Hardware/RTC

General

Just like the Wii and the GameCube, the Wii U contains a dedicated chip for the Real-Time Clock (RTC). The MX23L0002 is a custom chip that encompasses the RTC and a small SRAM bank. While the chip still sits on the EXI bus (channel 0, device 1) it no longer contains the GameCube font sets, as this data is now handled on the software side.

Communication

To access the RTC on the Wii U you must:

- Enable the EXI through HW_AIP_PROT;
- Initialize the EXI channels;
- Register device 1 (RTC) on EXI channel 0 with default frequency;
- To read from the RTC:
    -> EXI immediate write the RTC offset (see below);
    -> EXI immediate read the result;
- To write to the RTC:
    -> EXI immediate write the RTC offset (see below) ORed with flag 0x80000000;
    -> EXI immediate write the desired value;
- Reset the EXI channel.

Registers

The RTC exposes a few control registers and SRAM memory access in the form of EXI offsets, which can be accessed to read and write 32-bit values or perform DMA operations (in the case of SRAM).

Offset	Description
0x20000000	RTC_COUNTER
0x20000100	RTC_SRAM0
0x20000200	RTC_SRAM1
0x20000300	RTC_SRAM2
0x20000400	RTC_SRAM3
0x20000500	RTC_SRAM4
0x20000600	RTC_SRAM5
0x20000700	RTC_SRAM6
0x20000800	RTC_SRAM7
0x20000900	RTC_SRAM8
0x20000A00	RTC_SRAM9
0x20000B00	RTC_SRAMA
0x20000C00	RTC_SRAMB
0x20000D00	RTC_SRAMC
0x20000E00	RTC_SRAMD
0x20000F00	RTC_SRAME
0x20001000	RTC_SRAMF
0x20400000	RTC_SNAPSHOT
0x21000000	RTC_ONTMR
0x21000100	RTC_OFFTMR
0x21000400	RTC_COMPATSET
0x21000800	RTC_COMPATINT
0x21000C00	RTC_CONTROL0
0x21000D00	RTC_CONTROL1
0x21000E00	RTC_CONTROL2
0x21000F00	RTC_CONTROL3
0x21001000	RTC_SCRATCH0
0x21001100	RTC_SCRATCH1
0x21001200	RTC_SCRATCH2
0x21001300	RTC_SCRATCH3
0x21001800	RTC_NORMALINT

RTC_COUNTER

Counting time intervals in seconds.

RTC_SNAPSHOT

Snapshot of RTC_COUNTER.

RTC_ONTMR

Bits	Description
0-29	ONTMR_SET
30	PONTMR_DTCT
31	ONTMR_EN

RTC_OFFTMR

Bits	Description
0-29	OFFTMR_SET
30	POFFTMR_DTCT
31	OFFTMR_EN

RTC_CONTROL0

Bits	Description
0-7	RTC_REVISION
8	CANARY
9	LOW_BATT
10
11	UNSTBL_PWR
12-15
16	PONLG_TMR
17	PONFLG_SYS
18-23
24	POFFLG_TMR
25	POFFLG_4S
26	POFFLG_FPOFF
27-31

RTC_CONTROL1

Bits	Description
0	4COUNT_EN
1
2	CLKOUT_EN
3	FPOFF_MODE
4-7
8	SLEEP_EN
9
10	DEVPWR_EN
11-15
16	POFF_EXE
17-31

Pinout

Counter-clockwise from the top-left dot:

Pin number (Bottom, 5x7)	Pin number (Top, 6x6)	Name	Description
01	01	crystal 1
02	02	GND
03	03	SoC nRST	TP144. SoC resets when pulled down using a 3.3kohm resistor. R677 can be severed to disconnect the signal from the SMC+RTC to the SoC.
04	04	VCC/3v3
05	05	BT/5GHz standby Power-on-reset?	TP146, goes to BT and 5GHz module
06	06	?	TP143/R119, directly to SoC
07	09	?	TP175, to SMC, 1Hz 3.3V-0V. SMC CLK?
08	07	?	TP177
09	10	EXI MOSI	Device in, Wii U out. TP100, directly to SoC
10	11	EXI CS	TP102, directly to SoC
11	12	EXI MISO	Device out, Wii U in. TP176, Top RTC is directly to SoC. Bottom RTC has an inline resistor.
12	08	GND
13	13	EXI CLK	TP101
14	17	NC
15	14	2.4GHz power enable	TP141, enables Q1065 to send 3.3V standby to Wifi module
16	15	1.5V enable	TP149
17	16	15V PFET enable	TP147, enables Q1061 to send 15V to motherboard
18	18	?	TP9, acts like a power button (active low/pullup, pressed=0.0v, not pressed=3.3v), also connected to SMC
19	19	PGOOD	TP148, pulled high by 3.3V standby
20	20	VCC/3v3_Standby
21	21	SMC nRESET	TP145, to SMC
22	22	?	Via to nowhere? Maybe RTC has an internal LDO?
23	23	Battery
24	24	crystal 2