SPU Isolated Modules Reverse Engineering

aim_spu_module

It is used to retrieve the device type, device id, open psid and the pscode from the EID data that is passed in.

Debug messages

Address	Message
0x36f0	"(spu)start aim spu module!\n"
0x3710	"(spu) PU DMA area start address is not align 16byte\n"
0x3750	"(spu) PU EID area start address is not align 16byte\n"
0x3790	"(spu) PU DMA area size is not equall to AIM_DMA_SIZE\n"

Functions

Address	Name	Info
0x1440	debug_print	As the name already states...
0x30c0	do_dma	Used to dma data in and out of the isolated module's LS.
0x3168	write_tag_mask_bit	This function has one argument ($4).

Disasm

write_tag_mask_bit

//(tag_mask_bit:$4)
{
 //3168:	40 80 00 02 	il	$2,0 //Update immediately, unconditional.
 //316c:	21 a0 0b 82 	wrch	$MFC_WrTagUpdate,$2
 wrch(MFC_WrTagUpdate, 0);
 //3170:	01 e0 0b 83 	rchcnt	$3,$MFC_WrTagUpdate
 //3174:	7c 00 41 85 	ceqi	$5,$3,1
 //3178:	20 7f ff 05 	brz	$5,0x3170	# 3170
 while(rchcnt(MFC_WrTagUpdate) != 1);
 //317c:	01 a0 0c 02 	rdch	$2,$MFC_RdTagStat
 $2 = rdch(MFC_RdTagStat);
 //3180:	0b 61 01 86 	shl	$6,$3,$4
 //3184:	21 a0 0b 06 	wrch	$MFC_WrTagMask,$6
 wrch(MFC_WrTagMask, 1 << tag_mask_bit);
 //3188:	40 80 01 03 	il	$3,2 //Update tag status if or when all enabled tag groups have “no outstanding operation” status.
 //318c:	21 a0 0b 83 	wrch	$MFC_WrTagUpdate,$3
 wrch(MFC_WrTagUpdate, 2);
 //3190:	01 a0 0c 02 	rdch	$2,$MFC_RdTagStat
 $2 = rdch(MFC_RdTagStat);
 //3194:	35 00 00 00 	bi	$lr
 return;
}