Pervasive

Pervasive is a device that controls the clocks of most of the devices of the system.

ScePervasiveMisc (0xE3100000)

Devices can be fully disabled? by writing a 1 to the corresponding bit of the ScePervasiveMisc (PA 0xE3100000) register. To disable the device dev_off, do *REG32(0xE3100000 + (dev_off / 32) * 4) = 1 << (31 - (dev_off % 32)).

Offset	Description
0x0000	revision0. ex:0x80000115
0x0004	Unknown - SKBL prints L2 Cache is defective if bit 0x2 is set
0x0110	SDIF related
0x0114	SDIF related
0x0118	SDIF related
0x011C	SDIF related
0x0124	SDIF voltage control? - 3.3V by default; 1 << sdif_idx to set the SDIF to 1.8V
0x0130	PERVASIVE_SYS_SBEATB - Pervasive Secure Bus Error Attribute
0x0134	PERVASIVE_SYS_SBEADR - Pervasive Secure Bus Error Address
0x0138	PERVASIVE_SYS_BEATB - Pervasive Bus Error Attribute
0x013C	PERVASIVE_SYS_BEADR - Pervasive Bus Error Address
0x0194	gc
0x0300	Unknown
0x0304	Unknown
0x0308	Unknown
0x0310	SDIF related

revision0

Returned by SceLowio#scePervasiveGetSoCRevisionForDriver, read by SKBL/NSKBL/...

Contains the Kermit revision (see sceKernelSysrootGetKermitRevisionForKernel) and other information.

Bit mask	Information
0x80000000	Disable LPDDR2SUB. If set, it is not a DevKit.
0x20000000	Enable 4 LPDDR2 banks (used by SceCrashDump). Default is 2 LPPDR2 banks.
0x10000000	Enable 1 LPDDR2 bank (used by SceCrashDump). Default is 2 LPPDR2 banks.
0x0001FFFF	Kermit revision

Kermit revision

Bit mask	Information
0x0001FF00	Kermit new revision (new firmwares) (known values: 0 for KERMIT10_REV_ES4, 1 for KERMIT15_REV_ES1)
0x000000F0	Kermit major revision (old firmwares): Engineering Sample revision (1 = ES1, 2 = ES2, etc.)
0x0000000F	Kermit minor revision (old firmwares)

Known values

Hardware	Value
ES2.0 (according to System Software version 0.920)	0x0000002X
CXD5315GG-1	0x00000042
CXD5315GG	0x80000042
CXD5316GG	0x80000115
CXD5316BGG	0x94000115

ScePervasiveReset (0xE3101000)

Devices must be put out of reset (device reset disabled) before they are first used.

To enable reset of a device (put a device in reset), do *REG32(0xE3101000 + dev_off) |= mask.

To disable reset of a device (put a device out of reset), do *REG32(0xE3101000 + dev_off) &= ~mask.

dev_off	Access	Device	Reset Mask	Comment
0x4	Secure?	ARM Debugger?	1	Of ARM coprocessor 14?
0x10	Non-secure	GPU	1	enable: ScePervasiveForDriver_3E79D3D3/disable: ScePervasiveForDriver_8A85E36B
0x20	Secure	?	1	enable: ScePervasiveForDriver_377126CD/disable: ScePervasiveForDriver_6E11EB97
0x24	Secure	?	1	enable: ScePervasiveForDriver_7B0F388B/disable: ScePervasiveForDriver_4CCD40E6
0x28	Secure	CompatRAM	1	enable: ScePervasiveForDriver_7C285361/disable: ScePervasiveForDriver_E40BED0F
0x30	Non-secure	Venezia	1	enable: ScePervasiveForDriver_28731EC5/disable: ScePervasiveForDriver_A7E64C6F
0x34	Non-secure	Vip	1	enable: ScePervasiveForDriver_31C0A98B/disable: ScePervasiveForDriver_E2D8F6C3
0x40	Secure	SDIO0	1
0x44	Secure	SDIO1	1
0x48	Secure	DebugPA	1
0x4C	Secure	SceDbgSdio	1
0x50	Secure	DMAC0	1
0x54	Secure	DMAC1	1
0x58	Secure	DMAC2	1
0x5C	Secure	DMAC3	1
0x60	Secure	DMAC4	1
0x64	Secure	DMAC5	1
0x68	Secure	DMAC6	1	need devmode or dipsw 0xC0 or 0xC1 or 0xC2.
0x70	Non-secure	Csi	1	Camera Serial Interface
0x74
0x80	Non-secure	Dsi	1
0x84
0x88	Non-secure	Iftu	1	Integrated Facility Terminating Unit. See IFTU Registers. enable: ScePervasiveForDriver_B68254AD/disable: ScePervasiveForDriver_E92E28FF
0x8C	Non-secure	?	1	enable: ScePervasiveForDriver_7AE2F8E8/disable: ScePervasiveForDriver_17109C28
0x90	Non-secure	USB0/UDC0	0xB	See UDC. enable: ScePervasiveForDriver_4AF7A01E/disable: ScePervasiveForDriver_13CC07C9 0x1 - USB Host Controller 0x2 - USB Device Controller 0x8 - ????
0x94		USB1/UDC1
0x98		USB2/UDC2
0xA0	Non-secure	Sdif0 (emmc)	1	Storage Device InterFace
0xA4		Sdif1 (gcsd)
0xA8		Sdif2
0xAC		Sdif3
0xB0	Non-secure	Msif	1	Memory Stick InterFace. See MSIF Registers.
0xC0	Non-secure	I2S (Audio)	1	Inter-IC Sound
0xC4
0xC8
0xCC
0xD0
0xD4
0xD8
0xDC
0xE0	Non-secure	SrcMix	1	Source Mixer
0xE4
0xE8
0xF0	Non-secure	SPDIF (Audio)	1	Sony/Philips Digital InterFace
0x100	Non-secure	Gpio	1	General Purpose Input/Output. See GPIO Registers.
0x104	Non-secure	Spi (Syscon)	1	Serial Peripheral Interface. See SPI Registers.
0x108		Spi (Motion)
0x10C		Spi (OLED)
0x110	Non-secure	I2C	1	Inter-Integrated Circuit. See I2C Registers.
0x114
0x120	Non-secure	Uart0 (Console)	1	Universal Asynchronous Receiver Transmitter. See UART Registers.
0x124		Uart1
0x128		Uart2
0x12C		Uart3
0x130		Uart4
0x134		Uart5 (3G Modem)
0x138		Uart6
0x154	Secure?	Debug Bus	1	Taken out of reset by SKBL if Development mode or DIPsw 0xC0/0xC1/0xC2 is set
0x158	Secure?	?	1
0x160	Secure?	LPDDR2MAIN (DDRIF0)	1
0x164	Secure?	LPDDR2SUB (DDRIF1)	1
0x170	?	Timer	1?
0x178	Secure?	SPM32	4	Scratch Pad Memory 32KiB
		SPM128	8	Scratch Pad Memory 128KiB
0x17C	Secure?	Venezia?	1?	Must be != 0 for SceKernelBusError to dump Venezia registers.
0x180	Secure	VIP?	1	Must be != 0 for SceKernelBusError to dump VIP registers. enable: ScePervasiveForDriver_EBE9C84E/disable: ScePervasiveForDriver_8CF567AD
0x190	Secure	bigmac or emmc cryptor	?	x

ScePervasiveGate (0xE3102000)

Devices can be clock gated to preserve battery.

To enable clock gate (request the clock of a device to be enabled), do *REG32(0xE3102000 + dev_off) |= mask.

To disable clock gate (request the clock of a device to be disabled), do *REG32(0xE3102000 + dev_off) &= ~mask.

dev_off	Access	Device	Gate Mask	Comment
0x0	Secure?	?	?
0x4	Secure?	ARM Debugger?	1	Of ARM coprocessor 14?
0x10	Non-secure	GPU	v & 0xF000F	enable: ScePervasiveForDriver_39E51AE2/disable: ScePervasiveForDriver_CA0ACFC5
0x20	Secure	?	1	enable: ScePervasiveForDriver_8EE3AEDF/disable: ScePervasiveForDriver_3BF2A9B5
0x24	Secure	?	1	enable: ScePervasiveForDriver_7F4AB4AA/disable: ScePervasiveForDriver_0EBBE8DE
0x28	Secure	CompatRAM (2MiB)	1	enable: ScePervasiveForDriver_B2EE45C9/disable: ScePervasiveForDriver_39979C55
0x30	Non-secure	Venezia	1 (2 for secure)	enable: ScePervasiveForDriver_FB01A2DD/disable: ScePervasiveForDriver_2EEBE9AE
0x34	Non-secure	Vip	1	enable: ScePervasiveForDriver_B1CFA18F/disable: ScePervasiveForDriver_03E1FAA6
0x40	Secure	SceDbgSdio	1
0x44	Secure	SceDbgSdio	1
0x48	Secure	DebugPA	1 (also has 2?)
0x4C	Secure	SceDbgSdio	1
0x50	Secure	DMAC0	1
0x54	Secure	DMAC1	1
0x58	Secure	DMAC2	1
0x5C	Secure	DMAC3	1
0x60	Secure	DMAC4	1
0x64	Secure	DMAC5	1
0x68	Secure	DMAC6	1	need devmode or dipsw 0xC0 or 0xC1 or 0xC2.
0x70	Non-secure	Csi	1	Camera Serial Interface
0x74
0x80	Non-secure	Dsi	1
0x84
0x88	Non-secure	Iftu	1	Integrated Facility Terminating Unit. See IFTU Registers. enable: ScePervasiveForDriver_07F2A738/disable: ScePervasiveForDriver_5AFE0AF0
0x8C	Non-secure	?	1	enable: ScePervasiveForDriver_C0C842FE/disable: ScePervasiveForDriver_9BB7B932
0x90	Non-secure	USB0/UDC0	0xB	See UDC. enable: ScePervasiveForDriver_A2EFD7AF/disable: ScePervasiveForDriver_AD1E81EB 0x1 - USB Host Controller 0x2 - USB Device Controller 0x8 - ????
0x94		USB1/UDC1
0x98		USB2/UDC2
0xA0	Non-secure	Sdif0 (emmc)	1	Storage Device InterFace
0xA4		Sdif1 (gcsd)
0xA8		Sdif2
0xAC		Sdif3
0xB0	Non-secure	Msif	1	Memory Stick InterFace. See MSIF Registers.
0xC0	Non-secure	I2S (Audio)	1	Inter-IC Sound
0xC4
0xC8
0xCC
0xD0
0xD4
0xD8
0xDC
0xE0	Non-secure	SrcMix	1	Source Mixer
0xE4
0xE8
0xF0	Non-secure	SPDIF (Audio)	1	Sony/Philips Digital InterFace
0x100	Non-secure	Gpio	1	General Purpose Input/Output. See GPIO Registers.
0x104	Non-secure	Spi (Syscon)	1	Serial Peripheral Interface. See SPI Registers.
0x108		Spi (Motion)
0x10C		Spi (OLED)
0x110	Non-secure	I2C	1	Inter-Integrated Circuit. See I2C Registers.
0x114
0x120	Non-secure	Uart0 (Console)	1	Universal Asynchronous Receiver Transmitter. See UART Registers.
0x124		Uart1
0x128		Uart2
0x12C		Uart3
0x130		Uart4
0x134		Uart5 (3G Modem)
0x138		Uart6
0x154	Secure?	Debug Bus	1	See ScePervasiveReset for details.
0x158	Secure?	?	1
0x160	Secure?	LPDDR2MAIN (DDRIF0)	1
0x164	Secure?	LPDDR2SUB (DDRIF1)	1
0x170	?	Timer	1?
0x178	Secure?	SPM32	4	Scratch Pad Memory 32KiB
		SPM128	8	Scratch Pad Memory 128KiB

ScePervasiveVid (0xE3104000)

Voltage integer data

Offset	Group	Value
0x0	ARM	0
0x4	ARM	0x1F
0x8	ARM	0x27
0xC	ARM	0x2F
0x10	ARM	0x31
0x14	ARM	0x31
0x40	?	0x1D
0x44	?	0x22
0x48	?	0x2E
0x4C	?	0x25
0x60	?	0x1D
0x64	?	0x27
0x68	?	0x2E
0x6C	?	0x30
0xA0	Bus	0
0xA4	Bus	0x1E
0xA8	Bus	0x27
0xAC	Bus	0x2E

Base Clock

Registers at physical address 0xE3103000 (ScePervasiveBaseClk).

Offset	Accessibly	Description
0x0/0x4	Non-Secure/Secure	ARM Clocks
0x10	Non-Secure/Secure	GPU Clock
0x20	Non-Secure/Secure (?)	VENEZIA Clock
0x30	Non-Secure	Vip Clock
0x40	Secure	CMeP Clock
0x44	Non-Secure	CameraBus Clock
0x50	Secure	Could be Center Xbar/Bus clock
0x60	Non-Secure	Related to offset 0x60/0x64/0xA4.
0x64	Non-Secure	Related to offset 0x60/0x64/0xA4.
0x68	Non-Secure	Unknown. freq setting by ScePervasiveForDriver_A96642E3
0x70	Non-Secure	Related to Audio. freq setting by ScePervasiveForDriver_925D9D24
0x90	Secure	DRAM Main Clock
0x94	Secure	DRAM Sub Clock
0xA4	Non-Secure	Related to offset 0x60/0x64/0xA4.
0xB0	Non-Secure	Msif Clock
0xC4	Secure	Compat/GpuXbar Clock (PSP stuff)
0x100	Non-Secure	DSI1 Clock
0x180	Non-Secure	DSI0 Clock
0x1D0	Non-Secure	HDMI Clock
0x1F0	Non-Secure	Dmac5 Clock
0x210	Non-Secure	Related to Audio. freq setting by ScePervasiveForDriver_2FB5F88F
0x214	Non-Secure	Sys Clock

ARM Clocks

The ARM core clock and L2 cache clock consist of two registers 0xE3103000 and 0xE3103004.

Register 0xE3103000 selects the base clock frequency.

It seems that 42-freq is selected internally when Undefined index is selected

0xE3103000 ARM clock list

Index	ARM core freq	L2 cache freq
0	Undefined	Undefined
1	42	42
2	Undefined	Undefined
3	83	83
4	111	111
5	166	166
6	222	222
7	333	333
8	444	222
9	500	250
10	333	166
11	Undefined	Undefined
12	125	125
13	250	250
14	444	444
15	500	500

Register 0xE3103004 adjusts the selected base clock frequency.

0xE3103004 sets the index that adjusts the base clock frequency.

It seems that the adjustment can be expressed by the following formula.

f(n) = n(1 - adjust_index / 16)

adjust_index ranges from 0 to 8. Selecting 9 or higher selects 0 internally.

Also a joke-like approximation : f(n) = n(1 - aπ^-(1 + √2)).

However, not sure if this formula is completely correct, but It can see that it is very close to the value of yifan's clock analyzer.

ARM core measured adjust freq

base	0	1	2	3	4	5	6	7	8
1	41.666 MHz	39.62 MHz	36.458 MHz	33.854 MHz	31.249 MHz	28.645 MHz	26.41 MHz	23.437 MHz	20.833 MHz
3	83.333 MHz	78.124 MHz	72.916 MHz	67.708 MHz	62.499 MHz	57.291 MHz	52.83 MHz	46.874 MHz	41.666 MHz
4	111.111 MHz	104.166 MHz	97.222 MHz	90.277 MHz	83.333 MHz	76.388 MHz	69.444 MHz	62.499 MHz	55.555 MHz
5	166.666 MHz	156.249 MHz	145.833 MHz	135.416 MHz	124.999 MHz	114.583 MHz	104.166 MHz	93.749 MHz	83.333 MHz
6	222.222 MHz	208.333 MHz	194.444 MHz	180.555 MHz	166.666 MHz	152.777 MHz	138.888 MHz	124.999 MHz	111.111 MHz
7	333.333 MHz	312.499 MHz	291.666 MHz	270.833 MHz	249.999 MHz	229.166 MHz	208.333 MHz	187.499 MHz	166.666 MHz
8	444.444 MHz	416.666 MHz	388.888 MHz	361.111 MHz	333.333 MHz	305.555 MHz	277.777 MHz	249.999 MHz	222.222 MHz
9	500.0 MHz	468.749 MHz	437.499 MHz	406.249 MHz	374.999 MHz	343.749 MHz	312.499 MHz	281.249 MHz	249.999 MHz
10	333.333 MHz	312.499 MHz	291.666 MHz	270.833 MHz	249.999 MHz	229.166 MHz	208.333 MHz	187.499 MHz	166.666 MHz
12	124.999 MHz	117.187 MHz	109.374 MHz	101.562 MHz	93.749 MHz	85.937 MHz	78.124 MHz	70.312 MHz	62.499 MHz
13	249.999 MHz	234.374 MHz	218.749 MHz	203.124 MHz	187.499 MHz	171.874 MHz	156.249 MHz	140.624 MHz	124.999 MHz
14	444.444 MHz	416.666 MHz	388.888 MHz	361.111 MHz	333.333 MHz	305.555 MHz	277.777 MHz	249.999 MHz	222.222 MHz
15	500.0 MHz	468.749 MHz	437.499 MHz	406.249 MHz	374.999 MHz	343.749 MHz	312.499 MHz	281.249 MHz	249.999 MHz

ARM Clocks (by yifan's clock analyzer)

The ARM CPU clocks are controlled by two registers at physical address 0xE3103000 (ScePervasiveBaseClk). Currently, it is unknown how the values are interpreted. However, 0xE3103000 (one word) takes values 0 to 16, and increases clock speed while 0xE3103004 (single byte) takes values 0 to 8 and decreases clock speed. It is likely related to a PLL multiply and divide function. The input clock signal comes from a P1P40167 clock synthesizer (found on the bottom of the board under the main SoC). It takes a 27MHz crystal and generates a 37MHz clock which feeds directly into the SoC's internal PLL.

The following are tests run to determine what the values of each register corresponds to. It appears that the maximum clock speed is 499MHz and the minimum clock speed is 16MHz.

These clocks may be wrong. "Kernel Clock Speed" is "Clock Speed + 5". However, there is an error of ± 5 to 6 in "Clock Speed".

0xE3103000	0xE3103004	Clock Speed (MHz)	Kernel Clock Speed (MHz)
0	0	37	42
0	1	35	40
0	2	32	37
0	3	29	34
0	4	27	32
0	5	24	29
0	6	22	27
0	7	19	24
0	8	16	21
1	0	37	42
1	1	35	40
1	2	32	37
1	3	30	35
1	4	27	32
1	5	24	29
1	6	22	27
1	7	19	24
1	8	16	21
2	0	37	42
2	1	35	40
2	2	32	37
2	3	30	35
2	4	27	32
2	5	24	29
2	6	22	27
2	7	19	24
2	8	16	21
3	0	79	84
3	1	74	79
3	2	69	74
3	3	63	68
3	4	58	63
3	5	53	58
3	6	48	53
3	7	43	48
3	8	37	42
4	0	107	112
4	1	100	105
4	2	93	98
4	3	86	91
4	4	79	84
4	5	72	77
4	6	65	70
4	7	58	63
4	8	51	56
5	0	162	167
5	1	152	157
5	2	142	147
5	3	131	136
5	4	121	126
5	5	110	115
5	6	100	105
5	7	90	95
5	8	79	84
6	0	218	223
6	1	204	209
6	2	190	195
6	3	176	181
6	4	163	168
6	5	148	153
6	6	135	140
6	7	121	126
6	8	107	112
7	0	329	334
7	1	308	313
7	2	287	292
7	3	266	271
7	4	246	251
7	5	225	230
7	6	204	209
7	7	183	188
7	8	162	167
8	0	439	444
8	1	411	416
8	2	384	389
8	3	356	361
8	4	329	334
8	5	301	306
8	6	273	278
8	7	246	251
8	8	218	223
9	0	494	499
9	1	463	468
9	2	432	437
9	3	401	406
9	4	370	375
9	5	339	344
9	6	308	313
9	7	277	282
9	8	245	250
10	0	328	333
10	1	308	313
10	2	287	292
10	3	266	271
10	4	245	250
10	5	225	230
10	6	204	209
10	7	183	188
10	8	162	167
11	0	37	42
11	1	35	40
11	2	32	37
11	3	30	35
11	4	27	32
11	5	24	29
11	6	22	27
11	7	19	24
11	8	16	21
12	0	121	126
12	1	113	118
12	2	105	110
12	3	97	102
12	4	90	95
12	5	82	87
12	6	74	79
12	7	66	71
12	8	58	63
13	0	245	250
13	1	230	235
13	2	214	219
13	3	199	204
13	4	183	188
13	5	168	173
13	6	152	157
13	7	136	141
13	8	121	126
14	0	439	444
14	1	412	417
14	2	384	389
14	3	356	361
14	4	329	334
14	5	301	306
14	6	273	278
14	7	246	251
14	8	218	223
15	0	494	499
15	1	463	468
15	2	433	438
15	3	401	406
15	4	370	375
15	5	339	344
15	6	308	313
15	7	277	282
15	8	245	250
16	0	37	42
16	1	35	40
16	2	32	37
16	3	29	34
16	4	27	32
16	5	24	29
16	6	22	27
16	7	19	24
16	8	16	21

VENEZIA Clock

The register at physical address 0xE3103020 seems to control the clock frequency of VENEZIA.

Allowed register values

Value	Clock speed
0x1	41MHz
0x2	55MHz
0x3	83MHz
0x4	111MHz
0x5	166MHz
0x6	222MHz
0x7	333MHz

Vip Clock

Allowed register values

Value	Clock speed
0x1	41MHz
0x2	55MHz
0x3	83MHz
0x4	111MHz
0x5	166MHz
0x6	222MHz

CMeP Clock

The low 8 bits of the register at physical address 0xE3103040 control CMeP clock speed, and Main Xbar, I/O Bus speed too. This was guessed because it is used in a usleep()-like function to calculate the input for a sleep_for_cycles() function.

Testing was performed using SceLT5 as a time reference (µs-accurate), and compared against the hardcoded table in second_loader.

Value	Main Xbar	I/O Bus	CMeP speed (measured)	Table value
0x0	Unknown	Unknown	41.5 MHz	N/A
0x1	Unknown	Unknown	41.5 MHz
0x2	Unknown	Unknown	55.4 MHz
0x3	Unknown	Unknown	83.0 MHz
0x4	Unknown	Unknown	110.7 MHz
0x5	Unknown	Unknown	166.0 MHz
0x6	Unknown	Unknown	110.7 MHz
0x7	Unknown	Unknown	166.0 MHz
0x10000	Undefined	Undefined	27.7 MHz	50 MHz
0x10001	Undefined	Undefined	27.7 MHz	50 MHz
0x10002	56 MHz	27 MHz	27.7 MHz	27 MHz
0x10003	83 MHz	42 MHz	41.5 MHz	42 MHz
0x10004	111 MHz	56 MHz	55.3 MHz	56 MHz
0x10005	166 MHz	83 MHz	83.0 MHz	83 MHz
0x10006	222 MHz	111 MHz	110.7 MHz	111 MHz
0x10007	333 MHz	166 MHz	166.0 MHz	160 MHz

second_loader sets the register to 0x10005, meaning CMeP usually runs at 83MHz.

CameraBus Clock

Allowed register values

Value	Clock speed
1	41 MHz
2	67 MHz
3	83 MHz
4	133 MHz
5	166 MHz

DRAM Main Clock

Allowed register values

Value	Clock speed (measured)
1	170 MHz

DRAM Sub Clock

Allowed register values

Value	Clock speed (measured)
1	170 MHz

Msif Clock

Allowed register values

Value	Clock speed
0x10000	20 MHz
0x10001	40 MHz
0x10002	60 MHz

Bit 0x10000 is optional i.e by default Msif runs at 20 MHz. Its effect is unknown.

Compat/GpuXbar Clock

Allowed register values

Value	Compat Clock speed	GpuXbar Clock speed
0	333 MHz	166 MHz
1	Unknown	111 MHz
2	222 MHz	83 MHz

Dmac5 Clock

Allowed register values

Value	Clock speed
1	41 MHz
2	83 MHz
3	133 MHz
4	166 MHz

Sys Clock

Allowed register values

Value	Clock speed
0	222 MHz
1	190 MHz

ScePervasive2 (0xE3110000)

Offset	Description
0x248	VIP_PROT_BAP_ERRV
0x24C	VIP_PROT_BAP_ERRC
0x250	VIP_PROT_BAP_ERRA
0x254	VIP_PROT_VDPD_ERRV
0x258	VIP_PROT_VDPD_ERRC
0x25C	VIP_PROT_VDPD_ERRA
0x260	VIP_PROT_VDPM_ERRV
0x264	VIP_PROT_VDPM_ERRC
0x268	VIP_PROT_VDPM_ERRA
0x348	VENE_PROT_REG_ERRV
0x34C	VENE_PROT_REG_ERRC
0x350	VENE_PROT_REG_ERRA
0xC00	0x0 alias for ARM (0 / 1) = (0x1f000000 / 0x40000000)
0xD04	SPM128 Bus Error Address register
0xD08	SPM128 Bus Error Attribute register
0xD14	SPM32 Bus Error Address register
0xD18	SPM32 Bus Error Attribute register
0xD24	CompatRAM Bus Error Address register
0xD28	CompatRAM Bus Error Attribute register
0xD34	Pervasive2 Bus Error Address register - maybe PERVASIVE2_SYS_BEADR
0xD38	Pervasive2 Bus Error Attribute register - maybe PERVASIVE2_SYS_BEATB
0xD44	SPM128 Secure Bus Error Address register
0xD48	SPM128 Secure Bus Error Attribute register
0xD54	SPM32 Secure Bus Error Address register
0xD58	SPM32 Secure Bus Error Attribute register
0xD64	CompatRAM Secure Bus Error Address register
0xD68	CompatRAM Secure Bus Error Attribute register
0xD74	Pervasive2 Secure Bus Error Address register - maybe PERVASIVE2_SYS_SBEADR
0xD78	Pervasive2 Secure Bus Error Attribute register - maybe PERVASIVE2_SYS_SBEATB
0xD80	BET0 (Bus Error Target 0) - full name may be PERVASIVE2_SYS_BET0
0xD90	BET1 (Bus Error Target 1) - full name may be PERVASIVE2_SYS_BET1
0xD94	PERVASIVE2_SYS_BEBT - Bus Error ?Bus Target?
0xDC0	SBET0 (Secure Bus Error Target 0) - full name may be PERVASIVE2_SYS_SBET0
0xDD0	SBET1 (Secure Bus Error Target 1) - full name may be PERVASIVE2_SYS_SBET1
0xDD4	PERVASIVE2_SYS_SBEBT - Secure Bus Error ?Bus Target?
0xF30	USB PHY ready state - Bit 0 = Port 0, Bit 1 = Port 1, Bit 2 = Port 2
0xF34	USB PHY interrupt state - Bit 0 = Port 0, Bit 1 = Port 1, Bit 2 = Port 2
0xF40	Bit 0 = Memory Card insert state
0xF44	Memory Card insert interrupt state - Bit 0 = Card removed, Bit 1 = Card inserted
0xF50	USB VBUS state - Bit 0 = Port 0, Bit 1 = Port 1, Bit 2 = Port 2
0xF54	USB VBUS interrupt state