Hardware/NAND interface
| NAND interface | |
| Access | |
|---|---|
| Espresso | None |
| Starbuck | Full |
| Registers | |
| Base | 0x0d010000 |
| Length | 0x100 |
| Access size | 32 bits |
| Byte order | Big Endian |
| IRQs | |
| Espresso | None |
| Latte | 1 |
Register List
| NAND Interface | |||
|---|---|---|---|
| Address | Bits | Name | Description |
| 0x0d010000 | 32 | NAND_CTRL | NAND Control and Status |
| 0x0d010004 | 32 | NAND_CONFIG | NAND configuration register |
| 0x0d010008 | 32 | NAND_ADDR1 | Address bytes 1-2 (column) |
| 0x0d01000c | 32 | NAND_ADDR2 | Address bytes 3-5 (row) |
| 0x0d010010 | 32 | NAND_DATABUF | Memory address of the Data buffer |
| 0x0d010014 | 32 | NAND_ECCBUF | Memory address of the Spare buffer |
| 0x0d010018 | 32 | NAND_BANK | NAND bank swapping (WiiU/vWii) |
| 0x0d010030 | 32 | NAND_UNK_CTRL | Unknown |
| 0x0d010040...0x0d010100 | 32 | NAND_UNK | Eight 0x18-sized mirrors? |
Register Details
| NAND_CTRL (0x0d010000) | ||||||||||||||||
| 31 | 30 | 29 | 28 | 27 | 26 | 25 | 24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | |
| Access | R/W | R/W | R/W | R/W | R/W | R/W | R/W | R/W | R/W | |||||||
| Field | EXEC | IRQ | ERR | A5 | A4 | A3 | A2 | A1 | COMMAND | |||||||
| 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 | |
| Access | R/W | R/W | R/W | R/W | W | |||||||||||
| Field | WAIT | WR | RD | ECC | DATALEN | |||||||||||
This register controls the state of the NAND interface.
| Field | Description |
| EXEC | Write 1: initiate NAND command Write 0: reset NAND interface Read: NAND interface busy |
| IRQ | Set to enable IRQ generation when command is complete |
| ERR | If set, NAND error occured (?)[check] |
| A5 | Send fifth address byte (typ. row address high) |
| A4 | Send fourth address byte (typ. row address mid) |
| A3 | Send third address byte (typ. row address low) |
| A2 | Send second address byte (typ. column address high) |
| A1 | Send first address byte (typ. column address low) |
| COMMAND | 8-bit NAND command |
| WAIT | Wait for R/B to go high between address and data phases (wait for read/write/erase/reset) |
| WR | Transfer data to the NAND chip |
| RD | Transfer data from the NAND chip |
| ECC | Calculate ECC or ?? [check] |
| DATALEN | Number of bytes to transfer during the data phase |
| NAND_CONFIG (0x0d010004) | |||||||||||||||||
| 31 | 30 | 29 | 28 | 27 | 26 | 25 | 24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | ||
| Access | R/W | R/W | R/W | R/W | |||||||||||||
| Field | ATTR0 | ENABLE | ATTR1 | ATTR2 | |||||||||||||
| 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 | ||
| Access | R/W | R/W | |||||||||||||||
| Field | ATTR3 | ATTR4 | |||||||||||||||
This register probably configures certain aspects of the NAND interface (timings?)[check].
| Field | Description |
| ATTR0 | Set based on lookup table; set to 3 for 128MB NAND chips, 4 otherwise |
| ENABLE | Set to 1 before first command is sent to NAND, set to 0 when de-initializing the NAND driver. |
| ATTR1 | Set based on lookup table; always 0x3 |
| ATTR2 | Set based on lookup table; always 0x3e |
| ATTR3 | Set based on lookup table; always 0x0e |
| ATTR4 | Set based on lookup table; always 0x7f |
When IOSU initializes the NAND driver, it turns on the enable bit (writing 0x08000000) and then send the GET CHIP ID command (0x90). Based on the reply, it looks up the correct definitions of the other attributes and pokes them into this register. C2W changes this register twice during boot, once setting it to 0xCB3E0E7F and again setting it to 0x743E3EFF.
| NAND_ADDR1 (0x0d010008) | ||||||||||||||||
| 31 | 30 | 29 | 28 | 27 | 26 | 25 | 24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | |
| Access | U | |||||||||||||||
| Field | ||||||||||||||||
| 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 | |
| Access | R/W | R/W | ||||||||||||||
| Field | ADDR2 | ADDR1 | ||||||||||||||
This register contains the first two address bytes that can be sent to the NAND chip. Normally it contains the column address (offset within a page).
| Field | Description |
| ADDR2 | Second address byte |
| ADDR1 | First address byte |
| NAND_ADDR2 (0x0d01000c) | ||||||||||||||||
| 31 | 30 | 29 | 28 | 27 | 26 | 25 | 24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | |
| Access | U | R/W | ||||||||||||||
| Field | ADDR5 | |||||||||||||||
| 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 | |
| Access | R/W | R/W | ||||||||||||||
| Field | ADDR4 | ADDR3 | ||||||||||||||
This register contains the last three address bytes that can be sent to the NAND chip. Normally it contains the row address (page number).
| Field | Description |
| ADDR5 | Fifth address byte |
| ADDR4 | Fourth address byte |
| ADDR3 | Third address byte |
| NAND_DATABUF (0x0d010010) | ||
| 314 | 30 | |
| Access | R/W | U |
This register contains the DMA address of the page data buffer (0x800 bytes). The address must be 16-byte aligned. If the spare data is being written alone (such as using a RANDOM DATA IN command with DMALEN=0x40), this points to it instead. Generally speaking, the first 0x800 bytes of data go here, whatever they may be.
| NAND_ECCBUF (0x0d010014) | ||
| 314 | 30 | |
| Access | R/W | U |
This register contains the DMA address of the spare and ECC data buffer (0x40 spare bytes + 0x10 bytes of hardware-calculated ECC syndrome). The address must be 16-byte aligned. The hardware-calculated ECC is written to the address in this register XOR 0x40.
| NAND_BANK (0x0d010018) | |
| 310 | |
| Access | R/W |
This register contains a flag representing the currently active NAND bank. 0x00000001 is the vWii's bank and 0x00000002 is the Wii U's bank.