Yet Another Gamecube Documentation

10  EXI Devices


index

10.1  EXI Channel and Device List


The following table shows the GameCube devices which use the EXI bus and their channel and device numbers, the EXI frequency commonly used with them and their virtual offset in EXI mapping.

channel device freq offset Description
0 0 4   Memory Card (Slot A)
0 1 3 0x00000000 Mask ROM
0 1 3 0x20000000 Real-Time Clock (RTC)
0 1 3 0x20000100 SRAM
0 1   0x20010000 UART
1 0 4   Memory Card (Slot B)
2 0     AD16 (trace step)
0 2     Serial Port 1
0 2 5   Ethernet Adapter (SP1)


Note: The Real-Time Clock (RTC), SRAM, and Mask ROM are actually one device mapped to different address offsets. The SRAM should only be accessed by the IPL and contains non-volatile system data. The Mask ROM contains the IPL itself (encrypted) and the system font data.
index

10.2  Retrieving the ID of an EXI Device


To retrieve the ID of an EXI Device, an EXI IMM write operation must be used to send the ID command (0x0000) and an EXI IMM read operation should follow it to read the actual 4 byte ID.

ID Device
0x00000004 Memory Card 59
0x00000008 Memory Card 123
0x00000010 Memory Card 251
0x00000020 Memory Card 507
0x00000040 Memory Card 1019
0x00000080 Memory Card 2043
0x01010000 USB Adapter
0x01020000 NPDP GDEV
0x05070000 IS Viewer
0x04120000 AD16
0x03010000 Marlin (?)
0x02020000 Modem
0x04020200 Ethernet Adapter

index

10.3  Mask ROM


Mask ROM also referred as bootrom or IPL. Total size of bootrom is 2 MB.
index

10.3.1  Memory Map (Europe/PAL)


Start End Size Description
0x00000000 0x000000ff 0x00000100 Copyright message (*1)
0x00000100 0x001aeee8 0x001aede8 BIOS data (*2)
0x001AFF00 0x001FA0E0 0x0004D000 'Yay0' - ROM Fonts #1 (SJIS)
      0x61 bytes of 0xFF, 0x62 , followed by zeros until 0x1FCF00
0x001FCF00 0x001FF474 0x00003000 'Yay0' - ROM Fonts #2 (ANSI)
0x001FF474 0x001FFEF0   filled with 0x00
0x001FFF00   0x001FFFFF filled with 0xff


(*1) "(C) 1999-2001 Nintendo. All rights reserved.(C) 1999 ArtX Inc. All rights reserved.PAL Revision 1.0 " and zeros up to 0x100.
(*2) encrypted by an XOR cyphertext which is generated by a yet unknown algorithm (probably not a single LFSR)
index

10.3.2  Memory Map (USA/NTSC)


Start End Size Description
0x00000000 0x0015ee40 0x0015ee40 BIOS data (*1)
0x001AFF00   0x0004D000 ROM Fonts #1 (SJIS)
0x001FCF00   0x00003000 ROM Fonts #2 (ANSI)
0x001FFF00   0x001FFFFF filled with 0x00


(*1) encrypted by an XOR cyphertext which is generated by a yet unknown algorithm (probably not a single LFSR)

note: all unused space is filled with 0x00, no pieces with 0xFF.
index

10.3.3  Memory Map (Japenese/NTSC)


index

10.3.4  Memory Map (Japenese/NTSC - Panasonic Q)


index

10.3.5  Font Encoding


The 'Yay0' data is compressed similar to the the Zelda 64 'Yaz0' compression. Besides the Raw Font data it also contains some information about the Font.
index

10.3.6  Font Layout


10.3.6.1   SJIS Font (ROM Font #1)   10.3.6.2   ANSI Font (ROM Font #2)   The ANSI Font is a 512x512 Pixel Texture in I4 Format. It consists of 21 colums and 11 rows of characters which are in a 24x24 pixel grid.

  ! ' # $ % & ´ ( ) * + , - . / 0 1 2 3 4
5 6 7 8 9 : ; < = > ? @ A B C D E F G H I
J K L M N O P Q R S T U V W X Y Z [   ] ^
_ ' a b c d e f g h i j k l m n o p q r s
t u v w x y z                            
                                         
                                         
                                         
                                         
                                         
                                         

index

10.3.7  Operation


10.3.7.1   read

max offset is 2*1024*1024, max block len is ?
index

10.4  RTC (Real-Time Clock)


Real-Time Clock (RTC) is 32-bit value, counting time intervals in seconds. To get the real time (seconds since January 1st, 2000 12am) add the counter bias saved in SRAM.
index

10.4.1  Operation


10.4.1.1   read

Since it is uncertain if the hardware prevents fragmented reads of the time interval (eg byte 1 from tick n and byte 2-4 from tick n+1) it is recommended to repeatedly retrieve the value until there is no difference between two consecutive reads.
10.4.1.2   write

index

10.5  SRAM


SRAM is battery backed memory, used for saving some non volatile settings. Size of SRAM is 64 bytes.
index

10.5.1  Memory Map


offset end size Description
0x00   2 Checksum 1
0x02   2 Checksum 2
0x04   4 ead 0
0x08   4 ead 1
0x0c   4 counter Bias (add to RTC value to get actual time)
0x10   1 display offset H (signed value, -32...32)
0x11   1 ntd
0x12   1 language
     
value Description
0 english
1 german
2 french
3 spanish
4 italian
5 dutch
0x13   1 flags
     
bit(s)   Description
7   ? (=0)
6   ? (=0)
5   ? (=1)
4   ? (=0)
3   ? (=1)
2   0: mono 1: stereo
1   ? (=0)
0   ? (=0)
0x14   2*12 Flash ID
0x2c   4 wireless Keyboard ID
0x30   4*2 wireless PAD ID
0x38   1 last DVD Errorcode
0x39   1 padding/unused/reserved
0x3a   2*2 Flash ID checksum
0x3e   2 padding/unused/reserved

index

10.5.2  Operation


10.5.2.1   read

10.5.2.2   write

index

10.5.3  Checksums


the SRAM data is protected against corruption by a simple additive checksum which is calculated like this:

void checksums (unsigned short *buf, unsigned short *c1, unsigned short *c2) 
{ 
int i; 
    *c1 = 0; *c2 = 0; 
    for (i = 0;i<4;++i) 
    { 
        *c1 += buf[0x06 + i]; 
        *c2 += (buf[0x06 + i] ^ 0xFFFF); 
    } 
} 
index

10.6  AD16


AD16 is on channel 2, as device 0. Probably its used for debugging purposes. AD16 is the 32-bit register, keeping bootrom "trace-step".
index

10.6.1  Operation


10.6.1.1   init

10.6.1.2   write

10.6.1.3   read

index

10.6.2  Trace-Step Values


10.6.2.1   BS

0x01000000 AD16 Inited, cache lines 320, 340,360, 380, 3a0 prefetched
0x02000000 cache line 0x3e0 prefetched
0x03000000 rest of cachelines prefetched
0x04000000 ramtest passed
0x05000000 ramtest error
0x06000000 ramtest error

10.6.2.2   BS2

0x00000800 System Init
0x00000900 DVD Init
0x00000a00 Card Init
0x00000b00 video init
0x00000c00 final before menu

index

10.7  Memory Cards


Product Blocks Mega bits Mega bytes Vendor Chip
Memory Card 59 64 4 0.5 Nintendo Macronix MX25L4001 Serial Flash ROM
Action Replay memory card 64 4 0.5 Datel Macronix MX25L4004 4M-Bit(4Mx1) Serial Flash ROM
Memory Card '4 Mega' 64 4 0.5 3rd Party WINBOND 512K*8 CMOS flash memory (Winbond,W29C040P-90,215275901,216GJRA)
Memory Card 123 128 8 1 Nintendo (*)  
Memory Card '8 Mega' 128 8 1 3rd Party  
Memory Card 251 256 16 2 Nintendo  
Memory Card 507 512 32 4 Nintendo (*)  
Memory Card 1019 1024 64 8 Nintendo  
Memory Card '64 Mega' 1024 64 8 3rd Party  
USB Memory Adaptor 64M / 1019 blocks 1024 64 8 EMS  
Memory Card 2043 2048 128 16 Nintendo (*)  

(*) never seen those, appearently supported but never manufactured.

as you can see the products are named in reference to their useable capacity in blocks or total size in mega bits. The theoretical maximum size for a memory card is 128 mega bits (16 mega bytes, 2048 blocks).
index

10.7.1  Commands


Command len indata len outdata len Description
0x8500 2 - - ID 2 get ID
0x8300 2 - - Status 1 get Card Status
0x89 1 - - - - clear Card Status
0x52 1 offset, 0x00000000 8 Block Data <=0x200 read Block
0xf40000 3 - - - - erase Card
0xf1 1 Sector 2 - - erase Sector
0xf2 1 Block offset 4 Block Data <=0x80 write Block


index

10.7.2  Operation


10.7.2.1   unlocking

original memory cards (those manufactured by nintendo) need to be 'unlocked' before they can be accessed. this is appearently done by a small dsp program.

to do
10.7.2.2   get ID


    10.7.2.2.1  Card IDs  
10.7.2.3   get Status


    10.7.2.3.1  Status Bits  
7 0
x... ...r
bit(s)   description
7 x 1: erase in Progress (?)
0 r 1: Card ready (?)

10.7.2.4   clear Status

10.7.2.5   read Block

max offset is 16*1024*1024, max block len is 512 bytes.
10.7.2.6   erase Card

10.7.2.7   erase Sector

10.7.2.8   write Block

index

10.8  Ethernet Adapter


The Macronix chip found in the ethernet adapter (mx98730ec) seems to be a reenginered version of the mx98726 or mx98728 (or the ec type respectivly).
index

10.8.1  registers


Registerblock Base Size of Registerblock common access size
0x00 0x1000 1


These are the actual Chip Registers which match with the descriptions in MXs documents.

0x00 1 r/w NCRA - Network Control Register A (0x08 ?)
7 0
???? ?ep?
bit(s)   description
7   INTCLK - must be 0 for normal operation.
6   INTMODE - Interrupt Mode: Set for the active high interrupt, reset for the active low interrupt case.
5   LB1 - Loopback mode
4   LB0
   
LB1 LB0 description
0 0 Mode0 - Normal mode
0 1 Mode1 - internal FIFO Loopback
1 0 Mode2 - internal NWAY Loopback
1 1 Mode3 - internal PMD Loopback
3   SR - Start Receive : Enable the MAC to receive packets. Default is disabled.
2 e ST1 - Start Transmit Command/Status
1 p ST0
0   RESET - Software reset.
bit 1 and bit 2 will get cleared after a packet has been sent


0x01 1 r/w NCRB - Network Control Register (0x11, 0x12 ?)
7 0
   
bit(s)   description
6-7   RXINTC - Recieve Interrupt Counter
5   HBD - Heart Beat Check Disable
4   AB - "pass all broadcast frames"
3   PB - "pass bad frames"
2   PM - "pass all multicast"
1   CA - capture effect mode
0   PR - promiscuous mode


0x02 1 r/w GMAC Test Register A : TRA
bit(s)   Description
7   SB - Start/Stop Back-off counter
6   FC - Forced Collision
5   RWD - Receive Watchdog Disable
4   RWR - Recieve Watchdog Release
1-3   TMODE - Test Moder Select bits
0   TEST - Test mode enable


0x03 1 r/w GMAC Test Register B : TRB
bit(s)   Description
7   BFSTATUS
6   BFS1
5   BKCNTLB
4   BFS0
3   COLCNTCB
2   RDNCNTSB
1   RDNCNTCB
0   FKD - Flaky Oscillator Disable


0x04 1 r/w LTPS - Last Transmitted Packet Status (transmit error code ?)
bit(s)   Description
7   TERR - Transmit Error
6   OWC - Out of Window Collision
5   UF - TX FIFO Underflow
4   CRSLOST - Carrier Sense Lost
3   CC3 - Collision Count Bit 3
2   CC2
1   CC1
0   CC0


0x05 1 r/w LRPS - Last Recieved Packet Status
bit(s)   Description
7   RERR - Recieve Error
6   RF - Runt Frame
5   MF - Multicast Frame address
4   RW - Recieve Watchdog
3   FO - FIFO Overrun
2   FAE - Frame Alignment Error
1   CRC - CRC error
0   BF - RX Packet Buffer Full Error


0x06 1 r/w MPCL - Missed Packet Counter
bit(s)   Description
0-7   MISSCNT - Miss Packet Counter LSB


0x07 1 r/w MPCL - Missed Packet Counter
bit(s)   Description
0-7   MISSCNT - Miss Packet Counter MSB


0x08 1 r/w IMR - Interrupt Mask Register (IRQ Mask)
bit(s)   Description
7   RBFIM - RX Buffer Full Interrupt Mask
6   BUSEIM - Bus Error Interrupt Mask
5   FIFOEIM - FIFO Error Interrupt Mask
4   TEIM - Transmit Error Interrupt Mask
3   REIM - Receive Error Interrupt Mask
2   TIM - Transmit Interrupt Mask
1   RIM - Recieved Interrupt Mask
0   FRAGIM - Fragment Counter Interrupt Mask


0x09 1 r/w IR - Interrupt Register (irq status)
7 0
???t esr?
bit(s)   description
7   RBFI - RX Buffer Full Interrupt
6   BUSEI - Bus Error Interrupt
5   FIFOEI - FIFO Error Interrupt
4 t TEI - Transmit Error Interrupt (1: transmit error)
3 e REI - Recieve Error Interrupt (1: receive error ?)
2 s TI - Transmit OK Interrupt (1: packet sent ?)
1 r RI - Receive OK Interrupt (1: packet received ?)
0   FRAGI - Fragment Counter Interrupt


0x0a 2 r/w BP - Boundary Page Pointer Register (0x0100 ?)


0x0c 2 r/w TLBP - TX Low Boundary Page Pointer Register


0x0e 2 r/w TWP - Transmit Buffer Write Page Pointer Register


0x10 2 ?/? unused/reserved


0x12 2 r/w TRP - Transmit Buffer Read Page Pointer Register


0x14 2 r/w RXINTT - Receive Interrupt Timer


0x16 2 r/w RWP - Receive Buffer Write Page Pointer Register


0x18 2 r/w RRP - Receive Buffer Read Page Pointer Register


0x1a 2 r/w RHBP - RX High Boundary Page Pointer Register (0x0f00 ?)


0x1c 1 r/w EEPROM Interface Register:
bit(s)   Description
6-7   unused/reserved
5   EELD -
4   EESEL -
3   EEDO - Serial Data Output from external EEPROM clock device
2   EEDI - Serial Data Input to external EEPROM clock device
1   EECK - Serial Clock output to external EEPROM clock device (< 1 MHz)
0   EECS - Chip Select output to external EEPROM clock device


0x1d 1 r/w BICT - Bus Integrity Check Timer


0x1e 2 r/? IORDP - IO Data Port Page Pointer Register


0x20 6 r/w PAR0-PAR5 Network Address Filtering Registers - Physical (MAC) Address


0x26 8 r/w MAR0-PAR7 Network Address Filtering Registers - Hash Table Register
 
 
0x2e 1 r/w ANALOG - Transceiver Control Register
bit(s)   Description
6-7   unused/reserved (must be 0)
5   RST100 - Reset for NORMAL mode
4   RSQ - Reduced SQuelch Enable
3   PWD100 - Reset for NORMAL mode
2   PWD10B - Set for NORMAL mode
1   DS130 - Must be 1 for NORMAL mode with auto-compensation
0   DS120 - Must be 1 for NORMAL mode with auto-compensation
 
 
0x2f 1 r/w DINTVAL - DMA Interval Timer


0x30 1 r/w NWAYC - NWAY Configuration Register
bit(s)   Description
7   LTE - Link Test Enable
6   NTTEST - reserved
3-5   ANS - Autonegotiation Status
2   ANE - Autonegotiation Enable
1   PS100/10 - Port Select 100/10 Mbit
0   FD - Full Duplex Mode


0x31 1 r/- NWAYS - NWAY Status Register
bit(s)   description
7   10TXH - NWAY 10 TX Half duplex Mode
6   10TXF - NWAY 10 TX Full duplex Mode
5   100TXH - NWAY 100 Half duplex Mode
4   100TXF - NWAY 100 TX Full duplex Mode
3   ANCLPT - Auto-negotiation Completion
2   LPNWAY - Link Partner NWAY Status
1   LS100 - Physical Link Status of 100Mbps TP
0   LS10 - Physical Link Status of 10 Mbps TP


0x32 1 r/w GCA - GMAC Configuration A Register (0x08 ?)
bit(s)   description
7   unused/reserved (must be 0)
6   TXFIFOCNTEN
5   AUTOPUB - Auto Page Update option
4   unused/reserved
3   ARXERRB - Accept RX packet with error
2   SLOWSRAM
1   PBW - Packet Buffer Data Width
0   BPSCRM - Bypass Scrambler


0x33 1 r/w GCB - GMAC Configuration B Register
bit(s)   description
4-7   unused/reserved
2-3   RTHD - Recieve FIFO Threshold
0-1   TTHD - Transmit FIFO Threshold
 
 
0x34 4 -/w TWD - IO Mapped Data Port

 
0x38 2 -/- unused/reserved
 
 
0x3a 1 r/w Host Interface Protocol Register (0x08 ?)
7 0
   
bit(s)   description
2   DREQB - DREQB-pin status bit
1   STIORD/RRDYB - (no data available ?)
0   WRDYB - Write Packet Memory Ready Bar Status Indication
 
 
0x3b 1 r/- LPC - Link Partner Link Code Register
 
 
0x3c 1 r/w TX/RX DMA Status Register
 
 
0x3d 1 r/w MISC1 - MISC Control Register 1
 
 
0x3e 2 r/w TXFIFOCNT - TX FIFO Byte Counter
 
 
0x40 4 r/- RRD - RX Burst Read Data Port
 
 
0x44 2 r/- ID1 - 'MX'
 
 
0x46 2 r/- ID2 - '0001'
 
 
0x48 4 w WRTXFIFOD - Write TX FIFO Data Port Register (output queue)
 

0x4c 4 r/- IORD - IO Read Data Port Register
 

0x50 1 r/w MISC2 - MISC Control Register 2 (0x80 ?)


0x51 1 ? (?)
 
 
note: register 0x51 is not documented in mx98728 datasheet 
 
0x52 2 r/- HRPKTCNT - Host Recieve Packet Counter
 
 
0x54 3 r/w FRAGCNT - Host DMA Fragment Counter
 
 
note: 0x56 is the last reg of a mx98726 and mx98728
 
0x5b ? ?/? (?)
 
 
0x5c ? ?/? (?)
0x36 = disconnect network
 

0x5e ? ?/? (0x01 ?)


0x60 ? ?/? (0x00 ?)


0x100 0xf00 ?/w input queue (?)
- select for reading
- IMM read block

index

10.8.2  command-registers


Registerblock Base Size of Registerblock common access size
0x00 0x10 1


These Registers are related to the EXI Interface on the Ethernet-Adapter, not to the actual Ethernet Chip.

0x00 ? ?/? EXI id
- select register for reading
- IMM read 4 bytes (0x04,0x02,0x02,0x00)
 
 
0x01 ? ?/? ?
 
 
0x02 ? ?/? irq mask
 
 
0x03 ? ?/? irq status
7 0
r??p h???
bit(s)   description
7 r irq from MX chip
6 ? 'killing' irq (should not get this one)
5 ? command error
4 p challange/response request
3 h challange/response status
 
 
0x04 ? ?/? ? (revid_eth)
- select register for writing
- IMM write 0xd1,0x07 (16bit)
 
 
0x05 ? ?/? ? (0x4e ?)
 
 
0x06 ? ?/? ?
 
 
0x07 ? ?/? ?
 
 
0x08 ? ?/? Challenge
- select for reading
- IMM read 4 bytes
 
 
0x09 ? ?/? Response
- select for writing
- IMM write 4 bytes
 
 
0x0a ? ?/? ?
 
 
0x0b ? ?/? Status
1: challenge/response ok
2: challenge/response failed
 
 
0x0c ? ?/? ?
 
 
0x0d ? ?/? ?
 
 
0x0e ? ?/? ?
 
 
0x0f ? ?/? ? (0x00 ?)
 
index

10.8.3  Operation


10.8.3.1   selecting a register for reading

10.8.3.2   selecting a register for writing

10.8.3.3   selecting command-register for reading   10.8.3.4   selecting command-register for writing  
10.8.3.5   init

10.8.3.6   challenge/response calculation     
 
u32 ETHChallResp(u32 val,u32 revid_0,u32 revid_eth_0,u32 revid_eth_1)
{
    u32 c0,c1,c2,c3;
 
    c0=(
          ( ((val&0xff000000)> >24) +
            ((val&0x00ff0000)> >16) * 0xc1 + 0x18 + revid_0 )
        ^ ( ((val&0x000000ff) * ((val&0x0000ff00)> >8)) + 0x90 )
       ) & 0xff;
      c1=(
          ( ((val&0x00ff0000)> >16) + ((val&0x0000ff00)> >8) + 0x90 )
        ^ ( c0 + ((val&0xff000000)> >24) - 0xc1 )
       ) & 0xff;
      c2=(
          ( ((val&0x0000ff00)> >8) + 0xc8 )
        ^ ( c0 + ((revid_eth_0 + revid_0 * 0x23) ^ 0x19) )
       ) & 0xff;
      c3=(
          ( ((val&0xff000000)> >24) + 0xc1 )
        ^ ( (val&0x000000ff) + ((revid_eth_1 + 0xc8) ^ 0x90) )
       ) & 0xff;
      return ((c0 < < 24) | (c1 < < 16) - (c2 < < 8) - (c3));
} 
10.8.3.7   send packet (outside interrupt)

10.8.3.8   poll received packets (outside interrupt)

10.8.3.9   received packet format

first 4 bytes of a received packet contains a descriptor about the packet that has been received

31 24 23 16 15 8 7 0
.... .... yyyy .... xxxx xxxx .... ....
bit(s)   Description
20-23 y length of received packet lo bits (shift 4 down)
8-15 x length of received packet hi bits (shift 4 up and OR with lo bits)
length is inclusive the 4 byte descriptor!

index

10.9  UART


(note: the existance of an UART is highly speculative and was never proved for a fact) to do
index

10.10  SD Cards


SD cards support an SPI mode, which is essentially the same hardware protocol that official memory cards use. Notice the use of the word hardware, not software. SD cards uses the MMC command set for communication and data transfer, while Nintendo memory cards use a custom Macronix command set. This means that you should not waste your time trying to get standard GC programs to recognize the SD card as a normal memory card, because it will not work without specific code to access the SD card. Even if you make the raw sector data on the SD card the same as the Nintendo memory card, the low-level commands to access the sectors differ between the two. However, since the hardware bus and protocol are the same, an SD adapter can essentially be made with straight-through connections from the EXI bus to the SD card signals. to do
index

10.11  Viper 'Modchip'


this is a 3rd-Party 'modchip' used to override the IPL with a custom program. todo
index

10.12  Ripper III GC 'Modchip'


todo
index

10.13  Qoob 'Modchip'


todo
index

10.14  NinjaMOD 'Modchip'


todo
index

10.15  Mario Party Microphone


todo
index