Hardware/Espresso
Jump to navigation
Jump to search
Espresso is the code name for the Wii U's PowerPC processor. Unlike the Broadway, the Espresso contains a secure boot ROM so that if the Starbuck is taken over, Espresso code execution should not be possible.
Special Purpose Registers
| Index | Name | Description |
|---|---|---|
| 0x1 | XER | |
| 0x8 | LR | |
| 0x9 | CTR | |
| 0x12 | DSISR | |
| 0x13 | DAR | |
| 0x16 | DEC | |
| 0x19 | SDR1 | |
| 0x1A | SRR0 | |
| 0x1B | SRR1 | |
| 0x10C | UTBL | |
| 0x10D | UTBU | |
| 0x110 | SPRG0 | |
| 0x111 | SPRG1 | |
| 0x112 | SPRG2 | |
| 0x113 | SPRG3 | |
| 0x11A | EAR | |
| 0x11C | TBL | |
| 0x11D | TBU | |
| 0x11F | PVR | |
| 0x210 | IBAT0U | |
| 0x211 | IBAT0L | |
| 0x212 | IBAT1U | |
| 0x213 | IBAT1L | |
| 0x214 | IBAT2U | |
| 0x215 | IBAT2L | |
| 0x216 | IBAT3U | |
| 0x217 | IBAT3L | |
| 0x218 | DBAT0U | |
| 0x219 | DBAT0L | |
| 0x21A | DBAT1U | |
| 0x21B | DBAT1L | |
| 0x21C | DBAT2U | |
| 0x21D | DBAT2L | |
| 0x21E | DBAT3U | |
| 0x21F | DBAT3L | |
| 0x230 | IBAT4U | |
| 0x231 | IBAT4L | |
| 0x232 | IBAT5U | |
| 0x233 | IBAT5L | |
| 0x234 | IBAT6U | |
| 0x235 | IBAT6L | |
| 0x236 | IBAT7U | |
| 0x237 | IBAT7L | |
| 0x238 | DBAT4U | |
| 0x239 | DBAT4L | |
| 0x23A | DBAT5U | |
| 0x23B | DBAT5L | |
| 0x23C | DBAT6U | |
| 0x23D | DBAT6L | |
| 0x23E | DBAT7U | |
| 0x23F | DBAT7L | |
| 0x380 | UGQR0 | |
| 0x381 | UGQR1 | |
| 0x382 | UGQR2 | |
| 0x383 | UGQR3 | |
| 0x384 | UGQR4 | |
| 0x385 | UGQR5 | |
| 0x386 | UGQR6 | |
| 0x387 | UGQR7 | |
| 0x388 | UHID2 | |
| 0x389 | UWPAR | |
| 0x38A | UDMAU | |
| 0x38B | UDMAL | |
| 0x390 | GQR0 | |
| 0x391 | GQR1 | |
| 0x392 | GQR2 | |
| 0x393 | GQR3 | |
| 0x394 | GQR4 | |
| 0x395 | GQR5 | |
| 0x396 | GQR6 | |
| 0x397 | GQR7 | |
| 0x398 | HID2 | |
| 0x399 | WPAR | |
| 0x39A | DMA_U | |
| 0x39B | DMA_L | |
| 0x3A8 | UMMCR0 | |
| 0x3A9 | UPMC1 | |
| 0x3AA | UPMC2 | |
| 0x3AB | USIA | |
| 0x3AC | UMMCR1 | |
| 0x3AD | UPMC3 | |
| 0x3AE | UPMC4 | |
| 0x3B0 | HID5 | |
| 0x3B2 | PCSR | |
| 0x3B3 | SCR | |
| 0x3B4 | CAR | |
| 0x3B5 | BCR | |
| 0x3B6 | WPSAR | |
| 0x3B8 | MMCR0 | |
| 0x3B9 | PMC1 | |
| 0x3BA | PMC2 | |
| 0x3BB | SIA | |
| 0x3BC | MMCR1 | |
| 0x3BD | PMC3 | |
| 0x3BE | PMC4 | |
| 0x3D0 | DCATE | |
| 0x3D1 | DCATR | |
| 0x3D8 | DMATL0 | |
| 0x3D9 | DMATU0 | |
| 0x3DA | DMATR0 | |
| 0x3DB | DMATL1 | |
| 0x3DC | DMATU1 | |
| 0x3DD | DMATR1 | |
| 0x3EF | UPIR | CPU core index (Processor Index Register) |
| 0x3F0 | HID0 | |
| 0x3F1 | HID1 | |
| 0x3F2 | IABR | |
| 0x3F3 | HID4 | |
| 0x3F4 | TDCL | |
| 0x3F5 | DABR | |
| 0x3F9 | L2CR | |
| 0x3FA | TDCH | |
| 0x3FB | ICTC | |
| 0x3FC | THRM1 | |
| 0x3FD | THRM2 | |
| 0x3FE | THRM3 | |
| 0x3FF | PIR |
HID5
| Bit | Description |
|---|---|
| 0 | Enable HID5 |
| 1 | Enable PIR |
SCR
| Bit | Description |
|---|---|
| 31 | Set before exiting bootrom? If somehow set before then, uses a secret alternate set of ancast keys and prod ECC? |
| 30 | Bootrom enabled (clear only) |
| 29 | Keystore 00..1f enabled (clear only) |
| 28 | Keystore 20..3f enabled (clear only). Set just after reading provisioning u32? |
| 27 | If bit27 and bit26 are set, uses vWii ancast keys. |
| 26 | If bit26 and bit27 are set, uses vWii ancast keys. |
| 25 | If unset when booting from alternate ancast keys, errors and loops forever. |
| 24 | ? |
| 23 | ? |
| 22 | Start core 1 (TODO verify?) |
| 21 | Start core 2 (TODO verify?) |
| 20 | ? |
vWii Mode Clock
While entering in vWii mode, Cafe2Wii reboots the PPC and sets the clock multiplier to 3x. This can be disabled by changing in Cafe2Wii an OR 0x20 to BIC 0x20 in LT_MEMCMPT and an OR 0x99 to OR 0x9D in LT_SYSPROT.