Pervasive

From Vita Development Wiki
Jump to navigation Jump to search

Pervasive is a device that controls the clocks of most of the devices of the system.

ScePervasiveMisc (0xE3100000)

Devices can be fully disabled? by writing a 1 to the corresponding bit of the ScePervasiveMisc (PA 0xE3100000) register. To disable the device dev_off, do *REG32(0xE3100000 + (dev_off / 32) * 4) = 1 << (31 - (dev_off % 32)).

Offset Description
0x0000 revision0. ex:0x80000115
0x0004 Unknown - SKBL prints L2 Cache is defective if bit 0x2 is set
0x0130 PERVASIVE_SYS_SBEATB - Pervasive Secure Bus Error Attribute
0x0134 PERVASIVE_SYS_SBEADR - Pervasive Secure Bus Error Address
0x0138 PERVASIVE_SYS_BEATB - Pervasive Bus Error Attribute
0x013C PERVASIVE_SYS_BEADR - Pervasive Bus Error Address
0x0300 Unknown
0x0304 Unknown
0x0308 Unknown

revision0

Returned by SceLowio#scePervasiveGetSoCRevisionForDriver, read by SKBL/NSKBL/...

Contains the Kermit revision (see sceKernelSysrootGetKermitRevisionForKernel) and other information.

Bit mask Information
0x80000000 Disable LPDDR2SUB
0x30000000 Unknown (used by SceCrashDump)
0x4FFE0000 Unknown
0x0001FFFF Kermit revision
0x000000FF Kermit revision (old firmwares)
Known values
Hardware Value
PCH-1100 0x80000042
VTE-1016 0x80000042
PCH-2000 0x80000115
PDEL-1000 0x00000042

ScePervasiveReset (0xE3101000)

Devices must be put out of reset (device reset disabled) before they are first used.

To enable reset of a device (put a device in reset), do *REG32(0xE3101000 + dev_off) |= mask.

To disable reset of a device (put a device out of reset), do *REG32(0xE3101000 + dev_off) &= ~mask.

dev_off Access Device Reset Mask Comment
0x4 Secure? ARM Debugger? 1 Of ARM coprocessor 14?
0x10 Non-secure GPU 1 enable: ScePervasiveForDriver_3E79D3D3/disable: ScePervasiveForDriver_8A85E36B
0x20 Secure ? 1 enable: ScePervasiveForDriver_377126CD/disable: ScePervasiveForDriver_6E11EB97
0x24 Secure ? 1 enable: ScePervasiveForDriver_7B0F388B/disable: ScePervasiveForDriver_4CCD40E6
0x28 Secure CompatRAM 1 enable: ScePervasiveForDriver_7C285361/disable: ScePervasiveForDriver_E40BED0F
0x30 Non-secure Venezia 1 enable: ScePervasiveForDriver_28731EC5/disable: ScePervasiveForDriver_A7E64C6F
0x34 Non-secure Vip 1 enable: ScePervasiveForDriver_31C0A98B/disable: ScePervasiveForDriver_E2D8F6C3
0x40 Secure SDIO0 1
0x44 Secure SDIO1 1
0x48 Secure DebugPA 1
0x4C Secure SceDbgSdio 1
0x50 Secure DMAC0 1
0x54 Secure DMAC1 1
0x58 Secure DMAC2 1
0x5C Secure DMAC3 1
0x60 Secure DMAC4 1
0x64 Secure DMAC5 1
0x68 Secure DMAC6 1 need devmode or dipsw 0xC0 or 0xC1 or 0xC2.
0x70 Non-secure Csi 1 Camera Serial Interface
0x74
0x80 Non-secure Dsi 1
0x84
0x88 Non-secure Iftu 1 Integrated Facility Terminating Unit. See IFTU Registers. enable: ScePervasiveForDriver_B68254AD/disable: ScePervasiveForDriver_E92E28FF
0x8C Non-secure ? 1 enable: ScePervasiveForDriver_7AE2F8E8/disable: ScePervasiveForDriver_17109C28
0x90 Non-secure USB/Udcd ? USB Device Controller. See UDC. enable: ScePervasiveForDriver_4AF7A01E/disable: ScePervasiveForDriver_13CC07C9
0x94
0xA0 Non-secure Sdif0 (emmc) 1 Storage Device InterFace
0xA4 Sdif1 (gcsd)
0xA8 Sdif2
0xAC Sdif3
0xB0 Non-secure Msif 1 Memory Stick InterFace. See MSIF Registers.
0xC0 Non-secure I2S (Audio) 1 Inter-IC Sound
0xC4
0xC8
0xCC
0xD0
0xD4
0xD8
0xDC
0xE0 Non-secure SrcMix 1 Source Mixer
0xE4
0xE8
0xF0 Non-secure SPDIF (Audio) 1 Sony/Philips Digital InterFace
0x100 Non-secure Gpio 1 General Purpose Input/Output. See GPIO Registers.
0x104 Non-secure Spi (Syscon) 1 Serial Peripheral Interface. See SPI Registers.
0x108 Spi (Motion)
0x10C Spi (OLED)
0x110 Non-secure I2C 1 Inter-Integrated Circuit. See I2C Registers.
0x114
0x120 Non-secure Uart0 (Console) 1 Universal Asynchronous Receiver Transmitter. See UART Registers.
0x124 Uart1
0x128 Uart2
0x12C Uart3
0x130 Uart4
0x134 Uart5 (3G Modem)
0x138 Uart6
0x154 Secure? Debug Bus 1 Taken out of reset by SKBL if Development mode or DIPsw 0xC0/0xC1/0xC2 is set
0x158 Secure? ? 1
0x160 Secure? LPDDR2MAIN (DDRIF0) 1
0x164 Secure? LPDDR2SUB (DDRIF1) 1
0x170 ? Timer 1?
0x178 Secure? SPM32 4 Scratch Pad Memory 32KiB
SPM128 8 Scratch Pad Memory 128KiB
0x17C Secure? Venezia? 1? Must be != 0 for SceKernelBusError to dump Venezia registers.
0x180 Secure VIP? 1 Must be != 0 for SceKernelBusError to dump VIP registers. enable: ScePervasiveForDriver_EBE9C84E/disable: ScePervasiveForDriver_8CF567AD
0x190 Secure bigmac or emmc cryptor ? x

ScePervasiveGate (0xE3102000)

Devices can be clock gated to preserve battery.

To enable clock gate (request the clock of a device to be enabled), do *REG32(0xE3102000 + dev_off) |= mask.

To disable clock gate (request the clock of a device to be disabled), do *REG32(0xE3102000 + dev_off) &= ~mask.

dev_off Access Device Gate Mask Comment
0x0 Secure? ? ?
0x4 Secure? ARM Debugger? 1 Of ARM coprocessor 14?
0x10 Non-secure GPU v & 0xF000F enable: ScePervasiveForDriver_39E51AE2/disable: ScePervasiveForDriver_CA0ACFC5
0x20 Secure ? 1 enable: ScePervasiveForDriver_8EE3AEDF/disable: ScePervasiveForDriver_3BF2A9B5
0x24 Secure ? 1 enable: ScePervasiveForDriver_7F4AB4AA/disable: ScePervasiveForDriver_0EBBE8DE
0x28 Secure CompatRAM (2MiB) 1 enable: ScePervasiveForDriver_B2EE45C9/disable: ScePervasiveForDriver_39979C55
0x30 Non-secure Venezia 1 (2 for secure) enable: ScePervasiveForDriver_FB01A2DD/disable: ScePervasiveForDriver_2EEBE9AE
0x34 Non-secure Vip 1 enable: ScePervasiveForDriver_B1CFA18F/disable: ScePervasiveForDriver_03E1FAA6
0x40 Secure SceDbgSdio 1
0x44 Secure SceDbgSdio 1
0x48 Secure DebugPA 1 (also has 2?)
0x4C Secure SceDbgSdio 1
0x50 Secure DMAC0 1
0x54 Secure DMAC1 1
0x58 Secure DMAC2 1
0x5C Secure DMAC3 1
0x60 Secure DMAC4 1
0x64 Secure DMAC5 1
0x68 Secure DMAC6 1 need devmode or dipsw 0xC0 or 0xC1 or 0xC2.
0x70 Non-secure Csi 1 Camera Serial Interface
0x74
0x80 Non-secure Dsi 1
0x84
0x88 Non-secure Iftu 1 Integrated Facility Terminating Unit. See IFTU Registers. enable: ScePervasiveForDriver_07F2A738/disable: ScePervasiveForDriver_5AFE0AF0
0x8C Non-secure ? 1 enable: ScePervasiveForDriver_C0C842FE/disable: ScePervasiveForDriver_9BB7B932
0x90 Non-secure USB/Udcd ? USB Device Controller. See UDC. enable: ScePervasiveForDriver_4AF7A01E/disable: ScePervasiveForDriver_13CC07C9
0x94
0xA0 Non-secure Sdif0 (emmc) 1 Storage Device InterFace
0xA4 Sdif1 (gcsd)
0xA8 Sdif2
0xAC Sdif3
0xB0 Non-secure Msif 1 Memory Stick InterFace. See MSIF Registers.
0xC0 Non-secure I2S (Audio) 1 Inter-IC Sound
0xC4
0xC8
0xCC
0xD0
0xD4
0xD8
0xDC
0xE0 Non-secure SrcMix 1 Source Mixer
0xE4
0xE8
0xF0 Non-secure SPDIF (Audio) 1 Sony/Philips Digital InterFace
0x100 Non-secure Gpio 1 General Purpose Input/Output. See GPIO Registers.
0x104 Non-secure Spi (Syscon) 1 Serial Peripheral Interface. See SPI Registers.
0x108 Spi (Motion)
0x10C Spi (OLED)
0x110 Non-secure I2C 1 Inter-Integrated Circuit. See I2C Registers.
0x114
0x120 Non-secure Uart0 (Console) 1 Universal Asynchronous Receiver Transmitter. See UART Registers.
0x124 Uart1
0x128 Uart2
0x12C Uart3
0x130 Uart4
0x134 Uart5 (3G Modem)
0x138 Uart6
0x154 Secure? Debug Bus 1 See PervasiveReset for details.
0x158 Secure? ? 1
0x160 Secure? LPDDR2MAIN (DDRIF0) 1
0x164 Secure? LPDDR2SUB (DDRIF1) 1
0x170 ? Timer 1?
0x178 Secure? SPM32 4 Scratch Pad Memory 32KiB
SPM128 8 Scratch Pad Memory 128KiB

ScePervasiveBaseClk (0xE3103000)

Offset Access Device
0x0 Non-secure CPU (ARM)
0x4 Non-secure CPU (ARM)
0x10 Non-secure GPU
0x20 Non-secure Venezia
0x24 Non-secure ?
0x30 Non-secure Vip
0x40 Secure CMeP/Bus
0x44 Non-secure CameraBus
0x50 Secure ? (could be bigmac. or sdif)
0x60 Non-secure ?
0x64 Non-secure ?
0x68 Non-secure ?
0x70 Non-secure ? (Audio related. freq setting by ScePervasiveForDriver_925D9D24)
0x90 Secure DRAM Main
0x94 Secure DRAM Sub
0xA4 Non-secure ?
0xB0 Non-secure Msif
0xC4 Secure Compat/Xbar
0x100 Non-secure ?
0x180 Non-secure ?
0x1D0 Non-secure HDMI
0x1F0 Non-secure Direct Memory Access Controller 5. See Dmac5.
0x210 Non-secure ? (Audio related. freq setting by ScePervasiveForDriver_2FB5F88F)
0x214 Non-secure Sys

ScePervasiveVid (0xE3104000)

Voltage integer data

Offset Group Value
0x0 ARM 0
0x4 ARM 0x1F
0x8 ARM 0x27
0xC ARM 0x2F
0x10 ARM 0x31
0x14 ARM 0x31
0x40 ? 0x1D
0x44 ? 0x22
0x48 ? 0x2E
0x4C ? 0x25
0x60 ? 0x1D
0x64 ? 0x27
0x68 ? 0x2E
0x6C ? 0x30
0xA0 Bus 0
0xA4 Bus 0x1E
0xA8 Bus 0x27
0xAC Bus 0x2E

Base Clock

Registers at physical address 0xE2103000 (ScePervasiveBaseClk).

Offset Accessibly Description
0x0/0x4 Non-Secure/Secure ARM Clocks
0x10 Secure GPU Clock
0x20 Non-Secure/Secure (?) VENEZIA Clock
0x30 Non-Secure Vip Clock
0x40 Secure CMeP Clock
0x44 Non-Secure CameraBus Clock
0x60 Non-Secure Related to offset 0x60/0x64/0xA4.
0x64 Non-Secure Related to offset 0x60/0x64/0xA4.
0x70 Non-Secure Related to Audio. freq setting by ScePervasiveForDriver_925D9D24
0xA4 Non-Secure Related to offset 0x60/0x64/0xA4.
0xB0 Non-Secure Msif Clock
0x1D0 Non-Secure HDMI Clock
0x1F0 Non-Secure Dmac5 Clock
0x210 Non-Secure Related to Audio. freq setting by ScePervasiveForDriver_2FB5F88F

ARM Clocks

The ARM core clock and L2 cache clock consist of two registers 0xE2103000 and 0xE2103004.

Register 0xE2103000 selects the base clock frequency.

It seems that 42-freq is selected internally when Undefined index is selected

0xE2103000 ARM clock list
Index ARM core freq L2 cache freq
0 Undefined Undefined
1 42 42
2 Undefined Undefined
3 83 83
4 111 111
5 166 166
6 222 222
7 333 333
8 444 222
9 500 250
10 333 166
11 Undefined Undefined
12 125 125
13 250 250
14 444 444
15 500 500

Register 0xE2103004 adjusts the selected base clock frequency.

0xE2103004 sets the index that adjusts the base clock frequency.

It seems that the adjustment can be expressed by the following formula.

f(n) = n(1 - adjust_index / 16)

adjust_index ranges from 0 to 16 (?)

Also a joke-like approximation : f(n) = n(1 - aπ^-(1 + √2)).

However, not sure if this formula is completely correct, but It can see that it is very close to the value of yifan's clock analyzer.

ARM Clocks (by yifan's clock analyzer)

The ARM CPU clocks are controlled by two registers at physical address 0xE3103000 (ScePervasiveBaseClk). Currently, it is unknown how the values are interpreted. However, 0xE3103000 (one word) takes values 0 to 16, and increases clock speed while 0xE3103004 (single byte) takes values 0 to 8 and decreases clock speed. It is likely related to a PLL multiply and divide function. The input clock signal comes from a P1P40167 clock synthesizer (found on the bottom of the board under the main SoC). It takes a 27MHz crystal and generates a 37MHz clock which feeds directly into the SoC's internal PLL.

The following are tests run to determine what the values of each register corresponds to. It appears that the maximum clock speed is 499MHz and the minimum clock speed is 16MHz.

These clocks may be wrong. "Kernel Clock Speed" is "Clock Speed + 5". However, there is an error of ± 5 to 6 in "Clock Speed".

0xE3103000 0xE3103004 Clock Speed (MHz) Kernel Clock Speed (MHz)
0 0 37 42
0 1 35 40
0 2 32 37
0 3 29 34
0 4 27 32
0 5 24 29
0 6 22 27
0 7 19 24
0 8 16 21
1 0 37 42
1 1 35 40
1 2 32 37
1 3 30 35
1 4 27 32
1 5 24 29
1 6 22 27
1 7 19 24
1 8 16 21
2 0 37 42
2 1 35 40
2 2 32 37
2 3 30 35
2 4 27 32
2 5 24 29
2 6 22 27
2 7 19 24
2 8 16 21
3 0 79 84
3 1 74 79
3 2 69 74
3 3 63 68
3 4 58 63
3 5 53 58
3 6 48 53
3 7 43 48
3 8 37 42
4 0 107 112
4 1 100 105
4 2 93 98
4 3 86 91
4 4 79 84
4 5 72 77
4 6 65 70
4 7 58 63
4 8 51 56
5 0 162 167
5 1 152 157
5 2 142 147
5 3 131 136
5 4 121 126
5 5 110 115
5 6 100 105
5 7 90 95
5 8 79 84
6 0 218 223
6 1 204 209
6 2 190 195
6 3 176 181
6 4 163 168
6 5 148 153
6 6 135 140
6 7 121 126
6 8 107 112
7 0 329 334
7 1 308 313
7 2 287 292
7 3 266 271
7 4 246 251
7 5 225 230
7 6 204 209
7 7 183 188
7 8 162 167
8 0 439 444
8 1 411 416
8 2 384 389
8 3 356 361
8 4 329 334
8 5 301 306
8 6 273 278
8 7 246 251
8 8 218 223
9 0 494 499
9 1 463 468
9 2 432 437
9 3 401 406
9 4 370 375
9 5 339 344
9 6 308 313
9 7 277 282
9 8 245 250
10 0 328 333
10 1 308 313
10 2 287 292
10 3 266 271
10 4 245 250
10 5 225 230
10 6 204 209
10 7 183 188
10 8 162 167
11 0 37 42
11 1 35 40
11 2 32 37
11 3 30 35
11 4 27 32
11 5 24 29
11 6 22 27
11 7 19 24
11 8 16 21
12 0 121 126
12 1 113 118
12 2 105 110
12 3 97 102
12 4 90 95
12 5 82 87
12 6 74 79
12 7 66 71
12 8 58 63
13 0 245 250
13 1 230 235
13 2 214 219
13 3 199 204
13 4 183 188
13 5 168 173
13 6 152 157
13 7 136 141
13 8 121 126
14 0 439 444
14 1 412 417
14 2 384 389
14 3 356 361
14 4 329 334
14 5 301 306
14 6 273 278
14 7 246 251
14 8 218 223
15 0 494 499
15 1 463 468
15 2 433 438
15 3 401 406
15 4 370 375
15 5 339 344
15 6 308 313
15 7 277 282
15 8 245 250
16 0 37 42
16 1 35 40
16 2 32 37
16 3 29 34
16 4 27 32
16 5 24 29
16 6 22 27
16 7 19 24
16 8 16 21

VENEZIA Clock

The register at physical address 0xE3103020 seems to control the clock frequency of VENEZIA.

Allowed register values
Value Clock speed
0x1 41MHz
0x2 55MHz
0x3 83MHz
0x4 111MHz
0x5 166MHz
0x6 222MHz
0x7 333MHz

Vip Clock

Allowed register values
Value Clock speed
0x1 41MHz
0x2 55MHz
0x3 83MHz
0x4 111MHz
0x5 166MHz
0x6 222MHz

CMeP Clock

The low 8 bits of the register at physical address 0xE3103040 seem to control CMeP clock speed. This was guessed because it is used in a usleep()-like function to calculate the input for a sleep_for_cycles() function.

The following data comes from a hardcoded table:

Value Clock speed
0x2 27MHz
0x3 42MHz
0x4 56MHz
0x5 83MHz
0x6 111MHz
0x7 160MHz
Any other value 50MHz

second_loader sets the register to 5, meaning CMeP should run at 83MHz.

CameraBus Clock

Allowed register values
Value Clock speed
1 41-MHz
2 67-MHz
3 83-MHz
4 133-MHz
5 166-MHz

Dmac5 Clock

Allowed register values
Value Clock speed
1 41-MHz
2 83-MHz
3 133-MHz
4 166-MHz

Sys Clock

Allowed register values
Value Clock speed
0 222-MHz
1 190-MHz

ScePervasive2 (0xE3110000)

Offset Description
0x248 VIP_PROT_BAP_ERRV
0x24C VIP_PROT_BAP_ERRC
0x250 VIP_PROT_BAP_ERRA
0x254 VIP_PROT_VDPD_ERRV
0x258 VIP_PROT_VDPD_ERRC
0x25C VIP_PROT_VDPD_ERRA
0x260 VIP_PROT_VDPM_ERRV
0x264 VIP_PROT_VDPM_ERRC
0x268 VIP_PROT_VDPM_ERRA
0x348 VENE_PROT_REG_ERRV
0x34C VENE_PROT_REG_ERRC
0x350 VENE_PROT_REG_ERRA
0xD04 SPM128 Bus Error Address register
0xD08 SPM128 Bus Error Attribute register
0xD14 SPM32 Bus Error Address register
0xD18 SPM32 Bus Error Attribute register
0xD24 CompatRAM Bus Error Address register
0xD28 CompatRAM Bus Error Attribute register
0xD34 Pervasive2 Bus Error Address register - maybe PERVASIVE2_SYS_BEADR
0xD38 Pervasive2 Bus Error Attribute register - maybe PERVASIVE2_SYS_BEATB
0xD44 SPM128 Secure Bus Error Address register
0xD48 SPM128 Secure Bus Error Attribute register
0xD54 SPM32 Secure Bus Error Address register
0xD58 SPM32 Secure Bus Error Attribute register
0xD64 CompatRAM Secure Bus Error Address register
0xD68 CompatRAM Secure Bus Error Attribute register
0xD74 Pervasive2 Secure Bus Error Address register - maybe PERVASIVE2_SYS_SBEADR
0xD78 Pervasive2 Secure Bus Error Attribute register - maybe PERVASIVE2_SYS_SBEATB
0xD80 BET0 (Bus Error Target 0) - full name may be PERVASIVE2_SYS_BET0
0xD90 BET1 (Bus Error Target 1) - full name may be PERVASIVE2_SYS_BET1
0xD94 PERVASIVE2_SYS_BEBT - Bus Error ?Bus Target?
0xDC0 SBET0 (Secure Bus Error Target 0) - full name may be PERVASIVE2_SYS_SBET0
0xDD0 SBET1 (Secure Bus Error Target 1) - full name may be PERVASIVE2_SYS_SBET1
0xDD4 PERVASIVE2_SYS_SBEBT - Secure Bus Error ?Bus Target?
0xF40 Bit 0 = Memory Card insert state
Retrieved from "http://wiki.henkaku.xyz/index.php?title=Pervasive&oldid=19397"