Pervasive
Pervasive is a device that controls the clocks of most of the devices of the system.
ScePervasiveMisc (0xE3100000)
Devices can be fully disabled? by writing a 1 to the corresponding bit of the ScePervasiveMisc (PA 0xE3100000
) register. To disable the device dev_off
, do *REG32(0xE3100000 + (dev_off / 32) * 4) = 1 << (31 - (dev_off % 32))
.
Offset | Description |
---|---|
0x0000 | revision0. ex:0x80000115 |
0x0004 | Unknown - SKBL prints L2 Cache is defective if bit 0x2 is set
|
0x0110 | SDIF related |
0x0114 | SDIF related |
0x0118 | SDIF related |
0x011C | SDIF related |
0x0124 | SDIF voltage control? - 3.3V by default; 1 << sdif_idx to set the SDIF to 1.8V
|
0x0130 | PERVASIVE_SYS_SBEATB - Pervasive Secure Bus Error Attribute
|
0x0134 | PERVASIVE_SYS_SBEADR - Pervasive Secure Bus Error Address
|
0x0138 | PERVASIVE_SYS_BEATB - Pervasive Bus Error Attribute
|
0x013C | PERVASIVE_SYS_BEADR - Pervasive Bus Error Address
|
0x0194 | gc |
0x0300 | Unknown |
0x0304 | Unknown |
0x0308 | Unknown |
0x0310 | SDIF related |
revision0
Returned by SceLowio#scePervasiveGetSoCRevisionForDriver, read by SKBL/NSKBL/...
Contains the Kermit revision (see sceKernelSysrootGetKermitRevisionForKernel) and other information.
Bit mask | Information |
---|---|
0x80000000 |
Disable LPDDR2SUB |
0x30000000 |
Unknown (used by SceCrashDump) |
0x4FFE0000 |
Unknown |
0x0001FFFF |
Kermit revision |
0x000000FF |
Kermit revision (old firmwares) |
Hardware | Value |
---|---|
CXD5315GG-1 | 0x00000042
|
CXD5315GG | 0x80000042
|
CXD5316GG | 0x80000115
|
CXD5316BGG | 0x94000115
|
ScePervasiveReset (0xE3101000)
Devices must be put out of reset (device reset disabled) before they are first used.
To enable reset of a device (put a device in reset), do *REG32(0xE3101000 + dev_off) |= mask
.
To disable reset of a device (put a device out of reset), do *REG32(0xE3101000 + dev_off) &= ~mask
.
dev_off | Access | Device | Reset Mask | Comment |
---|---|---|---|---|
0x4 | Secure? | ARM Debugger? | 1 | Of ARM coprocessor 14? |
0x10 | Non-secure | GPU | 1 | enable: ScePervasiveForDriver_3E79D3D3/disable: ScePervasiveForDriver_8A85E36B |
0x20 | Secure | ? | 1 | enable: ScePervasiveForDriver_377126CD/disable: ScePervasiveForDriver_6E11EB97 |
0x24 | Secure | ? | 1 | enable: ScePervasiveForDriver_7B0F388B/disable: ScePervasiveForDriver_4CCD40E6 |
0x28 | Secure | CompatRAM | 1 | enable: ScePervasiveForDriver_7C285361/disable: ScePervasiveForDriver_E40BED0F |
0x30 | Non-secure | Venezia | 1 | enable: ScePervasiveForDriver_28731EC5/disable: ScePervasiveForDriver_A7E64C6F |
0x34 | Non-secure | Vip | 1 | enable: ScePervasiveForDriver_31C0A98B/disable: ScePervasiveForDriver_E2D8F6C3 |
0x40 | Secure | SDIO0 | 1 | |
0x44 | Secure | SDIO1 | 1 | |
0x48 | Secure | DebugPA | 1 | |
0x4C | Secure | SceDbgSdio | 1 | |
0x50 | Secure | DMAC0 | 1 | |
0x54 | Secure | DMAC1 | 1 | |
0x58 | Secure | DMAC2 | 1 | |
0x5C | Secure | DMAC3 | 1 | |
0x60 | Secure | DMAC4 | 1 | |
0x64 | Secure | DMAC5 | 1 | |
0x68 | Secure | DMAC6 | 1 | need devmode or dipsw 0xC0 or 0xC1 or 0xC2. |
0x70 | Non-secure | Csi | 1 | Camera Serial Interface |
0x74 | ||||
0x80 | Non-secure | Dsi | 1 | |
0x84 | ||||
0x88 | Non-secure | Iftu | 1 | Integrated Facility Terminating Unit. See IFTU Registers. enable: ScePervasiveForDriver_B68254AD/disable: ScePervasiveForDriver_E92E28FF |
0x8C | Non-secure | ? | 1 | enable: ScePervasiveForDriver_7AE2F8E8/disable: ScePervasiveForDriver_17109C28 |
0x90 | Non-secure | USB0/UDC0 | 0xB | See UDC. enable: ScePervasiveForDriver_4AF7A01E/disable: ScePervasiveForDriver_13CC07C9 0x1 - USB Host Controller 0x2 - USB Device Controller 0x8 - ???? |
0x94 | USB1/UDC1 | |||
0x98 | USB2/UDC2 | |||
0xA0 | Non-secure | Sdif0 (emmc) | 1 | Storage Device InterFace |
0xA4 | Sdif1 (gcsd) | |||
0xA8 | Sdif2 | |||
0xAC | Sdif3 | |||
0xB0 | Non-secure | Msif | 1 | Memory Stick InterFace. See MSIF Registers. |
0xC0 | Non-secure | I2S (Audio) | 1 | Inter-IC Sound |
0xC4 | ||||
0xC8 | ||||
0xCC | ||||
0xD0 | ||||
0xD4 | ||||
0xD8 | ||||
0xDC | ||||
0xE0 | Non-secure | SrcMix | 1 | Source Mixer |
0xE4 | ||||
0xE8 | ||||
0xF0 | Non-secure | SPDIF (Audio) | 1 | Sony/Philips Digital InterFace |
0x100 | Non-secure | Gpio | 1 | General Purpose Input/Output. See GPIO Registers. |
0x104 | Non-secure | Spi (Syscon) | 1 | Serial Peripheral Interface. See SPI Registers. |
0x108 | Spi (Motion) | |||
0x10C | Spi (OLED) | |||
0x110 | Non-secure | I2C | 1 | Inter-Integrated Circuit. See I2C Registers. |
0x114 | ||||
0x120 | Non-secure | Uart0 (Console) | 1 | Universal Asynchronous Receiver Transmitter. See UART Registers. |
0x124 | Uart1 | |||
0x128 | Uart2 | |||
0x12C | Uart3 | |||
0x130 | Uart4 | |||
0x134 | Uart5 (3G Modem) | |||
0x138 | Uart6 | |||
0x154 | Secure? | Debug Bus | 1 | Taken out of reset by SKBL if Development mode or DIPsw 0xC0/0xC1/0xC2 is set |
0x158 | Secure? | ? | 1 | |
0x160 | Secure? | LPDDR2MAIN (DDRIF0) | 1 | |
0x164 | Secure? | LPDDR2SUB (DDRIF1) | 1 | |
0x170 | ? | Timer | 1? | |
0x178 | Secure? | SPM32 | 4 | Scratch Pad Memory 32KiB |
SPM128 | 8 | Scratch Pad Memory 128KiB | ||
0x17C | Secure? | Venezia? | 1? | Must be != 0 for SceKernelBusError to dump Venezia registers. |
0x180 | Secure | VIP? | 1 | Must be != 0 for SceKernelBusError to dump VIP registers. enable: ScePervasiveForDriver_EBE9C84E/disable: ScePervasiveForDriver_8CF567AD |
0x190 | Secure | bigmac or emmc cryptor | ? | x |
ScePervasiveGate (0xE3102000)
Devices can be clock gated to preserve battery.
To enable clock gate (request the clock of a device to be enabled), do *REG32(0xE3102000 + dev_off) |= mask
.
To disable clock gate (request the clock of a device to be disabled), do *REG32(0xE3102000 + dev_off) &= ~mask
.
dev_off | Access | Device | Gate Mask | Comment |
---|---|---|---|---|
0x0 | Secure? | ? | ? | |
0x4 | Secure? | ARM Debugger? | 1 | Of ARM coprocessor 14? |
0x10 | Non-secure | GPU | v & 0xF000F | enable: ScePervasiveForDriver_39E51AE2/disable: ScePervasiveForDriver_CA0ACFC5 |
0x20 | Secure | ? | 1 | enable: ScePervasiveForDriver_8EE3AEDF/disable: ScePervasiveForDriver_3BF2A9B5 |
0x24 | Secure | ? | 1 | enable: ScePervasiveForDriver_7F4AB4AA/disable: ScePervasiveForDriver_0EBBE8DE |
0x28 | Secure | CompatRAM (2MiB) | 1 | enable: ScePervasiveForDriver_B2EE45C9/disable: ScePervasiveForDriver_39979C55 |
0x30 | Non-secure | Venezia | 1 (2 for secure) | enable: ScePervasiveForDriver_FB01A2DD/disable: ScePervasiveForDriver_2EEBE9AE |
0x34 | Non-secure | Vip | 1 | enable: ScePervasiveForDriver_B1CFA18F/disable: ScePervasiveForDriver_03E1FAA6 |
0x40 | Secure | SceDbgSdio | 1 | |
0x44 | Secure | SceDbgSdio | 1 | |
0x48 | Secure | DebugPA | 1 (also has 2?) | |
0x4C | Secure | SceDbgSdio | 1 | |
0x50 | Secure | DMAC0 | 1 | |
0x54 | Secure | DMAC1 | 1 | |
0x58 | Secure | DMAC2 | 1 | |
0x5C | Secure | DMAC3 | 1 | |
0x60 | Secure | DMAC4 | 1 | |
0x64 | Secure | DMAC5 | 1 | |
0x68 | Secure | DMAC6 | 1 | need devmode or dipsw 0xC0 or 0xC1 or 0xC2. |
0x70 | Non-secure | Csi | 1 | Camera Serial Interface |
0x74 | ||||
0x80 | Non-secure | Dsi | 1 | |
0x84 | ||||
0x88 | Non-secure | Iftu | 1 | Integrated Facility Terminating Unit. See IFTU Registers. enable: ScePervasiveForDriver_07F2A738/disable: ScePervasiveForDriver_5AFE0AF0 |
0x8C | Non-secure | ? | 1 | enable: ScePervasiveForDriver_C0C842FE/disable: ScePervasiveForDriver_9BB7B932 |
0x90 | Non-secure | USB0/UDC0 | 0xB | See UDC. enable: ScePervasiveForDriver_A2EFD7AF/disable: ScePervasiveForDriver_AD1E81EB 0x1 - USB Host Controller 0x2 - USB Device Controller 0x8 - ???? |
0x94 | USB1/UDC1 | |||
0x98 | USB2/UDC2 | |||
0xA0 | Non-secure | Sdif0 (emmc) | 1 | Storage Device InterFace |
0xA4 | Sdif1 (gcsd) | |||
0xA8 | Sdif2 | |||
0xAC | Sdif3 | |||
0xB0 | Non-secure | Msif | 1 | Memory Stick InterFace. See MSIF Registers. |
0xC0 | Non-secure | I2S (Audio) | 1 | Inter-IC Sound |
0xC4 | ||||
0xC8 | ||||
0xCC | ||||
0xD0 | ||||
0xD4 | ||||
0xD8 | ||||
0xDC | ||||
0xE0 | Non-secure | SrcMix | 1 | Source Mixer |
0xE4 | ||||
0xE8 | ||||
0xF0 | Non-secure | SPDIF (Audio) | 1 | Sony/Philips Digital InterFace |
0x100 | Non-secure | Gpio | 1 | General Purpose Input/Output. See GPIO Registers. |
0x104 | Non-secure | Spi (Syscon) | 1 | Serial Peripheral Interface. See SPI Registers. |
0x108 | Spi (Motion) | |||
0x10C | Spi (OLED) | |||
0x110 | Non-secure | I2C | 1 | Inter-Integrated Circuit. See I2C Registers. |
0x114 | ||||
0x120 | Non-secure | Uart0 (Console) | 1 | Universal Asynchronous Receiver Transmitter. See UART Registers. |
0x124 | Uart1 | |||
0x128 | Uart2 | |||
0x12C | Uart3 | |||
0x130 | Uart4 | |||
0x134 | Uart5 (3G Modem) | |||
0x138 | Uart6 | |||
0x154 | Secure? | Debug Bus | 1 | See ScePervasiveReset for details. |
0x158 | Secure? | ? | 1 | |
0x160 | Secure? | LPDDR2MAIN (DDRIF0) | 1 | |
0x164 | Secure? | LPDDR2SUB (DDRIF1) | 1 | |
0x170 | ? | Timer | 1? | |
0x178 | Secure? | SPM32 | 4 | Scratch Pad Memory 32KiB |
SPM128 | 8 | Scratch Pad Memory 128KiB |
ScePervasiveVid (0xE3104000)
Voltage integer data
Offset | Group | Value |
---|---|---|
0x0 | ARM | 0 |
0x4 | ARM | 0x1F |
0x8 | ARM | 0x27 |
0xC | ARM | 0x2F |
0x10 | ARM | 0x31 |
0x14 | ARM | 0x31 |
0x40 | ? | 0x1D |
0x44 | ? | 0x22 |
0x48 | ? | 0x2E |
0x4C | ? | 0x25 |
0x60 | ? | 0x1D |
0x64 | ? | 0x27 |
0x68 | ? | 0x2E |
0x6C | ? | 0x30 |
0xA0 | Bus | 0 |
0xA4 | Bus | 0x1E |
0xA8 | Bus | 0x27 |
0xAC | Bus | 0x2E |
Base Clock
Registers at physical address 0xE2103000
(ScePervasiveBaseClk).
Offset | Accessibly | Description |
---|---|---|
0x0/0x4 | Non-Secure/Secure | ARM Clocks |
0x10 | Non-Secure/Secure | GPU Clock |
0x20 | Non-Secure/Secure (?) | VENEZIA Clock |
0x30 | Non-Secure | Vip Clock |
0x40 | Secure | CMeP Clock |
0x44 | Non-Secure | CameraBus Clock |
0x50 | Secure | Could be Center Xbar/Bus clock |
0x60 | Non-Secure | Related to offset 0x60/0x64/0xA4. |
0x64 | Non-Secure | Related to offset 0x60/0x64/0xA4. |
0x68 | Non-Secure | Unknown. freq setting by ScePervasiveForDriver_A96642E3 |
0x70 | Non-Secure | Related to Audio. freq setting by ScePervasiveForDriver_925D9D24 |
0x90 | Secure | DRAM Main Clock |
0x94 | Secure | DRAM Sub Clock |
0xA4 | Non-Secure | Related to offset 0x60/0x64/0xA4. |
0xB0 | Non-Secure | Msif Clock |
0xC4 | Secure | Compat/GpuXbar Clock (PSP stuff) |
0x100 | Non-Secure | DSI1 Clock |
0x180 | Non-Secure | DSI0 Clock |
0x1D0 | Non-Secure | HDMI Clock |
0x1F0 | Non-Secure | Dmac5 Clock |
0x210 | Non-Secure | Related to Audio. freq setting by ScePervasiveForDriver_2FB5F88F |
0x214 | Non-Secure | Sys Clock |
ARM Clocks
The ARM core clock and L2 cache clock consist of two registers 0xE2103000 and 0xE2103004.
Register 0xE2103000 selects the base clock frequency.
It seems that 42-freq is selected internally when Undefined index is selected
Index | ARM core freq | L2 cache freq |
---|---|---|
0 | Undefined | Undefined |
1 | 42 | 42 |
2 | Undefined | Undefined |
3 | 83 | 83 |
4 | 111 | 111 |
5 | 166 | 166 |
6 | 222 | 222 |
7 | 333 | 333 |
8 | 444 | 222 |
9 | 500 | 250 |
10 | 333 | 166 |
11 | Undefined | Undefined |
12 | 125 | 125 |
13 | 250 | 250 |
14 | 444 | 444 |
15 | 500 | 500 |
Register 0xE2103004 adjusts the selected base clock frequency.
0xE2103004 sets the index that adjusts the base clock frequency.
It seems that the adjustment can be expressed by the following formula.
f(n) = n(1 - adjust_index / 16)
adjust_index ranges from 0 to 8. Selecting 9 or higher selects 0 internally.
Also a joke-like approximation : f(n) = n(1 - aπ^-(1 + √2))
.
However, not sure if this formula is completely correct, but It can see that it is very close to the value of yifan's clock analyzer.
base | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 |
---|---|---|---|---|---|---|---|---|---|
1 | 41.666 MHz | 39.62 MHz | 36.458 MHz | 33.854 MHz | 31.249 MHz | 28.645 MHz | 26.41 MHz | 23.437 MHz | 20.833 MHz |
3 | 83.333 MHz | 78.124 MHz | 72.916 MHz | 67.708 MHz | 62.499 MHz | 57.291 MHz | 52.83 MHz | 46.874 MHz | 41.666 MHz |
4 | 111.111 MHz | 104.166 MHz | 97.222 MHz | 90.277 MHz | 83.333 MHz | 76.388 MHz | 69.444 MHz | 62.499 MHz | 55.555 MHz |
5 | 166.666 MHz | 156.249 MHz | 145.833 MHz | 135.416 MHz | 124.999 MHz | 114.583 MHz | 104.166 MHz | 93.749 MHz | 83.333 MHz |
6 | 222.222 MHz | 208.333 MHz | 194.444 MHz | 180.555 MHz | 166.666 MHz | 152.777 MHz | 138.888 MHz | 124.999 MHz | 111.111 MHz |
7 | 333.333 MHz | 312.499 MHz | 291.666 MHz | 270.833 MHz | 249.999 MHz | 229.166 MHz | 208.333 MHz | 187.499 MHz | 166.666 MHz |
8 | 444.444 MHz | 416.666 MHz | 388.888 MHz | 361.111 MHz | 333.333 MHz | 305.555 MHz | 277.777 MHz | 249.999 MHz | 222.222 MHz |
9 | 500.0 MHz | 468.749 MHz | 437.499 MHz | 406.249 MHz | 374.999 MHz | 343.749 MHz | 312.499 MHz | 281.249 MHz | 249.999 MHz |
10 | 333.333 MHz | 312.499 MHz | 291.666 MHz | 270.833 MHz | 249.999 MHz | 229.166 MHz | 208.333 MHz | 187.499 MHz | 166.666 MHz |
12 | 124.999 MHz | 117.187 MHz | 109.374 MHz | 101.562 MHz | 93.749 MHz | 85.937 MHz | 78.124 MHz | 70.312 MHz | 62.499 MHz |
13 | 249.999 MHz | 234.374 MHz | 218.749 MHz | 203.124 MHz | 187.499 MHz | 171.874 MHz | 156.249 MHz | 140.624 MHz | 124.999 MHz |
14 | 444.444 MHz | 416.666 MHz | 388.888 MHz | 361.111 MHz | 333.333 MHz | 305.555 MHz | 277.777 MHz | 249.999 MHz | 222.222 MHz |
15 | 500.0 MHz | 468.749 MHz | 437.499 MHz | 406.249 MHz | 374.999 MHz | 343.749 MHz | 312.499 MHz | 281.249 MHz | 249.999 MHz |
ARM Clocks (by yifan's clock analyzer)
The ARM CPU clocks are controlled by two registers at physical address 0xE3103000
(ScePervasiveBaseClk). Currently, it is unknown how the values are interpreted. However, 0xE3103000
(one word) takes values 0 to 16, and increases clock speed while 0xE3103004
(single byte) takes values 0 to 8 and decreases clock speed. It is likely related to a PLL multiply and divide function. The input clock signal comes from a P1P40167 clock synthesizer (found on the bottom of the board under the main SoC). It takes a 27MHz crystal and generates a 37MHz clock which feeds directly into the SoC's internal PLL.
The following are tests run to determine what the values of each register corresponds to. It appears that the maximum clock speed is 499MHz and the minimum clock speed is 16MHz.
These clocks may be wrong. "Kernel Clock Speed" is "Clock Speed + 5". However, there is an error of ± 5 to 6 in "Clock Speed".
0xE3103000 |
0xE3103004 |
Clock Speed (MHz) | Kernel Clock Speed (MHz) |
---|---|---|---|
0 | 0 | 37 | 42 |
0 | 1 | 35 | 40 |
0 | 2 | 32 | 37 |
0 | 3 | 29 | 34 |
0 | 4 | 27 | 32 |
0 | 5 | 24 | 29 |
0 | 6 | 22 | 27 |
0 | 7 | 19 | 24 |
0 | 8 | 16 | 21 |
1 | 0 | 37 | 42 |
1 | 1 | 35 | 40 |
1 | 2 | 32 | 37 |
1 | 3 | 30 | 35 |
1 | 4 | 27 | 32 |
1 | 5 | 24 | 29 |
1 | 6 | 22 | 27 |
1 | 7 | 19 | 24 |
1 | 8 | 16 | 21 |
2 | 0 | 37 | 42 |
2 | 1 | 35 | 40 |
2 | 2 | 32 | 37 |
2 | 3 | 30 | 35 |
2 | 4 | 27 | 32 |
2 | 5 | 24 | 29 |
2 | 6 | 22 | 27 |
2 | 7 | 19 | 24 |
2 | 8 | 16 | 21 |
3 | 0 | 79 | 84 |
3 | 1 | 74 | 79 |
3 | 2 | 69 | 74 |
3 | 3 | 63 | 68 |
3 | 4 | 58 | 63 |
3 | 5 | 53 | 58 |
3 | 6 | 48 | 53 |
3 | 7 | 43 | 48 |
3 | 8 | 37 | 42 |
4 | 0 | 107 | 112 |
4 | 1 | 100 | 105 |
4 | 2 | 93 | 98 |
4 | 3 | 86 | 91 |
4 | 4 | 79 | 84 |
4 | 5 | 72 | 77 |
4 | 6 | 65 | 70 |
4 | 7 | 58 | 63 |
4 | 8 | 51 | 56 |
5 | 0 | 162 | 167 |
5 | 1 | 152 | 157 |
5 | 2 | 142 | 147 |
5 | 3 | 131 | 136 |
5 | 4 | 121 | 126 |
5 | 5 | 110 | 115 |
5 | 6 | 100 | 105 |
5 | 7 | 90 | 95 |
5 | 8 | 79 | 84 |
6 | 0 | 218 | 223 |
6 | 1 | 204 | 209 |
6 | 2 | 190 | 195 |
6 | 3 | 176 | 181 |
6 | 4 | 163 | 168 |
6 | 5 | 148 | 153 |
6 | 6 | 135 | 140 |
6 | 7 | 121 | 126 |
6 | 8 | 107 | 112 |
7 | 0 | 329 | 334 |
7 | 1 | 308 | 313 |
7 | 2 | 287 | 292 |
7 | 3 | 266 | 271 |
7 | 4 | 246 | 251 |
7 | 5 | 225 | 230 |
7 | 6 | 204 | 209 |
7 | 7 | 183 | 188 |
7 | 8 | 162 | 167 |
8 | 0 | 439 | 444 |
8 | 1 | 411 | 416 |
8 | 2 | 384 | 389 |
8 | 3 | 356 | 361 |
8 | 4 | 329 | 334 |
8 | 5 | 301 | 306 |
8 | 6 | 273 | 278 |
8 | 7 | 246 | 251 |
8 | 8 | 218 | 223 |
9 | 0 | 494 | 499 |
9 | 1 | 463 | 468 |
9 | 2 | 432 | 437 |
9 | 3 | 401 | 406 |
9 | 4 | 370 | 375 |
9 | 5 | 339 | 344 |
9 | 6 | 308 | 313 |
9 | 7 | 277 | 282 |
9 | 8 | 245 | 250 |
10 | 0 | 328 | 333 |
10 | 1 | 308 | 313 |
10 | 2 | 287 | 292 |
10 | 3 | 266 | 271 |
10 | 4 | 245 | 250 |
10 | 5 | 225 | 230 |
10 | 6 | 204 | 209 |
10 | 7 | 183 | 188 |
10 | 8 | 162 | 167 |
11 | 0 | 37 | 42 |
11 | 1 | 35 | 40 |
11 | 2 | 32 | 37 |
11 | 3 | 30 | 35 |
11 | 4 | 27 | 32 |
11 | 5 | 24 | 29 |
11 | 6 | 22 | 27 |
11 | 7 | 19 | 24 |
11 | 8 | 16 | 21 |
12 | 0 | 121 | 126 |
12 | 1 | 113 | 118 |
12 | 2 | 105 | 110 |
12 | 3 | 97 | 102 |
12 | 4 | 90 | 95 |
12 | 5 | 82 | 87 |
12 | 6 | 74 | 79 |
12 | 7 | 66 | 71 |
12 | 8 | 58 | 63 |
13 | 0 | 245 | 250 |
13 | 1 | 230 | 235 |
13 | 2 | 214 | 219 |
13 | 3 | 199 | 204 |
13 | 4 | 183 | 188 |
13 | 5 | 168 | 173 |
13 | 6 | 152 | 157 |
13 | 7 | 136 | 141 |
13 | 8 | 121 | 126 |
14 | 0 | 439 | 444 |
14 | 1 | 412 | 417 |
14 | 2 | 384 | 389 |
14 | 3 | 356 | 361 |
14 | 4 | 329 | 334 |
14 | 5 | 301 | 306 |
14 | 6 | 273 | 278 |
14 | 7 | 246 | 251 |
14 | 8 | 218 | 223 |
15 | 0 | 494 | 499 |
15 | 1 | 463 | 468 |
15 | 2 | 433 | 438 |
15 | 3 | 401 | 406 |
15 | 4 | 370 | 375 |
15 | 5 | 339 | 344 |
15 | 6 | 308 | 313 |
15 | 7 | 277 | 282 |
15 | 8 | 245 | 250 |
16 | 0 | 37 | 42 |
16 | 1 | 35 | 40 |
16 | 2 | 32 | 37 |
16 | 3 | 29 | 34 |
16 | 4 | 27 | 32 |
16 | 5 | 24 | 29 |
16 | 6 | 22 | 27 |
16 | 7 | 19 | 24 |
16 | 8 | 16 | 21 |
VENEZIA Clock
The register at physical address 0xE3103020
seems to control the clock frequency of VENEZIA.
Value | Clock speed |
---|---|
0x1 | 41MHz |
0x2 | 55MHz |
0x3 | 83MHz |
0x4 | 111MHz |
0x5 | 166MHz |
0x6 | 222MHz |
0x7 | 333MHz |
Vip Clock
Value | Clock speed |
---|---|
0x1 | 41MHz |
0x2 | 55MHz |
0x3 | 83MHz |
0x4 | 111MHz |
0x5 | 166MHz |
0x6 | 222MHz |
CMeP Clock
The low 8 bits of the register at physical address 0xE3103040
control CMeP clock speed, and Main Xbar, I/O Bus speed too.
This was guessed because it is used in a usleep()
-like function to calculate the input for a sleep_for_cycles()
function.
Testing was performed using SceLT5 as a time reference (µs-accurate), and compared against the hardcoded table in second_loader
.
Value | Main Xbar | I/O Bus | CMeP speed (measured) | Table value |
---|---|---|---|---|
0x0 | Unknown | Unknown | 41.5 MHz | N/A |
0x1 | Unknown | Unknown | 41.5 MHz | |
0x2 | Unknown | Unknown | 55.4 MHz | |
0x3 | Unknown | Unknown | 83.0 MHz | |
0x4 | Unknown | Unknown | 110.7 MHz | |
0x5 | Unknown | Unknown | 166.0 MHz | |
0x6 | Unknown | Unknown | 110.7 MHz | |
0x7 | Unknown | Unknown | 166.0 MHz | |
0x10000 | Undefined | Undefined | 27.7 MHz | 50 MHz |
0x10001 | Undefined | Undefined | 27.7 MHz | 50 MHz |
0x10002 | 56 MHz | 27 MHz | 27.7 MHz | 27 MHz |
0x10003 | 83 MHz | 42 MHz | 41.5 MHz | 42 MHz |
0x10004 | 111 MHz | 56 MHz | 55.3 MHz | 56 MHz |
0x10005 | 166 MHz | 83 MHz | 83.0 MHz | 83 MHz |
0x10006 | 222 MHz | 111 MHz | 110.7 MHz | 111 MHz |
0x10007 | 333 MHz | 166 MHz | 166.0 MHz | 160 MHz |
second_loader
sets the register to 0x10005, meaning CMeP usually runs at 83MHz.
CameraBus Clock
Value | Clock speed |
---|---|
1 | 41 MHz |
2 | 67 MHz |
3 | 83 MHz |
4 | 133 MHz |
5 | 166 MHz |
DRAM Main Clock
Value | Clock speed (measured) |
---|---|
1 | 170 MHz |
DRAM Sub Clock
Value | Clock speed (measured) |
---|---|
1 | 170 MHz |
Msif Clock
Value | Clock speed |
---|---|
0x10000 | 20 MHz |
0x10001 | 40 MHz |
0x10002 | 60 MHz |
Bit 0x10000 is optional i.e by default Msif runs at 20 MHz. Its effect is unknown.
Compat/GpuXbar Clock
Value | Compat Clock speed | GpuXbar Clock speed |
---|---|---|
0 | 333 MHz | 166 MHz |
1 | Unknown | 111 MHz |
2 | 222 MHz | 83 MHz |
Dmac5 Clock
Value | Clock speed |
---|---|
1 | 41 MHz |
2 | 83 MHz |
3 | 133 MHz |
4 | 166 MHz |
Sys Clock
Value | Clock speed |
---|---|
0 | 222 MHz |
1 | 190 MHz |
ScePervasive2 (0xE3110000)
Offset | Description |
---|---|
0x248 | VIP_PROT_BAP_ERRV
|
0x24C | VIP_PROT_BAP_ERRC
|
0x250 | VIP_PROT_BAP_ERRA
|
0x254 | VIP_PROT_VDPD_ERRV
|
0x258 | VIP_PROT_VDPD_ERRC
|
0x25C | VIP_PROT_VDPD_ERRA
|
0x260 | VIP_PROT_VDPM_ERRV
|
0x264 | VIP_PROT_VDPM_ERRC
|
0x268 | VIP_PROT_VDPM_ERRA
|
0x348 | VENE_PROT_REG_ERRV
|
0x34C | VENE_PROT_REG_ERRC
|
0x350 | VENE_PROT_REG_ERRA
|
0xC00 | 0x0 alias for ARM (0 / 1) = (0x1f000000 / 0x40000000) |
0xD04 | SPM128 Bus Error Address register |
0xD08 | SPM128 Bus Error Attribute register |
0xD14 | SPM32 Bus Error Address register |
0xD18 | SPM32 Bus Error Attribute register |
0xD24 | CompatRAM Bus Error Address register |
0xD28 | CompatRAM Bus Error Attribute register |
0xD34 | Pervasive2 Bus Error Address register - maybe PERVASIVE2_SYS_BEADR
|
0xD38 | Pervasive2 Bus Error Attribute register - maybe PERVASIVE2_SYS_BEATB
|
0xD44 | SPM128 Secure Bus Error Address register |
0xD48 | SPM128 Secure Bus Error Attribute register |
0xD54 | SPM32 Secure Bus Error Address register |
0xD58 | SPM32 Secure Bus Error Attribute register |
0xD64 | CompatRAM Secure Bus Error Address register |
0xD68 | CompatRAM Secure Bus Error Attribute register |
0xD74 | Pervasive2 Secure Bus Error Address register - maybe PERVASIVE2_SYS_SBEADR
|
0xD78 | Pervasive2 Secure Bus Error Attribute register - maybe PERVASIVE2_SYS_SBEATB
|
0xD80 | BET0 (Bus Error Target 0) - full name may be PERVASIVE2_SYS_BET0
|
0xD90 | BET1 (Bus Error Target 1) - full name may be PERVASIVE2_SYS_BET1
|
0xD94 | PERVASIVE2_SYS_BEBT - Bus Error ?Bus Target?
|
0xDC0 | SBET0 (Secure Bus Error Target 0) - full name may be PERVASIVE2_SYS_SBET0
|
0xDD0 | SBET1 (Secure Bus Error Target 1) - full name may be PERVASIVE2_SYS_SBET1
|
0xDD4 | PERVASIVE2_SYS_SBEBT - Secure Bus Error ?Bus Target?
|
0xF30 | USB PHY ready state - Bit 0 = Port 0, Bit 1 = Port 1, Bit 2 = Port 2 |
0xF34 | USB PHY interrupt state - Bit 0 = Port 0, Bit 1 = Port 1, Bit 2 = Port 2 |
0xF40 | Bit 0 = Memory Card insert state |
0xF44 | Memory Card insert interrupt state - Bit 0 = Card removed, Bit 1 = Card inserted |
0xF50 | USB VBUS state - Bit 0 = Port 0, Bit 1 = Port 1, Bit 2 = Port 2 |
0xF54 | USB VBUS interrupt state |