yet another PlayStationPortable Documentation

8 Hardware Registers

8.1 ? (threadman)

Registerblock Base	Size of Registerblock	common access size
`0xbc000000`		32 bit

0xbc000000 4 r/w Memory Protection 0x08000000 -> 0x081FFFFFF

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
31		`0x081c0000 -> 0x081FFFFFF Kernel Write Enable`
30		`0x081c0000 -> 0x081FFFFFF Kernel Read Enable`
29		`0x081c0000 -> 0x081FFFFFF User Write Enable`
28		`0x081c0000 -> 0x081FFFFFF User Read Enable`
27		`0x08180000 -> 0x081BFFFFF Kernel Write Enable`
26		`0x08180000 -> 0x081BFFFFF Kernel Read Enable`
25		`0x08180000 -> 0x081BFFFFF User Write Enable`
24		`0x08180000 -> 0x081BFFFFF User Read Enable`
23		`0x08140000 -> 0x0817FFFFF Kernel Write Enable`
22		`0x08140000 -> 0x0817FFFFF Kernel Read Enable`
21		`0x08140000 -> 0x0817FFFFF User Write Enable`
20		`0x08140000 -> 0x0817FFFFF User Read Enable`
19		`0x08100000 -> 0x0813FFFFF Kernel Write Enable`
18		`0x08100000 -> 0x0813FFFFF Kernel Read Enable`
17		`0x08100000 -> 0x0813FFFFF User Write Enable`
16		`0x08100000 -> 0x0813FFFFF User Read Enable`
15		`0x080c0000 -> 0x080FFFFFF Kernel Write Enable`
14		`0x080c0000 -> 0x080FFFFFF Kernel Read Enable`
13		`0x080c0000 -> 0x080FFFFFF User Write Enable`
12		`0x080c0000 -> 0x080FFFFFF User Read Enable`
11		`0x08080000 -> 0x080BFFFFF Kernel Write Enable`
10		`0x08080000 -> 0x080BFFFFF Kernel Read Enable`
9		`0x08080000 -> 0x080BFFFFF User Write Enable`
8		`0x08080000 -> 0x080BFFFFF User Read Enable`
7		`0x08040000 -> 0x0807FFFFF Kernel Write Enable`
6		`0x08040000 -> 0x0807FFFFF Kernel Read Enable`
5		`0x08040000 -> 0x0807FFFFF User Write Enable`
4		`0x08040000 -> 0x0807FFFFF User Read Enable`
3		`0x08000000 -> 0x08003FFFF Kernel Write Enable`
2		`0x08000000 -> 0x08003FFFF Kernel Read Enable`
1		`0x08000000 -> 0x08003FFFF User Write Enable`
0		`0x08000000 -> 0x08003FFFF User Read Enable`

0xbc000004 4 r/w Memory Protection 0x08200000 -> 0x083FFFFFF

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
31		`0x083c0000 -> 0x083FFFFFF Kernel Write Enable`
30		`0x083c0000 -> 0x083FFFFFF Kernel Read Enable`
29		`0x083c0000 -> 0x083FFFFFF User Write Enable`
28		`0x083c0000 -> 0x083FFFFFF User Read Enable`
27		`0x08380000 -> 0x083BFFFFF Kernel Write Enable`
26		`0x08380000 -> 0x083BFFFFF Kernel Read Enable`
25		`0x08380000 -> 0x083BFFFFF User Write Enable`
24		`0x08380000 -> 0x083BFFFFF User Read Enable`
23		`0x08340000 -> 0x0837FFFFF Kernel Write Enable`
22		`0x08340000 -> 0x0837FFFFF Kernel Read Enable`
21		`0x08340000 -> 0x0837FFFFF User Write Enable`
20		`0x08340000 -> 0x0837FFFFF User Read Enable`
19		`0x08300000 -> 0x0833FFFFF Kernel Write Enable`
18		`0x08300000 -> 0x0833FFFFF Kernel Read Enable`
17		`0x08300000 -> 0x0833FFFFF User Write Enable`
16		`0x08300000 -> 0x0833FFFFF User Read Enable`
15		`0x082c0000 -> 0x082FFFFFF Kernel Write Enable`
14		`0x082c0000 -> 0x082FFFFFF Kernel Read Enable`
13		`0x082c0000 -> 0x082FFFFFF User Write Enable`
12		`0x082c0000 -> 0x082FFFFFF User Read Enable`
11		`0x08280000 -> 0x082BFFFFF Kernel Write Enable`
10		`0x08280000 -> 0x082BFFFFF Kernel Read Enable`
9		`0x08280000 -> 0x082BFFFFF User Write Enable`
8		`0x08280000 -> 0x082BFFFFF User Read Enable`
7		`0x08240000 -> 0x0827FFFFF Kernel Write Enable`
6		`0x08240000 -> 0x0827FFFFF Kernel Read Enable`
5		`0x08240000 -> 0x0827FFFFF User Write Enable`
4		`0x08240000 -> 0x0827FFFFF User Read Enable`
3		`0x08200000 -> 0x08203FFFF Kernel Write Enable`
2		`0x08200000 -> 0x08203FFFF Kernel Read Enable`
1		`0x08200000 -> 0x08203FFFF User Write Enable`
0		`0x08200000 -> 0x08203FFFF User Read Enable`

0xbc000008 4 r/w Memory Protection 0x08400000 -> 0x085FFFFFF

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
31		`0x085c0000 -> 0x085FFFFFF Kernel Write Enable`
30		`0x085c0000 -> 0x085FFFFFF Kernel Read Enable`
29		`0x085c0000 -> 0x085FFFFFF User Write Enable`
28		`0x085c0000 -> 0x085FFFFFF User Read Enable`
27		`0x08580000 -> 0x085BFFFFF Kernel Write Enable`
26		`0x08580000 -> 0x085BFFFFF Kernel Read Enable`
25		`0x08580000 -> 0x085BFFFFF User Write Enable`
24		`0x08580000 -> 0x085BFFFFF User Read Enable`
23		`0x08540000 -> 0x0857FFFFF Kernel Write Enable`
22		`0x08540000 -> 0x0857FFFFF Kernel Read Enable`
21		`0x08540000 -> 0x0857FFFFF User Write Enable`
20		`0x08540000 -> 0x0857FFFFF User Read Enable`
19		`0x08500000 -> 0x0853FFFFF Kernel Write Enable`
18		`0x08500000 -> 0x0853FFFFF Kernel Read Enable`
17		`0x08500000 -> 0x0853FFFFF User Write Enable`
16		`0x08500000 -> 0x0853FFFFF User Read Enable`
15		`0x084c0000 -> 0x084FFFFFF Kernel Write Enable`
14		`0x084c0000 -> 0x084FFFFFF Kernel Read Enable`
13		`0x084c0000 -> 0x084FFFFFF User Write Enable`
12		`0x084c0000 -> 0x084FFFFFF User Read Enable`
11		`0x08480000 -> 0x084BFFFFF Kernel Write Enable`
10		`0x08480000 -> 0x084BFFFFF Kernel Read Enable`
9		`0x08480000 -> 0x084BFFFFF User Write Enable`
8		`0x08480000 -> 0x084BFFFFF User Read Enable`
7		`0x08440000 -> 0x0847FFFFF Kernel Write Enable`
6		`0x08440000 -> 0x0847FFFFF Kernel Read Enable`
5		`0x08440000 -> 0x0847FFFFF User Write Enable`
4		`0x08440000 -> 0x0847FFFFF User Read Enable`
3		`0x08400000 -> 0x08403FFFF Kernel Write Enable`
2		`0x08400000 -> 0x08403FFFF Kernel Read Enable`
1		`0x08400000 -> 0x08403FFFF User Write Enable`
0		`0x08400000 -> 0x08403FFFF User Read Enable`

0xbc00000c 4 r/w Memory Protection 0x08600000 -> 0x087FFFFFF

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
31		`0x087c0000 -> 0x087FFFFFF Kernel Write Enable`
30		`0x087c0000 -> 0x087FFFFFF Kernel Read Enable`
29		`0x087c0000 -> 0x087FFFFFF User Write Enable`
28		`0x087c0000 -> 0x087FFFFFF User Read Enable`
27		`0x08780000 -> 0x087BFFFFF Kernel Write Enable`
26		`0x08780000 -> 0x087BFFFFF Kernel Read Enable`
25		`0x08780000 -> 0x087BFFFFF User Write Enable`
24		`0x08780000 -> 0x087BFFFFF User Read Enable`
23		`0x08740000 -> 0x0877FFFFF Kernel Write Enable`
22		`0x08740000 -> 0x0877FFFFF Kernel Read Enable`
21		`0x08740000 -> 0x0877FFFFF User Write Enable`
20		`0x08740000 -> 0x0877FFFFF User Read Enable`
19		`0x08700000 -> 0x0873FFFFF Kernel Write Enable`
18		`0x08700000 -> 0x0873FFFFF Kernel Read Enable`
17		`0x08700000 -> 0x0873FFFFF User Write Enable`
16		`0x08700000 -> 0x0873FFFFF User Read Enable`
15		`0x086c0000 -> 0x086FFFFFF Kernel Write Enable`
14		`0x086c0000 -> 0x086FFFFFF Kernel Read Enable`
13		`0x086c0000 -> 0x086FFFFFF User Write Enable`
12		`0x086c0000 -> 0x086FFFFFF User Read Enable`
11		`0x08680000 -> 0x086BFFFFF Kernel Write Enable`
10		`0x08680000 -> 0x086BFFFFF Kernel Read Enable`
9		`0x08680000 -> 0x086BFFFFF User Write Enable`
8		`0x08680000 -> 0x086BFFFFF User Read Enable`
7		`0x08640000 -> 0x0867FFFFF Kernel Write Enable`
6		`0x08640000 -> 0x0867FFFFF Kernel Read Enable`
5		`0x08640000 -> 0x0867FFFFF User Write Enable`
4		`0x08640000 -> 0x0867FFFFF User Read Enable`
3		`0x08600000 -> 0x08603FFFF Kernel Write Enable`
2		`0x08600000 -> 0x08603FFFF Kernel Read Enable`
1		`0x08600000 -> 0x08603FFFF User Write Enable`
0		`0x08600000 -> 0x08603FFFF User Read Enable`

0xbc000030 4 r/w

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
8-9		1: thread profile mode 3: make profiler accessable in usermode at `0x5c400000` (used in threadman)

0xbc000044 4 r/w

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
9		(used in threadman)

index

8.2 System Config

Registerblock Base	Size of Registerblock	common access size
`0xbc100000`		32 bit

0xbc100000 4 r/w

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
25-16		Number of NMI that occured
0-9

NMI related, looks like enable mask (upper 16bits: kernel lower:user)

0xbc100004 4 r/w

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)

description

NMI related, looks like IRQ latches (written to ACK)

bc100010,..28,..30 might have flags for individual NMI sources

0xbc100040 4 r/w

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
0-1		`RAM size: 0-16M; 1-32M; 2-64M; 3-128M`

0xbc100044 4 r/w SC/ME RPC Interrupt

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
0		`write 1 to post interrupt`

The RPC works by posting an interrupt to the other processor using the following code: asm("syncn"); _sw(1, 0xBC100044); asm("syncn"); If you do that on the SC you interrupt (interrupt 31 ?) the ME, on the ME is does the reverse. On the SC side that is wrapped up in sceSysregInterruptToOther.

0xbc100048 4 r/w SC/ME Semaphore

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)

description

For semaphores there seems to be a shared lock register at 0xBC100048 which both the ME and the SC can write to and it used as a spin lock.

0xbc10004c 4 r/w RESET ENABLE

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
10		KIRK
8-9		MSIF
7		ATA
6		USB
5		AVC
4		VME
3		AW
2		ME
1		SC
0		Top

0xbc100050 4 r/w BUS CLOCK ENABLE

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
15-16		Audio
14		UART4 ?
13		EMCSM (nand)
12		?
10-11		MSIF
9		USB
8		ATA
7		KIRK
5-6		DMAC
4		DMACPlus
3		AW ?
2		AW ?
1		AW ?
0		ME

0xbc100078 4 r/w IO ENABLE

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
19-24		SPI
13-18		UART
12		PWM
11		KEY
10		AUDIO ?
9		SIRCS
8		IIC
6-7		AUDIO
5		LCDC
3-4		MSIF
2		ATA
1		USB
0		EMCSM (nand)

0xbc10007c 4 r/w GPIO IO ENABLE

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)

description

0xbc100080 4 r/w

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)

description

Access to system memory causes an exception unless 0x00000007 is written into this register.

index

8.3 ? (interruptman)

Registerblock Base	Size of Registerblock	common access size
`0xbc300000`		32 bit

0xbc300000 4 r/w

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)

description

upper 2 bits 'enable' ?, upper bits=mask ? (used in irq handler)

0xbc300008 4 r/w

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)

description

upper bits=mask,low 4 bits='ack,enable' ? (used in irq handler)

0xbc300010 4 r/w

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)

description

mask ? (used in irq handler)

0xbc300018 4 r/w

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)

description

mask ? (used in irq handler)

index

8.4 Profiler

Registerblock Base	Size of Registerblock	common access size
`0xbc400000`		32 bit

0xbc400000 4 r/w ENABLE

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)

description

0	profiling disabled
1	profiling enabled

first clear all counter registers by writing 0 to them, then enable profiling. counter registers are as follows:

Address	Unit	Description
`0xbc400004`	cycles	systemck
`0xbc400008`	cycles	cpu ck
`0xbc40000c`	cycles	stall (total)
`0xbc400010`	cycles	stall (internal)
`0xbc400014`	cycles	stall (memory)
`0xbc400018`	cycles	stall (COPz)
`0xbc40001c`	cycles	stall (VFPU)
`0xbc400020`	cycles	sleep
`0xbc400024`	cycles	bus access
`0xbc400028`	times	uncached load
`0xbc40002c`	times	uncached store
`0xbc400030`	times	cached load
`0xbc400034`	times	cached store
`0xbc400038`	times	I cache miss
`0xbc40003c`	times	D cache miss
`0xbc400040`	times	D cache wb
`0xbc400044`	instructions	COP0 inst
`0xbc400048`	instructions	FPU inst
`0xbc40004c`	instructions	VFPU inst
`0xbc400050`	cycles	local bus

index

8.5 ME Control

Registerblock Base	Size of Registerblock	common access size
`0xbcc00000`		32 bit

0xbcc00010 4 r/w

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
0		reset. set to 1, then wait until 0

0xbcc00030 4 r/w

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)

description

set to 0x00000008 at ME Reset

0xbcc00040 4 r/w

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)

description

set to 0x00000002 at ME Reset

0xbcc00070 4 r/w

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)

description

set to 0x00000001 at ME Reset

index

8.6 NAND Flash

Registerblock Base	Size of Registerblock	common access size
`0xbd101000`	0x100 ?	32 bit

0xbd101000 4 r NAND Control Register

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
18-31		?
17		Calculate ECC for user page during writing
16		Calculate ECC for user page during reading
0-15		?

0xbd101004 4 r Status ?

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
7		0: NAND is not write-protected, 1: NAND is write-protected
0		0=busy, 1=ready

0xbd101008 4 w Command

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
0-7		Command (see below)

0xbd10100c 4 w Address

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
10-26		Physical page to access

0xbd101014 4 w Nand Reset Reg

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
0		Reset NAND controller to default state?

0xbd101020 4 w Nand DMA Address Reg

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
10-26		Physical page to access

0xbd101024 4 w NAND DMA Control

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
19-31
9		Set to enable DMA transfer? (ECC?) Or set to clear previous status?
8		Set to enable DMA transfer? (USER?) Or set to clear previous status?
2-7		?
1		0 -> Transfer from Nand to Nand Data Buffer 1 -> Transfer from Nand Data Buffer to Nand
0		Set to enable DMA transfer

0xbd101028 4 r NAND DMA Status

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
0-31		!=0 means write failed ?

0xbd101038 4 rw NAND DMA Intr

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)

description

Probably the same bits as bd101024

0xbd101200 4 w resume (?)

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
0-31		write 0x0b040205 to resume?

0xbd101300 4 rw NAND serial Data

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
24-31		byte 3
16-23		byte 2
8-15		byte 1
0-7		byte 0

0xbff00000 512 rw Nand DMA User Data Buf

512 bytes buffer to hold DMA data for a user page.

0xbff00800 4 rw Nand User ECC Reg

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
0-31		Hardware calculated ECC for a user page

0xbff00900 16 rw Nand DMA Spare Data Buf

16 bytes buffer to hold DMA data for a spare page.

index

8.6.1 Command Set

Function	1st Cycle	2nd Cycle	Acceptable when Busy
Read 1	0x00/0x01		no
Read 2	0x50		no
Read ID	0x90		no
Reset	0xff		yes
Page Program	0x80	0x10	no
Copy-Back Program	0x00	0x8a	no
Block Erase	0x60	0xd0	no
Read Status	0x70		yes

index

8.6.2 Read ID

write 0x90 to the Command Register
write 0x00 to address input
two sequential read cycles return
- manufacture code
- device code

index

8.6.3 read from NAND

Write appropriate flags to Nand Control reg (bd1010000)
Write page number to Nand DMA Addr reg (bd101020)
Clear appropriate flags in the Nand DMA Intr reg (bd101038)
Start DMA transfer by writing the appropriate flags to the Nand DMA control reg (bd101024)
Wait for interrupt
Copy user data from Nand User Data buf (bff00000 - bff00200) (careful with cache!)
Check User ECC status (?) (bff00800)
Copy ECC value from from Nand User ECC buf (bff00800)
Copy spare data from Nand Spare Data buf (bff00900)
Check Spare ECC manually

index

8.6.4 write to NAND

Copy user data to Nand User Data buf (bff00000 - bff00200) (careful with cache!)
Write ECC value to Nand User ECC buf (bff00800) (Alternatively, the hw might be able to generate it)
Write appropriate flags to Nand Control reg (bd1010000)
Write spare data to Nand Spare Data buf (bff00900 - bff00910)
Write page number to Nand DMA Addr reg (bd101020)
Clear appropriate flags in the Nand DMA Intr reg (bd101038)
Start DMA transfer by writing the appropriate flags to Nand DMA control reg (bd101024)
Wait for interrupt and process accordingly

(Maybe it's possible to write data using the serial data register too)

index

8.7 KIRK - Decryption Engine

Registerblock Base	Size of Registerblock	common access size
`0xbde00000`		32 bit

0xbde00000 4 r/w Signature

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
		`'K' 'I' 'R' 'K'`

0xbde00004 4 r/w Version

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
		`version: '0' '0' '1' '0'`

0xbde00008 4 r/w Error

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
		`set to 1 on incomplete processing`

0xbde0000c 4 r/w StartProcessing

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
		`set this to 1 or 2 to start phase 1/2 of the processing`

0xbde00010 4 r/w command

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s) description

0-4

command	dest		source		extra	description

`0x01`	`buf`	`size`	`buf+0x40`	`size+0x40`		`decrypt`	memlmd, mesg_led
`0x02`
`0x03`
`0x04`	`buf`	`size+0x14`	`buf`	`size+0x14`	`0x04,code`	`block cypher`	chnnlsv, memab
`0x05`	`buf`	`size+0x14`	`buf`	`size+0x14`	`0x04,0x0100`	`block cypher`	chnnlsv
`0x06`
`0x07`	`buf`	`size+0x14`	`buf`	`size+0x14`	`0x05,code`	`block cypher, scramble`	memlmd, mesg_led,chnnlsv, memab
`0x08`	`buf`	`size+0x14`	`buf`	`size+0x14`	`0x05,0x0100`	`block cypher`	chnnlsv
`0x09`
`0x0a`
`0x0b`	`buf`	`size`	`buf`	`size`		`SHA1 (size>=0x14)`	memlmd, mesg_led, memab
`0x0c`	`buf`	`0x3c`	`0`	`0`		`? some read`	memab
`0x0d`	`buf`	`0x3c`	`buf`	`0x3c`		`?`
`0x0e`	`buf`	`0x14`	`0`	`0`		`dbgsvrgetdata`	mesg_led,chnnlsv,memab,semawm
`0x0f`
`0x10`	`buf`	`0x34`	`buf`	`0x34`			memab
`0x11`	`0`	`0`	`buf`	`0x64`		`? some check`	memab
`0x12`	`0`	`0`	`buf`	`0xb8`		`? some check`	openpsid, memab

0xbde00014 4 r/w result

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
		`result of semaphore_XXXXXXXX functions (exported)`

0xbde00018 4 r/w ?

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)

description

0xbde0001c 4 r/w pattern

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
		`pattern to check status of processing`

0xbde00020 4 r/w asyncPattern

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
		`pattern set before starting an async processing`

0xbde00024 4 r/w asyncPattern_end

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
		`value of asyncPattern after processing`

0xbde00028 4 r/w pattern_end

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
		`value of pattern after processing`

0xbde0002c 4 r/w source_addr

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
		`physical address of source buffer`

0xbde00030 4 r/w dest_addr

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
		`physical address of destination buffer`

0xbde0004c 4 r/w ?

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)

description

0xbde00050 4 r/w ?

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)

description

index

8.7.1 Keys

0x6A, 0x19, 0x71, 0xF3, 0x18, 0xDE, 0xD3, 0xA2, 0x6D,
0x3B, 0xDE, 0xC7, 0xBE, 0x98, 0xE2, 0x4C, 0xE3, 0xDC,
0xDF, 0x42, 0x7B, 0x5B, 0x12, 0x28, 0x7D, 0xC0, 0x7A,
0x59, 0x86, 0xF0, 0xF5, 0xB5, 0x58, 0xD8, 0x64, 0x18,
0x84, 0x24, 0x7F, 0xE9, 0x57, 0xAB, 0x4F, 0xC6, 0x92,
0x6D, 0x70, 0x29, 0xD3, 0x61, 0x87, 0x87, 0xD0, 0xAE,
0x2C, 0xE7, 0x37, 0x77, 0xC7, 0x3C, 0x96, 0x7E, 0x21,
0x1F, 0x65, 0x95, 0xC0, 0x61, 0x57, 0xAC, 0x64, 0xD8,
0x5A, 0x6D, 0x14, 0xD2, 0x9C, 0x54, 0xC6, 0x68, 0x5D,
0xF5, 0xC3, 0xF0, 0x50, 0xDA, 0xEA, 0x19, 0x43, 0xA7,
0xAD, 0xC3, 0x2A, 0x14, 0xCA, 0xC8, 0x4C, 0x83, 0x86,
0x18, 0xAE, 0x86, 0x49, 0xFB, 0x4F, 0x45, 0x75, 0xD2,
0xC3, 0xD6, 0xE1, 0x13, 0x69, 0x37, 0xC6, 0x90, 0xCF,
0xF9, 0x79, 0xA1, 0x77, 0x3A, 0x3E, 0xBB, 0xBB, 0xD5,
0x3B, 0x84, 0x1B, 0x9A, 0xB8, 0x79, 0xF0, 0xD3, 0x5F,
0x6F, 0x4C, 0xC0, 0x28, 0x87, 0xBC, 0xAE, 0xDA, 0x00,

0x50, 0xCC, 0x03, 0xAC, 0x3F, 0x53, 0x1A, 0xFA, 0x0A,
0xA4, 0x34, 0x23, 0x86, 0x61, 0x7F, 0x97, 0x84, 0x1C,
0x1A, 0x1D, 0x08, 0xD4, 0x50, 0xB6, 0xD9, 0x73, 0x27,
0x80, 0xD1, 0xDE, 0xEE, 0xCA, 0x49, 0x8B, 0x84, 0x37,
0xDB, 0xF0, 0x70, 0xA2, 0xA6, 0x2B, 0x09, 0x4D, 0x3B,
0x29, 0xDE, 0x0B, 0xE1, 0x6F, 0x04, 0x7A, 0xC4, 0x18,
0x7A, 0x69, 0x73, 0xBF, 0x02, 0xD8, 0xA1, 0xD0, 0x58,
0x7E, 0x69, 0xCE, 0xAC, 0x5E, 0x1B, 0x0A, 0xF8, 0x19,
0xE6, 0x9A, 0xC0, 0xDE, 0xA0, 0xB2, 0xCE, 0x04, 0x43,
0xC0, 0x9D, 0x50, 0x5D, 0x0A, 0xD7, 0xFD, 0xC6, 0x53,
0xAA, 0x13, 0xDD, 0x2C, 0x3B, 0x2B, 0xBF, 0xAB, 0x7C,
0xF5, 0xA0, 0x4A, 0x79, 0xE3, 0xF1, 0x7B, 0x2E, 0xB2,
0xA3, 0xAC, 0x8E, 0x0A, 0x38, 0x9B, 0x9E, 0xAA, 0xEC,
0x2B, 0xA3, 0x75, 0x13, 0x75, 0x77, 0x98, 0x6A, 0x66,
0x92, 0x65, 0xBC, 0x97, 0x80, 0x0E, 0x32, 0x88, 0x9F,
0x64, 0xBA, 0x99, 0x8A, 0x72, 0x96, 0x9F, 0xE1, 0xE0,

index

8.8 GPIO

Registerblock Base	Size of Registerblock	common access size
`0xbe240000`		32 bit

0xbe240004 4 w Port Read

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)

description

0xbe240008 4 w Port Write

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)

description

0xbe24000C 4 w Port Clear

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)

description

index

8.9 UART4

Registerblock Base	Size of Registerblock	common access size
`0xbe4c0000`		32 bit

0xbe4c0000 4 r/w FIFO

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
0-7	r	read byte from recieve buffer
	w	write byte to transmit buffer

0xbe4c0018 4 r/w STATUS

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
5	TXFULL	1 if transmit buffer full
4	RXEMPTY	1 if recieve buffer empty

0xbe4c0024 4 w DIV1 - upper bits of Baudrate Divisor

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
		(96000000 / baudrate) > > 6

0xbe4c0028 4 w DIV2 - lower 6 bits of Baudrate Divisor

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
0-5		(96000000 / baudrate) & 0x3f

0xbe4c002c 4 w CONTROL

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
6		? (set to 1 if you want to set baudrate)
5		? (set to 1 if you want to set baudrate)

0xbe4c0030 4 w ?

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)

description

0xbe4c0034 4 w ?

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)

description

0xbe4c0044 4 w ?

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)

description

index

8.10 UART3 Headphone/Remote SIO

Registerblock Base	Size of Registerblock	common access size
`0xbe500000`		32 bit

0xbe500000 4 r/w FIFO

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
0-7	r	read byte from recieve buffer
	w	write byte to transmit buffer

0xbe500018 4 r/w STATUS

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
5	TXFULL	1 if transmit buffer full
4	RXEMPTY	1 if recieve buffer empty

0xbe500024 4 w DIV1 - upper bits of Baudrate Divisor

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
		(96000000 / baudrate) > > 6

0xbe500028 4 w DIV2 - lower 6 bits of Baudrate Divisor

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
0-5		(96000000 / baudrate) & 0x3f

0xbe50002c 4 w CONTROL

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`....`	`....`	`....`	`....`	`....`	`....`

bit(s)		description
6		? (set to 1 if you want to set baudrate)
5		? (set to 1 if you want to set baudrate)

index