Pervasive

Pervasive is a device that controls the clocks of most of the devices of the system.

ScePervasiveMisc (0xE3100000)

Devices can be fully disabled? by writing a 1 to the corresponding bit of the ScePervasiveMisc (PA 0xE3100000) register. To disable the device dev_off, do *REG32(0xE3100000 + (dev_off / 32) * 4) = 1 << (31 - (dev_off % 32)).

Offset	Description
0x0000	"SoC revision". ex:0x80000115
0x0004	Unknown - SKBL prints L2 Cache is defective if bit 0x2 is set

"SoC revision"

Returned by SceLowio#scePervasiveGetSoCRevisionForDriver, read by SKBL/NSKBL/...

Contains the Kermit revision (see sceKernelSysrootGetKermitRevisionForKernel) and other information.

Bit mask	Information
0x80000000	Disable LPDDR2SUB
0x30000000	Unknown (used by SceCrashDump)
0x4FFE0000	Unknown
0x0001FFFF	Kermit revision
0x000000FF	Kermit revision (old firmwares)

Known values

Hardware	Value
PCH-1100	0x80000042
VTE-1016	0x80000042
PCH-2000	0x80000115
PDEL-1000	0x00000042

ScePervasiveReset (0xE3101000)

Devices must be put out of reset (device reset disabled) before they are first used.

To enable reset of a device (put a device in reset), do *REG32(0xE3101000 + dev_off) |= mask.

To disable reset of a device (put a device out of reset), do *REG32(0xE3101000 + dev_off) &= ~mask.

dev_off	Access	Device	Reset Mask	Comment
0x4	Secure?	ARM Debugger?	1	Of ARM coprocessor 14?
0x10	Non-secure	?	1	enable: ScePervasiveForDriver_3E79D3D3/disable: ScePervasiveForDriver_8A85E36B
0x20	Secure	?	1	enable: ScePervasiveForDriver_377126CD/disable: ScePervasiveForDriver_6E11EB97
0x24	Secure	?	1	enable: ScePervasiveForDriver_7B0F388B/disable: ScePervasiveForDriver_4CCD40E6
0x28	Secure	?	1	enable: ScePervasiveForDriver_7C285361/disable: ScePervasiveForDriver_E40BED0F
0x30	Non-secure	Vip	1	enable: ScePervasiveForDriver_28731EC5/disable: ScePervasiveForDriver_A7E64C6F
0x34	Non-secure	Vip	1	enable: ScePervasiveForDriver_31C0A98B/disable: ScePervasiveForDriver_E2D8F6C3
0x40	Secure	SceDbgSdio	1
0x44	Secure	SceDbgSdio	1
0x48	Secure	SceDbgSdio	1
0x4C	Secure	SceDbgSdio	1
0x50	Secure	?	1
0x54	Secure	?	1
0x58	Secure	?	1
0x5C	Secure	?	1
0x60	Secure	?	1
0x64	Secure	DMAC5	1
0x70	Non-secure	?	1	enable: ScePervasiveForDriver_66BF2885/disable: ScePervasiveForDriver_D3B59C33
0x80	Non-secure	Dsi	1
0x88	Non-secure	?	1	enable: ScePervasiveForDriver_B68254AD/disable: ScePervasiveForDriver_E92E28FF
0x8C	Non-secure	?	1	enable: ScePervasiveForDriver_7AE2F8E8/disable: ScePervasiveForDriver_17109C28
0x90	Non-secure	?	?	enable: ScePervasiveForDriver_4AF7A01E/disable: ScePervasiveForDriver_13CC07C9
0xA0	Non-secure	?	?	enable: ScePervasiveForDriver_3D8A8712/disable: ScePervasiveForDriver_D326E15F
0xB0	Non-secure	Msif	1
0xC0	Non-secure	?	1	enable: ScePervasiveForDriver_146108D4/disable: ScePervasiveForDriver_EEE340ED
0xE0	Non-secure	?	1	enable: ScePervasiveForDriver_821AE6C7/disable: ScePervasiveForDriver_5BAFA0DC
0xF0	Non-secure	?	1	enable: ScePervasiveForDriver_B8AF1249/disable: ScePervasiveForDriver_6A2FB697
0x100	Non-secure	Gpio	1
0x104	Non-secure	Spi	1
0x110	Non-secure	?	1	enable: ScePervasiveForDriver_41F9E1C3/disable: ScePervasiveForDriver_86BEA9A4
0x120	Non-secure	Uart	1
0x154	Secure?	?	1	Disable reset this device by SKBL on Development mode
0x158	Secure?	?	1
0x160	Secure?	LPDDR2MAIN	1
0x164	Secure?	LPDDR2SUB	1
0x180	Secure	some media device	1	enable: ScePervasiveForDriver_EBE9C84E/disable: ScePervasiveForDriver_8CF567AD

ScePervasiveGate (0xE3102000)

Devices can be clock gated to preserve battery.

To enable clock gate (request the clock of a device to be enabled), do *REG32(0xE3102000 + dev_off) |= mask.

To disable clock gate (request the clock of a device to be disabled), do *REG32(0xE3102000 + dev_off) &= ~mask.

dev_off	Access	Device	Gate Mask	Comment
0x0	Secure?	?	?
0x4	Secure?	ARM Debugger?	1	Of ARM coprocessor 14?
0x10	Non-secure	?	v & 0xF000F	enable: ScePervasiveForDriver_39E51AE2/disable: ScePervasiveForDriver_CA0ACFC5
0x20	Secure	?	1	enable: ScePervasiveForDriver_8EE3AEDF/disable: ScePervasiveForDriver_3BF2A9B5
0x24	Secure	?	1	enable: ScePervasiveForDriver_7F4AB4AA/disable: ScePervasiveForDriver_0EBBE8DE
0x28	Secure	?	1	enable: ScePervasiveForDriver_B2EE45C9/disable: ScePervasiveForDriver_39979C55
0x30	Non-secure	Vip	1 (2 for secure)	enable: ScePervasiveForDriver_FB01A2DD/disable: ScePervasiveForDriver_2EEBE9AE
0x34	Non-secure	Vip	1	enable: ScePervasiveForDriver_B1CFA18F/disable: ScePervasiveForDriver_03E1FAA6
0x40	Secure	SceDbgSdio	1
0x44	Secure	SceDbgSdio	1
0x48	Secure	SceDbgSdio	1 (also has 2?)
0x4C	Secure	SceDbgSdio	1
0x50	Secure	?	1
0x54	Secure	?	1
0x58	Secure	?	1
0x5C	Secure	?	1
0x60	Secure	?	1
0x64	Secure	DMAC5	1
0x70	Non-secure	?	1	enable: ScePervasiveForDriver_1068C067/disable: ScePervasiveForDriver_4B223AF5
0x80	Non-secure	Dsi	1
0x88	Non-secure	?	1	enable: ScePervasiveForDriver_07F2A738/disable: ScePervasiveForDriver_5AFE0AF0
0x8C	Non-secure	?	1	enable: ScePervasiveForDriver_C0C842FE/disable: ScePervasiveForDriver_9BB7B932
0x90	Non-secure	?	?	enable: ScePervasiveForDriver_A2EFD7AF/disable: ScePervasiveForDriver_AD1E81EB
0xA0	Non-secure	?	?	enable: ScePervasiveForDriver_3CF7A012/disable: ScePervasiveForDriver_4E43299D
0xB0	Non-secure	Msif	1
0xC0	Non-secure	?	1	enable: ScePervasiveForDriver_4235EB7D/disable: ScePervasiveForDriver_A3CF9844
0xE0	Non-secure	?	1	enable: ScePervasiveForDriver_47F2C35C/disable: ScePervasiveForDriver_F861FEE4
0xF0	Non-secure	?	1	enable: ScePervasiveForDriver_6B5DEDA2/disable: ScePervasiveForDriver_51981FEE
0x100	Non-secure	Gpio	1
0x104	Non-secure	Spi	1
0x110	Non-secure	?	1	enable: ScePervasiveForDriver_C37CFDFC/disable: ScePervasiveForDriver_3F3E1AEA
0x120	Non-secure	Uart	1
0x154	Secure?	?	1	Enable this device by SKBL on Development mode
0x158	Secure?	?	1
0x160	Secure?	LPDDR2MAIN	1
0x164	Secure?	LPDDR2SUB	1

Devices

The offsets and masks of Pervasive devices are documented below. Some devices appear to only be accessible in secure world.

Offset	Description	Gate Mask	Reset Mask	Comments
0x0	Arm	?	?	ARM CPU
0x4	Arm	?	?	ARM CPU
0x10	Gpu (?Secure?)	?0xF00F?		GPU
0x20	Venezia	?0xF000F?		See Venezia.
0x20	? (Secure)	0x3	0x3
0x24	? (Secure)	0x1	0x1
0x28	? (Secure)	0x1	0x1	GpuEs4 and SceEmcTop related
0x30	Vip	0x1	0x1	Venezia Image Processor. See Venezia.
0x30	Vip (Secure)	0x2	0x2	Venezia Image Processor. See Venezia.
0x34	?	0x1		Venezia related
0x40	Bus? (Secure) Set to 0x10006 (mask_or_freq_level & 0xF | 0x10000) by second_loader.	0x1	0x1
0x44	CameraBus (Secure)	0x1	0x1
0x50	? (Secure) Set to 1 by second_loader.	0x1	0x1
0x54	? (Secure)	0x1	0x1
0x58	? (Secure)	0x1	0x1
0x5C	? (Secure)	0x1	0x1
0x60	? (Secure)	0x1	0x1
0x64	? (Secure)	0x1	0x1
0x70	CSI0	0x1		Camera Serial Interface
0x74	CSI1	0x1		Camera Serial Interface
0x80	IFTU0	0xF	0x7	Integrated Facility Terminating Unit. See IFTU Registers.
0x84	IFTU1	0xF	0x7	Integrated Facility Terminating Unit. See IFTU Registers.
0x88	IFTU2	0xF	0x7	Integrated Facility Terminating Unit. See IFTU Registers.
0x8C	?	0x1
0x90	UDC0	0xA	0xA	USB Device Controller. See UDC.
0x94	UDC1	0xA	0xA	USB Device Controller. See UDC.
0xA0	SDIF0	0x1		Storage Device InterFace
0xA4	SDIF1	0x1		Storage Device InterFace
0xA8	SDIF2	0x1		Storage Device InterFace
0xB0	MSIF	0x1		Memory Stick InterFace. See MSIF Registers.
0xC0	I2s0 (Audio)	0x1	0x1	Inter-IC Sound
0xC4	I2s1 (Audio)	0x1	0x1	Inter-IC Sound
0xC8	I2s2 (Audio)	0x1	0x1	Inter-IC Sound
0xCC	I2s3 (Audio)	0x1	0x1	Inter-IC Sound
0xD0	I2s4 (Audio)	0x1	0x1	Inter-IC Sound
0xD4	I2s5 (Audio)	0x1	0x1	Inter-IC Sound
0xD8	I2s6 (Audio)	0x1	0x1	Inter-IC Sound
0xDC	I2s7 (Audio)	0x1	0x1	Inter-IC Sound
0xE0	SrcMix0 (Audio)	0x1	0x1	Source Mixer
0xE4	SrcMix1 (Audio)	0x1	0x1	Source Mixer
0xE8	SrcMix2 (Audio)	0x1	0x1	Source Mixer
0xEC	?	?	?
0xF0	SPDIF (Audio)	0x1	0x1	Sony/Philips Digital InterFace
0x100	GPIO	0x1	0x1	General Purpose Input/Output. See GPIO Registers.
0x104	SPI0 (Syscon)	0x1	0x1	Serial Peripheral Interface. See SPI Registers.
0x108	SPI1 (Motion)	0x1	0x1	Serial Peripheral Interface. See SPI Registers.
0x10C	SPI2 (OLED)	0x1	0x1	Serial Peripheral Interface. See SPI Registers.
0x110	I2C0	0x1	0x1	Inter-Integrated Circuit. See I2C Registers.
0x114	I2C1	0x1	0x1	Inter-Integrated Circuit. See I2C Registers.
0x118
0x11C
0x120	UART0 (Console)	0x1	0x1	Universal Asynchronous Receiver Transmitter. See UART Registers.
0x124	UART1	0x1	0x1	Universal Asynchronous Receiver Transmitter. See UART Registers.
0x128	UART2	0x1	0x1	Universal Asynchronous Receiver Transmitter. See UART Registers.
0x12C	UART3	0x1	0x1	Universal Asynchronous Receiver Transmitter. See UART Registers.
0x130	UART4	0x1	0x1	Universal Asynchronous Receiver Transmitter. See UART Registers.
0x134	UART5 (3G Modem)	0x1	0x1	Universal Asynchronous Receiver Transmitter. See UART Registers.
0x138	UART6	0x1	0x1	Universal Asynchronous Receiver Transmitter. See UART Registers.
0x160	LPDDR2MAIN	0x1	0x1	Main LPDDR2 RAM
0x164	LPDDR2SUB	0x1	0x1	Secondary LPDDR2 RAM
0x180	?		0x1
0x1A4	?	?	?
0x1F0	DMAC5	?	?	Direct Memory Access Controller. See Dmac5.

Base Clock

Registers at physical address 0xE2103000 (ScePervasiveBaseClk).

Offset	Description
0x0/0x4	ARM Clocks
0x20	VENEZIA Clock
0x40	CMeP Clock

ARM Clocks

The ARM CPU clocks are controlled by two registers at physical address 0xE3103000 (ScePervasiveBaseClk). Currently, it is unknown how the values are interpreted. However, 0xE3103000 (one word) takes values 0 to 16, and increases clock speed while 0xE3103004 (single byte) takes values 0 to 8 and decreases clock speed. It is likely related to a PLL multiply and divide function. The input clock signal comes from a P1P40167 clock synthesizer (found on the bottom of the board under the main SoC). It takes a 27MHz crystal and generates a 37MHz clock which feeds directly into the SoC's internal PLL.

The following are tests run to determine what the values of each register corresponds to. It appears that the maximum clock speed is 499MHz and the minimum clock speed is 16MHz.

These clocks may be wrong. "Kernel Clock Speed" is "Clock Speed + 5". However, there is an error of ± 5 to 6 in "Clock Speed".

0xE3103000	0xE3103004	Clock Speed (MHz)	Kernel Clock Speed (MHz)
0	0	37	42
0	1	35	40
0	2	32	37
0	3	29	34
0	4	27	32
0	5	24	29
0	6	22	27
0	7	19	24
0	8	16	21
1	0	37	42
1	1	35	40
1	2	32	37
1	3	30	35
1	4	27	32
1	5	24	29
1	6	22	27
1	7	19	24
1	8	16	21
2	0	37	42
2	1	35	40
2	2	32	37
2	3	30	35
2	4	27	32
2	5	24	29
2	6	22	27
2	7	19	24
2	8	16	21
3	0	79	84
3	1	74	79
3	2	69	74
3	3	63	68
3	4	58	63
3	5	53	58
3	6	48	53
3	7	43	48
3	8	37	42
4	0	107	112
4	1	100	105
4	2	93	98
4	3	86	91
4	4	79	84
4	5	72	77
4	6	65	70
4	7	58	63
4	8	51	56
5	0	162	167
5	1	152	157
5	2	142	147
5	3	131	136
5	4	121	126
5	5	110	115
5	6	100	105
5	7	90	95
5	8	79	84
6	0	218	223
6	1	204	209
6	2	190	195
6	3	176	181
6	4	163	168
6	5	148	153
6	6	135	140
6	7	121	126
6	8	107	112
7	0	329	334
7	1	308	313
7	2	287	292
7	3	266	271
7	4	246	251
7	5	225	230
7	6	204	209
7	7	183	188
7	8	162	167
8	0	439	444
8	1	411	416
8	2	384	389
8	3	356	361
8	4	329	334
8	5	301	306
8	6	273	278
8	7	246	251
8	8	218	223
9	0	494	499
9	1	463	468
9	2	432	437
9	3	401	406
9	4	370	375
9	5	339	344
9	6	308	313
9	7	277	282
9	8	245	250
10	0	328	333
10	1	308	313
10	2	287	292
10	3	266	271
10	4	245	250
10	5	225	230
10	6	204	209
10	7	183	188
10	8	162	167
11	0	37	42
11	1	35	40
11	2	32	37
11	3	30	35
11	4	27	32
11	5	24	29
11	6	22	27
11	7	19	24
11	8	16	21
12	0	121	126
12	1	113	118
12	2	105	110
12	3	97	102
12	4	90	95
12	5	82	87
12	6	74	79
12	7	66	71
12	8	58	63
13	0	245	250
13	1	230	235
13	2	214	219
13	3	199	204
13	4	183	188
13	5	168	173
13	6	152	157
13	7	136	141
13	8	121	126
14	0	439	444
14	1	412	417
14	2	384	389
14	3	356	361
14	4	329	334
14	5	301	306
14	6	273	278
14	7	246	251
14	8	218	223
15	0	494	499
15	1	463	468
15	2	433	438
15	3	401	406
15	4	370	375
15	5	339	344
15	6	308	313
15	7	277	282
15	8	245	250
16	0	37	42
16	1	35	40
16	2	32	37
16	3	29	34
16	4	27	32
16	5	24	29
16	6	22	27
16	7	19	24
16	8	16	21

CMeP Clock

The low 8 bits of the register at physical address 0xE3103040 seem to control CMeP clock speed. This was guessed because it is used in a usleep()-like function to calculate the input for a sleep_for_cycles() function.

The following data comes from a hardcoded table:

Value	Clock speed
0x2	27MHz
0x3	42MHz
0x4	56MHz
0x5	83MHz
0x6	111MHz
0x7	160MHz
Any other value	50MHz

second_loader sets the register to 5, meaning CMeP should run at 83MHz.

VENEZIA Clock

The register at physical address 0xE3103020 seems to control the clock frequency of VENEZIA.

Allowed register values

Value	Clock speed
0x1	41MHz
0x2	55MHz
0x3	83MHz
0x4	111MHz
0x5	166MHz
0x6	222MHz
0x7	333MHz

ScePervasive2 (0xE3110000)

Offset	Description
0xF40	Bit 0 = Memory Card insert state