In memory of Ben “bushing” Byer, who passed away on Monday, February 8th, 2016.

Difference between revisions of "Hardware/RTC"

From WiiUBrew
Jump to navigation Jump to search
(SMC nRESET)
 
Line 16: Line 16:
 
  - Reset the EXI channel.
 
  - Reset the EXI channel.
  
−
===RTC offsets===
+
== Registers ==
 
The RTC exposes a few control registers and SRAM memory access in the form of EXI offsets, which can be accessed to read and write 32-bit values or perform DMA operations (in the case of SRAM).
 
The RTC exposes a few control registers and SRAM memory access in the form of EXI offsets, which can be accessed to read and write 32-bit values or perform DMA operations (in the case of SRAM).
  
 
{| style="border: 1px solid #bbb; border-collapse: collapse; background-color: #eef; padding: 0.2em 0.2em 0.2em 0.2em;" border="1" cellpadding="2"
 
{| style="border: 1px solid #bbb; border-collapse: collapse; background-color: #eef; padding: 0.2em 0.2em 0.2em 0.2em;" border="1" cellpadding="2"
 
|- style="background-color: #ddd;"
 
|- style="background-color: #ddd;"
−
! Name
 
 
! Offset
 
! Offset
 
! Description
 
! Description
 
|-
 
|-
−
| RTC_COUNTER || 0x20000000 || Contains the counting time intervals in seconds
+
| 0x20000000 || [[#RTC_COUNTER|RTC_COUNTER]]
 
|-
 
|-
−
| RTC_SRAM || 0x20000100 || Battery backed memory
+
| 0x20000100 || RTC_SRAM0
−
The SRAM has a total size of 64 bytes, starting at offset 0x20000100 and ending at offset 0x20001000.
 
−
Therefore, each word is located at (0x20000100 + 0x100 * i) with (i < 0x10).
 
−
On Wii U mode (recent firmware versions only), this memory is used to store IOSU kernel panic strings.
 
 
|-
 
|-
−
| RTC_SNAPSHOT || 0x20400000 || Contains a snapshot of RTC_COUNTER
+
| 0x20000200 || RTC_SRAM1
 
|-
 
|-
−
| ONTMR_SET || 0x21000000 || Contains the value set for the ON timer
+
| 0x20000300 || RTC_SRAM2
−
The value set here is masked with 0x3FFFFFFF and represents time intervals in seconds.
 
−
The following flags can be set on the value's upper bits:
 
−
0x80000000 (ONTMR_EN): Enable/disable the ON timer.
 
−
0x40000000 (PONTMR_DTCT): Unknown.
 
 
|-
 
|-
−
| OFFTMR_SET || 0x21000100 || Contains the value set for the OFF timer
+
| 0x20000400 || RTC_SRAM3
−
The value set here is masked with 0x3FFFFFFF and represents time intervals in seconds.
 
−
The following flags can be set on the value's upper bits:
 
−
0x80000000 (OFFTMR_EN): Enable/disable the OFF timer.
 
−
0x40000000 (POFFTMR_DTCT): Unknown.
 
 
|-
 
|-
−
| RTC_TEST0 || 0x21000400 || Always 0x03030303 after power on (test pattern)
+
| 0x20000500 || RTC_SRAM4
 
|-
 
|-
−
| RTC_TEST1 || 0x21000500 || Always 0x03030303 after power on (test pattern)
+
| 0x20000600 || RTC_SRAM5
 
|-
 
|-
−
| RTC_TEST2 || 0x21000600 || Always 0x03030303 after power on (test pattern)
+
| 0x20000700 || RTC_SRAM6
 
|-
 
|-
−
| RTC_TEST3 || 0x21000700 || Always 0x03030303 after power on (test pattern)
+
| 0x20000800 || RTC_SRAM7
 
|-
 
|-
−
| RTC_CONTROL0 || 0x21000C00 || RTC control register 0
+
| 0x20000900 || RTC_SRAM8
−
The last byte stored here (mask == 0x000000FF) is always RTC_REVISION (0x00 or 0x01).
 
−
The following flags can be set here:
 
−
0x04000000 (POFFLG_FPOFF): Set upon a forced power off.
 
−
0x02000000 (POFFLG_4S): Set upon a 4 second power button press.
 
−
0x01000000 (POFFLG_TMR): Set upon a OFF timer power off.
 
−
0x00020000 (PONFLG_SYS): Set upon a system power event.
 
−
0x00010000 (PONLG_TMR): Set upon a ON timer power on.
 
−
0x00000800 (UNSTBL_PWR): Unknown. boot0 checks this before launching a recovery boot1 image.
 
−
0x00000200 (LOW_BATT): Set when the CMOS battery is worn off.
 
−
0x00000100 (CANARY): Used by IOS-ACP when handling the rtcflag0.dat and rtcflag1.dat files.
 
 
|-
 
|-
−
| RTC_CONTROL1 || 0x21000D00 || RTC control register 1
+
| 0x20000A00 || RTC_SRAM9
−
The following flags can be set here:
 
−
0x00010000 (POFF_EXE): Setting this flag executes a power off event.
 
−
0x00000400 (DEVPWR_EN or DEVPWR_SYNC): If set, this flag is referred to as DEVPWR_EN (device power enabled?).
 
−
                                        If not set, this flag is referred to as DEVPWR_SYNC (device power sync?).
 
−
0x00000100 (SLEEP_EN): Setting this flag puts the RTC in sleep mode (used in standby mode).
 
−
0x00000008 (FPOFF_MODE): This flag defines the forced power off event mode.
 
−
0x00000004 (CLKOUT_EN): This flag enables/disables the CLKOUT pin.
 
−
0x00000001 (4COUNT_EN): This flag enables/disables the 4 second power button press functionality.
 
 
|-
 
|-
 +
| 0x20000B00 || RTC_SRAMA
 +
|-
 +
| 0x20000C00 || RTC_SRAMB
 +
|-
 +
| 0x20000D00 || RTC_SRAMC
 +
|-
 +
| 0x20000E00 || RTC_SRAMD
 +
|-
 +
| 0x20000F00 || RTC_SRAME
 +
|-
 +
| 0x20001000 || RTC_SRAMF
 +
|-
 +
| 0x20400000 || [[#RTC_SNAPSHOT|RTC_SNAPSHOT]]
 +
|-
 +
| 0x21000000 || [[#RTC_ONTMR|RTC_ONTMR]]
 +
|-
 +
| 0x21000100 || [[#RTC_OFFTMR|RTC_OFFTMR]]
 +
|-
 +
| 0x21000400 || RTC_COMPATSET
 +
|-
 +
| 0x21000800 || RTC_COMPATINT
 +
|-
 +
| 0x21000C00 || [[#RTC_CONTROL0|RTC_CONTROL0]]
 +
|-
 +
| 0x21000D00 || [[#RTC_CONTROL1|RTC_CONTROL1]]
 +
|-
 +
| 0x21000E00 || RTC_CONTROL2
 +
|-
 +
| 0x21000F00 || RTC_CONTROL3
 +
|-
 +
| 0x21001000 || RTC_SCRATCH0
 +
|-
 +
| 0x21001100 || RTC_SCRATCH1
 +
|-
 +
| 0x21001200 || RTC_SCRATCH2
 +
|-
 +
| 0x21001300 || RTC_SCRATCH3
 +
|-
 +
| 0x21001800 || RTC_NORMALINT
 +
|}
 +
 +
=== RTC_COUNTER ===
 +
Counting time intervals in seconds.
 +
 +
=== RTC_SNAPSHOT ===
 +
Snapshot of RTC_COUNTER.
 +
 +
=== RTC_ONTMR ===
 +
{| class="wikitable"
 +
|-
 +
! Bits
 +
! Description
 +
|-
 +
| 0-29
 +
| ONTMR_SET
 +
|-
 +
| 30
 +
| PONTMR_DTCT
 +
|-
 +
| 31
 +
| ONTMR_EN
 +
|}
 +
 +
=== RTC_OFFTMR ===
 +
{| class="wikitable"
 +
|-
 +
! Bits
 +
! Description
 +
|-
 +
| 0-29
 +
| OFFTMR_SET
 +
|-
 +
| 30
 +
| POFFTMR_DTCT
 +
|-
 +
| 31
 +
| OFFTMR_EN
 +
|}
 +
 +
=== RTC_CONTROL0 ===
 +
{| class="wikitable"
 +
|-
 +
! Bits
 +
! Description
 +
|-
 +
| 0-7
 +
| RTC_REVISION
 +
|-
 +
| 8
 +
| CANARY
 +
|-
 +
| 9
 +
| LOW_BATT
 +
|-
 +
| 10
 +
|
 +
|-
 +
| 11
 +
| UNSTBL_PWR
 +
|-
 +
| 12-15
 +
|
 +
|-
 +
| 16
 +
| PONLG_TMR
 +
|-
 +
| 17
 +
| PONFLG_SYS
 +
|-
 +
| 18-23
 +
|
 +
|-
 +
| 24
 +
| POFFLG_TMR
 +
|-
 +
| 25
 +
| POFFLG_4S
 +
|-
 +
| 26
 +
| POFFLG_FPOFF
 +
|-
 +
| 27-31
 +
|
 +
|}
 +
 +
=== RTC_CONTROL1 ===
 +
{| class="wikitable"
 +
|-
 +
! Bits
 +
! Description
 +
|-
 +
| 0
 +
| 4COUNT_EN
 +
|-
 +
| 1
 +
|
 +
|-
 +
| 2
 +
| CLKOUT_EN
 +
|-
 +
| 3
 +
| FPOFF_MODE
 +
|-
 +
| 4-7
 +
|
 +
|-
 +
| 8
 +
| SLEEP_EN
 +
|-
 +
| 9
 +
|
 +
|-
 +
| 10
 +
| DEVPWR_EN
 +
|-
 +
| 11-15
 +
|
 +
|-
 +
| 16
 +
| POFF_EXE
 +
|-
 +
| 17-31
 +
|
 
|}
 
|}
  

Latest revision as of 23:43, 13 April 2025

General

Just like the Wii and the GameCube, the Wii U contains a dedicated chip for the Real-Time Clock (RTC). The MX23L0002 is a custom chip that encompasses the RTC and a small SRAM bank. While the chip still sits on the EXI bus (channel 0, device 1) it no longer contains the GameCube font sets, as this data is now handled on the software side.

Communication

To access the RTC on the Wii U you must: 

- Enable the EXI through HW_AIP_PROT;
- Initialize the EXI channels;
- Register device 1 (RTC) on EXI channel 0 with default frequency;
- To read from the RTC:
    -> EXI immediate write the RTC offset (see below);
    -> EXI immediate read the result;
- To write to the RTC:
    -> EXI immediate write the RTC offset (see below) ORed with flag 0x80000000;
    -> EXI immediate write the desired value;
- Reset the EXI channel.

Registers

The RTC exposes a few control registers and SRAM memory access in the form of EXI offsets, which can be accessed to read and write 32-bit values or perform DMA operations (in the case of SRAM).

Offset Description
0x20000000 RTC_COUNTER
0x20000100 RTC_SRAM0
0x20000200 RTC_SRAM1
0x20000300 RTC_SRAM2
0x20000400 RTC_SRAM3
0x20000500 RTC_SRAM4
0x20000600 RTC_SRAM5
0x20000700 RTC_SRAM6
0x20000800 RTC_SRAM7
0x20000900 RTC_SRAM8
0x20000A00 RTC_SRAM9
0x20000B00 RTC_SRAMA
0x20000C00 RTC_SRAMB
0x20000D00 RTC_SRAMC
0x20000E00 RTC_SRAMD
0x20000F00 RTC_SRAME
0x20001000 RTC_SRAMF
0x20400000 RTC_SNAPSHOT
0x21000000 RTC_ONTMR
0x21000100 RTC_OFFTMR
0x21000400 RTC_COMPATSET
0x21000800 RTC_COMPATINT
0x21000C00 RTC_CONTROL0
0x21000D00 RTC_CONTROL1
0x21000E00 RTC_CONTROL2
0x21000F00 RTC_CONTROL3
0x21001000 RTC_SCRATCH0
0x21001100 RTC_SCRATCH1
0x21001200 RTC_SCRATCH2
0x21001300 RTC_SCRATCH3
0x21001800 RTC_NORMALINT

RTC_COUNTER

Counting time intervals in seconds.

RTC_SNAPSHOT

Snapshot of RTC_COUNTER.

RTC_ONTMR

Bits Description
0-29 ONTMR_SET
30 PONTMR_DTCT
31 ONTMR_EN

RTC_OFFTMR

Bits Description
0-29 OFFTMR_SET
30 POFFTMR_DTCT
31 OFFTMR_EN

RTC_CONTROL0

Bits Description
0-7 RTC_REVISION
8 CANARY
9 LOW_BATT
10
11 UNSTBL_PWR
12-15
16 PONLG_TMR
17 PONFLG_SYS
18-23
24 POFFLG_TMR
25 POFFLG_4S
26 POFFLG_FPOFF
27-31

RTC_CONTROL1

Bits Description
0 4COUNT_EN
1
2 CLKOUT_EN
3 FPOFF_MODE
4-7
8 SLEEP_EN
9
10 DEVPWR_EN
11-15
16 POFF_EXE
17-31

Pinout

Counter-clockwise from the top-left dot:

Pin number (Bottom, 5x7) Pin number (Top, 6x6) Name Description
01 01 crystal 1
02 02 GND
03 03 Reset? TP144. Acts like a reset when pulled down using a 3.3kohm resistor. R677 can be severed to disconnect the signal from the SMC+RTC to the SoC.
04 04 VCC? Goes to 3.3V plane on the PCB
05 05 ? TP146, trace goes near Bluetooth connector
06 06 ? TP143, directly to SoC
07 09 ? TP175, to SMC, clock? 1Hz 3.3V-0V
08 07 EXI MISO Device out, Wii U in. TP176, directly to SoC
09 10 EXI MOSI Device in, Wii U out
10 11 EXI CS TP102, directly to SoC
11 12 ? directly to SoC? Has an in-line resistor
12 08 GND
13 13 EXI CLK TP101
14 17 NC
15 14 2.4GHz power enable TP141, enables Q1065 to send 3.3V standby to Wifi module
16 15 1.5V enable TP149
17 16 15V PFET enable TP147, enables Q1061 to send 15V to motherboard
18 18 ? TP9, Power Button (active low/pullup, pressed=0.0v, not pressed=3.3v), also connected to SMC
19 19 PGOOD? TP148, pulled high by 3.3V standby
20 20 VCC? 3.3V Standby
21 21 SMC nRESET TP145, to SMC
22 22 ? via to nowhere? capacitor to ground?
23 23 VCC backup batt
24 24 crystal 2
Retrieved from "https://wiiubrew.org/w/index.php?title=Hardware/RTC&oldid=4156"