Hardware/RTC

General

Just like the Wii and the GameCube, the Wii U contains a dedicated chip for the Real-Time Clock (RTC). The MX23L0002 is a custom chip that encompasses the RTC and a small SRAM bank. While the chip still sits on the EXI bus (channel 0, device 1) it no longer contains the GameCube font sets, as this data is now handled on the software side.

On a regular retail Wii U, this is the only device registered on the EXI bus. An additional device called NESCAFE (part of the debug CORTADO package) was presumably used in the past for debugging purposes and used to sit on channel 0 as device 2.

Communication

To access the RTC on the Wii U you must:

- Enable the EXI through LT_EXICTRL;
- Initialize the EXI channels;
- Register device 1 (RTC) on EXI channel 0 with default frequency;
- To read from the RTC:
    -> EXI immediate write the RTC offset (see below);
    -> EXI immediate read the result;
- To write to the RTC:
    -> EXI immediate write the RTC offset (see below) ORed with flag 0x80000000;
    -> EXI immediate write the desired value;
- Reset the EXI channel.

RTC offsets

The RTC exposes a few control registers and SRAM memory access in the form of EXI offsets, which can be accessed to read and write 32-bit values or perform DMA operations (in the case of SRAM).

Name	Offset	Description
RTC_COUNTER	0x20000000	Contains the counting time intervals in seconds
RTC_SRAM	0x20000100	Battery backed memory The SRAM has a total size of 64 bytes, starting at offset 0x20000100 and ending at offset 0x20001000. Each word is located at (0x20000100 + 0x100 * i) with (i < 0x10).
RTC_SNAPSHOT	0x20400000	Contains a snapshot of RTC_COUNTER (taken upon power on?)
ONTMR_SET	0x21000000	Contains the value set for the ON timer
OFFTMR_SET	0x21000100	Contains the value set for the OFF timer
RTC_UNK0	0x21000400	Always 0x03030303 after power on (PLL?)
RTC_UNK1	0x21000500	Always 0x03030303 after power on (PLL?)
RTC_UNK2	0x21000600	Always 0x03030303 after power on (PLL?)
RTC_UNK3	0x21000700	Always 0x03030303 after power on (PLL?)
RTC_CONTROL0	0x21000C00	RTC control register 0 The last byte stored here is always RTC_REVISION (0x00 or 0x01). The following flags can be set here: 0x04000000 [POFFLG_FPOFF]: Set upon a forced power off. 0x02000000 [POFFLG_4S]: Set upon a 4 second power button press. 0x01000000 [POFFLG_TMR]: Set upon a OFF timer power off. 0x00010000 [PONLG_TMR]: Set upon a ON timer power on. 0x00020000 [PONFLG_SYS]: Set upon a system power event. 0x00000800 [UNSTBL_PWR]: Unknown. boot0 checks this before launching a recovery boot1 image. 0x00000200 [LOW_BATT]: Set when the CMOS battery is worn off. 0x00000100 [CANARY]: Unknown. Likely set on factory for testing.
RTC_CONTROL1	0x21000D00	RTC control register 1