Pervasive: Difference between revisions
(→CMeP Clock: Add more detailed table) |
|||
Line 1,366: | Line 1,366: | ||
=== CMeP Clock === | === CMeP Clock === | ||
The low 8 bits of the register at physical address <code>0xE3103040</code> | The low 8 bits of the register at physical address <code>0xE3103040</code> control CMeP clock speed, and maybe I/O bus speed too. | ||
This was guessed because it is used in a <code>usleep()</code>-like function to calculate the input for a <code>sleep_for_cycles()</code> function. | |||
Testing was performed using SceLT5 as a time reference (µs-accurate), and compared against the hardcoded table in <code>second_loader</code>. | |||
{| class="wikitable" | {| class="wikitable" | ||
|- | |- | ||
! Value !! | ! Value !! CMeP speed (measured) !! Table value | ||
|- | |||
| 0x0 || 41.5 MHz | |||
|rowspan="8"|N/A | |||
|- | |||
| 0x1 || 41.5MHz | |||
|- | |||
| 0x2 || 55.4MHz | |||
|- | |||
| 0x3 || 83.0MHz | |||
|- | |||
| 0x4 || 110.7MHz | |||
|- | |||
| 0x5 || 166.0MHz | |||
|- | |||
| 0x6 || 110.7MHz | |||
|- | |||
| 0x7 || 166.0MHz | |||
|- | |||
| 0x10000 || 41.5MHz || 50MHz | |||
|- | |- | ||
| | | 0x10001 || 27.7MHz || 50MHz | ||
|- | |- | ||
| | | 0x10002 || 27.7MHz || 27MHz | ||
|- | |- | ||
| | | 0x10003 || 41.5MHz || 42MHz | ||
|- | |- | ||
| | | 0x10004 || 55.3MHz || 56MHz | ||
|- | |- | ||
| | | 0x10005 || 83.0MHz || 83MHz | ||
|- | |- | ||
| | | 0x10006 || 110.7MHz || 111MHz | ||
|- | |- | ||
| | | 0x10007 || 166.0MHz || 160MHz | ||
|} | |} | ||
<code>second_loader</code> sets the register to | <code>second_loader</code> sets the register to 0x10005, meaning CMeP usually runs at 83MHz. | ||
=== CameraBus Clock === | === CameraBus Clock === |
Revision as of 11:49, 24 April 2023
Pervasive is a device that controls the clocks of most of the devices of the system.
ScePervasiveMisc (0xE3100000)
Devices can be fully disabled? by writing a 1 to the corresponding bit of the ScePervasiveMisc (PA 0xE3100000
) register. To disable the device dev_off
, do *REG32(0xE3100000 + (dev_off / 32) * 4) = 1 << (31 - (dev_off % 32))
.
Offset | Description |
---|---|
0x0000 | revision0. ex:0x80000115 |
0x0004 | Unknown - SKBL prints L2 Cache is defective if bit 0x2 is set
|
0x0130 | PERVASIVE_SYS_SBEATB - Pervasive Secure Bus Error Attribute
|
0x0134 | PERVASIVE_SYS_SBEADR - Pervasive Secure Bus Error Address
|
0x0138 | PERVASIVE_SYS_BEATB - Pervasive Bus Error Attribute
|
0x013C | PERVASIVE_SYS_BEADR - Pervasive Bus Error Address
|
0x0300 | Unknown |
0x0304 | Unknown |
0x0308 | Unknown |
revision0
Returned by SceLowio#scePervasiveGetSoCRevisionForDriver, read by SKBL/NSKBL/...
Contains the Kermit revision (see sceKernelSysrootGetKermitRevisionForKernel) and other information.
Bit mask | Information |
---|---|
0x80000000 |
Disable LPDDR2SUB |
0x30000000 |
Unknown (used by SceCrashDump) |
0x4FFE0000 |
Unknown |
0x0001FFFF |
Kermit revision |
0x000000FF |
Kermit revision (old firmwares) |
Hardware | Value |
---|---|
PCH-1100 | 0x80000042
|
VTE-1016 | 0x80000042
|
PCH-2000 | 0x80000115
|
PDEL-1000 | 0x00000042
|
ScePervasiveReset (0xE3101000)
Devices must be put out of reset (device reset disabled) before they are first used.
To enable reset of a device (put a device in reset), do *REG32(0xE3101000 + dev_off) |= mask
.
To disable reset of a device (put a device out of reset), do *REG32(0xE3101000 + dev_off) &= ~mask
.
dev_off | Access | Device | Reset Mask | Comment |
---|---|---|---|---|
0x4 | Secure? | ARM Debugger? | 1 | Of ARM coprocessor 14? |
0x10 | Non-secure | GPU | 1 | enable: ScePervasiveForDriver_3E79D3D3/disable: ScePervasiveForDriver_8A85E36B |
0x20 | Secure | ? | 1 | enable: ScePervasiveForDriver_377126CD/disable: ScePervasiveForDriver_6E11EB97 |
0x24 | Secure | ? | 1 | enable: ScePervasiveForDriver_7B0F388B/disable: ScePervasiveForDriver_4CCD40E6 |
0x28 | Secure | CompatRAM | 1 | enable: ScePervasiveForDriver_7C285361/disable: ScePervasiveForDriver_E40BED0F |
0x30 | Non-secure | Venezia | 1 | enable: ScePervasiveForDriver_28731EC5/disable: ScePervasiveForDriver_A7E64C6F |
0x34 | Non-secure | Vip | 1 | enable: ScePervasiveForDriver_31C0A98B/disable: ScePervasiveForDriver_E2D8F6C3 |
0x40 | Secure | SDIO0 | 1 | |
0x44 | Secure | SDIO1 | 1 | |
0x48 | Secure | DebugPA | 1 | |
0x4C | Secure | SceDbgSdio | 1 | |
0x50 | Secure | DMAC0 | 1 | |
0x54 | Secure | DMAC1 | 1 | |
0x58 | Secure | DMAC2 | 1 | |
0x5C | Secure | DMAC3 | 1 | |
0x60 | Secure | DMAC4 | 1 | |
0x64 | Secure | DMAC5 | 1 | |
0x68 | Secure | DMAC6 | 1 | need devmode or dipsw 0xC0 or 0xC1 or 0xC2. |
0x70 | Non-secure | Csi | 1 | Camera Serial Interface |
0x74 | ||||
0x80 | Non-secure | Dsi | 1 | |
0x84 | ||||
0x88 | Non-secure | Iftu | 1 | Integrated Facility Terminating Unit. See IFTU Registers. enable: ScePervasiveForDriver_B68254AD/disable: ScePervasiveForDriver_E92E28FF |
0x8C | Non-secure | ? | 1 | enable: ScePervasiveForDriver_7AE2F8E8/disable: ScePervasiveForDriver_17109C28 |
0x90 | Non-secure | USB/Udcd | ? | USB Device Controller. See UDC. enable: ScePervasiveForDriver_4AF7A01E/disable: ScePervasiveForDriver_13CC07C9 |
0x94 | ||||
0xA0 | Non-secure | Sdif0 (emmc) | 1 | Storage Device InterFace |
0xA4 | Sdif1 (gcsd) | |||
0xA8 | Sdif2 | |||
0xAC | Sdif3 | |||
0xB0 | Non-secure | Msif | 1 | Memory Stick InterFace. See MSIF Registers. |
0xC0 | Non-secure | I2S (Audio) | 1 | Inter-IC Sound |
0xC4 | ||||
0xC8 | ||||
0xCC | ||||
0xD0 | ||||
0xD4 | ||||
0xD8 | ||||
0xDC | ||||
0xE0 | Non-secure | SrcMix | 1 | Source Mixer |
0xE4 | ||||
0xE8 | ||||
0xF0 | Non-secure | SPDIF (Audio) | 1 | Sony/Philips Digital InterFace |
0x100 | Non-secure | Gpio | 1 | General Purpose Input/Output. See GPIO Registers. |
0x104 | Non-secure | Spi (Syscon) | 1 | Serial Peripheral Interface. See SPI Registers. |
0x108 | Spi (Motion) | |||
0x10C | Spi (OLED) | |||
0x110 | Non-secure | I2C | 1 | Inter-Integrated Circuit. See I2C Registers. |
0x114 | ||||
0x120 | Non-secure | Uart0 (Console) | 1 | Universal Asynchronous Receiver Transmitter. See UART Registers. |
0x124 | Uart1 | |||
0x128 | Uart2 | |||
0x12C | Uart3 | |||
0x130 | Uart4 | |||
0x134 | Uart5 (3G Modem) | |||
0x138 | Uart6 | |||
0x154 | Secure? | Debug Bus | 1 | Taken out of reset by SKBL if Development mode or DIPsw 0xC0/0xC1/0xC2 is set |
0x158 | Secure? | ? | 1 | |
0x160 | Secure? | LPDDR2MAIN (DDRIF0) | 1 | |
0x164 | Secure? | LPDDR2SUB (DDRIF1) | 1 | |
0x170 | ? | Timer | 1? | |
0x178 | Secure? | SPM32 | 4 | Scratch Pad Memory 32KiB |
SPM128 | 8 | Scratch Pad Memory 128KiB | ||
0x17C | Secure? | Venezia? | 1? | Must be != 0 for SceKernelBusError to dump Venezia registers. |
0x180 | Secure | VIP? | 1 | Must be != 0 for SceKernelBusError to dump VIP registers. enable: ScePervasiveForDriver_EBE9C84E/disable: ScePervasiveForDriver_8CF567AD |
0x190 | Secure | bigmac or emmc cryptor | ? | x |
ScePervasiveGate (0xE3102000)
Devices can be clock gated to preserve battery.
To enable clock gate (request the clock of a device to be enabled), do *REG32(0xE3102000 + dev_off) |= mask
.
To disable clock gate (request the clock of a device to be disabled), do *REG32(0xE3102000 + dev_off) &= ~mask
.
dev_off | Access | Device | Gate Mask | Comment |
---|---|---|---|---|
0x0 | Secure? | ? | ? | |
0x4 | Secure? | ARM Debugger? | 1 | Of ARM coprocessor 14? |
0x10 | Non-secure | GPU | v & 0xF000F | enable: ScePervasiveForDriver_39E51AE2/disable: ScePervasiveForDriver_CA0ACFC5 |
0x20 | Secure | ? | 1 | enable: ScePervasiveForDriver_8EE3AEDF/disable: ScePervasiveForDriver_3BF2A9B5 |
0x24 | Secure | ? | 1 | enable: ScePervasiveForDriver_7F4AB4AA/disable: ScePervasiveForDriver_0EBBE8DE |
0x28 | Secure | CompatRAM (2MiB) | 1 | enable: ScePervasiveForDriver_B2EE45C9/disable: ScePervasiveForDriver_39979C55 |
0x30 | Non-secure | Venezia | 1 (2 for secure) | enable: ScePervasiveForDriver_FB01A2DD/disable: ScePervasiveForDriver_2EEBE9AE |
0x34 | Non-secure | Vip | 1 | enable: ScePervasiveForDriver_B1CFA18F/disable: ScePervasiveForDriver_03E1FAA6 |
0x40 | Secure | SceDbgSdio | 1 | |
0x44 | Secure | SceDbgSdio | 1 | |
0x48 | Secure | DebugPA | 1 (also has 2?) | |
0x4C | Secure | SceDbgSdio | 1 | |
0x50 | Secure | DMAC0 | 1 | |
0x54 | Secure | DMAC1 | 1 | |
0x58 | Secure | DMAC2 | 1 | |
0x5C | Secure | DMAC3 | 1 | |
0x60 | Secure | DMAC4 | 1 | |
0x64 | Secure | DMAC5 | 1 | |
0x68 | Secure | DMAC6 | 1 | need devmode or dipsw 0xC0 or 0xC1 or 0xC2. |
0x70 | Non-secure | Csi | 1 | Camera Serial Interface |
0x74 | ||||
0x80 | Non-secure | Dsi | 1 | |
0x84 | ||||
0x88 | Non-secure | Iftu | 1 | Integrated Facility Terminating Unit. See IFTU Registers. enable: ScePervasiveForDriver_07F2A738/disable: ScePervasiveForDriver_5AFE0AF0 |
0x8C | Non-secure | ? | 1 | enable: ScePervasiveForDriver_C0C842FE/disable: ScePervasiveForDriver_9BB7B932 |
0x90 | Non-secure | USB/Udcd | ? | USB Device Controller. See UDC. enable: ScePervasiveForDriver_4AF7A01E/disable: ScePervasiveForDriver_13CC07C9 |
0x94 | ||||
0xA0 | Non-secure | Sdif0 (emmc) | 1 | Storage Device InterFace |
0xA4 | Sdif1 (gcsd) | |||
0xA8 | Sdif2 | |||
0xAC | Sdif3 | |||
0xB0 | Non-secure | Msif | 1 | Memory Stick InterFace. See MSIF Registers. |
0xC0 | Non-secure | I2S (Audio) | 1 | Inter-IC Sound |
0xC4 | ||||
0xC8 | ||||
0xCC | ||||
0xD0 | ||||
0xD4 | ||||
0xD8 | ||||
0xDC | ||||
0xE0 | Non-secure | SrcMix | 1 | Source Mixer |
0xE4 | ||||
0xE8 | ||||
0xF0 | Non-secure | SPDIF (Audio) | 1 | Sony/Philips Digital InterFace |
0x100 | Non-secure | Gpio | 1 | General Purpose Input/Output. See GPIO Registers. |
0x104 | Non-secure | Spi (Syscon) | 1 | Serial Peripheral Interface. See SPI Registers. |
0x108 | Spi (Motion) | |||
0x10C | Spi (OLED) | |||
0x110 | Non-secure | I2C | 1 | Inter-Integrated Circuit. See I2C Registers. |
0x114 | ||||
0x120 | Non-secure | Uart0 (Console) | 1 | Universal Asynchronous Receiver Transmitter. See UART Registers. |
0x124 | Uart1 | |||
0x128 | Uart2 | |||
0x12C | Uart3 | |||
0x130 | Uart4 | |||
0x134 | Uart5 (3G Modem) | |||
0x138 | Uart6 | |||
0x154 | Secure? | Debug Bus | 1 | See PervasiveReset for details. |
0x158 | Secure? | ? | 1 | |
0x160 | Secure? | LPDDR2MAIN (DDRIF0) | 1 | |
0x164 | Secure? | LPDDR2SUB (DDRIF1) | 1 | |
0x170 | ? | Timer | 1? | |
0x178 | Secure? | SPM32 | 4 | Scratch Pad Memory 32KiB |
SPM128 | 8 | Scratch Pad Memory 128KiB |
ScePervasiveBaseClk (0xE3103000)
Offset | Access | Device |
---|---|---|
0x0 | Non-secure | CPU (ARM) |
0x4 | Non-secure | CPU (ARM) |
0x10 | Non-secure | GPU |
0x20 | Non-secure | Venezia |
0x24 | Non-secure | ? |
0x30 | Non-secure | Vip |
0x40 | Secure | CMeP/Bus |
0x44 | Non-secure | CameraBus |
0x50 | Secure | ? (could be bigmac. or sdif) |
0x60 | Non-secure | ? |
0x64 | Non-secure | ? |
0x68 | Non-secure | ? |
0x70 | Non-secure | ? (Audio related. freq setting by ScePervasiveForDriver_925D9D24) |
0x90 | Secure | DRAM Main |
0x94 | Secure | DRAM Sub |
0xA4 | Non-secure | ? |
0xB0 | Non-secure | Msif |
0xC4 | Secure | Compat/Xbar |
0x100 | Non-secure | ? |
0x180 | Non-secure | ? |
0x1D0 | Non-secure | HDMI |
0x1F0 | Non-secure | Direct Memory Access Controller 5. See Dmac5. |
0x210 | Non-secure | ? (Audio related. freq setting by ScePervasiveForDriver_2FB5F88F) |
0x214 | Non-secure | Sys |
ScePervasiveVid (0xE3104000)
Voltage integer data
Offset | Group | Value |
---|---|---|
0x0 | ARM | 0 |
0x4 | ARM | 0x1F |
0x8 | ARM | 0x27 |
0xC | ARM | 0x2F |
0x10 | ARM | 0x31 |
0x14 | ARM | 0x31 |
0x40 | ? | 0x1D |
0x44 | ? | 0x22 |
0x48 | ? | 0x2E |
0x4C | ? | 0x25 |
0x60 | ? | 0x1D |
0x64 | ? | 0x27 |
0x68 | ? | 0x2E |
0x6C | ? | 0x30 |
0xA0 | Bus | 0 |
0xA4 | Bus | 0x1E |
0xA8 | Bus | 0x27 |
0xAC | Bus | 0x2E |
Base Clock
Registers at physical address 0xE2103000
(ScePervasiveBaseClk).
Offset | Accessibly | Description |
---|---|---|
0x0/0x4 | Non-Secure/Secure | ARM Clocks |
0x10 | Secure | GPU Clock |
0x20 | Non-Secure/Secure (?) | VENEZIA Clock |
0x30 | Non-Secure | Vip Clock |
0x40 | Secure | CMeP Clock |
0x44 | Non-Secure | CameraBus Clock |
0x60 | Non-Secure | Related to offset 0x60/0x64/0xA4. |
0x64 | Non-Secure | Related to offset 0x60/0x64/0xA4. |
0x68 | Non-Secure | Unknown. freq setting by ScePervasiveForDriver_A96642E3 |
0x70 | Non-Secure | Related to Audio. freq setting by ScePervasiveForDriver_925D9D24 |
0xA4 | Non-Secure | Related to offset 0x60/0x64/0xA4. |
0xB0 | Non-Secure | Msif Clock |
0x1D0 | Non-Secure | HDMI Clock |
0x1F0 | Non-Secure | Dmac5 Clock |
0x210 | Non-Secure | Related to Audio. freq setting by ScePervasiveForDriver_2FB5F88F |
ARM Clocks
The ARM core clock and L2 cache clock consist of two registers 0xE2103000 and 0xE2103004.
Register 0xE2103000 selects the base clock frequency.
It seems that 42-freq is selected internally when Undefined index is selected
Index | ARM core freq | L2 cache freq |
---|---|---|
0 | Undefined | Undefined |
1 | 42 | 42 |
2 | Undefined | Undefined |
3 | 83 | 83 |
4 | 111 | 111 |
5 | 166 | 166 |
6 | 222 | 222 |
7 | 333 | 333 |
8 | 444 | 222 |
9 | 500 | 250 |
10 | 333 | 166 |
11 | Undefined | Undefined |
12 | 125 | 125 |
13 | 250 | 250 |
14 | 444 | 444 |
15 | 500 | 500 |
Register 0xE2103004 adjusts the selected base clock frequency.
0xE2103004 sets the index that adjusts the base clock frequency.
It seems that the adjustment can be expressed by the following formula.
f(n) = n(1 - adjust_index / 16)
adjust_index ranges from 0 to 16 (?)
Also a joke-like approximation : f(n) = n(1 - aπ^-(1 + √2))
.
However, not sure if this formula is completely correct, but It can see that it is very close to the value of yifan's clock analyzer.
ARM Clocks (by yifan's clock analyzer)
The ARM CPU clocks are controlled by two registers at physical address 0xE3103000
(ScePervasiveBaseClk). Currently, it is unknown how the values are interpreted. However, 0xE3103000
(one word) takes values 0 to 16, and increases clock speed while 0xE3103004
(single byte) takes values 0 to 8 and decreases clock speed. It is likely related to a PLL multiply and divide function. The input clock signal comes from a P1P40167 clock synthesizer (found on the bottom of the board under the main SoC). It takes a 27MHz crystal and generates a 37MHz clock which feeds directly into the SoC's internal PLL.
The following are tests run to determine what the values of each register corresponds to. It appears that the maximum clock speed is 499MHz and the minimum clock speed is 16MHz.
These clocks may be wrong. "Kernel Clock Speed" is "Clock Speed + 5". However, there is an error of ± 5 to 6 in "Clock Speed".
0xE3103000 |
0xE3103004 |
Clock Speed (MHz) | Kernel Clock Speed (MHz) |
---|---|---|---|
0 | 0 | 37 | 42 |
0 | 1 | 35 | 40 |
0 | 2 | 32 | 37 |
0 | 3 | 29 | 34 |
0 | 4 | 27 | 32 |
0 | 5 | 24 | 29 |
0 | 6 | 22 | 27 |
0 | 7 | 19 | 24 |
0 | 8 | 16 | 21 |
1 | 0 | 37 | 42 |
1 | 1 | 35 | 40 |
1 | 2 | 32 | 37 |
1 | 3 | 30 | 35 |
1 | 4 | 27 | 32 |
1 | 5 | 24 | 29 |
1 | 6 | 22 | 27 |
1 | 7 | 19 | 24 |
1 | 8 | 16 | 21 |
2 | 0 | 37 | 42 |
2 | 1 | 35 | 40 |
2 | 2 | 32 | 37 |
2 | 3 | 30 | 35 |
2 | 4 | 27 | 32 |
2 | 5 | 24 | 29 |
2 | 6 | 22 | 27 |
2 | 7 | 19 | 24 |
2 | 8 | 16 | 21 |
3 | 0 | 79 | 84 |
3 | 1 | 74 | 79 |
3 | 2 | 69 | 74 |
3 | 3 | 63 | 68 |
3 | 4 | 58 | 63 |
3 | 5 | 53 | 58 |
3 | 6 | 48 | 53 |
3 | 7 | 43 | 48 |
3 | 8 | 37 | 42 |
4 | 0 | 107 | 112 |
4 | 1 | 100 | 105 |
4 | 2 | 93 | 98 |
4 | 3 | 86 | 91 |
4 | 4 | 79 | 84 |
4 | 5 | 72 | 77 |
4 | 6 | 65 | 70 |
4 | 7 | 58 | 63 |
4 | 8 | 51 | 56 |
5 | 0 | 162 | 167 |
5 | 1 | 152 | 157 |
5 | 2 | 142 | 147 |
5 | 3 | 131 | 136 |
5 | 4 | 121 | 126 |
5 | 5 | 110 | 115 |
5 | 6 | 100 | 105 |
5 | 7 | 90 | 95 |
5 | 8 | 79 | 84 |
6 | 0 | 218 | 223 |
6 | 1 | 204 | 209 |
6 | 2 | 190 | 195 |
6 | 3 | 176 | 181 |
6 | 4 | 163 | 168 |
6 | 5 | 148 | 153 |
6 | 6 | 135 | 140 |
6 | 7 | 121 | 126 |
6 | 8 | 107 | 112 |
7 | 0 | 329 | 334 |
7 | 1 | 308 | 313 |
7 | 2 | 287 | 292 |
7 | 3 | 266 | 271 |
7 | 4 | 246 | 251 |
7 | 5 | 225 | 230 |
7 | 6 | 204 | 209 |
7 | 7 | 183 | 188 |
7 | 8 | 162 | 167 |
8 | 0 | 439 | 444 |
8 | 1 | 411 | 416 |
8 | 2 | 384 | 389 |
8 | 3 | 356 | 361 |
8 | 4 | 329 | 334 |
8 | 5 | 301 | 306 |
8 | 6 | 273 | 278 |
8 | 7 | 246 | 251 |
8 | 8 | 218 | 223 |
9 | 0 | 494 | 499 |
9 | 1 | 463 | 468 |
9 | 2 | 432 | 437 |
9 | 3 | 401 | 406 |
9 | 4 | 370 | 375 |
9 | 5 | 339 | 344 |
9 | 6 | 308 | 313 |
9 | 7 | 277 | 282 |
9 | 8 | 245 | 250 |
10 | 0 | 328 | 333 |
10 | 1 | 308 | 313 |
10 | 2 | 287 | 292 |
10 | 3 | 266 | 271 |
10 | 4 | 245 | 250 |
10 | 5 | 225 | 230 |
10 | 6 | 204 | 209 |
10 | 7 | 183 | 188 |
10 | 8 | 162 | 167 |
11 | 0 | 37 | 42 |
11 | 1 | 35 | 40 |
11 | 2 | 32 | 37 |
11 | 3 | 30 | 35 |
11 | 4 | 27 | 32 |
11 | 5 | 24 | 29 |
11 | 6 | 22 | 27 |
11 | 7 | 19 | 24 |
11 | 8 | 16 | 21 |
12 | 0 | 121 | 126 |
12 | 1 | 113 | 118 |
12 | 2 | 105 | 110 |
12 | 3 | 97 | 102 |
12 | 4 | 90 | 95 |
12 | 5 | 82 | 87 |
12 | 6 | 74 | 79 |
12 | 7 | 66 | 71 |
12 | 8 | 58 | 63 |
13 | 0 | 245 | 250 |
13 | 1 | 230 | 235 |
13 | 2 | 214 | 219 |
13 | 3 | 199 | 204 |
13 | 4 | 183 | 188 |
13 | 5 | 168 | 173 |
13 | 6 | 152 | 157 |
13 | 7 | 136 | 141 |
13 | 8 | 121 | 126 |
14 | 0 | 439 | 444 |
14 | 1 | 412 | 417 |
14 | 2 | 384 | 389 |
14 | 3 | 356 | 361 |
14 | 4 | 329 | 334 |
14 | 5 | 301 | 306 |
14 | 6 | 273 | 278 |
14 | 7 | 246 | 251 |
14 | 8 | 218 | 223 |
15 | 0 | 494 | 499 |
15 | 1 | 463 | 468 |
15 | 2 | 433 | 438 |
15 | 3 | 401 | 406 |
15 | 4 | 370 | 375 |
15 | 5 | 339 | 344 |
15 | 6 | 308 | 313 |
15 | 7 | 277 | 282 |
15 | 8 | 245 | 250 |
16 | 0 | 37 | 42 |
16 | 1 | 35 | 40 |
16 | 2 | 32 | 37 |
16 | 3 | 29 | 34 |
16 | 4 | 27 | 32 |
16 | 5 | 24 | 29 |
16 | 6 | 22 | 27 |
16 | 7 | 19 | 24 |
16 | 8 | 16 | 21 |
VENEZIA Clock
The register at physical address 0xE3103020
seems to control the clock frequency of VENEZIA.
Value | Clock speed |
---|---|
0x1 | 41MHz |
0x2 | 55MHz |
0x3 | 83MHz |
0x4 | 111MHz |
0x5 | 166MHz |
0x6 | 222MHz |
0x7 | 333MHz |
Vip Clock
Value | Clock speed |
---|---|
0x1 | 41MHz |
0x2 | 55MHz |
0x3 | 83MHz |
0x4 | 111MHz |
0x5 | 166MHz |
0x6 | 222MHz |
CMeP Clock
The low 8 bits of the register at physical address 0xE3103040
control CMeP clock speed, and maybe I/O bus speed too.
This was guessed because it is used in a usleep()
-like function to calculate the input for a sleep_for_cycles()
function.
Testing was performed using SceLT5 as a time reference (µs-accurate), and compared against the hardcoded table in second_loader
.
Value | CMeP speed (measured) | Table value |
---|---|---|
0x0 | 41.5 MHz | N/A |
0x1 | 41.5MHz | |
0x2 | 55.4MHz | |
0x3 | 83.0MHz | |
0x4 | 110.7MHz | |
0x5 | 166.0MHz | |
0x6 | 110.7MHz | |
0x7 | 166.0MHz | |
0x10000 | 41.5MHz | 50MHz |
0x10001 | 27.7MHz | 50MHz |
0x10002 | 27.7MHz | 27MHz |
0x10003 | 41.5MHz | 42MHz |
0x10004 | 55.3MHz | 56MHz |
0x10005 | 83.0MHz | 83MHz |
0x10006 | 110.7MHz | 111MHz |
0x10007 | 166.0MHz | 160MHz |
second_loader
sets the register to 0x10005, meaning CMeP usually runs at 83MHz.
CameraBus Clock
Value | Clock speed |
---|---|
1 | 41-MHz |
2 | 67-MHz |
3 | 83-MHz |
4 | 133-MHz |
5 | 166-MHz |
Dmac5 Clock
Value | Clock speed |
---|---|
1 | 41-MHz |
2 | 83-MHz |
3 | 133-MHz |
4 | 166-MHz |
Sys Clock
Value | Clock speed |
---|---|
0 | 222-MHz |
1 | 190-MHz |
ScePervasive2 (0xE3110000)
Offset | Description |
---|---|
0x248 | VIP_PROT_BAP_ERRV
|
0x24C | VIP_PROT_BAP_ERRC
|
0x250 | VIP_PROT_BAP_ERRA
|
0x254 | VIP_PROT_VDPD_ERRV
|
0x258 | VIP_PROT_VDPD_ERRC
|
0x25C | VIP_PROT_VDPD_ERRA
|
0x260 | VIP_PROT_VDPM_ERRV
|
0x264 | VIP_PROT_VDPM_ERRC
|
0x268 | VIP_PROT_VDPM_ERRA
|
0x348 | VENE_PROT_REG_ERRV
|
0x34C | VENE_PROT_REG_ERRC
|
0x350 | VENE_PROT_REG_ERRA
|
0xD04 | SPM128 Bus Error Address register |
0xD08 | SPM128 Bus Error Attribute register |
0xD14 | SPM32 Bus Error Address register |
0xD18 | SPM32 Bus Error Attribute register |
0xD24 | CompatRAM Bus Error Address register |
0xD28 | CompatRAM Bus Error Attribute register |
0xD34 | Pervasive2 Bus Error Address register - maybe PERVASIVE2_SYS_BEADR
|
0xD38 | Pervasive2 Bus Error Attribute register - maybe PERVASIVE2_SYS_BEATB
|
0xD44 | SPM128 Secure Bus Error Address register |
0xD48 | SPM128 Secure Bus Error Attribute register |
0xD54 | SPM32 Secure Bus Error Address register |
0xD58 | SPM32 Secure Bus Error Attribute register |
0xD64 | CompatRAM Secure Bus Error Address register |
0xD68 | CompatRAM Secure Bus Error Attribute register |
0xD74 | Pervasive2 Secure Bus Error Address register - maybe PERVASIVE2_SYS_SBEADR
|
0xD78 | Pervasive2 Secure Bus Error Attribute register - maybe PERVASIVE2_SYS_SBEATB
|
0xD80 | BET0 (Bus Error Target 0) - full name may be PERVASIVE2_SYS_BET0
|
0xD90 | BET1 (Bus Error Target 1) - full name may be PERVASIVE2_SYS_BET1
|
0xD94 | PERVASIVE2_SYS_BEBT - Bus Error ?Bus Target?
|
0xDC0 | SBET0 (Secure Bus Error Target 0) - full name may be PERVASIVE2_SYS_SBET0
|
0xDD0 | SBET1 (Secure Bus Error Target 1) - full name may be PERVASIVE2_SYS_SBET1
|
0xDD4 | PERVASIVE2_SYS_SBEBT - Secure Bus Error ?Bus Target?
|
0xF40 | Bit 0 = Memory Card insert state |