Pervasive: Difference between revisions

From Vita Development Wiki
Jump to navigation Jump to search
(→‎ScePervasive2 (0xE3110000): Add some detail on 'access mode' register)
(→‎ScePervasiveMisc (0xE3100000): Add info about SceSonyRegbus / CompatiRAM init sequence)
 
(2 intermediate revisions by the same user not shown)
Line 53: Line 53:
|-
|-
| 0x03C
| 0x03C
| Related to GPU. Only bit 0 is R/W. Writing 1 triggers a DABT in <code>gpu_es4.skprx</code>
| Related to GPU. Only bit 0 is R/W. Writing 1 triggers a DABT in <code>gpu_es4.skprx</code>. Set to 0 by SKBL during CompatiRAM initialization.
|-
|-
| 0x040
| 0x040
| Unknown. Only bit 0 is R/W.
| Unknown. Only bit 0 is R/W. Set to 0 by SKBL during SceSonyRegbus initialization.
|-
|-
| 0x044
| 0x044
Line 77: Line 77:
|-
|-
| 0x05C
| 0x05C
| RAZ/WI
| SKBL writes 0x1 during CompatiRAM initialization then waits until bit is cleared by HW.
|-
|-
| 0x060
| 0x060
| Unknown. Only bit 0 is R/W.
| Unknown. Only bit 0 is R/W. SKBL writes 1 during SceSonyRegbus initialization then waits until bit is cleared by HW.
|-
|-
| 0x064
| 0x064
Line 134: Line 134:
|-
|-
| 0x0B8
| 0x0B8
| rowspan="3" | RAZ/WI
| rowspan="2" | RAZ/WI
|-
|-
| 0x0BC
| 0x0BC
|-
|-
| 0x0C0
| 0x0C0
| Some kind of event status/IRQ register.
Bits are set by hardware. Software can clear a bit by writing 1 to it, and polling until the bit becomes 0.
SKBL waits until bit 0x8 is set (after writing to Misc+0x5C) during CompatiRAM initialization, then clears it.
SKBL waits until bit 0x10 is set (after writing to Misc+0x60) during SceSonyRegbus initialization, then clears it.
|-
|-
| 0x0C4
| 0x0C4
| Unknown. Only bit 0 is R/W.
| Unknown. Only bit 0 is R/W. SKBL writes 0 here during SceSonyRegbus initialization.
|-
|-
| 0x0C8
| 0x0C8
Line 409: Line 416:
|-
|-
| 0x2F8
| 0x2F8
| Related to GPU. Only bit 0 is R/W. Writing 1 triggers a GPU core dump.
| Related to GPU/Regbus. Only bit 0 is R/W. Writing 1 triggers a GPU core dump.
 
Set to 1 by SKBL during CompatiRAM initialization, then set back to 0.
|-
|-
| 0x2FC
| 0x2FC
Line 509: Line 518:
| 0x20
| 0x20
| Secure
| Secure
| ?
| PSP Allegrex
| 1
| 1
| enable: ScePervasiveForDriver_377126CD/disable: ScePervasiveForDriver_6E11EB97
| enable: ScePervasiveForDriver_377126CD/disable: ScePervasiveForDriver_6E11EB97
Line 515: Line 524:
| 0x24
| 0x24
| Secure
| Secure
| ?
| SceSonyRegbus
| 1
| 1
| enable: ScePervasiveForDriver_7B0F388B/disable: ScePervasiveForDriver_4CCD40E6
| enable: ScePervasiveForDriver_7B0F388B/disable: ScePervasiveForDriver_4CCD40E6
Line 881: Line 890:
| 0x28
| 0x28
| Secure
| Secure
| CompatRAM (2MiB)
| CompatRAM ("Tachyon-eDRAM", 2MiB)
| 1
| 1
| enable: ScePervasiveForDriver_B2EE45C9/disable: ScePervasiveForDriver_39979C55
| enable: ScePervasiveForDriver_B2EE45C9/disable: ScePervasiveForDriver_39979C55
Line 1,249: Line 1,258:
| Compati2MiB
| Compati2MiB
| 1
| 1
| a.k.a. Tachyon-eDRAM, Camera SRAM, etc
| ?
|-
|-
| ?
| ?
Line 1,255: Line 1,264:
| ?
| ?
|-
|-
| SPM32
| SPM128
| 4
| 4
| Scratch Pad Memory 32KiB
| Scratch Pad Memory 128KiB
|-
|-
| SPM128
| SPM32
| 8
| 8
| Scratch Pad Memory 128KiB
| Scratch Pad Memory 32KiB
|-
|-
| ?
| DevNull
| 0x10
| 0x10
| ?
| <code>/dev/null</code> (PA <code>0x1D000000</code>)
|-
|-
| 0x17C
| 0x17C

Latest revision as of 16:03, 9 March 2025

Pervasive is a register group used for various purposes, such as controlling the clocks of most peripherals in Kermit.

The name probably comes from pervasive logic, a term used to describe logic present in hardware designs, yet not a part of the primary functionalities.

ScePervasiveMisc (0xE3100000)

Devices can be fully disabled? by writing a 1 to the corresponding bit of the ScePervasiveMisc (PA 0xE3100000) register. To disable the device dev_off, do *REG32(0xE3100000 + (dev_off / 32) * 4) = 1 << (31 - (dev_off % 32)).

Offset Description
0x000 Read-only. revision0. ex:0x80000115
0x004 Read-only. Unknown - SKBL prints L2 Cache is defective if bit 0x2 is set
0x008 RAZ/WI
0x00C
0x010 Unknown. Only bit 0 is R/W
0x014 RAZ/WI
0x018
0x01C
0x020 Unknown. Only bits 0x8000003F are R/W.
0x024 RAZ/WI
0x028
0x02C
0x030 Unknown. Only bit 0 is R/W. Writing 1 hangs the system.
0x034 Related to GPU. Only bit 0 is R/W. Writing 1 triggers a DABT in gpu_es4.skprx.
0x038 Unknown. Only bit 0 is R/W. Writing 1 then 0 hangs the system.
0x03C Related to GPU. Only bit 0 is R/W. Writing 1 triggers a DABT in gpu_es4.skprx. Set to 0 by SKBL during CompatiRAM initialization.
0x040 Unknown. Only bit 0 is R/W. Set to 0 by SKBL during SceSonyRegbus initialization.
0x044 Unknown. Only bit 0 is R/W. Writing 1 hangs the system.
0x0048 Unknown. Only bit 0 is R/W.
0x04C Unknown. Only bit 0 is R/W.
0x050 Unknown. Only bit 0 is R/W. Writing 1 hangs the system.
0x054 Unknown. Only bit 0 is R/W.
0x058 Unknown. Only bit 0 is R/W.
0x05C SKBL writes 0x1 during CompatiRAM initialization then waits until bit is cleared by HW.
0x060 Unknown. Only bit 0 is R/W. SKBL writes 1 during SceSonyRegbus initialization then waits until bit is cleared by HW.
0x064 RAZ/WI
0x068
0x06C
0x070
0x074
0x078
0x07C
0x080
0x084 Related to USB Device Controller
0x088 Related to USB Device Controller
0x08C Related to USB Device Controller
0x090 RAZ/WI
0x094
0x098
0x09C
0x0A0 Unknown. Only bit 0 is R/W.
0x0A4 RAZ/WI
0x0A8
0x0AC
0x0B0 Unknown, Pervasive access modes? Written to by SMC 0x104. Only bits 0x7FFFF are R/W. Example: 0x1F3DA
0x0B4 Unknown, TAS access modes? Written to by SMC 0x105. Only bits 0xFF are R/W.
0x0B8 RAZ/WI
0x0BC
0x0C0 Some kind of event status/IRQ register.

Bits are set by hardware. Software can clear a bit by writing 1 to it, and polling until the bit becomes 0.

SKBL waits until bit 0x8 is set (after writing to Misc+0x5C) during CompatiRAM initialization, then clears it.

SKBL waits until bit 0x10 is set (after writing to Misc+0x60) during SceSonyRegbus initialization, then clears it.

0x0C4 Unknown. Only bit 0 is R/W. SKBL writes 0 here during SceSonyRegbus initialization.
0x0C8 RAZ/WI
0x0CC
0x0D0 Unknown. Only bit 0 is R/W.
0x0D4 RAZ/WI
0x0D8
0x0DC
0x0E0 Unknown. Only bit 0 is R/W.
0x0E4 Unknown. Only bit 0 is R/W.
0x0E8 Unknown. Only bit 0 is R/W.
0x0EC RAZ/WI
0x0F0
0x0F4
0x0F8
0x0FC
0x100
0x104
0x108
0x10C
0x110 SDIF related
0x114 SDIF related
0x118 SDIF related
0x11C SDIF related
0x120 RAZ/WI
0x124 SDIF voltage control? - 3.3V by default; 1 << sdif_idx to set the SDIF to 1.8V
0x128 RAZ/WI
0x12C
0x130 PERVASIVE_SYS_SBEATB - Pervasive Secure Bus Error Attribute
0x134 PERVASIVE_SYS_SBEADR - Pervasive Secure Bus Error Address
0x138 PERVASIVE_SYS_BEATB - Pervasive Bus Error Attribute
0x13C PERVASIVE_SYS_BEADR - Pervasive Bus Error Address
0x140 Related to DSI0
0x144 Related to CSI/CIF
0x148 Related to DSI1
0x14C RAZ/WI
0x150 Read/write. Unknown.
0x154 Read/write. Unknown.
0x158 Unknown. Only bits 0xFFFF are R/W.
0x15C RAZ/WI
0x160 Unknown. Only bits 0xFFFF are R/W.
0x164 Unknown. Only bits 0xFFFF are R/W.
0x168 RAZ/WI
0x16C
0x170 UDC-related? (similar to 0x17C)
0x174
0x178
0x17C Related to USB Device Controller
0x180 Read/write. Unknown.
0x184 Unknown. Only bits 0xFF are R/W.
0x188 Unknown. Only bit 0 is R/W.
0x18C UART5 pull-down enable (control flow pins)

Bit 1: UART5_CTS (Kermit B17 / mPCIe 10)

Bit 0: UART5_TX (Kermit A17 / mPCIe 12)

0x190 Unknown. Only bit 0 is R/W.
0x194 Related to Game Card. Only bit 0 is R/W.
0x198 Unknown. Only bit 0 is R/W.
0x19C RAZ/WI
0x1A0
0x1A4
0x1A8
0x1AC UART5 pull-down enable (control flow pins)

Bit 1: UART5_RFR (Kermit E17 / mPCIe 8)

Bit 0: UART5_RX (Kermit D17 / mPCIe 14)

0x1B0 RAZ/WI
0x1B4
0x1B8
0x1BC
0x1C0
0x1C4
0x1C8
0x1CC
0x1D0
0x1D4
0x1D8
0x1DC
0x1E0
0x1E4
0x1E8
0x1EC
0x1F0
0x1F4
0x1F8
0x1FC
0x200 Unknown. Only bits 0x3 are R/W.
0x204 RAZ/WI
0x208
0x20C
0x210 Unknown. Only bit 0 is R/W.
0x214 Unknown. Only bit 0 is R/W.
0x218 RAZ/WI
0x21C
0x220 Unknown. Only bit 0 is R/W.
0x224 Unknown. Only bit 0 is R/W.
0x228 Unknown. Only bits 0xFFFF are R/W.
0x22C Unknown. Only bits 0x3 are R/W.
0x230 Unknown. Only bits 0x7 are R/W.
0x240 Unknown. Only bits 0x3 are R/W.
0x260 Unknown. Only bits 0xFF are R/W.
0x270 Unknown. Only bits 0x3 are R/W.
0x274 Unknown. Only bits 0x3 are R/W.
0x280 Unknown. Only bits 0x1F are R/W.
0x284 Unknown. Only bit 0 is R/W.
0x2F0 Unknown. Only bit 0 is R/W.
0x2F4 Unknown. Only bit 0 is R/W. Writing 1 hangs the system.
0x2F8 Related to GPU/Regbus. Only bit 0 is R/W. Writing 1 triggers a GPU core dump.

Set to 1 by SKBL during CompatiRAM initialization, then set back to 0.

0x2FC Unknown. Only bit 0 is R/W.
0x300 Read-only? Unknown, equal to 0x3E8A8000.
0x304 Read-only? Unknown, equal to 0x65D3450C.
0x308 Read-only? Unknown, equal to 0x9C421841.
0x30C RAZ/WI
0x310 RAZ/WI? SDIF related
0x314~0xFFC are RAZ/WI

revision0

Returned by SceLowio#scePervasiveGetSoCRevisionForDriver, read by SKBL/NSKBL/...

Contains the Kermit revision (see sceKernelSysrootGetKermitRevisionForKernel) and other information.

Bit mask Information
0x80000000 Disable LPDDR2SUB. If set, it is not a DevKit.
0x20000000 Enable 4 LPDDR2 banks (used by SceCrashDump). Default is 2 LPPDR2 banks.
0x10000000 Enable 1 LPDDR2 bank (used by SceCrashDump). Default is 2 LPPDR2 banks.
0x0001FFFF Kermit revision
Kermit revision
Bit mask Information
0x0001FF00 Kermit new revision (new firmwares) (known values: 0 for KERMIT10_REV_ES4, 1 for KERMIT15_REV_ES1)
0x000000F0 Kermit major revision (old firmwares): Engineering Sample revision (1 = ES1, 2 = ES2, etc.)
0x0000000F Kermit minor revision (old firmwares)
Known values
Hardware Value
ES2.0 (according to System Software version 0.920) 0x0000002X
CXD5315GG-1 0x00000042
CXD5315GG 0x80000042
CXD5316GG 0x80000115
CXD5316BGG 0x94000115

ScePervasiveReset (0xE3101000)

Devices must be put out of reset (device reset disabled) before they are first used.

To enable reset of a device (put a device in reset), do *REG32(0xE3101000 + dev_off) |= mask.

To disable reset of a device (put a device out of reset), do *REG32(0xE3101000 + dev_off) &= ~mask.

dev_off Access Device Reset Mask Comment
0x4 Secure? ARM Debugger? 1 Of ARM coprocessor 14?
0x10 Non-secure GPU 1 enable: ScePervasiveForDriver_3E79D3D3/disable: ScePervasiveForDriver_8A85E36B
0x20 Secure PSP Allegrex 1 enable: ScePervasiveForDriver_377126CD/disable: ScePervasiveForDriver_6E11EB97
0x24 Secure SceSonyRegbus 1 enable: ScePervasiveForDriver_7B0F388B/disable: ScePervasiveForDriver_4CCD40E6
0x28 Secure CompatRAM 1 enable: ScePervasiveForDriver_7C285361/disable: ScePervasiveForDriver_E40BED0F
0x30 Non-secure Venezia 1 enable: ScePervasiveForDriver_28731EC5/disable: ScePervasiveForDriver_A7E64C6F
0x34 Non-secure Vip 1 enable: ScePervasiveForDriver_31C0A98B/disable: ScePervasiveForDriver_E2D8F6C3
0x40 Secure SDIO0 1
0x44 Secure SDIO1 1
0x48 Secure DebugPA 1
0x4C Secure SceDbgSdio 1
0x50 Secure DMAC0 1
0x54 Secure DMAC1 1
0x58 Secure DMAC2 1
0x5C Secure DMAC3 1
0x60 Secure DMAC4 1
0x64 Secure DMAC5 1
0x68 Secure DMAC6 1 need devmode or dipsw 0xC0 or 0xC1 or 0xC2.
0x70 Non-secure Csi 1 Camera Serial Interface
0x74
0x80 Non-secure Dsi 1
0x84
0x88 Non-secure Iftu 1 Integrated Facility Terminating Unit. See IFTU Registers. enable: ScePervasiveForDriver_B68254AD/disable: ScePervasiveForDriver_E92E28FF
0x8C Non-secure ? 1 enable: ScePervasiveForDriver_7AE2F8E8/disable: ScePervasiveForDriver_17109C28
0x90 Non-secure USB0/UDC0 0xB See UDC. enable: ScePervasiveForDriver_4AF7A01E/disable: ScePervasiveForDriver_13CC07C9

0x1 - USB Host Controller
0x2 - USB Device Controller
0x8 - ????
0x94 USB1/UDC1
0x98 USB2/UDC2
0xA0 Non-secure Sdif0 (emmc) 1 Storage Device InterFace
0xA4 Sdif1 (gcsd)
0xA8 Sdif2
0xAC Sdif3
0xB0 Non-secure Msif 1 Memory Stick InterFace. See MSIF Registers.
0xC0 Non-secure I2S (Audio) 1 Inter-IC Sound
0xC4
0xC8
0xCC
0xD0
0xD4
0xD8
0xDC
0xE0 Non-secure SrcMix 1 Source Mixer
0xE4
0xE8
0xF0 Non-secure SPDIF (Audio) 1 Sony/Philips Digital InterFace
0x100 Non-secure Gpio 1 General Purpose Input/Output. See GPIO Registers.
0x104 Non-secure Spi (Syscon) 1 Serial Peripheral Interface. See SPI Registers.
0x108 Spi (Motion)
0x10C Spi (OLED)
0x110 Non-secure I2C 1 Inter-Integrated Circuit. See I2C Registers.
0x114
0x120 Non-secure Uart0 (Console) 1 Universal Asynchronous Receiver Transmitter. See UART Registers.
0x124 Uart1
0x128 Uart2
0x12C Uart3
0x130 Uart4
0x134 Uart5 (3G Modem)
0x138 Uart6
0x154 Secure? Debug Bus 1 Taken out of reset by SKBL if Development mode or DIPsw 0xC0/0xC1/0xC2 is set
0x158 Secure? ? 1
0x160 Secure? LPDDR2MAIN (DDRIF0) 1
0x164 Secure? LPDDR2SUB (DDRIF1) 1
0x170 ? Timer 1?
0x178 Secure? SPM32 4 Scratch Pad Memory 32KiB
SPM128 8 Scratch Pad Memory 128KiB
0x17C Secure? Venezia? 1? Must be != 0 for SceKernelBusError to dump Venezia registers.
0x180 Secure VIP? 1 Must be != 0 for SceKernelBusError to dump VIP registers. enable: ScePervasiveForDriver_EBE9C84E/disable: ScePervasiveForDriver_8CF567AD
0x190 Secure bigmac or emmc cryptor ? This field is set to 0 by SK command 0xD01.

ScePervasiveGate (0xE3102000)

Devices can be clock gated to preserve battery.

To enable clock gate (request the clock of a device to be enabled), do *REG32(0xE3102000 + dev_off) |= mask.

To disable clock gate (request the clock of a device to be disabled), do *REG32(0xE3102000 + dev_off) &= ~mask.

dev_off Access Device Gate Mask Comment
0x0 Secure? ARM? 0x00F10000
0x4 Secure? ARM Debugger? 1 Of ARM coprocessor 14?
0x8 ? ? 0xFFFFFFFF
0xC ? N/A N/A Read-As-Zero / Write-Ignore
0x10 Non-secure GPU v & 0xF000F enable: ScePervasiveForDriver_39E51AE2/disable: ScePervasiveForDriver_CA0ACFC5
0x14 ? N/A N/A RAZ/WI
0x18
0x1C
0x20 Secure ? 1 (or 2) enable: ScePervasiveForDriver_8EE3AEDF/disable: ScePervasiveForDriver_3BF2A9B5
0x24 Secure ? 1 enable: ScePervasiveForDriver_7F4AB4AA/disable: ScePervasiveForDriver_0EBBE8DE
0x28 Secure CompatRAM ("Tachyon-eDRAM", 2MiB) 1 enable: ScePervasiveForDriver_B2EE45C9/disable: ScePervasiveForDriver_39979C55
0x2C ? N/A N/A RAZ/WI
0x30 Non-secure Venezia 1 (2 for secure) enable: ScePervasiveForDriver_FB01A2DD/disable: ScePervasiveForDriver_2EEBE9AE
0x34 Non-secure Vip 1 enable: ScePervasiveForDriver_B1CFA18F/disable: ScePervasiveForDriver_03E1FAA6
0x38 ? N/A N/A RAZ/WI
0x3C
0x40 Secure SceDbgSdio 1
0x44 Secure SceDbgSdio 1
0x48 Secure DebugPA 1 (or 2)
0x4C Secure SceDbgSdio 1 ?RAZ/WI?
0x50 Secure DMAC0 1
0x54 Secure DMAC1 1
0x58 Secure DMAC2 1
0x5C Secure DMAC3 1
0x60 Secure DMAC4 1
0x64 Secure DMAC5 1
0x68 Secure DMAC6 1 need devmode or dipsw 0xC0 or 0xC1 or 0xC2.
0x6C ? N/A N/A RAZ/WI
0x70 Non-secure Csi 1 Camera Serial Interface
0x74
0x78 ? N/A N/A RAZ/WI
0x7C
0x80 Non-secure Dsi 1 (or 0xF)
0x84
0x88 Non-secure Iftu 1 See IFTU Registers. enable: ScePervasiveForDriver_07F2A738/disable: ScePervasiveForDriver_5AFE0AF0
0x8C Non-secure ? 1 enable: ScePervasiveForDriver_C0C842FE/disable: ScePervasiveForDriver_9BB7B932
0x90 Non-secure USB0/UDC0 0xB (or 0xF) See UDC. enable: ScePervasiveForDriver_A2EFD7AF/disable: ScePervasiveForDriver_AD1E81EB

0x1 - USB Host Controller
0x2 - USB Device Controller
0x8 - ????
0x94 USB1/UDC1
0x98 USB2/UDC2
0x9C ? N/A N/A RAZ/WI
0xA0 Non-secure Sdif0 (emmc) 1 Storage Device InterFace
0xA4 Sdif1 (gcsd)
0xA8 Sdif2
0xAC Sdif3
0xB0 Non-secure Msif 1 Memory Stick InterFace. See MSIF Registers.
0xB4 ? N/A N/A RAZ/WI
0xB8
0xBC
0xC0 Non-secure I2S (Audio) 1 Inter-IC Sound
0xC4
0xC8
0xCC
0xD0
0xD4
0xD8
0xDC
0xE0 Non-secure SrcMix 1 Source Mixer
0xE4
0xE8
0xEC ? N/A N/A RAZ/WI
0xF0 Non-secure SPDIF (Audio) 1 Sony/Philips Digital InterFace
0xF4 ? N/A N/A RAZ/WI
0xF8
0xFC
0x100 Non-secure Gpio 1 General Purpose Input/Output. See GPIO Registers.
0x104 Non-secure Spi (Syscon) 1 Serial Peripheral Interface. See SPI Registers.
0x108 Spi (Motion)
0x10C Spi (OLED)
0x110 Non-secure I2C 1 Inter-Integrated Circuit. See I2C Registers.
0x114
0x118 ? N/A N/A RAZ/WI
0x11C
0x120 Non-secure Uart0 (Console) 1 Universal Asynchronous Receiver Transmitter. See UART Registers.
0x124 Uart1
0x128 Uart2
0x12C Uart3
0x130 Uart4
0x134 Uart5 (3G Modem)
0x138 Uart6
0x13C ? N/A N/A RAZ/WI
0x140
0x144
0x148
0x14C
0x150
0x154 Secure? Debug Bus 1 See ScePervasiveReset for details.
0x158 Secure? ? 1
0x15C ? N/A N/A RAZ/WI
0x160 Secure? LPDDR2MAIN (DDRIF0) 1
0x164 Secure? LPDDR2SUB (DDRIF1) 1
0x168 ? N/A N/A RAZ/WI
0x16C
0x170 ? Timer 1?
0x174 ? ? 1
0x178 Secure? Compati2MiB 1 ?
? 2 ?
SPM128 4 Scratch Pad Memory 128KiB
SPM32 8 Scratch Pad Memory 32KiB
DevNull 0x10 /dev/null (PA 0x1D000000)
0x17C ? N/A N/A RAZ/WI
0x180 ? ? 0xFF
0x184 ? ? 0x3
0x188 ? N/A N/A RAZ/WI
0x18C
0x190~0xFFC are RAZ/WI

ScePervasiveBaseClk (0xE3103000)

“Base Clock” registers - used to control the clocks fed to various peripherals in the SoC.

Offset Accessibly Description
0x0/0x4 Non-Secure/Secure ARM Clocks
0x10 Non-Secure/Secure GPU Clock
0x20 Non-Secure/Secure (?) VENEZIA Clock
0x30 Non-Secure Vip Clock
0x40 Secure CMeP Clock
0x44 Non-Secure CameraBus Clock
0x50 Secure Could be Center Xbar/Bus clock

Set to 1 by First Loader under certain conditions

0x60 Non-Secure Related to offset 0x60/0x64/0xA4.
0x64 Non-Secure Related to offset 0x60/0x64/0xA4.
0x68 Non-Secure Unknown. freq setting by ScePervasiveForDriver_A96642E3
0x70 Non-Secure Related to Audio. freq setting by ScePervasiveForDriver_925D9D24
0x90 Secure DRAM Main Clock
0x94 Secure DRAM Sub Clock
0xA4 Non-Secure Related to offset 0x60/0x64/0xA4.
0xB0 Non-Secure Msif Clock
0xC4 Secure Compat/GpuXbar Clock (PSP stuff)
0x100 Non-Secure DSI1 Clock
0x180 Non-Secure DSI0 Clock
0x1D0 Non-Secure HDMI Clock
0x1F0 Non-Secure Dmac5 Clock
0x210 Non-Secure Related to Audio. freq setting by ScePervasiveForDriver_2FB5F88F
0x214 Non-Secure Sys Clock

ARM Clocks

The ARM core clock and L2 cache clock consist of two registers 0xE3103000 and 0xE3103004.

ARM clock register role list Collapse
Register Address Role
0xE3103000 Multiplier. This selects how much to multiply the 27.777...MHz supplied by the crystal.
0xE3103004 Divisor. This adjusts the clock determined by the multiplication.

The base clock is probably 27.777... MHz, and by applying a multiplier to the base clock you can get common clock speeds.

And it seems that 1 is selected internally when Undefined value is selected.

Core Multiplier (0xE3103000) Collapse
Value ARM Core Multiplier ARM Core freq (MHz)
0 Undefined Undefined
1 x1.5 41.666 ...
2 Undefined Undefined
3 x3 83.333 ...
4 x4 111.111 ...
5 x6 166.666 ...
6 x8 222.222 ...
7 x12 333.333 ...
8 x16 444.444 ...
9 x18 500.0
10 x12 333.333 ...
11 Undefined Undefined
12 x4.5 125.0
13 x9 250.0
14 x16 444.444 ...
15 x18 500.0

Also, here is the ARM Core/L2 Cache clock list dumped from second_loader.

second_loader embd clock list for Multiplier (0xE3103000) Collapse
Index ARM core freq L2 cache freq
0 Undefined Undefined
1 42 42
2 Undefined Undefined
3 83 83
4 111 111
5 166 166
6 222 222
7 333 333
8 444 222
9 500 250
10 333 166
11 Undefined Undefined
12 125 125
13 250 250
14 444 444
15 500 500

The Divisor (0xE3103004) reduces the clock in steps.

Divisor ranges from 0 to 8. Selecting 9 or higher selects 0 internally.

ARM core measured freq with Multiplier and Divisor
base 0 1 2 3 4 5 6 7 8
1 41.666 MHz 39.62 MHz 36.458 MHz 33.854 MHz 31.249 MHz 28.645 MHz 26.41 MHz 23.437 MHz 20.833 MHz
3 83.333 MHz 78.124 MHz 72.916 MHz 67.708 MHz 62.499 MHz 57.291 MHz 52.83 MHz 46.874 MHz 41.666 MHz
4 111.111 MHz 104.166 MHz 97.222 MHz 90.277 MHz 83.333 MHz 76.388 MHz 69.444 MHz 62.499 MHz 55.555 MHz
5 166.666 MHz 156.249 MHz 145.833 MHz 135.416 MHz 124.999 MHz 114.583 MHz 104.166 MHz 93.749 MHz 83.333 MHz
6 222.222 MHz 208.333 MHz 194.444 MHz 180.555 MHz 166.666 MHz 152.777 MHz 138.888 MHz 124.999 MHz 111.111 MHz
7 333.333 MHz 312.499 MHz 291.666 MHz 270.833 MHz 249.999 MHz 229.166 MHz 208.333 MHz 187.499 MHz 166.666 MHz
8 444.444 MHz 416.666 MHz 388.888 MHz 361.111 MHz 333.333 MHz 305.555 MHz 277.777 MHz 249.999 MHz 222.222 MHz
9 500.0 MHz 468.749 MHz 437.499 MHz 406.249 MHz 374.999 MHz 343.749 MHz 312.499 MHz 281.249 MHz 249.999 MHz
10 333.333 MHz 312.499 MHz 291.666 MHz 270.833 MHz 249.999 MHz 229.166 MHz 208.333 MHz 187.499 MHz 166.666 MHz
12 124.999 MHz 117.187 MHz 109.374 MHz 101.562 MHz 93.749 MHz 85.937 MHz 78.124 MHz 70.312 MHz 62.499 MHz
13 249.999 MHz 234.374 MHz 218.749 MHz 203.124 MHz 187.499 MHz 171.874 MHz 156.249 MHz 140.624 MHz 124.999 MHz
14 444.444 MHz 416.666 MHz 388.888 MHz 361.111 MHz 333.333 MHz 305.555 MHz 277.777 MHz 249.999 MHz 222.222 MHz
15 500.0 MHz 468.749 MHz 437.499 MHz 406.249 MHz 374.999 MHz 343.749 MHz 312.499 MHz 281.249 MHz 249.999 MHz

And the overall pseudocode for these is as follows. 

multiplier_list[] = {
	1.5, // Undefined
	1.5,
	1.5, // Undefined
	3,
	4,
	6,
	8,
	12,
	16,
	18,
	12,
	1.5, // Undefined
	4.5,
	9,
	16,
	18
};

f(b = 27.777...) = (b * multiplier_list[multiplier & 0xF])(1 - divisor / 16)

Also a joke-like approximation : f(b = 27.777...) = (b * multiplier_list[multiplier & 0xF])(1 - divisor * π^-(1 + √2)).

However, not sure if this formula is completely correct, but It can see that it is very close to the value of yifan's clock analyzer.

ARM Clocks (by yifan's clock analyzer)

The ARM CPU clocks are controlled by two registers at physical address 0xE3103000 (ScePervasiveBaseClk). Currently, it is unknown how the values are interpreted. However, 0xE3103000 (one word) takes values 0 to 16, and increases clock speed while 0xE3103004 (single byte) takes values 0 to 8 and decreases clock speed. It is likely related to a PLL multiply and divide function. The input clock signal comes from a P1P40167 clock synthesizer (found on the bottom of the board under the main SoC). It takes a 27MHz crystal and generates a 37MHz clock which feeds directly into the SoC's internal PLL.

The following are tests run to determine what the values of each register corresponds to. It appears that the maximum clock speed is 499MHz and the minimum clock speed is 16MHz.

These clocks may be wrong. "Kernel Clock Speed" is "Clock Speed + 5". However, there is an error of ± 5 to 6 in "Clock Speed".

0xE3103000 0xE3103004 Clock Speed (MHz) Kernel Clock Speed (MHz)
0 0 37 42
0 1 35 40
0 2 32 37
0 3 29 34
0 4 27 32
0 5 24 29
0 6 22 27
0 7 19 24
0 8 16 21
1 0 37 42
1 1 35 40
1 2 32 37
1 3 30 35
1 4 27 32
1 5 24 29
1 6 22 27
1 7 19 24
1 8 16 21
2 0 37 42
2 1 35 40
2 2 32 37
2 3 30 35
2 4 27 32
2 5 24 29
2 6 22 27
2 7 19 24
2 8 16 21
3 0 79 84
3 1 74 79
3 2 69 74
3 3 63 68
3 4 58 63
3 5 53 58
3 6 48 53
3 7 43 48
3 8 37 42
4 0 107 112
4 1 100 105
4 2 93 98
4 3 86 91
4 4 79 84
4 5 72 77
4 6 65 70
4 7 58 63
4 8 51 56
5 0 162 167
5 1 152 157
5 2 142 147
5 3 131 136
5 4 121 126
5 5 110 115
5 6 100 105
5 7 90 95
5 8 79 84
6 0 218 223
6 1 204 209
6 2 190 195
6 3 176 181
6 4 163 168
6 5 148 153
6 6 135 140
6 7 121 126
6 8 107 112
7 0 329 334
7 1 308 313
7 2 287 292
7 3 266 271
7 4 246 251
7 5 225 230
7 6 204 209
7 7 183 188
7 8 162 167
8 0 439 444
8 1 411 416
8 2 384 389
8 3 356 361
8 4 329 334
8 5 301 306
8 6 273 278
8 7 246 251
8 8 218 223
9 0 494 499
9 1 463 468
9 2 432 437
9 3 401 406
9 4 370 375
9 5 339 344
9 6 308 313
9 7 277 282
9 8 245 250
10 0 328 333
10 1 308 313
10 2 287 292
10 3 266 271
10 4 245 250
10 5 225 230
10 6 204 209
10 7 183 188
10 8 162 167
11 0 37 42
11 1 35 40
11 2 32 37
11 3 30 35
11 4 27 32
11 5 24 29
11 6 22 27
11 7 19 24
11 8 16 21
12 0 121 126
12 1 113 118
12 2 105 110
12 3 97 102
12 4 90 95
12 5 82 87
12 6 74 79
12 7 66 71
12 8 58 63
13 0 245 250
13 1 230 235
13 2 214 219
13 3 199 204
13 4 183 188
13 5 168 173
13 6 152 157
13 7 136 141
13 8 121 126
14 0 439 444
14 1 412 417
14 2 384 389
14 3 356 361
14 4 329 334
14 5 301 306
14 6 273 278
14 7 246 251
14 8 218 223
15 0 494 499
15 1 463 468
15 2 433 438
15 3 401 406
15 4 370 375
15 5 339 344
15 6 308 313
15 7 277 282
15 8 245 250
16 0 37 42
16 1 35 40
16 2 32 37
16 3 29 34
16 4 27 32
16 5 24 29
16 6 22 27
16 7 19 24
16 8 16 21

GPU Clocks

The GPU clock is controlled by the 32-bit 0xE3103010. However, it is divided into a lower 16-bit for mpfreq and an upper 16-bit for corefreq.

Allowed register values for corefreq
Value Clock speed
0 42MHz
1 55MHz
2 83MHz
3 111MHz
5 166MHz
7 222MHz
Allowed register values for mpfreq
Value Clock speed
0 42MHz
1 55MHz
2 83MHz
3 111MHz
5 166MHz
7 222MHz

VENEZIA Clock

The register at physical address 0xE3103020 seems to control the clock frequency of VENEZIA.

Allowed register values
Value Clock speed
0x1 41MHz
0x2 55MHz
0x3 83MHz
0x4 111MHz
0x5 166MHz
0x6 222MHz
0x7 333MHz

Vip Clock

Allowed register values
Value Clock speed
0x1 41MHz
0x2 55MHz
0x3 83MHz
0x4 111MHz
0x5 166MHz
0x6 222MHz

CMeP Clock

The low 8 bits of the register at physical address 0xE3103040 control CMeP clock speed, and Main Xbar, I/O Bus speed too. This was guessed because it is used in a usleep()-like function to calculate the input for a sleep_for_cycles() function.


Testing was performed using SceLT5 as a time reference (µs-accurate), and compared against the hardcoded table in second_loader.

Value Main Xbar I/O Bus CMeP speed (measured) Table value
0x0 Unknown Unknown 41.5 MHz N/A
0x1 Unknown Unknown 41.5 MHz
0x2 Unknown Unknown 55.4 MHz
0x3 Unknown Unknown 83.0 MHz
0x4 Unknown Unknown 110.7 MHz
0x5 Unknown Unknown 166.0 MHz
0x6 Unknown Unknown 110.7 MHz
0x7 Unknown Unknown 166.0 MHz
0x10000 Undefined Undefined 27.7 MHz 50 MHz
0x10001 Undefined Undefined 27.7 MHz 50 MHz
0x10002 56 MHz 27 MHz 27.7 MHz 27 MHz
0x10003 83 MHz 42 MHz 41.5 MHz 42 MHz
0x10004 111 MHz 56 MHz 55.3 MHz 56 MHz
0x10005 166 MHz 83 MHz 83.0 MHz 83 MHz
0x10006 222 MHz 111 MHz 110.7 MHz 111 MHz
0x10007 333 MHz 166 MHz 166.0 MHz 160 MHz

second_loader sets the register to 0x10005, meaning CMeP usually runs at 83MHz.

CameraBus Clock

Allowed register values
Value Clock speed
1 41 MHz
2 67 MHz
3 83 MHz
4 133 MHz
5 166 MHz

DRAM Main Clock

Allowed register values
Value Clock speed (measured)
1 170 MHz

DRAM Sub Clock

Allowed register values
Value Clock speed (measured)
1 170 MHz

Msif Clock

Allowed register values
Value Clock speed
0x10000 20 MHz
0x10001 40 MHz
0x10002 60 MHz

Bit 0x10000 is optional i.e by default Msif runs at 20 MHz. Its effect is unknown.

Compat/GpuXbar Clock

Allowed register values
Value Compat Clock speed GpuXbar Clock speed
0 333 MHz 166 MHz
1 Unknown 111 MHz
2 222 MHz 83 MHz

Dmac5 Clock

Allowed register values
Value Clock speed
1 41 MHz
2 83 MHz
3 133 MHz
4 166 MHz

Sys Clock

Allowed register values
Value Clock speed
0 222 MHz
1 190 MHz

ScePervasiveVid (0xE3104000)

Voltage ID.

Offset Group Value
0x0 VDDA 0
0x4 VDDA 0x1F
0x8 VDDA 0x27
0xC VDDA 0x2F
0x10 VDDA 0x31
0x14 VDDA 0x31
0x40 VDDG 0x1D
0x44 VDDG 0x22
0x48 VDDG 0x2E
0x4C VDDG 0x25
0x60 ? 0x1D
0x64 ? 0x27
0x68 ? 0x2E
0x6C ? 0x30
0xA0 Bus 0
0xA4 Bus 0x1E
0xA8 Bus 0x27
0xAC Bus 0x2E

It is used in sceSysconCtrlVoltageForDriver and the value is used as follows. 

sceSysconCtrlVoltageForDriver(type, 0x8A - vid); // 0x8A == 138 -> 1.38v - vid

ScePervasive2 (0xE3110000)

Offset Description
0x248 VIP_PROT_BAP_ERRV
0x24C VIP_PROT_BAP_ERRC
0x250 VIP_PROT_BAP_ERRA
0x254 VIP_PROT_VDPD_ERRV
0x258 VIP_PROT_VDPD_ERRC
0x25C VIP_PROT_VDPD_ERRA
0x260 VIP_PROT_VDPM_ERRV
0x264 VIP_PROT_VDPM_ERRC
0x268 VIP_PROT_VDPM_ERRA
0x348 VENE_PROT_REG_ERRV
0x34C VENE_PROT_REG_ERRC
0x350 VENE_PROT_REG_ERRA
0xC00 0x0 alias for ARM (0 / 1) = (0x1f000000 / 0x40000000)
0xD04 SPM128 Bus Error Address register
0xD08 SPM128 Bus Error Attribute register
0xD14 SPM32 Bus Error Address register
0xD18 SPM32 Bus Error Attribute register
0xD24 CompatRAM Bus Error Address register
0xD28 CompatRAM Bus Error Attribute register
0xD34 Pervasive2 Bus Error Address register - maybe PERVASIVE2_SYS_BEADR
0xD38 Pervasive2 Bus Error Attribute register - maybe PERVASIVE2_SYS_BEATB
0xD44 SPM128 Secure Bus Error Address register
0xD48 SPM128 Secure Bus Error Attribute register
0xD54 SPM32 Secure Bus Error Address register
0xD58 SPM32 Secure Bus Error Attribute register
0xD64 CompatRAM Secure Bus Error Address register
0xD68 CompatRAM Secure Bus Error Attribute register
0xD74 Pervasive2 Secure Bus Error Address register - maybe PERVASIVE2_SYS_SBEADR
0xD78 Pervasive2 Secure Bus Error Attribute register - maybe PERVASIVE2_SYS_SBEATB
0xD80 BET0 (Bus Error Target 0) - full name may be PERVASIVE2_SYS_BET0
0xD90 BET1 (Bus Error Target 1) - full name may be PERVASIVE2_SYS_BET1
0xD94 PERVASIVE2_SYS_BEBT - Bus Error ?Bus Target?
0xDC0 SBET0 (Secure Bus Error Target 0) - full name may be PERVASIVE2_SYS_SBET0
0xDD0 SBET1 (Secure Bus Error Target 1) - full name may be PERVASIVE2_SYS_SBET1
0xDD4 PERVASIVE2_SYS_SBEBT - Secure Bus Error ?Bus Target?
0xF30 USB PHY ready state - Bit 0 = Port 0, Bit 1 = Port 1, Bit 2 = Port 2
0xF34 USB PHY interrupt state - Bit 0 = Port 0, Bit 1 = Port 1, Bit 2 = Port 2
0xF40 Bit 0 = Memory Card insert state
0xF44 Memory Card insert interrupt state - Bit 0 = Card removed, Bit 1 = Card inserted
0xF50 USB VBUS state - Bit 0 = Port 0, Bit 1 = Port 1, Bit 2 = Port 2
0xF54 USB VBUS interrupt state
0xFC0 Unknown, Pervasive2 access modes? Written to by SMC 0x106. Only bits 0x3FFFF are R/W.
Retrieved from "http://wiki.henkaku.xyz/index.php?title=Pervasive&oldid=21514"