Yet Another Gamecube Documentation

Yet Another Gamecube Documentation

10 EXI Devices

10.1 EXI Channel and Device List

The following table shows the GameCube devices which use the EXI bus and their channel and device numbers, the EXI frequency commonly used with them and their virtual offset in EXI mapping.

channel	device	freq	offset	Description
`0`	`0`	`4`		Memory Card (Slot A)
`0`	`1`	`3`	`0x00000000`	Mask ROM
`0`	`1`	3	`0x20000000`	Real-Time Clock (RTC)
`0`	`1`	`3`	`0x20000100`	SRAM
`0`	`1`		`0x20010000`	UART
`1`	`0`	`4`		Memory Card (Slot B)
`2`	`0`			AD16 (trace step)
`0`	`2`			Serial Port 1
`0`	`2`	`5`		Ethernet Adapter (SP1)

Note: The Real-Time Clock (RTC), SRAM, and Mask ROM are actually one device mapped to different address offsets. The SRAM should only be accessed by the IPL and contains non-volatile system data. The Mask ROM contains the IPL itself (encrypted) and the system font data.

10.2 Retrieving the ID of an EXI Device

To retrieve the ID of an EXI Device, an EXI IMM write operation must be used to send the ID command (0x0000) and an EXI IMM read operation should follow it to read the actual 4 byte ID.

ID	Device
`0x00000004`	Memory Card 59
`0x00000008`	Memory Card 123
`0x00000010`	Memory Card 251
`0x00000020`	Memory Card 507
`0x00000040`	Memory Card 1019
`0x00000080`	Memory Card 2043
`0x01010000`	USB Adapter
`0x01020000`	NPDP GDEV
`0x05070000`	IS Viewer
`0x04120000`	AD16
`0x03010000`	Marlin (?)
`0x02020000`	Modem
`0x04020200`	Ethernet Adapter

10.3 Mask ROM

Mask ROM also referred as bootrom or IPL. Total size of bootrom is 2 MB.

10.3.1 Memory Map (Europe/PAL)

Start	End	Size	Description
`0x00000000`	`0x000000ff`	`0x00000100`	Copyright message (*1)
`0x00000100`	`0x001aeee8`	`0x001aede8`	BIOS data (*2)
`0x001AFF00`	`0x001FA0E0`	`0x0004D000`	'Yay0' - ROM Fonts #1 (SJIS)
			0x61 bytes of 0xFF, 0x62 , followed by zeros until 0x1FCF00
`0x001FCF00`	`0x001FF474`	`0x00003000`	'Yay0' - ROM Fonts #2 (ANSI)
`0x001FF474`	`0x001FFEF0`		filled with 0x00
`0x001FFF00`		`0x001FFFFF`	filled with 0xff

(*1) "(C) 1999-2001 Nintendo. All rights reserved.(C) 1999 ArtX Inc. All rights reserved.PAL Revision 1.0 " and zeros up to 0x100.
(*2) encrypted by an XOR cyphertext which is generated by a yet unknown algorithm (probably not a single LFSR)

10.3.2 Memory Map (USA/NTSC)

Start	End	Size	Description
`0x00000000`	`0x0015ee40`	`0x0015ee40`	BIOS data (*1)
`0x001AFF00`		`0x0004D000`	ROM Fonts #1 (SJIS)
`0x001FCF00`		`0x00003000`	ROM Fonts #2 (ANSI)
`0x001FFF00`		`0x001FFFFF`	filled with 0x00

(*1) encrypted by an XOR cyphertext which is generated by a yet unknown algorithm (probably not a single LFSR)

note: all unused space is filled with 0x00, no pieces with 0xFF.

10.3.3 Memory Map (Japenese/NTSC)

10.3.4 Memory Map (Japenese/NTSC - Panasonic Q)

10.3.5 Font Encoding

The 'Yay0' data is compressed similar to the the Zelda 64 'Yaz0' compression. Besides the Raw Font data it also contains some information about the Font.

10.3.6 Font Layout

10.3.6.1 SJIS Font (ROM Font #1) 10.3.6.2 ANSI Font (ROM Font #2) The ANSI Font is a 512x512 Pixel Texture in I4 Format. It consists of 21 colums and 11 rows of characters which are in a 24x24 pixel grid.

!

'

#

$

%

&

´

(

)

*

+

,

-

.

/

0

1

2

3

4

5

6

7

8

9

:

;

<

=

>

?

@

A

B

C

D

E

F

G

H

I

J

K

L

M

N

O

P

Q

R

S

T

U

V

W

X

Y

Z

[

]

^

_

'

a

b

c

d

e

f

g

h

i

j

k

l

m

n

o

p

q

r

s

t

u

v

w

x

y

z

10.3.7 Operation

10.3.7.1 read

IMM write 32 bit: (offset< <6)
DMA read X bytes

max offset is 2*1024*1024, max block len is ?

10.4 RTC (Real-Time Clock)

Real-Time Clock (RTC) is 32-bit value, counting time intervals in seconds. To get the real time (seconds since January 1st, 2000 12am) add the counter bias saved in SRAM.

10.4.1 Operation

10.4.1.1 read

IMM write 32 : 0x20000000 | (0< <6) (RTC offset)
IMM read 32-bit RTC value

Since it is uncertain if the hardware prevents fragmented reads of the time interval (eg byte 1 from tick n and byte 2-4 from tick n+1) it is recommended to repeatedly retrieve the value until there is no difference between two consecutive reads.

10.4.1.2 write

IMM write 32 : 0xA0000000 (== 0x20000000 | 0x80000000 (write flag) - (0< <6) (RTC offset)
IMM write 32-bit RTC value

10.5 SRAM

SRAM is battery backed memory, used for saving some non volatile settings. Size of SRAM is 64 bytes.

10.5.1 Memory Map

offset end size Description

0x00 2 Checksum 1

0x02 2 Checksum 2

0x04 4 ead 0

0x08 4 ead 1

0x0c 4 counter Bias (add to RTC value to get actual time)

0x10 1 display offset H (signed value, -32...32)

0x11 1 ntd

0x12 1 language

value	Description
0	english
1	german
2	french
3	spanish
4	italian
5	dutch

0x13 1 flags

bit(s)		Description
7		? (=0)
6		? (=0)
5		? (=1)
4		? (=0)
3		? (=1)
2		0: mono 1: stereo
1		? (=0)
0		? (=0)

0x14 2*12 Flash ID

0x2c 4 wireless Keyboard ID

0x30 4*2 wireless PAD ID

0x38 1 last DVD Errorcode

0x39 1 padding/unused/reserved

0x3a 2*2 Flash ID checksum

0x3e 2 padding/unused/reserved

10.5.2 Operation

10.5.2.1 read

IMM write 32 : 0x20000100 (== 0x20000000 - (8 < < 6) (SRAM offset))
DMA read 64 bytes.

10.5.2.2 write

IMM write 32 : 0xa0000100 (== 0x20000000 - 0x80000000 (write flag) - (8 < < 6) (SRAM offset)
use sequential IMM writes

10.5.3 Checksums

the SRAM data is protected against corruption by a simple additive checksum which is calculated like this:

void checksums (unsigned short *buf, unsigned short *c1, unsigned short *c2)
{
int i;
    *c1 = 0; *c2 = 0;
    for (i = 0;i<4;++i)
    {
        *c1 += buf[0x06 + i];
        *c2 += (buf[0x06 + i] ^ 0xFFFF);
    }
}

10.6 AD16

AD16 is on channel 2, as device 0. Probably its used for debugging purposes. AD16 is the 32-bit register, keeping bootrom "trace-step".

10.6.1 Operation

10.6.1.1 init

IMM write : 0x0000
IMM read 32 bit ID and check it for error (it should be 0x04120000)

10.6.1.2 write

IMM write : 0xa0
IMM write 32-bit value (trace-step)

10.6.1.3 read

IMM write : 0xa2
IMM read 32-bit AD16 register value

10.6.2 Trace-Step Values

10.6.2.1 BS

0x01000000	AD16 Inited, cache lines 320, 340,360, 380, 3a0 prefetched
0x02000000	cache line 0x3e0 prefetched
0x03000000	rest of cachelines prefetched
0x04000000	ramtest passed
0x05000000	ramtest error
0x06000000	ramtest error

10.6.2.2 BS2

0x00000800	System Init
0x00000900	DVD Init
0x00000a00	Card Init
0x00000b00	video init
0x00000c00	final before menu

10.7 Memory Cards

Product	Blocks	Mega bits	Mega bytes	Vendor	Chip
Memory Card 59	64	4	0.5	Nintendo	Macronix MX25L4001 Serial Flash ROM
Action Replay memory card	64	4	0.5	Datel	Macronix MX25L4004 4M-Bit(4Mx1) Serial Flash ROM
Memory Card '4 Mega'	64	4	0.5	3rd Party	WINBOND 512K*8 CMOS flash memory (Winbond,W29C040P-90,215275901,216GJRA)
Memory Card 123	128	8	1	Nintendo (*)
Memory Card '8 Mega'	128	8	1	3rd Party
Memory Card 251	256	16	2	Nintendo
Memory Card 507	512	32	4	Nintendo (*)
Memory Card 1019	1024	64	8	Nintendo
Memory Card '64 Mega'	1024	64	8	3rd Party
USB Memory Adaptor 64M / 1019 blocks	1024	64	8	EMS
Memory Card 2043	2048	128	16	Nintendo (*)

(*) never seen those, appearently supported but never manufactured.

as you can see the products are named in reference to their useable capacity in blocks or total size in mega bits. The theoretical maximum size for a memory card is 128 mega bits (16 mega bytes, 2048 blocks).

10.7.1 Commands

Command	len	indata	len	outdata	len	Description
`0x8500`	`2`	-	`-`	ID	`2`	get ID
`0x8300`	`2`	-	`-`	Status	`1`	get Card Status
`0x89`	`1`	-	`-`	-	`-`	clear Card Status
`0x52`	`1`	offset, 0x00000000	`8`	Block Data	`<=0x200`	read Block
`0xf40000`	`3`	-	`-`	-	`-`	erase Card
`0xf1`	`1`	Sector	`2`	-	`-`	erase Sector
`0xf2`	`1`	Block offset	`4`	Block Data	`<=0x80`	write Block

10.7.2 Operation

10.7.2.1 unlocking

original memory cards (those manufactured by nintendo) need to be 'unlocked' before they can be accessed. this is appearently done by a small dsp program.

to do

10.7.2.2 get ID

IMM write 0x85,00
IMM read 2 bytes ID

10.7.2.2.1 Card IDs

10.7.2.3 get Status

IMM write 0x83,00
IMM read 1 byte Status

10.7.2.3.1 Status Bits

`7`	`0`
`x...`	`...r`

bit(s)		description
`7`	x	1: erase in Progress (?)
`0`	r	1: Card ready (?)

10.7.2.4 clear Status

IMM write 0x89

10.7.2.5 read Block

select
IMM write: 0x52
IMM write: (offset > > 17), (offset >
9), (offset > > 7) & 3, offset & 0x7F
IMM write: 0x00, 0x00, 0x00, 0x00
read 8 bit values
deselect

max offset is 16*1024*1024, max block len is 512 bytes.

10.7.2.6 erase Card

select
IMM write 0xf4,0x00,0x00
deselect

10.7.2.7 erase Sector

select
IMM write 0xf1
IMM write (sector > > 17) & 0x7F, (sector >
9) & 0xFF
deselect
wait until bit 7 of card status is cleared

10.7.2.8 write Block

wait while bit 0 of card status is cleared (= card ready)
select
IMM write 0xf2
IMM write (offset > > 17) & 0x3F, (offset >
9) & 0xFF, (offset > > 7) & 3, offset & 0x7F
write 0x80 bytes
deselect

10.8 Ethernet Adapter

The Macronix chip found in the ethernet adapter (mx98730ec) seems to be a reenginered version of the mx98726 or mx98728 (or the ec type respectivly).

10.8.1 registers

Registerblock Base	Size of Registerblock	common access size
`0x00`	`0x1000`	`1`

These are the actual Chip Registers which match with the descriptions in MXs documents.

0x00 1 r/w NCRA - Network Control Register A (0x08 ?)

`7`	`0`
`????`	`?ep?`

bit(s) description

7 INTCLK - must be 0 for normal operation.

6 INTMODE - Interrupt Mode: Set for the active high interrupt, reset for the active low interrupt case.

5 LB1 - Loopback mode

4 LB0

LB1	LB0	description
0	0	Mode0 - Normal mode
0	1	Mode1 - internal FIFO Loopback
1	0	Mode2 - internal NWAY Loopback
1	1	Mode3 - internal PMD Loopback

3 SR - Start Receive : Enable the MAC to receive packets. Default is disabled.

2 e ST1 - Start Transmit Command/Status

1 p ST0

0 RESET - Software reset.

bit 1 and bit 2 will get cleared after a packet has been sent

0x01 1 r/w NCRB - Network Control Register (0x11, 0x12 ?)

`7`	`0`

bit(s)		description
6-7		RXINTC - Recieve Interrupt Counter
5		HBD - Heart Beat Check Disable
4		AB - "pass all broadcast frames"
3		PB - "pass bad frames"
2		PM - "pass all multicast"
1		CA - capture effect mode
0		PR - promiscuous mode

0x02 1 r/w GMAC Test Register A : TRA

bit(s)		Description
7		SB - Start/Stop Back-off counter
6		FC - Forced Collision
5		RWD - Receive Watchdog Disable
4		RWR - Recieve Watchdog Release
1-3		TMODE - Test Moder Select bits
0		TEST - Test mode enable

0x03 1 r/w GMAC Test Register B : TRB

bit(s)		Description
7		BFSTATUS
6		BFS1
5		BKCNTLB
4		BFS0
3		COLCNTCB
2		RDNCNTSB
1		RDNCNTCB
0		FKD - Flaky Oscillator Disable

0x04 1 r/w LTPS - Last Transmitted Packet Status (transmit error code ?)

bit(s)		Description
7		TERR - Transmit Error
6		OWC - Out of Window Collision
5		UF - TX FIFO Underflow
4		CRSLOST - Carrier Sense Lost
3		CC3 - Collision Count Bit 3
2		CC2
1		CC1
0		CC0

0x05 1 r/w LRPS - Last Recieved Packet Status

bit(s)		Description
7		RERR - Recieve Error
6		RF - Runt Frame
5		MF - Multicast Frame address
4		RW - Recieve Watchdog
3		FO - FIFO Overrun
2		FAE - Frame Alignment Error
1		CRC - CRC error
0		BF - RX Packet Buffer Full Error

0x06 1 r/w MPCL - Missed Packet Counter

bit(s)		Description
0-7		MISSCNT - Miss Packet Counter LSB

0x07 1 r/w MPCL - Missed Packet Counter

bit(s)		Description
0-7		MISSCNT - Miss Packet Counter MSB

0x08 1 r/w IMR - Interrupt Mask Register (IRQ Mask)

bit(s)		Description
7		RBFIM - RX Buffer Full Interrupt Mask
6		BUSEIM - Bus Error Interrupt Mask
5		FIFOEIM - FIFO Error Interrupt Mask
4		TEIM - Transmit Error Interrupt Mask
3		REIM - Receive Error Interrupt Mask
2		TIM - Transmit Interrupt Mask
1		RIM - Recieved Interrupt Mask
0		FRAGIM - Fragment Counter Interrupt Mask

0x09 1 r/w IR - Interrupt Register (irq status)

`7`	`0`
`???t`	`esr?`

bit(s)		description
7		RBFI - RX Buffer Full Interrupt
6		BUSEI - Bus Error Interrupt
5		FIFOEI - FIFO Error Interrupt
4	t	TEI - Transmit Error Interrupt (1: transmit error)
`3`	e	REI - Recieve Error Interrupt (1: receive error ?)
`2`	s	TI - Transmit OK Interrupt (1: packet sent ?)
`1`	r	RI - Receive OK Interrupt (1: packet received ?)
`0`		FRAGI - Fragment Counter Interrupt

0x0a 2 r/w BP - Boundary Page Pointer Register (0x0100 ?)

0x0c 2 r/w TLBP - TX Low Boundary Page Pointer Register

0x0e 2 r/w TWP - Transmit Buffer Write Page Pointer Register

0x10 2 ?/? unused/reserved

0x12 2 r/w TRP - Transmit Buffer Read Page Pointer Register

0x14 2 r/w RXINTT - Receive Interrupt Timer

0x16 2 r/w RWP - Receive Buffer Write Page Pointer Register

0x18 2 r/w RRP - Receive Buffer Read Page Pointer Register

0x1a 2 r/w RHBP - RX High Boundary Page Pointer Register (0x0f00 ?)

0x1c 1 r/w EEPROM Interface Register:

bit(s)		Description
6-7		unused/reserved
5		EELD -
4		EESEL -
3		EEDO - Serial Data Output from external EEPROM clock device
2		EEDI - Serial Data Input to external EEPROM clock device
1		EECK - Serial Clock output to external EEPROM clock device (< 1 MHz)
0		EECS - Chip Select output to external EEPROM clock device

0x1d 1 r/w BICT - Bus Integrity Check Timer

0x1e 2 r/? IORDP - IO Data Port Page Pointer Register

0x20 6 r/w PAR0-PAR5 Network Address Filtering Registers - Physical (MAC) Address

0x26 8 r/w MAR0-PAR7 Network Address Filtering Registers - Hash Table Register

0x2e 1 r/w ANALOG - Transceiver Control Register

bit(s)		Description
6-7		unused/reserved (must be 0)
5		RST100 - Reset for NORMAL mode
4		RSQ - Reduced SQuelch Enable
3		PWD100 - Reset for NORMAL mode
2		PWD10B - Set for NORMAL mode
1		DS130 - Must be 1 for NORMAL mode with auto-compensation
0		DS120 - Must be 1 for NORMAL mode with auto-compensation

0x2f 1 r/w DINTVAL - DMA Interval Timer

0x30 1 r/w NWAYC - NWAY Configuration Register

bit(s)		Description
7		LTE - Link Test Enable
6		NTTEST - reserved
3-5		ANS - Autonegotiation Status
2		ANE - Autonegotiation Enable
1		PS100/10 - Port Select 100/10 Mbit
0		FD - Full Duplex Mode

0x31 1 r/- NWAYS - NWAY Status Register

bit(s)		description
7		10TXH - NWAY 10 TX Half duplex Mode
6		10TXF - NWAY 10 TX Full duplex Mode
5		100TXH - NWAY 100 Half duplex Mode
4		100TXF - NWAY 100 TX Full duplex Mode
3		ANCLPT - Auto-negotiation Completion
2		LPNWAY - Link Partner NWAY Status
1		LS100 - Physical Link Status of 100Mbps TP
0		LS10 - Physical Link Status of 10 Mbps TP

0x32 1 r/w GCA - GMAC Configuration A Register (0x08 ?)

bit(s)		description
7		unused/reserved (must be 0)
6		TXFIFOCNTEN
5		AUTOPUB - Auto Page Update option
4		unused/reserved
3		ARXERRB - Accept RX packet with error
2		SLOWSRAM
1		PBW - Packet Buffer Data Width
0		BPSCRM - Bypass Scrambler

0x33 1 r/w GCB - GMAC Configuration B Register

bit(s)		description
4-7		unused/reserved
2-3		RTHD - Recieve FIFO Threshold
0-1		TTHD - Transmit FIFO Threshold

0x34 4 -/w TWD - IO Mapped Data Port

0x38 2 -/- unused/reserved

0x3a 1 r/w Host Interface Protocol Register (0x08 ?)

`7`	`0`

bit(s)		description
2		DREQB - DREQB-pin status bit
1		STIORD/RRDYB - (no data available ?)
0		WRDYB - Write Packet Memory Ready Bar Status Indication

0x3b 1 r/- LPC - Link Partner Link Code Register

0x3c 1 r/w TX/RX DMA Status Register

0x3d 1 r/w MISC1 - MISC Control Register 1

0x3e 2 r/w TXFIFOCNT - TX FIFO Byte Counter

0x40 4 r/- RRD - RX Burst Read Data Port

0x44 2 r/- ID1 - 'MX'

0x46 2 r/- ID2 - '0001'

0x48 4 w WRTXFIFOD - Write TX FIFO Data Port Register (output queue)

0x4c 4 r/- IORD - IO Read Data Port Register

0x50 1 r/w MISC2 - MISC Control Register 2 (0x80 ?)

0x51 1 ? (?)

note: register 0x51 is not documented in mx98728 datasheet

0x52 2 r/- HRPKTCNT - Host Recieve Packet Counter

0x54 3 r/w FRAGCNT - Host DMA Fragment Counter

note: 0x56 is the last reg of a mx98726 and mx98728

0x5b ? ?/? (?)

0x5c ? ?/? (?)

0x36 = disconnect network

0x5e ? ?/? (0x01 ?)

0x60 ? ?/? (0x00 ?)

0x100 0xf00 ?/w input queue (?)

- select for reading

- IMM read block

10.8.2 command-registers

Registerblock Base	Size of Registerblock	common access size
`0x00`	`0x10`	`1`

These Registers are related to the EXI Interface on the Ethernet-Adapter, not to the actual Ethernet Chip.

0x00 ? ?/? EXI id

- select register for reading

- IMM read 4 bytes (0x04,0x02,0x02,0x00)

0x01 ? ?/? ?

0x02 ? ?/? irq mask

0x03 ? ?/? irq status

`7`	`0`
`r??p`	`h???`

bit(s)		description
`7`	r	irq from MX chip
`6`	?	'killing' irq (should not get this one)
`5`	?	command error
`4`	p	challange/response request
`3`	h	challange/response status

0x04 ? ?/? ? (revid_eth)

- select register for writing

- IMM write 0xd1,0x07 (16bit)

0x05 ? ?/? ? (0x4e ?)

0x06 ? ?/? ?

0x07 ? ?/? ?

0x08 ? ?/? Challenge

- select for reading

- IMM read 4 bytes

0x09 ? ?/? Response

- select for writing

- IMM write 4 bytes

0x0a ? ?/? ?

0x0b ? ?/? Status

1: challenge/response ok

2: challenge/response failed

0x0c ? ?/? ?

0x0d ? ?/? ?

0x0e ? ?/? ?

0x0f ? ?/? ? (0x00 ?)

10.8.3 Operation

10.8.3.1 selecting a register for reading

IMM write 0x80000000 - (register< <8)

10.8.3.2 selecting a register for writing

IMM write 0xc0000000 - (register< <8)

10.8.3.3 selecting command-register for reading

IMM write (register< <8) (16 bits)

10.8.3.4 selecting command-register for writing

IMM write 0x4000 - (register< <8) (16 bits)

10.8.3.5 init

write reg - 1 byte to 0x60, 0x00
read reg - 1 byte from 0x0f (?)
delay
write reg - 1 byte to 0x00, 0x01
write reg - 1 byte to 0x00, 0x00 (not necessary ?)
read reg - 1 byte from 0x01, 0x00
read reg - 1 byte from 0x5b
write reg - 1 byte to 0x5b, write back previously read value AND ~(1< <7
write reg - 1 byte to 0x5e, 0x01 (or same as 0x5b ?!)
read reg - 1 byte from 0x5c
write reg - 1 byte to 0x5c, write back previously read value OR 4
write reg - 1 byte to 0x01, 0x11
write reg - 1 byte to 0x50, 0x80 (?)
write reg - 1 byte to 0x08, 0xff
write reg - 1 byte to 0x09, 0xff
write reg - 1 byte to 0x02, 0x00 (?)
write reg - 1 byte to 0x00, 0x08
delay
write reg - 2 bytes to 0x16, 0x0100 (recv buffer write ptr)
write reg - 2 bytes to 0x18, 0x0100 (recv buffer read ptr)

10.8.3.6   challenge/response calculation

u32 ETHChallResp(u32 val,u32 revid_0,u32 revid_eth_0,u32 revid_eth_1)
{
    u32 c0,c1,c2,c3;

    c0=(
          ( ((val&0xff000000)> >24) +
            ((val&0x00ff0000)> >16) * 0xc1 + 0x18 + revid_0 )
        ^ ( ((val&0x000000ff) * ((val&0x0000ff00)> >8)) + 0x90 )
       ) & 0xff;
    c1=(
          ( ((val&0x00ff0000)> >16) + ((val&0x0000ff00)> >8) + 0x90 )
        ^ ( c0 + ((val&0xff000000)> >24) - 0xc1 )
       ) & 0xff;
    c2=(
          ( ((val&0x0000ff00)> >8) + 0xc8 )
        ^ ( c0 + ((revid_eth_0 + revid_0 * 0x23) ^ 0x19) )
       ) & 0xff;
    c3=(
          ( ((val&0xff000000)> >24) + 0xc1 )
        ^ ( (val&0x000000ff) + ((revid_eth_1 + 0xc8) ^ 0x90) )
       ) & 0xff;
    return ((c0 < < 24) | (c1 < < 16) - (c2 < < 8) - (c3));
}

10.8.3.7 send packet (outside interrupt)

write reg - X bytes to 0x48, <senddata> (X must be >=0x3c!)
read reg - 1 byte from 0x00, status ?
write reg - 1 byte to 0x00, 0x00
write reg - 1 byte to 0x00, previously read status OR 0x04 (set bit3, ACK error?)
read reg - 1 byte from 0x00,status ;do while (status AND 0x06)!=0 (wait until packet sent)

10.8.3.8 poll received packets (outside interrupt)

read reg - 2 bytes from 0x16, write_ptr
read reg - 2 bytes from 0x18, read_ptr
if write_ptr==read_ptr, no more packets are available
write reg - 1 byte to 0x3a, 0x02
read reg - 1 byte from 0x3a, if (value&2)!=0, no more data is available
read reg- 4 bytes from read_ptr, packet descriptor
read reg - X bytes from 0x100+read_ptr, <data> (X must be >=0x3c! ; wrap around to 0x100 if read_ptr=0xf00)
write reg - 2 bytes to 0x18, first byte of packet descriptor, 0x00 (advance read pointer)
write reg - 1 byte to 0x09, 0x02
write cmd - 1 byte to 0x02, 0xf8 (ACK?)

10.8.3.9 received packet format

first 4 bytes of a received packet contains a descriptor about the packet that has been received

`31`	`24`	`23`	`16`	`15`	`8`	`7`	`0`
`....`	`....`	`yyyy`	`....`	`xxxx`	`xxxx`	`....`	`....`

bit(s)		Description
20-23	y	length of received packet lo bits (shift 4 down)
8-15	x	length of received packet hi bits (shift 4 up and OR with lo bits)

length is inclusive the 4 byte descriptor!

10.9 UART

(note: the existance of an UART is highly speculative and was never proved for a fact) to do

10.10 SD Cards

SD cards support an SPI mode, which is essentially the same hardware protocol that official memory cards use. Notice the use of the word hardware, not software. SD cards uses the MMC command set for communication and data transfer, while Nintendo memory cards use a custom Macronix command set. This means that you should not waste your time trying to get standard GC programs to recognize the SD card as a normal memory card, because it will not work without specific code to access the SD card. Even if you make the raw sector data on the SD card the same as the Nintendo memory card, the low-level commands to access the sectors differ between the two. However, since the hardware bus and protocol are the same, an SD adapter can essentially be made with straight-through connections from the EXI bus to the SD card signals. to do

10.11 Viper 'Modchip'

this is a 3rd-Party 'modchip' used to override the IPL with a custom program. todo

10.12 Ripper III GC 'Modchip'

todo

10.13 Qoob 'Modchip'

todo

10.14 NinjaMOD 'Modchip'

todo

10.15 Mario Party Microphone

todo