Physical Memory: Difference between revisions
Jump to navigation
Jump to search
Line 60: | Line 60: | ||
| 0x20000 | | 0x20000 | ||
| S | | S | ||
| cmep 128KiB SRAM. [[Secure_Kernel|secure kernel]], [[Sm_modules|sm location]]. | | cmep 128KiB SRAM. [[Second_Loader|second_loader]], [[Secure_Kernel|secure kernel]], [[Sm_modules|sm location]]. | ||
|- | |- | ||
| 0x1A000000 | | 0x1A000000 |
Revision as of 04:22, 14 January 2022
Main table
Start | End | Size | World | Comments |
---|---|---|---|---|
0x00000000 | 0x00007FFF | 0x8000 | NS/S | ARM Boot. Alias of 0x1F000000 , ScePower scratch buffer
|
0x00040000 | 0x0005FFFF | 0x20000 | S | MeP boot. Mirror of 0x00800000. |
0x00300000 | 0x0030FFFF | 0x10000 | S | cmep icache |
0x00310000 | 0x0031FFFF | 0x10000 | S | cmep icache tag |
0x00320000 | 0x0032FFFF | 0x10000 | S | cmep dcache |
0x00330000 | 0x0033FFFF | 0x10000 | S | cmep dcache tag |
0x004B0000 | 0x005FFFFF | 0x150000 | S | Reverved for Venezia |
0x00600000 | 0x007FFFFF | 0x200000 | S | Reserved for MeP |
0x00800000 | 0x0081FFFF | 0x20000 | S | cmep 128KiB SRAM. second_loader, secure kernel, sm location. |
0x1A000000 | 0x1A001FFF | 0x2000 | NS/S | ARM, SceInterruptControllerReg / ScePeriphReg, Interrupts (PERIPHBASE )
|
0x1A002000 | 0x1A002FFF | 0x1000 | NS/S | ARM. ScePl310Reg / SceL2CacheReg, L2 Cache Controller |
0x1C000000 | 0x1C1FFFFF | 0x200000 | NS/S | Tachyon-eDRAM. SceDisplay / SceCamera SRAM (only 960x544 pixels * 4 bytes = 0x1FE000 bytes mapped) |
0x1F000000 | 0x1F007FFF | 0x8000 | NS/S | SPAD32K. ScePowerScratchPad32KiB |
0x1F840000 | 0x1F85FFFF | 0x20000 | NS/S | SPAD128K. SceVeneziaSpram. Stores Secure Kernel on boot. |
0x20000000 | 0x27FFFFFF | 0x8000000 | NS | VRAM. Graphics bar |
0x30000000 | ? | ? | S | Unknown. Used by second_loader |
0x40000000 | 0x401FFFFF on FWs <= 3.51, 0x401FFFFF on FWs >= 3.52 | 0x300000 on FWs <= 3.51, 0x200000 on FWs >= 3.52 | S | Secure DRAM |
0x40300000 on FWs <= 3.51, 0x40200000 on FWs >= 3.52 | 0xBFFFFFFF | 0x7FD00000 on FWs <= 3.51, 0x7FE00000 on FWs >= 3.52 | NS/S | Non-secure Shared DRAM |
0xC0000000 | 0xDFFFFFFF | 0x20000000 | NS/S | Reserved for Venezia. Maybe unused. |
0xE0000000 | 0xE00FFFFF | 0x100000 | S | Control Register. cmep |
0xE0100000 | 0xE0100FFF | 0x1000 | NS | SceGpio1Reg |
0xE0400000 | 0xE0400FFF | 0x1000 | NS | SceDmacmgrDmac4Reg |
0xE0410000 | 0xE0410FFF | 0x1000 | NS | SceDmacmgrDmac5Reg |
0xE0420000 | 0xE0420FFF | 0x1000 | NS | SceI2s0Reg |
0xE0430000 | 0xE0430FFF | 0x1000 | NS | SceI2s1Reg |
0xE0440000 | 0xE0440FFF | 0x1000 | NS | SceI2s2Reg |
0xE0450000 | 0xE0450FFF | 0x1000 | NS | SceI2s3Reg |
0xE0460000 | 0xE0460FFF | 0x1000 | NS | SceI2s5Reg |
0xE0470000 | 0xE0470FFF | 0x1000 | NS | SceI2s4Reg |
0xE0490000 | 0xE0490FFF | 0x1000 | NS | SceI2s7Reg |
0xE04A0000 | 0xE04A0FFF | 0x1000 | NS | SceSrcMix0Reg |
0xE04B0000 | 0xE04B0FFF | 0x1000 | NS | SceSrcMix1Reg |
0xE04C0000 | 0xE04C0FFF | 0x1000 | NS | SceSrcMix2Reg |
0xE04D0000 | 0xE04D3FFF | 0x4000 | NS | SceSpdifReg |
0xE04DC000 | 0xE04DCFFF | 0x1000 | NS | SceAclkgenReg |
0xE04E0000 | 0xE04E0FFF | 0x1000 | NS/S | SceDmacmgrKeyringReg / SceSblDMAC5DmacKRBase / DMAC Register base |
0xE0500000 | 0xE0500FFF | 0x1000 | NS | SceI2c0Reg |
0xE0510000 | 0xE0510FFF | 0x1000 | NS | SceI2c1Reg |
0xE0900000 | 0xE0900FFF | 0x1000 | NS | SceMsif |
0xE0A00000 | 0xE0A00FFF | 0x1000 | NS | SceSpi0Reg (SceSyscon) |
0xE0A10000 | 0xE0A10FFF | 0x1000 | NS | SceSpi1Reg (SceMotionDev) |
0xE0A20000 | 0xE0A20FFF | 0x1000 | NS | SceSpi2Reg (SceOled) |
0xE0B00000 | 0xE0B00FFF | 0x1000 | NS | SceSdif0 |
0xE0C00000 | 0xE0C00FFF | 0x1000 | NS | SceSdif1 |
0xE0C10000 | 0xE0C10FFF | 0x1000 | NS | SceSdif2 |
0xE0C20000 | ? | ? | ? | SceSdif3 (not present on 1.69, does 3.60 use only NSKBL?) |
0xE2030000 | 0xE209FFFF | 0x70000 | NS | SceUartReg |
0xE20A0000 | 0xE20A0FFF | 0x1000 | NS | SceGpio0Reg / SceLedReg |
0xE20A1000 | 0xE20AFFFF | 0xF000 | NS | SceLedReg |
0xE20B1000 | 0xE20B5FFF | 0x5000 | NS | SceLongRangeTimerReg |
0xE20B6000 | 0xE20B6FFF | 0x1000 | NS | SceLT5, Clock in usec |
0xE20B7000 | 0xE20BFFFF | 0x9000 | NS | SceWordTimerReg |
0xE20BE000 | 0xE20BEFFF | 0x1000 | ? | Timer for usleep |
0xE20C0000 | 0xE20C0FFF | 0x1000 | NS | ScePwmReg |
0xE3000000 | 0xE3000FFF | 0x1000 | NS | SceDmacmgrDmac0Reg |
0xE3010000 | 0xE3010FFF | 0x1000 | NS | SceDmacmgrDmac1Reg |
0xE3020000 | 0xE3020FFF | 0x1000 | NS | SceCif0Reg |
0xE3030000 | 0xE3030FFF | 0x1000 | NS | SceCif1Reg |
0xE3050000 | 0xE3050FFF | 0x1000 | NS | SceCsi0Reg |
0xE3060000 | 0xE3060FFF | 0x1000 | NS | SceCsi1Reg |
0xE3100000 | 0xE3100FFF | 0x1000 | NS | ScePervasiveMisc |
0xE3101000 | 0xE3101FFF | 0x1000 | NS | ScePervasiveResetReg |
0xE3102000 | 0xE3102FFF | 0x1000 | NS | ScePervasiveGate |
0xE3103000 | 0xE3103FFF | 0x1000 | NS | ScePervasiveBaseClk |
0xE3104000 | 0xE3104FFF | 0x1000 | NS | ScePervasiveVid |
0xE3105000 | 0xE3105FFF | 0x1000 | NS | SceUartClkgenReg |
0xE3106000 | 0xE3106FFF | 0x1000 | NS | ScePervasiveMailboxReg |
0xE3108000 | 0xE3108FFF | 0x1000 | NS | ScePervasiveTas0 |
0xE3109000 | 0xE3109FFF | 0x1000 | NS | ScePervasiveTas1 |
0xE310A000 | 0xE310AFFF | 0x1000 | NS | ScePervasiveTas2 |
0xE310B000 | 0xE310BFFF | 0x1000 | NS | ScePervasiveTas3 |
0xE310C000 | 0xE310CFFF | 0x1000 | NS | ScePervasiveTas4 |
0xE310D000 | 0xE310DFFF | 0x1000 | NS | ScePervasiveTas5 |
0xE310E000 | 0xE310EFFF | 0x1000 | NS | ScePervasiveTas6 |
0xE310F000 | 0xE310FFFF | 0x1000 | NS | ScePervasiveTas7 |
0xE3110000 | 0xE3110FFF | 0x1000 | NS | SceUdcd0 / ScePervasive2Reg |
0xE3200000 | 0xE3200FFF | 0x1000 | S | Base Debug ROM Table |
0xE3203000 | 0xE3203FFF | 0x1000 | NS | SceTpiuReg |
0xE3204000 | 0xE3204FFF | 0x1000 | NS | SceFunnelReg |
0xE3205000 | 0xE3205FFF | 0x1000 | NS | SceItmReg |
0xE3300000 | 0xE3300FFF | 0x1000 | S | ARM Cortex-A9 Debug ROM Table |
0xE3310000 | 0xE3310FFF | 0x1000 | NS | SceDbg0Reg, Debugger Interface |
0xE3311000 | 0xE3311FFF | 0x1000 | NS | ScePmu0Reg |
0xE3312000 | 0xE3312FFF | 0x1000 | NS | SceDbg1Reg, Debugger Interface |
0xE3313000 | 0xE3313FFF | 0x1000 | NS | ScePmu1Reg |
0xE3314000 | 0xE3314FFF | 0x1000 | NS | SceDbg2Reg, Debugger Interface |
0xE3315000 | 0xE3315FFF | 0x1000 | NS | ScePmu2Reg |
0xE3316000 | 0xE3316FFF | 0x1000 | NS | SceDbg3Reg, Debugger Interface |
0xE3317000 | 0xE3317FFF | 0x1000 | NS | ScePmu3Reg |
0xE3318000 | 0xE3318FFF | 0x1000 | NS | SceCti0Reg |
0xE3319000 | 0xE3319FFF | 0x1000 | NS | SceCti1Reg |
0xE331A000 | 0xE331AFFF | 0x1000 | NS | SceCti2Reg |
0xE331B000 | 0xE331BFFF | 0x1000 | NS | SceCti3Reg |
0xE331C000 | 0xE331CFFF | 0x1000 | NS | ScePtm0Reg |
0xE331D000 | 0xE331DFFF | 0x1000 | NS | ScePtm1Reg |
0xE331E000 | 0xE331EFFF | 0x1000 | NS | ScePtm2Reg |
0xE331F000 | 0xE331FFFF | 0x1000 | NS | ScePtm3Reg |
0xE3320000 | 0xE3323FFF | 0x4000 | NS | ARM-VFP. SceIntrmgrVfpIntRegs |
0xE4020000 | 0xE4020FFF | 0x1000 | NS | USB2_OHCI. SceUsbdEhci |
0xE40B0000 | 0xE40B0FFF | 0x1000 | NS | SceUsbdEhci |
0xE40C0000 | 0xE40C0FFF | 0x1000 | NS | SceUdcd1 |
0xE40D0000 | 0xE40D0FFF | 0x1000 | NS | SceUdcd2 |
0xE40E0000 | 0xE40E0FFF | 0x1000 | NS | SceUsbdEhci |
0xE5000000 | 0xE5000FFF | 0x1000 | NS | SceDmacmgrDmac2Reg |
0xE5010000 | 0xE5010FFF | 0x1000 | NS | SceDmacmgrDmac3Reg |
0xE5020000 | 0xE5020FFF | 0x1000 | NS | SceIftu0RegA (OLED FB) |
0xE5021000 | 0xE5021FFF | 0x1000 | NS | SceIftu0RegB |
0xE5022000 | 0xE5022FFF | 0x1000 | NS | SceIftuc0Reg |
0xE5030000 | 0xE5030FFF | 0x1000 | NS | SceIftu1RegA (HDMI FB) |
0xE5031000 | 0xE5031FFF | 0x1000 | NS | SceIftu1RegB |
0xE5032000 | 0xE5032FFF | 0x1000 | NS | SceIftuc1Reg |
0xE5040000 | 0xE5040FFF | 0x1000 | NS | SceIftu2Reg |
0xE5050000 | 0xE5050FFF | 0x1000 | NS | SceDsi0Reg |
0xE5060000 | 0xE5060FFF | 0x1000 | NS | SceDsi1Reg |
0xE5070000 | 0xE5070FFF | 0x1000 | NS | SceCompatMailbox |
0xE5071000 | 0xE5071FFF | 0x1000 | NS | SceCompatLCDDMA |
0xE50C0000 | 0xE50C0FFF | 0x1000 | NS | SceDmacmgrDmac6Reg |
0xE50D0000 | 0xE50D1FFF | 0x2000 | NS | ScePfmReg / SceDeci4pDtracepPaReg |
0xE5800000 | 0xE580FFFF | 0x10000 | NS | SceSDbgSdio0 |
0xE5810000 | 0xE581FFFF | 0x10000 | NS | SceDbgSdio1 |
0xE5880000 | 0xE5888FFF (?) | 0x9000 (?) | ? | LPDDR2SUB (1st 256MiB DRAM bank config regs) (?) |
0xE6000000 | 0xE6008FFF (?) | 0x9000 (?) | ? | LPDDR2"TOP" (2nd 256MiB DRAM bank config regs) (?) |
0xE8000000 | 0xE8001FFF | 0x2000 | S | SceSonyRegbus. GPU Control |
0xE8100000 | 0xE8100FFF | 0x1000 | NS/S | SceCompatSharedSram (0xBFC00000 in PSP)
|
0xE8200000 | 0xE8200FFF | 0x1000 | S | SceEmcTop (External Memory Controller, VRAM?) |
0xE8300000 | 0xE8301FFF | 0x2000 | S | SceGrab |
0xE8400000 | 0xE841FFFF | 0x20000 | NS | SceSGX543Reg |
0xEC000000 | ? | ? | ? | Mapped by SKBL |
0xEC060000 | ? | ? | ? | Mapped by SKBL. Maybe related to cmep reset. |
0xED000000 | ? | ? | ? | Mapped by SKBL |
0xEE000000 | ? | ? | ? | Mapped by SKBL |
0xF0000000 | ? | ? | ? | Reserved for Venezia |
Secure DRAM
FW 3.60 Secure DRAM
Start | End | Size | Comments |
---|---|---|---|
0x40000000 | 0x400000BF | 0xC0 | SKBL Reset Vector |
0x40000500 | 0x400099FF | 0x9500 | kprx_auth_sm.self. This area is also used as a work buffer at boot. |
0x40009B00 | 0x4000A27F | 0x780 | prog_rvk.srvk |
0x4001FD00 | 0x4001FEFF | 0x100 | SceKblParam with magic not set |
0x40020000 | 0x400570C7 | 0x370C8 | SKBL segment 0 |
0x40057100 | 0x400571DF | 0xE0 | SKBL segment 1 |
0x40073570 | 0x4007376F | 0x200 | SceKblParam |
This region is used by both Secure and Non-Secure Kernel Boot Loaders, and by Secure Kernel modules.
Start | End | Size | Comments |
---|---|---|---|
0x40200000 on FW 3.60, 0x40300000 on FW 1.69 | 0x4FFFFFFF | 0x0FE00000 on FW 3.60, 0x0FD00000 on FW 1.69 | TrustZone region. ?First 0x1000 bytes are a Reset Vector named SceKernelReset whose first 0x100 bytes are identical as in uncompressed NSKBL (need to check)? |
0x50000000 | 0x50FFFFFF | 0x1000000 | ARZL compressed NSKBL. Comes from one of kernel_boot_loader.self segments. |
0x51000000 | 0x51FFFFFF | 0x1000000 | SceBootKernelImage. Uncompressed NSKBL. Comes from ARZL compressed NSKBL. |
0x52000000 | 0x5FFFFFFF | 0xE000000 | Non-secure kernel and usermode modules |
0x60000000 | 0x7FFFFFFF | 0x20000000 | DevKit additional 512MiB. LDDR2TOP. |
0x80000000 | 0x9FFFFFFF | 0x20000000 | DevKit additional 512MiB. LDDR2SUB. For perf (not published anywhere). |
0xA0000000 | 0xBFFFFFFF | 0x20000000 | DevKit additional 512MiB. LDDR2SUB. For perf (not published anywhere, disabled). |
NSKBL Layout
NSKBL on FW 3.60
Start | End | Size | Comments |
---|---|---|---|
0x51000000 | 0x51028087 | 0x28088 | NSKBL Text segment |
??? | ??? | ??? | NSKBL Data segment |
Notes:
- The first 0xC0 bytes of the Text segment are the reset vector.
- NSKBL is mapped in RWX mode so it may write itself to text segment.
cmep
Each cmep device has its own physical memory area.
Start | End | Comments |
---|---|---|
0xE0000000 | 0xE000FFFF | ARM/F00D communication F00D Communication Ports |
0xE0010000 | 0xE001FFFF | cmep Reset |
0xE0020000 | 0xE002FFFF | ? |
0xE0030000 | 0xE003FFFF | F00D Key Ring Controller. ?EEPROM programmer? |
0xE0040000 | 0xE004FFFF | F00D Math Processor (Bignum worker) |
0xE0050000 | 0xE0050FFF? | Bigmac crypto engine, similar to DMAC5 |
0xE0058000 | 0xE0067FFF | F00D Keyring Regs F00D Key Ring Base. EEPROM / Bigmac keyslots, 0x800 entries, 0x20 bytes each key
|
0xE0070000 | ? | SceEmmcController |
0xE00C0000 | 0xE00CFFFF | ? |
Interrupt registers
Start | End | Comments |
---|---|---|
0xE3100138 | 0xE310013B | BEATB |
0xE310013C | 0xE310013F | BEADR |
0xE3110D80 | 0xE3110D83 | BET0 |
0xE3110D90 | 0xE3110D93 | BET1 |
0xE3110D94 | 0xE3110D97 | BEBT |
0xE3000110 | 0xE3000113 | DMAC0 - address |
0xE3000114 | 0xE3000117 | DMAC0 - attribute |
0xE3010110 | 0xE3010113 | DMAC1 - address |
0xE3010114 | 0xE3010117 | DMAC1 - attribute |
0xE5000110 | 0xE5000113 | DMAC2 - address |
0xE5000114 | 0xE5000117 | DMAC2 - attribute |
0xE5010110 | 0xE5010113 | DMAC3 - address |
0xE5010114 | 0xE5010117 | DMAC3 - attribute |
0xE0400810 | 0xE0400813 | DMAC4 - address |
0xE0400814 | 0xE0400817 | DMAC4 - attribute |
0xE50C0110 | 0xE50C0113 | DMAC6 - address |
0xE50C0114 | 0xE50C0117 | DMAC6 - attribute |
0xE3110D14 | 0xE3110D17 | SPM32 - address |
0xE3110D18 | 0xE3110D1B | SPM32 - attribute |
0xE3110D04 | 0xE3110D07 | SPM128 - address |
0xE3110D08 | 0xE3110D0B | SPM128 - attribute |
0xE600C008 | 0xE600C00B | LPDDR2 I/F CH0 - address |
0xE600C000 | 0xE600C003 | LPDDR2 I/F CH0 - attribute |
0xE588C008 | 0xE588C00B | LPDDR2 I/F CH1 - address |
0xE588C000 | 0xE588C003 | LPDDR2 I/F CH1 - attribute |
0xE310013C | 0xE310013F | Pervasive - address |
0xE3100138 | 0xE310013B | Pervasive - attribute |
0xE50D10F0 | 0xE50D10F3 | Debug/PA - address |
0xE50D10F4 | 0xE50D10F7 | Debug/PA - attribute |
0xE3110D34 | 0xE3110D37 | Pervasive2 - address |
0xE3110D38 | 0xE3110D3B | Pervasive2 - attribute |
0xE580FFF0 | 0xE580FFF3 | SDIO0 - address |
0xE580FFF4 | 0xE580FFF7 | SDIO0 - attribute |
0xE581FFF0 | 0xE581FFF3 | SDIO1 - address |
0xE581FFF4 | 0xE581FFF7 | SDIO1 - attribute |