallback(0); DVDReset(); [r13 - 0x7da8] = 1 (s64)[r13 - 0x7d9c] = __OSGetSystemTime(); break; __OSGetSystemTime(); if(fail) break; DVDLowSetResetCoverCallback(0x813007d8); DVDReset(); state = 3; // Read Disk information (ID) case 3: DVDReadDiskID(0x8145e620 + 64, 0x80000000, 0x813007e4); state = 4; break; // Leave immediately ? case 16: break; default: OSPanic(__FILE__, __LINE__, "BS2 ERROR > > UNKNOWN STATE"); OSRestoreInterrupts(level); return (DVDLowGetCoverStatus() == 1) ? 19 : step; // 81301154 void BS2Menu() BS2InitAlloc(); static OSHeapHandler BS2Heap; // 81307EA8 void BS2InitAlloc() u8 *arenaLo; u8 *arenaHi; u8 *arenaNew; arenaLo = OSGetArenaLo(); arenaLo = (void *)OSRoundUp32B(arenaLo); arenaHi = OSGetArenaHi(); arenaHi = (void *)OSRoundDown32B(arenaHi); arenaNew = OSInitAlloc(0x80800000, arenaHi, 2); OSSetArenaLo(arenaHi); BS2Heap = OSCreateHeap(arenaLo, arenaHi); OSSetCurrentHeap(BS2Heap); OSAddToHeap(BS2Heap, arenaNew, 0x81100000); BS2CheckAlloc(); // 81307F34 void BS2CheckAlloc() OSCheckHeap(BS2Heap); // 81307F58 void *OSAlloc(long size) void *ptr; if((ptr = OSAlloc(size)) == 0) OSPanic(?); return ptr; 18.2.2.3 Map of IPL Library code Address Name Libray 0x813014C8 DEMOInit (*) DEMO 0x81307F58 OSAlloc (*) OS 0x813327BC PPCMtmmcr0 0x813327C4 PPCMfpmc1 0x813327CC PPCMtpmc1 0x81332814 OSInit OS 0x81332EF0 OSInitAlarm OS 0x81332F3C OSCreateAlarm 0x81333688 OSAllocFromHeap 0x81333784 OSSetCurrentHeap 0x81333794 OSInitAlloc 0x81333804 OSCreateHeap 0x81333870 OSAddToHeap 0x813338D0 OSCheckHeap 0x813344C0 OSGetStackPointer 0x8133491C OSReport 0x8133499C OSPanic 0x81334AA4 PPCHalt 0x81334D4C EXIImm EXI 0x81335134 EXISync 0x813353C8 EXIProbeReset 0x8133570C EXISelect 0x81335838 EXIDeselect 0x81335D6C EXILock 0x81335E60 EXIUnlock 0x81335F54 AD16Init 0x81336090 AD16WriteReg 0x813361B0 OSDisableInterrupts 0x813361C4 OSEnableInterrupts 0x813361D8 OSRestoreInterrupts 0x81336DD8 __OSGetRTC 0x813372B0 __OSLockSram 0x81337658 __OSUnlockSram 0x813376A0 __OSSyncSram 0x813376B0 __OSCheckSram 0x81338504 OSInitThreadQueue 0x8133939C OSGetTick 0x813393B8 __OSSetTime 0x8133943C __OSGetSystemTime 0x8133963C OSTicksToCalendarTime 0x8133AC50 DVDLowGetCoverStatus DVD 0x8133AB18 DVDLowReset 0x8133ABD4 DVDLowSetResetCoverCallback 0x8133B5F0 DVDInit 0x8133CD18 DVDReadDiskID 0x8133D0EC DVDReset 0x8133DBE0 __VIInit VI 0x8133DDC8 VIInit 0x8133E6C0 VIConfigure 0x8133F0B4 VIGetTvFormat Address Name Libray 0x8134052c PADInit PAD 0x8134092c PADSetSpec 0x81343114 CARDInit 0x813480D4 GXInit 0x81349148 GXInitFifoBase 0x81349230 GXSetCPUFifo 0x81349340 GXSetGPFifo 0x813494B8 __GXFifoInit 0x8134B0AC __GXPEInit 0x8135A178 __div2i gcc 0x8135A394 __mod2i gcc 0x8135B494 vprintf stdlib (*) these functions were slightly modified for the IPL. 18.2.3 Apploader The Apploader provides functions to the bootrom that load the game (using bootrom read DVD functions). The bootrom calls the Init function, then the Main function in a loop, then the Closing function. At first, the BIOS calls the Apploader entrypoint with r3, r4, and r5 pointing to a free space for a 32 bit value. // info based on Luigi Mansion appldr.bin file // (built date is 17 Dec 2001). // Apploader Entrypoint // Input values : // r3 = Address where to put the address of the Init function // r4 = Address where to put the address of the Main Loading function // r5 = Address where to put the address of the Closing function // Return values : // none // file:[0010-0013] = 0x81200288 (apploader entrypoint) void Entrypoint(r3, r4, r5) [r3] = 0x81200290 // Init [r4] = 0x81200580 // Main [r5] = 0x81200D50 // Close // Init function // Input values : // Return values : // none void Init(void (*OSReport)(char *fmt, ...)) // clear some important memory areas memset(OSAppLdr + 32, 0, 32); memset(&OSAppLdr.DolImage, 0, sizeof(DolImage)); [+0x140] = 0 OSAppLdr.pass = 0 [+0x148] = 0 OSAppLdr.OSReport = OSReport // save report callback OSAppLdr.OSReport("Apploader Initialized. $ Revision: 28 $n"); OSAppLdr.OSReport("This Apploader built %s %sn", __DATE__, __TIME__); // Main Loader function // Input values : // r3 = Address where to put the Memory destination of the disk read // r4 = Address where to put the Size of the disk read // r5 = Address where to put the Starting position of the disk read // Return value: // r3 = 0 if everything is already loaded // = 1 (or !=0) if main function should be called again // at 0x81200580 // helper functions (below) u32 DOLSize(void); // 0x812013E0 seems to be a big structure, like that : struct OSAppLdr // untouched u32 SecondTimeForThePart; u8 [28] u8 [32] // "BB2" structure ? DolImage DolImage; // main DOL executable header // flags or something u32 +0x140 u32 pass; // 0...12 u32 +0x148 // report routine itself is placed somewhere in bootrom void (*OSReport)(char *fmt, ...); // flags or something u32 +0x150 u32 +0x154 u32 +0x158 u32 +0x15C u8 [32] } OSAppLdr; // 0x174 total int Main(r3, r4, r5) int pass = OSAppLdr.pass; if(pass <= 12) switch(pass) // read "BB2" structure (DVD offset at 0x0420) case 0: case 1: // "BB2" structure ? // 0420-0424 offset of main executable DOL // 0424-0427 offset of the FST // 0428-042B size of FST // 042C-042F maximum size of FST [r3] = OSAppLdr + 32 [r4] = 32 [r5] = 0x420 OSAppLdr.pass = 2 DCInvalidateRange([r3], [r4]) break; // check "BB2" structure FST sizes case 2: FSTLength = [OSAppLdr + 32 + 8] FSTMaxLength = [OSAppLdr + 32 + 12] if(FSTLength > FSTMaxLength) OSAppLdr.OSReport( "APPLOADER ERROR > > > FSTLength(%d) in BB2 is greater than FSTMaxLength(%d)n", FSTLength, FSTMaxLength); PPCHalt(); [r3] = OSAppLdr + 0x160 [r4] = 32 [r5] = 0x440 OSAppLdr.pass = 3 DCInvalidateRange([r3], [r4]) break; case 3: [0x800000E8] = [OSAppLdr + 0x160] // word break; case 4: // load main DOL header (256 bytes) case 5: [r3] = &OSAppLdr.DolImage [r4] = 256 [r5] = [OSAppLdr + 32] // from BB2 OSAppLdr.pass = 6 DCInvalidateRange([r3], [r4]) break; case 6: totalSize = DOLSize(); maxSize = [[800000F4] + 0x28]; // PadSpec ? if((totalSize > maxSize) && maxSize) OSAppLdr.OSReport( "APPLOADER ERROR > > > Total size of text/data sections of the dol file are too big (%d(0x%08x) bytes). Currently the limit is set as %d(0x%08x) bytesn", totalSize, maxSize); PPCHalt(); case 7: case 8: case 9: case 10: case 11: case 12: if(SecondTimeForThePart == TRUE) OSAppLdr.OSReport( "Failed assertion SecondTimeForThePart == TRUE"); PPCHalt(); break; return 1; else return 0; // helper functions // at 0x81200338 u32 DOLSize(void) DolImage *dol = &OSAppLdr.DolImage; u32 totalBytes = 0; int i; for(i=0; itextData[i]) // aligned to 32 byte boundary totalBytes += (dol->textLen[i] + 31) & ~31; for(i=0; idataData[i]) // aligned to 32 byte boundary totalBytes += (dol->dataLen[i] + 31) & ~31; return totalBytes; // Closing function // Return value: r3 = entry point // at 0x81200D50 u32 Close(void) // provide entrypoint of main DOL executable to IPL return OSAppLdr.DolImage.entry; 18.2.4 Main DOL executable 18.3 Game and Maker Codes 18.3.1 Gamecodes offset size Description 1 1 System ID value id Description 0x47 G Gamecube (standard value) used by Legend Of Zelda: Ocarina Of Time (Master Quest) 0x44 D Might be a indicator for emulated/ported/promotional titles. 0x55 U used by GBA-Player Boot CD 2-3 2 Game ID/serial Number 4 1 Country/Region Code value id Country 0x45 E USA/NTSC 0x50 P Europe/PAL 0x4a J Japan/NTSC 0x55 U used by the European version of The Legend Of Zelda: Ocarina Of Time (Master Quest) 18.3.2 Game Serial ID Characters Description 3 System ID 'DOL' 4 Gamecode 3 Country ID ID Country USA guess what :) NOE Nintendo of Europe NOA Nintendo of America ? Japan for example * DOL-GZLE-USA (Zelda) * DOL-GNHE-USA (NHL Hitz 20-20) * DOL-GTEP-NOE (1080° Avalanche) 18.3.3 Makercodes The ID (2 Bytes ASCII) belongs to the publisher, not the developer. Hence, even though Rare developed Star Fox Adventures, and Retro Studios developed Metroid Prime, they both have the Vendor ID of Nintendo (01). It is unknown how vendor IDs are allocated; However, all IDs thus far seem to be alphanumeric. If this is accurate, then as a result the maximum number of unique vendors is 1,296. Vendor IDs seem to be region-independent. ID Vendor 01 Nintendo 08 Capcom 41 Ubisoft 4F Eidos 51 Acclaim 52 Activision 5D Midway 5G Hudson 64 Lucas Arts 69 Electronic Arts 6S TDK Mediactive 8P Sega A4 Mirage Studios AF Namco B2 Bandai DA Tomy EM Konami 18.4 Macronix Chip IDs MX ff t mm b p r s MX MX', vendor id ff 2 digits, device family 17 auto focus controller 23 mask rom 25 spi serial flash memory 26 mtp eeprom 27 eeprom 28 flash memory 29 flash memory (single voltage) 53 memory card (smc) 67 flash memory 69 flash memory + sram (stacked chip) 88 digital camera/flat panel display controller 89 flat panel display controller 92 sound generator 93 single chip answering machine/digital recorder controller 97 isdn controller 98 network 99 bluetooth t 1 character, device type c cmos f flash l low-voltage w srw v 2.2v u 1.8v x 1.5v vw 2.25v+srw mm 2 to 4 digits, mode/density 004 4M, x8 Boot Block 040 4M, x8 Equal Sector 400 4M, x8/x16 Boot Block b 1 character, bootblock type (rom only) t top b bottom MX ff t mm b p r s p 1 character, package type p plastic dip m plastic sop q plastic plcc t tsop normal d qeramic dip x8 0.8mm ball pitch, bga, csp x csp r 1 character, temperature range c commercial i industrial m military s 1 character, speed 45 45ns 55 55ns 70 70ns 85 85ns 90 90ns 10 100ns 12 120ns 15 150ns 20 200ns 25 250ns 18.5 chip simelarities * mx25L4001 (serial flash rom in nintendo memory card 59) o datasheet was never available at Macronix but take a look at their 3-volt SPI Flash ROMs (the MX25LXX02 series) for a general pinout without the Unknown pin 24. * mx25L4004 (serial flash rom in datel memory card) o mx25L4004 - 4Mbit, 4Mx1 serial flash rom (datasheet was, but is no longer available at Macronix :/) * mx98730ec (eth controller in bba) o mx98728ec - single chip 10/100 base generic MAC interface o (mx98726, mx98728) * Gekko o ibm PowerPc750CXe o (PowerPc740, PowerPc750, PowerPc750CX) * (inside flipper) o (big ???) mx92L832 - 32 poly phony sound generator o (big ???) mx96037 - 16bit DSP Controller o (mx93011a,...) * mx 8013108-M rtnc-dol 1r6022a1 (rtc/ipl) * MoSys (MS3M23B-5 A) 12MB 1-T SRAM (main memory) * NEC (D4891281G5 0125XU621) 16MB ARAM (auxiliary/dsp memory) 18.6 Easter Eggs * To hear a different sound when the console boots hold the Z button down once you turn the console on and as the square bounces down you will hear the noises of kids. * Hold Z then about one second later hold A to hear another sound. * If you have 4 controllers (and 5 hands) this one will work: Before you turn the Gamecube on hold down Z on each controller, then turn the system on (with your 5th hand of course). You will be greeted by a ninja yell. * holding B on first controller, then powering on will let you switch a pal gamecube into 60Hz mode 19 References * U.S. Pat. 5,680,534 (Video game/video graphics program fabricating system and method with superimpose control) * U.S. Pat. 6,411,301; 6,452,600; 6,466,218; 6,697,074 (Graphics system interface) - GX Info * U.S. Pat. 6,421,058 (Graphics command stream for calling a display object in a graphics system) - a lot of GX Info * U.S. Pat. 6,424,348; 6,456,290; 6,489,963 (Application program interface for a graphics system) - GX Info * U.S. Pat. 6,457,128 (Optical disk. An optical disk barcode forming method, an optical disk reproduction apparatus, a marking forming apparatus, a method of forming a laser marking on an optical disk, and a method of manufacturing an optical disk.) * U.S. Pat. 6,468,160 (Security system for video game system with hard disk drive and internet access capability) * U.S. Pat. 6,591,019 (3D transformation matrix compression and decompression) * U.S. Pat. 6,606,689 (Method and apparatus for pre-caching data in audio memory) - ARAM Info * U.S. Pat. 6,609,977 (External interfaces for a 3D graphics system) - Lots of Register Info * U.S. Pat. 6,618,048 (3D graphics rendering system for performing Z value clamping in near-Z range to maximize scene resolution of visually important Z components) * U.S. Pat. 6,636,214 (Method and apparatus for dynamically reconfiguring the order of hidden surface processing based on rendering mode) - Some GX Stuff * U.S. Pat. 6,639,595 (Achromatic lighting in a graphics system and method) - Some GX Info * U.S. Pat. 6,580,430 (Method and apparatus for providing improved fog effects in a graphics system) - some GX Info * U.S. Pat. 6,643,744 (Method and apparatus for pre-fetching audio data) - Some ARAM Info * U.S. Pat. 6,664,958 (Z-Texturing) - GX Info * U.S. Pat. 6,664,962 (Shadow mapping in a low cost graphics system) - GX Info * U.S. Pat. 6,707,458 (Method and apparatus for texture tiling in a graphics system) - GX Info * U.S. Pat. 6,681,296 (Method and apparatus for software management of on-chip cache) * U.S. Pat. 6,700,586 (Low cost graphics with stitching processing hardware support for skeletal animation) * U.S. Pat. 6,701,424 (Method and apparatus for efficient loading and storing of vectors) * U.S. Pat. 6,717,577 (Vertex cache for 3D computer graphics) * Macronix Product Catalog * mx98726 Datasheet * mx98728 Datasheet * mx25L4004 Datasheet * PowerPC 740/PowerPC 750 RISC Microprocessor User`s Manual * PowerPC 750CX/ 750CXe RISC Microprocessor User`s Manual * Standard ECMA-268 (80 mm DVD - Read-Only Disk) * MN102H60G/60K/F60G/F60K LSI User Manual 19.1 Sources * http://www.uspto.gov * http://www.macronix.com * http://www.ibm.com * http://www.s3.com/s3tc (no more available) * http://www.ecma-international.org/publications/standards/Ecma-268.htm * https://www.semicon.panasonic.co.jp 20 Credits besides freely available datasheets and patents, this document was created based on information provided by the following people. if you think you are missing in this list, please keep me informed so i can add you immediately. titanik/crazy nation 'Gamecube Low-level Info' in CZN 'Gamecube Source pack #1' duke/napalm duke@napalm-x.com initial "gcinfo.txt" some invaluable information (you know who you are) costis costis@gbaemu.com, gcdev.com http://www.gcdev.com hardware introduction text (posted on some website...uhm :)) gcspec.html additional info in sram checksum, video regs org kvzorganic@mail.ru additional apploader info / apploader RE IPL RE, boot process details info on Gekko specific opcodes tons of other info (cheers mate) torlus gcc config ??? www.gc-nfo.com some file-format info Crowtrobo ctr-snd.txt memory card info Azimer http://www.apollo64.com some additional VI info tmbinc debugmo.de http://debugmo.de released some sources that helped to close the one or other gap driving force behind GX reversing IPL encryption reversing/IPL replacement info shagkur shagkur@gmx.net GX reversing, additional sources/infos Timothy Wilson theimp@iinet.net.au compiled some valuable info concerning memory cards Authors of GClib gclib.sf.net cross-checking against the Source helped to make sure no bad errors sneaked in GC-Linux Team gc-linux.sf.net another valueable source for code that has been cross-checked against Aaron Kaluszka megabyte@kontek.net some image format info Monk monk@mad.scientist.com TPL Fileformat details Steven Looman steven@krx.nl keyboard scancodes, comments on adapters thakis http://www.amnoid.de/gc/ lots of additonal fileformat info, proofreading&spellchecking Alexander Wold (micropal) http://cube.iu.hio.no/~s104086/ additional rtc/ipl pinout info moreover, many thanks must go to everyone who helped making this document more consistant and error free by proofreading and pointing out mistakes, in particular tmbinc, org, hubb, Aaron Kaluszka, Skywalker, Jihad, xor37h, costis, CrowTrobo, mist, ionic, Briii, Desktopman, Spike Grobstein, Steven Looman, Anders Montonen, Monk, Josiah "afnom" Burroughs, Scream - CT, thakis ... (please check the changelog for details)