Talk:Undocumented SPU Channels

Channel 67

Used to get the config ring.

Use is similar to channel 73.

uint8_t expectedConfigRing65[];
uint8_t expectedConfigRing90[];
   
function _start+1340() { //extracted from bootloader on 0x1A datecode console
   
    uint64_t vr = getSPU_VR(); //First active SPE priv1 SPU_VR register
    uint32_t toIgnore;
    uint32_t toRead;
    uint8_t expectedConfigRing;
    uint8_t readedConfigRing[];
    switch (vr) {
        case 0x201:
        case 0x202:
            //90nm console
            toIgnore = 0xA6;
            toRead = 0x156;
            expectedConfigRing = expectedConfigRing90;
            break;
        default:
            //65nm console
            toIgnore = 0xBB;
            toRead = 0x152;
            expectedConfigRing = expectedConfigRing90;
    }
    unsigned int index;
    for (index = 0; index < toIgnore>>3; index++) {
        rdch(67);
    }
    for (index = 0; index < toRead; index++) {
        readedConfigRing[index] = rdch(67) & 0xFF;
    }
    while (moreBitFieldsToCheck) {
        checkConfigRingField(expectedConfigRing, readedConfigRing, field, .....);
    }
   
}

Channel 64

Used to control isolation-mode persistent storage (w:ch72/r:ch73) and probably config ring storage (r:ch67).

Other values written to channel 64 (on bootldr): 0x00, 0x02, 0x20000

High 16 bits (isolation-mode persistent storage control)

• 0x10000 : reset persistent storage r/w index (writes to ch72 and reads from ch73 will start at index zero)
• (0x20000 | 0x40000) = 0x60000 : lock persistent storage r/w (reading from ch73 will return zero as long as the current isolated session lasts)