General
The Wii U added a new chip to assist with power management alongside the RTC, labeled "SMC". The SMC is responsible for managing disc drive power/eject, power LED patterns, wireless resets, regulator enable/PGOOD monitoring, and possibly other unknown functionality. Known part numbers include 1224EE429 301, 1225EE423 301. Chip is likely related to the RL78/G13, since their pinouts are similar (reset on pin2, i2c pins match, REGC pin matches, "EE" = 40pin 64KB ROM, etc).
Communication
SMC resides as device ID 0x50 on I2C bus 3. It communicates at 5kHz in IOS and 10KHz in Cafe2Wii?
Registers
SMC has two types of registers: Read/write and command-based. Read/write registers operate by having the register number written (1 byte), followed by either another written byte, or a 1 byte read. Command-based registers perform their action just by writing the register number (1 byte). When attempting to read a command-based register, it will read as 0xFF.
| Index
|
Type
|
Description
|
| 0x00 |
Command |
SMC_CMD_ODD_ON
|
| 0x01 |
Command |
SMC_CMD_ODD_OFF
|
| 0x02 |
Command |
SMC_CMD_ODD_EJECT
|
| 0x10 |
Command |
SMC_CMD_SBYLED_OFF
|
| 0x11 |
Command |
SMC_CMD_PWRLED_ON
|
| 0x12 |
Command |
SMC_CMD_PWRLED_OFF
|
| 0x13 |
Command |
SMC_CMD_PWRLED_BLINK
|
| 0x14 |
Command |
SMC_CMD_C24LED_OFF
|
| 0x15 |
Command |
SMC_CMD_C24LED_ON
|
| 0x16 |
Command |
SMC_CMD_C24LED_BLINK
|
| 0x1E |
Command |
SMC_CMD_SBYLED_ON
|
| 0x1F |
Command |
SMC_CMD_SBYLED_BLINK
|
| 0x20 |
Command |
SMC_CMD_RESET_BT
|
| 0x21 |
Command |
SMC_CMD_RESET_WIFI24
|
| 0x22 |
Command |
SMC_CMD_RESET_WIFI5
|
| 0x30 |
Read/Write |
SMC_CMD_TIMER_23_16
|
| 0x31 |
Read/Write |
SMC_CMD_TIMER_15_08
|
| 0x32 |
Read/Write |
SMC_CMD_TIMER_07_00
|
| 0x40 |
Read |
SMC_CMD_PROG_REVISION (val: 0xC5)
|
| 0x41 |
Read |
SMC_CMD_SYSTEM_EVENT
|
| 0x42 |
Read |
SMC_CMD_ODD_FLAG (val: 0x0B, 0x0A?)
|
| 0x43 |
Read/Write |
SMC_CMD_USB_FLAG (bitmask; front USB: 0x1, rear USB: 0x2)
|
| 0x44 |
Read/Write |
SMC_CMD_CCIND_FLAG
|
| 0x45 |
Read/Write |
SMC_CMD_PWRERR_FLAG (val: 0x08)
|
| 0x46 |
Read/Write |
SMC_CMD_DEVEN_FLAG (val: 0x00)
|
| 0x47 |
Read |
? not writable (val: 0xFF)
|
| 0x48 |
Read |
? not writable (val: 0x0F)
|
| 0x49 |
Read |
? (val: 0x4000000; needs ProgramRevision > 0xD3?)
|
| 0x60~0x6F |
Read/Write |
SystemError (0x60=LAPSSetting; values must be written from largest to smallest address for values to be set)
|
| 0x70 |
Read |
UnkDataValid (0x01 when UnkData is valid, else 0x00)
|
| 0x71 |
Read/Write? |
Blinks the drive LED/reset on read? (I2C reads 0xFF briefly).
|
| 0x72 |
Read/Write |
Seems to affect whether UnkDataValid is set for addrs 0x4~0x81. bit1 fills in UnkData with 0x5, ((reg & 0xF0) > 0x80) returns UnkDataValid to 0? (val: 0x00)
|
| 0x73 |
Read/Write |
UnkAddrHi? Changes to 0x10 when UnkAddrHi is less than 0x10. (val: 0x00)
|
| 0x74 |
Read/Write |
UnkAddrLo? Changes UnkData and UnkDataValid. (val: 0x00)
|
| 0x75 |
Read |
? (val: 0x00)
|
| 0x76 |
Read |
UnkData. Changes to 0x5 then 0xf1 when 0x74 is written to 0x00 twice.
|
| 0x80~0xFF |
Read/Write |
scratch mem? (val: 0x00)
|
SMC_CMD_SYSTEM_EVENT
| Bitmask
|
Name
|
| 0x40 |
SMC_POWER_BUTTON
|
| 0x20 |
SMC_EJECT_BUTTON
|
| 0x10 |
SMC_DISK_INSERT
|
| 0x08 |
SMC_TIMER
|
| 0x04 |
SMC_BT_IRQ
|
| 0x02 |
SMC_WAKE0
|
| 0x01 |
SMC_WAKE1
|
SMC_CMD_CCIND_FLAG
| Value
|
Name
|
| 0x20 |
Blue LED on
|
| 0x10 |
Blue LED pulse
|
| 0x08 |
Red LED on
|
| 0x04 |
Red LED pulse
|
| 0x02 |
Yellow LED on
|
| 0x01 |
Yellow LED pulse
|
SMC_CMD_DEVEN_FLAG
| Value
|
Name
|
| 0x01 |
SMC_DEVEN_WIFI24
|
Pinout
Counter-clockwise from the dot and PCB arrow:
| Pin number
|
Name
|
Notes
|
| 01
|
P40/TOOL0?
|
TP146, to RTC and Bluetooth(?). Input. Triggers blinking red LED on LOW.
|
| 02
|
nRESET
|
TP145, resets SMC when measured. On WUP-DEV-X9, attached to a 5-pin header (pin1)
|
| 03
|
Main SoC nRST. Input, interrupt(?). SMC stops i2c on LOW.
|
TP144
|
| 04
|
3v3?
|
TP168. Input? SMC stops i2c on LOW?
|
| 05
|
INTP0?
|
Disconnected
|
| 06
|
Disc presence sensor (receiver)
|
TP19. On WUP-DEV-X9, attached to a 5-pin header (pin2)
|
| 07
|
RTC1HZ?
|
TP175, to RTC, clock? Pulses between 3.3v and 0v at 1Hz. On WUP-DEV-X9, attached to a 5-pin header (pin3)
|
| 08
|
REGC
|
Connected to GND via C137
|
| 09
|
GND/Vss
|
|
| 10
|
Vdd/3v3
|
Decoupling cap C73
|
| 11
|
I2C SCL
|
TP153, 3v3 pullup resistor
|
| 12
|
I2C SDA
|
TP154, 3v3 pullup resistor
|
| 13
|
Power Button (active low)
|
TP70 (separated by resistor), internal pull-up.
|
| 14
|
?
|
TP155, to farthest WiFi module? verify
|
| 15
|
Rear USB enable
|
TP80, 3v3 pullup resistor
|
| 16
|
Rear USB fault
|
TP109, 3v3 pullup resistor
|
| 17
|
?
|
TP38, regulator-related?
|
| 18
|
?
|
TP15, regulator-related?
|
| 19
|
?
|
TP157, to closer wifi module? 3v3 pull-up?
|
| 20
|
Front USB enable
|
TP39, regulator-related?
|
| 21
|
?
|
TP68, mystery faceplate pin, not connected to any buttons. Internal pull-up.
|
| 22
|
Front USB power fault
|
TP95, 3v3 pullup?
|
| 23
|
?
|
TP156, to Mitsumi/vWii module, 3v3 pullup?
|
| 24
|
LED_W
|
to transistor pin, PWM at 100Hz.
|
| 25
|
BTN_EJECT
|
to faceplate, input, internal pull-up
|
| 26
|
LED_Y
|
TP2001, to faceplate, PWM at 100Hz.
|
| 27
|
?
|
TP37, regulator-related?
|
| 28
|
Disc present?
|
TP171, to faceplate?
|
| 29
|
?
|
TP16, regulator-related?
|
| 30
|
AVref?
|
Decoupling cap C73
|
| 31
|
GND
|
|
| 32
|
Disc presence sensor (transmitter)
|
TP18, 8Hz
|
| 33
|
Fake power button (connected to RTC, pulsed low with Eject)
|
TP9
|
| 34
|
Disk eject (to drive, active high)
|
TP5
|
| 35
|
Optical power enable?
|
TP152, TP88, near backup battery
|
| 36
|
?
|
TP172, to Mitsumi/vWii module, input?
|
| 37
|
?
|
TP173, 3v3 pullup? 5GHz wifi?
|
| 38
|
?
|
TP174, 2.4GHz wifi? input?
|
| 39
|
LED_B
|
to transistor lead. PWM at 100Hz.
|
| 40
|
LED_R
|
TP66, TP2000, to faceplate. PWM at 100Hz.
|
WUP-DEV-X9 has an unpopulated through-hole 5-pin debug header for SMC, possibly for debugging or programming?
| Pin number
|
Name
|
Notes
|
| 01
|
nRST
|
TP145
|
| 02
|
?
|
TP19
|
| 03
|
?
|
TP175
|
| 04
|
3v3
|
TP122
|
| 05
|
GND
|
GND
|