Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP

MMIO Register map

Matthew Parlane edited this page · 56 revisions
Base Name 4CC Found in Comments
7E000000 Multicore Sync Block MULT platform.h Abused as "Fake framebuffer device."
7E001000 Compact Camera Port 2 TX ccpt Dump unregistered MMIO.
7E002000 VC Interrupt Controller INTE loader.bin
7E003000 Timers time Documentation
7E004000 " txp" Dump unregistered MMIO.
7E005000 jpeg Dump unregistered MMIO.
7E006000 Message -based Parallel Host Interface mphi platform.h
7E007000 DMA0-14 DMA[0-14] Documentation
7E009000 ARBA Dump unregistered MMIO.
7E00A000 brdg Dump unregistered MMIO.
7E00B000 ARM Control Block platform.h
7E100000 Power Management "\0\0pm" Reset Controller and Watchdog registers.
7E101000 Clock Management "\0\0cm" bootcode.bin
7E102000 a2w Dump unregistered MMIO.
7E103000 Audio Video Standard avs Dump unregistered MMIO. http://en.wikipedia.org/wiki/Audio_Video_Standard
7E104000 Random Number Generator rng Dump unregistered MMIO.
7E200000 GPIOs Documentation
7E201000 UART0 Documentation
7E202000 Legacy MMC host controller. bootcode.bin Used during boot by the bootrom and bootcode.bin
7E203000 PCM " pcm" Documentation
7E204000 SPI0 spim Documentation
7E205000 BSC0 " i2c" Documentation AKA I2C
7E206000
7E207000
pixv Dump unregistered MMIO.
7E208000 dpi Dump unregistered MMIO.
7E209000 Display Serial Interface dsi Dump unregistered MMIO.
7E20C000 Pulse Width Modulator pwm0 Dump unregistered MMIO.
7E20D000 perm Dump unregistered MMIO.
7E20E000 tec Dump unregistered MMIO.
7E20F000 One Time Programmable memory (codename: Dragon) otp0 Not accessible via the ARM core.
7E210000 SLIMbus slim Dump unregistered MMIO. http://en.wikipedia.org/wiki/SLIMbus
7E211000 cpg Dump unregistered MMIO.
7E212000 Dump unregistered MMIO. Needs confirmation, all I got was 0x448
7E213000 AVSP Dump unregistered MMIO.
7E214000 0 bootrom
7E215000 Auxiliaries aux0 Documentation UART1, SPI1 and SPI2
7E300000 EMMC Documentation
7E400000 ddrv Dump unregistered MMIO.
7E600000 SMI smi_ ???
7E800000 ucam mailbox Size 0x2000
7E802000 cmi mailbox
7E804000 BSC1 i2c Documentation
7E805000 BSC2 i2c Documentation Used for HDMI interface
7E806000 veca mailbox
7E807000 pixv mailbox
7E808000 hdmi mailbox
7E809000 hdcp mailbox
7E80a000 arbr mailbox
7E900000 dbus mailbox Size 0x8000 (related to hdmi?)
7E910000 ave0 mailbox Size 0x8000
7E980000 USB Documentation
7EE00000 SDRAM Controller sdco bootcode.bin
7EE01000 L2 Cache Controller l2cc bootcode.bin
7EE02000 L1 Cache Controller l1cc bootcode.bin
7EE04000 arbr Dump unregistered MMIO.
7EE05000 DMA15 Documentation
7EE06000 DRAM stuff? bootcode.bin
7EE07000 DRAM stuff? dcrc bootcode.bin
7EE08000 AXIP Dump unregistered MMIO.

Legacy MMC Controller.

Base: 0x7E202000

This is an Legacy MMC Host controller used by bootrom/bootcode.bin (and possibly other parts of the bootchain.) There is a driver for it in the Raspberry Pi Linux tree, but no other official documentation exists.

Registers:

Register Name Comments
0x0 Command
0x4 Argument The command argument should be written here before the command is written to 0x0
0x8 Timeout
0xc ClkDiv Set to 0x19
0x10 Response 0
0x14 Response 1
0x18 Response 2
0x1c Response 3
0x20 Status
0x24
0x28 Set to 1
0x2c
0x30 VDD
0x34 EDM
0x38 Host Config Set to 0xA
0x3c HBCT Bytecount
0x40 Data Data from the MMC card can be read from this FIFO 4 bytes at a time.
0x44
0x48
0x4c
0x50 HBLC Blockcount

MMC Command Register

Bit(s) Field Name Type Comments
31:16
15 Enable R/W Set this to 1 to when executing a command, it will reset itself to 0 when the command has finished executing.
14 Fail Flag
13
12
11 Busy ?/W Set this to zero when executing TRANSFER_STOP or one when executing READ_MULTIPLE_BLOCKS
10 No Response
9 Long Response
8
7 Write
6 Read
5:0 Command ?/W The command according to the MMC spec.

Status Register

Bit(s) Field Name Type Comments
31:1 ? Bits 7:5 and 3 are sometimes returned from a function.
0 FIFO Status RO Set when there is data in the FIFO (Data Register 0x40)

OTP0 (codename: Dragon)

Base: 0x7E20F000

This is an (undocumented) interface to the OTP (unofficially codenamed Dragon) used by bootcode.bin (and probably other parts of the bootchain.) It appears to start repeating after the 128th word. 0x80 == 0x00, 0x81 = 0x01 and so forth. This gives us an OTP storage of 128 words[32 bit] or 512 bytes.

Here is code for generating a bootcode.bin for dumping the contents of your OTP over serial.

Registers:

Register Name Comments
0x0 OTP_BOOTMODE_REG
0x4 OTP_CONFIG_REG
0x8 OTP_CTRL_LO_REG
0xc OTP_CTRL_HI_REG
0x10 OTP_STATUS_REG
0x14 OTP_BITSEL_REG
0x18 OTP_DATA_REG
0x1c OTP_ADDR_REG
0x20 OTP_WRITE_DATA_READ_REG
0x24 OTP_INIT_STATUS_REG
Something went wrong with that request. Please try again.