Physical Memory: Difference between revisions

From Vita Development Wiki
Jump to navigation Jump to search
No edit summary
 
(28 intermediate revisions by 5 users not shown)
Line 1: Line 1:
== Main table ==
== Main table ==


{| class='sortable wikitable mw-collapsible mw-collapsed'
<div class="toccolours mw-collapsible mw-collapsed">
<div style="font-weight:bold;line-height:1.6;">List sorted by group</div>
<div class="mw-collapsible-content">
{| class='sortable wikitable mw-collapsible'
|+Top Group
|+Top Group
! Address
! Address
Line 268: Line 271:
|}
|}


{| class='sortable wikitable mw-collapsible mw-collapsed'
{| class='sortable wikitable mw-collapsible'
|+Main Xbar
|+Main Xbar
! Address
! Address
Line 316: Line 319:
|}
|}


{| class='sortable wikitable mw-collapsible mw-collapsed'
{| class='sortable wikitable mw-collapsible'
|+Center Xbar
|+Center Xbar
! Address
! Address
Line 367: Line 370:
|}
|}


{| class='sortable wikitable mw-collapsible mw-collapsed'
{| class='sortable wikitable mw-collapsible'
|+Video Xbar
|+Video Xbar
! Address
! Address
Line 424: Line 427:
|}
|}


{| class='sortable wikitable mw-collapsible mw-collapsed'
{| class='sortable wikitable mw-collapsible'
|+IFTU Xbar
|+IFTU Xbar
! Address
! Address
Line 454: Line 457:
|}
|}


{| class='sortable wikitable mw-collapsible mw-collapsed'
{| class='sortable wikitable mw-collapsible'
|+VIP Xbar
|+VIP Xbar
! Address
! Address
Line 490: Line 493:
|}
|}


{| class='sortable wikitable mw-collapsible mw-collapsed'
{| class='sortable wikitable mw-collapsible'
|+Debug Bus
|+Debug Bus
! Address
! Address
Line 517: Line 520:
|}
|}


{| class='sortable wikitable mw-collapsible mw-collapsed'
{| class='sortable wikitable mw-collapsible'
|+DMAC Xbar
|+DMAC Xbar
! Address
! Address
Line 544: Line 547:
|}
|}


{| class='sortable wikitable mw-collapsible mw-collapsed'
{| class='sortable wikitable mw-collapsible'
|+IO Slave Bus
|+IO Slave Bus
! Address
! Address
Line 580: Line 583:
|}
|}


{| class='sortable wikitable mw-collapsible mw-collapsed'
{| class='sortable wikitable mw-collapsible'
|+IO Master Bus
|+IO Master Bus
! Address
! Address
Line 601: Line 604:
|}
|}


{| class='sortable wikitable mw-collapsible mw-collapsed'
{| class='sortable wikitable mw-collapsible'
|+Pervasive Bus
|+Pervasive Bus
! Address
! Address
Line 625: Line 628:
|}
|}


{| class='sortable wikitable mw-collapsible mw-collapsed'
{| class='sortable wikitable mw-collapsible'
|+Misc IO Bus
|+Misc IO Bus
! Address
! Address
Line 664: Line 667:
|}
|}


{| class='sortable wikitable mw-collapsible mw-collapsed'
{| class='sortable wikitable mw-collapsible'
|+North IO Master Bus
|+North IO Master Bus
! Address
! Address
Line 703: Line 706:
|}
|}


{| class='sortable wikitable mw-collapsible mw-collapsed'
{| class='sortable wikitable mw-collapsible'
|+Audio Bus
|+Audio Bus
! Address
! Address
Line 736: Line 739:
|}
|}


{| class='sortable wikitable mw-collapsible mw-collapsed'
{| class='sortable wikitable mw-collapsible'
|+North IO Slave Bus
|+North IO Slave Bus
! Address
! Address
Line 769: Line 772:
|}
|}


{| class='sortable wikitable mw-collapsible mw-collapsed'
{| class='sortable wikitable mw-collapsible'
|+SRC Bus
|+SRC Bus
! Address
! Address
Line 787: Line 790:
|}
|}


{| class='sortable wikitable mw-collapsible mw-collapsed'
{| class='sortable wikitable mw-collapsible'
|+GPU Register Bus
|+GPU Register Bus
! Address
! Address
Line 823: Line 826:
|}
|}


{| class='sortable wikitable mw-collapsible mw-collapsed'
{| class='sortable wikitable mw-collapsible'
|+IFTU Register Bus
|+IFTU Register Bus
! Address
! Address
Line 850: Line 853:
|}
|}


{| class='sortable wikitable mw-collapsible mw-collapsed'
{| class='sortable wikitable mw-collapsible'
|+Camera Slave Bus
|+Camera Slave Bus
! Address
! Address
Line 883: Line 886:
|}
|}


{| class='sortable wikitable mw-collapsible mw-collapsed'
{| class='sortable wikitable mw-collapsible'
|+Camera Master Bus
|+Camera Master Bus
! Address
! Address
Line 910: Line 913:
|}
|}


{| class='sortable wikitable mw-collapsible mw-collapsed'
{| class='sortable wikitable mw-collapsible'
|+USB Slave Bus
|+USB Slave Bus
! Address
! Address
Line 940: Line 943:
|}
|}


{| class='sortable wikitable mw-collapsible mw-collapsed'
{| class='sortable wikitable mw-collapsible'
|+USB Master Bus
|+USB Master Bus
! Address
! Address
Line 979: Line 982:
|}
|}


{| class='sortable wikitable mw-collapsible mw-collapsed'
{| class='sortable wikitable mw-collapsible'
|+SubLCD Slave Bus
|+SubLCD Slave Bus
! Address
! Address
Line 1,012: Line 1,015:
|}
|}


{| class='sortable wikitable mw-collapsible mw-collapsed'
{| class='sortable wikitable mw-collapsible'
|+SubLCD Master Bus
|+SubLCD Master Bus
! Address
! Address
Line 1,033: Line 1,036:
|}
|}


{| class='sortable wikitable mw-collapsible mw-collapsed'
{| class='sortable wikitable mw-collapsible'
|+Camera Register Bus
|+Camera Register Bus
! Address
! Address
Line 1,053: Line 1,056:
| SSX_CameraRegBus_TA_CSI1
| SSX_CameraRegBus_TA_CSI1
|}
|}
</div></div>


{| class='wikitable mw-collapsible'
{| class='wikitable mw-collapsible'
Line 1,062: Line 1,066:
|-
|-
| 0x00000000
| 0x00000000
| 0x00007FFF
| 0x0003FFFF
| 0x8000
| 0x40000
| NS/S
| NS/S
| ARM Boot. Alias of physical address <code>0x1F000000</code> i.e. [[ScePower]] scratchpad.
| ARM Boot. By default, alias of physical address <code>0x1F000000</code> i.e. [[ScePower]] scratchpad.
Can be remapped.
|-
|-
| 0x00040000
| 0x00040000
Line 1,101: Line 1,106:
| 0x150000
| 0x150000
| S
| S
| Reverved for [[Venezia]]
| Reserved for [[Venezia]]
|-
|-
| 0x00600000
| 0x00600000
Line 1,113: Line 1,118:
| 0x20000
| 0x20000
| S
| S
| cmep 128KiB SRAM. [[Second_Loader|second_loader]], [[Secure_Kernel|secure kernel]], [[Sm_modules|sm location]].
| Cmep 128KiB SRAM. Stores [[Second_Loader|second_loader]], [[Secure_Kernel|secure_kernel]] and [[Secure_Modules|Secure Modules]].
|-
|-
| 0x1A000000
| 0x1A000000
Line 1,131: Line 1,136:
| 0x200000
| 0x200000
| NS/S
| NS/S
| Compatibility SRAM. SRAM used by [[SKBL]] to store [[ARZL]] decoded [[SceSysmem]], [[SceDisplay]] / [[SceCamera]] SRAM (only 960x544 pixels * 4 bytes = 0x1FE000 bytes mapped), PspEmu Tachyon-eDRAM.
| SRAM. SRAM used to store [[First Loader]] loaded from boot ROM storage, [[CMeP]] exception vectors and raw [[SLSK]] loaded from [[eMMC]] or SD/GCSD by [[First Loader]], [[ARZL]] decoded [[SceSysmem]] by [[SKBL]], [[SceDisplay]] / [[SceCamera]] SRAM (only 960x544 pixels * 4 bytes = 0x1FE000 bytes mapped), Compatibility SRAM for PspEmu (Tachyon-eDRAM), SceKernelBsodSram for [[SceKernelBlueScreenOfDeath]]. Cleared with zeroes on soft reset.
|-
| 0x1D000000
| 0x1D000FFF
| 0x1000
| ?
| <code>/dev/null</code> - memory that reads as zero and ignores writes. Used by [[SceMsif]].
|-
| 0x1D001000
| 0x1D001FFF
| 0x1000
| ?
| <code>/dev/null (E)</code> - does not exist on Kermit ES4 (Address Space Hole)
|-
|-
| 0x1F000000
| 0x1F000000
Line 1,152: Line 1,169:
|-
|-
| 0x30000000
| 0x30000000
| ?
| ?0x3FFFFFFF?
| ?
| ?0x10000000?
| S
| S
| Unknown. Used by first_loader (proto:0x5C398) and [[second_loader]] (3.60:0x808208)
| Unknown secure area used by Cmep. Used by [[First_Loader|first_loader]] (prototype:0x5C398) and [[Second_Loader|second_loader]] (3.600.011:0x808208).
|-
|-
| 0x40000000
| 0x40000000
Line 1,195: Line 1,212:
| 0x1000
| 0x1000
| NS
| NS
| SceDmacmgrDmac4Reg
| [[DMAC#DMAC4|SceDmacmgrDmac4Reg]]
|-
|-
| 0xE0410000
| 0xE0410000
Line 1,201: Line 1,218:
| 0x1000
| 0x1000
| NS
| NS
| [[Dmac5|SceDmacmgrDmac5Reg]]
| [[DMAC#DMAC5|SceDmacmgrDmac5Reg]]
|-
|-
| 0xE0420000
| 0xE0420000
Line 1,279: Line 1,296:
| 0x1000
| 0x1000
| NS/S
| NS/S
| [[Dmac5#0xE04E0000:_SceDmacmgrKeyringReg|SceDmacmgrKeyringReg]], SceSblDMAC5DmacKRBase, DMAC Register base
| [[DMAC#DMAC5_Key_Ring|SceDmacmgrKeyringReg]], SceSblDMAC5DmacKRBase, DMAC Register base
|-
|-
| 0xE0500000
| 0xE0500000
Line 1,319: Line 1,336:
| 0xE0B00000
| 0xE0B00000
| 0xE0B00FFF
| 0xE0B00FFF
| 0x1000
| 0x10000
| NS
| NS
| SceSdif0
| [[SDIF_Registers|SceSdif0]]
|-
|-
| 0xE0C00000
| 0xE0C00000
| 0xE0C00FFF
| 0xE0C00FFF
| 0x1000
| 0x10000
| NS
| NS
| SceSdif1
| [[SDIF_Registers|SceSdif1]]
|-
|-
| 0xE0C10000
| 0xE0C10000
| 0xE0C10FFF
| 0xE0C10FFF
| 0x1000
| 0x10000
| NS
| NS
| SceSdif2
| [[SDIF_Registers|SceSdif2]]
|-
|-
| 0xE0C20000
| 0xE0C20000
Line 1,339: Line 1,356:
| ?
| ?
| ?
| ?
| SceSdif3 (not present on FW 1.69, does FW 3.60 use only NSKBL?)
| [[SDIF_Registers|SceSdif3]] (not present on FW 1.69, does FW 3.60 use only NSKBL?)
|-
|-
| 0xE2030000
| 0xE2030000
Line 1,352: Line 1,369:
| NS/S
| NS/S
| [[GPIO_Registers|SceGpio0Reg / SceLedReg]]
| [[GPIO_Registers|SceGpio0Reg / SceLedReg]]
|-
| 0xE20B0000
| 0xE20B0FFF
| 0x1000
| NS
| [[Hardware Timers#Global Timer|Global Timer]]
|-
|-
| 0xE20B1000
| 0xE20B1000
Line 1,363: Line 1,386:
| 0x1000
| 0x1000
| NS
| NS
| SceLT5, Clock in usec (part of [[Hardware Timers|SceLongRangeTimerReg]])
| SceLT5 - holds System Time in usec (part of [[Hardware Timers|SceLongRangeTimerReg]])
|-
|-
| 0xE20B7000
| 0xE20B7000
Line 1,374: Line 1,397:
| 0xE20BEFFF
| 0xE20BEFFF
| 0x1000
| 0x1000
| S?
| NS/S
| SceTimerForUsleep (part of [[Hardware Timers|SceWordTimerReg]])
| SceTimerForUsleep (part of [[Hardware Timers|SceWordTimerReg]])
|-
| 0xE20BF000
| 0xE20BFFFF
| 0x1000
| NS/S
| [[Hardware_Timers#Bus Error Registers|Timer Bus Error Registers]]
|-
|-
| 0xE20C0000
| 0xE20C0000
Line 1,387: Line 1,416:
| 0x1000
| 0x1000
| NS
| NS
| SceDmacmgrDmac0Reg
| [[DMAC#Standard_DMACs|SceDmacmgrDmac0Reg]]
|-
|-
| 0xE3010000
| 0xE3010000
Line 1,393: Line 1,422:
| 0x1000
| 0x1000
| NS
| NS
| SceDmacmgrDmac1Reg
| [[DMAC#Standard_DMACs|SceDmacmgrDmac1Reg]]
|-
|-
| 0xE3020000
| 0xE3020000
Line 1,441: Line 1,470:
| 0x1000
| 0x1000
| NS
| NS
| [[ScePervasiveBaseClk]]
| [[Pervasive#Base_Clock|ScePervasiveBaseClk]]
|-
|-
| 0xE3104000
| 0xE3104000
Line 1,681: Line 1,710:
| 0x1000
| 0x1000
| NS
| NS
| SceDmacmgrDmac2Reg
| [[DMAC#Standard_DMACs|SceDmacmgrDmac2Reg]]
|-
|-
| 0xE5010000
| 0xE5010000
Line 1,687: Line 1,716:
| 0x1000
| 0x1000
| NS
| NS
| SceDmacmgrDmac3Reg
| [[DMAC#Standard_DMACs|SceDmacmgrDmac3Reg]]
|-
|-
| 0xE5020000
| 0xE5020000
Line 1,735: Line 1,764:
| 0x1000
| 0x1000
| NS
| NS
| SceDsi0Reg
| [[DSI_Registers|SceDsi0Reg]]
|-
|-
| 0xE5060000
| 0xE5060000
Line 1,741: Line 1,770:
| 0x1000
| 0x1000
| NS
| NS
| SceDsi1Reg
| [[DSI_Registers|SceDsi1Reg]]
|-
|-
| 0xE5070000
| 0xE5070000
Line 1,759: Line 1,788:
| 0x1000
| 0x1000
| NS
| NS
| SceDmacmgrDmac6Reg
| [[DMAC#Standard_DMACs|SceDmacmgrDmac6Reg]]
|-
|-
| 0xE50D0000
| 0xE50D0000
Line 1,792: Line 1,821:
|-
|-
| 0xE8000000
| 0xE8000000
| 0xE8001FFF
| 0xE80FFFFF
| 0x2000
| 0x1000000
| S
| S
| SceSonyRegbus. GPU Control
| [[SceSonyRegbus]]. GPU Control
|-
|-
| 0xE8100000
| 0xE8100000
Line 1,824: Line 1,853:
| ?
| ?
| ?
| ?
| ?
| NS/S
| Mapped by [[SKBL]]
| Xbar
|-
|-
| 0xED000000
| 0xED000000
| ?
| ?
| ?
| ?
| ?
| NS/S
| Mapped by [[SKBL]]
| Xbar
|-
|-
| 0xEE000000
| 0xEE000000
| ?
| ?
| ?
| ?
| ?
| NS/S
| Mapped by [[SKBL]]
| Xbar
|-
|-
| 0xF0000000
| 0xF0000000
Line 1,848: Line 1,877:
== Secure DRAM ==
== Secure DRAM ==


=== FW 0.931 Secure DRAM ===
=== System Software version 0.931.010 Secure DRAM ===


On FW 0.931, [[SKBL]] is stored at physical address <code>0x50000000</code>. So, on FW 0.931, which data are stored at <code>0x40040000</code>? Is it even considered as Secure DRAM?
On System Software version 0.931.010, [[SKBL]] is stored at physical address <code>0x50000000</code>. So, on System Software version 0.931.010, which data are stored at <code>0x40040000</code>? Is it even considered as Secure DRAM?


[[ARZL]] compressed [[NSKBL]] is kept in place inside SKBL segment 0 (at offset 0x37100) til [[ARZL]] decoding to Non-secure DRAM at physical address <code>0x51000000</code>.
[[ARZL]] compressed [[NSKBL]] is kept in place inside SKBL segment 0 (at offset 0x37100) til [[ARZL]] decoding to Non-secure DRAM at physical address <code>0x51000000</code>.
Line 1,858: Line 1,887:
On FWs 0.990-0.995, [[SKBL]] segment 0 starts at physical address <code>0x40040000</code>.
On FWs 0.990-0.995, [[SKBL]] segment 0 starts at physical address <code>0x40040000</code>.


[[ARZL]] compressed [[NSKBL]] is extracted from a kernel_boot_loader segment to Non-secure DRAM at physical address <code>0x50000000</code>. It is then [[ARZL]] decoded to Non-secure DRAM at physical address <code>0x51000000</code>.
[[ARZL]] compressed [[NSKBL]] is extracted from a [[Kernel_Boot_Loader|kernel_boot_loader]] segment to Non-secure DRAM at physical address <code>0x50000000</code>. It is then [[ARZL]] decoded to Non-secure DRAM at physical address <code>0x51000000</code>.


=== FWs >=0.996 Secure DRAM ===
=== FWs >=0.996 Secure DRAM ===
Line 1,918: Line 1,947:
! Comments
! Comments
|-
|-
| 0x40200000 on FW 3.60, 0x40300000 on FW 1.69
| 0x40200000 on FW 3.60
0x40300000 on FW 1.69
| 0x4FFFFFFF
| 0x4FFFFFFF
| 0x0FE00000 on FW 3.60, 0x0FD00000 on FW 1.69
| 0x0FE00000 on FW 3.60
0x0FD00000 on FW 1.69
| TrustZone region. ?First 0x1000 bytes are a Reset Vector named SceKernelReset whose first 0x100 bytes are identical as in uncompressed NSKBL (need to check)?
| TrustZone region. ?First 0x1000 bytes are a Reset Vector named SceKernelReset whose first 0x100 bytes are identical as in uncompressed NSKBL (need to check)?
|-
|-
Line 1,946: Line 1,977:
| 0x9FFFFFFF
| 0x9FFFFFFF
| 0x20000000
| 0x20000000
| DevKit additional 512MiB. LDDR2SUB. For perf (not published anywhere).
| DevKit additional 512MiB. LDDR2SUB. For perf (not published anywhere). This memory is mapped on usermode VA 0x40000000.
|-
|-
| 0xA0000000
| 0xA0000000
Line 1,983: Line 2,014:
* NSKBL is mapped in RWX mode so it may write itself to text segment.
* NSKBL is mapped in RWX mode so it may write itself to text segment.


== cmep ==
== Cmep registers ==
 
See also [[Cmep registers]].


Each cmep device has its own physical memory area.
Each Cmep device has its own physical memory area.


{| class='wikitable'
{| class='wikitable'
Line 1,994: Line 2,027:
| 0xE0000000
| 0xE0000000
| 0xE000FFFF
| 0xE000FFFF
| [[F00D_Processor#Memory|ARM/F00D communication]] [[F00D Communication Ports]]
| [[Cmep#Communication|ARM/Cmep communication]]
|-
|-
| 0xE0010000
| 0xE0010000
| 0xE001FFFF
| 0xE001FFFF
| cmep Reset
| [[Cmep]] Reset
|-
|-
| 0xE0020000
| 0xE0020000
Line 2,006: Line 2,039:
| 0xE0030000
| 0xE0030000
| 0xE003FFFF
| 0xE003FFFF
| [[F00D Key Ring Controller]]. ?EEPROM programmer?
| [[Cmep_registers#0xE0030000:_Bigmac_Keyring_controller|Bigmac Key Ring controller]]. ?EEPROM programmer?
|-
|-
| 0xE0040000
| 0xE0040000
| 0xE004FFFF
| 0xE004FFFF
| [[F00D Math Processor]] (Bignum worker)
| Cmep Math Processor (Bignum worker)
|-
|-
| 0xE0050000
| 0xE0050000
| 0xE0050FFF?
| 0xE0050FFF?
| [[Bigmac]] crypto engine, similar to [[Dmac5|DMAC5]]
| [[DMAC#Bigmac|Bigmac]] DMAC/crypto engine (similar to [[DMAC#DMAC5|DMAC5]])
|-
|-
| 0xE0058000
| 0xE0058000
| 0xE0067FFF
| 0xE0067FFF
| [[F00D Keyring Regs]] [[F00D Key Ring Base]]. EEPROM / [[Bigmac]] key rings, <code>0x800</code> entries, <code>0x20</code> bytes for each key ring
| [[Cmep registers]] [[Cmep Key Ring Base]]. EEPROM / [[DMAC#Bigmac_Key_Ring|Bigmac key ring]], <code>0x800</code> entries, <code>0x20</code> bytes for each slot
|-
|-
| 0xE0070000
| 0xE0070000

Latest revision as of 03:51, 10 November 2024

Main table

List sorted by group
Top Group
Address Size Description
0x00000000 0x820000 Device Boot.
0x1A000000 0x3000 ARM cache controller.
0x1C000000 0x200000 Scratch 2MiB SRAM.
0x1F000000 0x8000 Alias of address 0x00000000.
0x1F840000 0x20000 Boot store and VIP scratch.
0x20000000 0x8000000 128MiB CDRAM.
0x30000000 ? Unknown CMeP device.
0x40000000 0x20000000 512MiB DRAM.
0x60000000 0x40000000 1GiB DRAM for Development Kit.
0xE0000000 0x100000 CMeP's Control Register.
0xE0100000 0x1000 Gpio 1.
0xE0400000 0x20000 Dmac part 4~5.
0xE0420000 0xC0000 Audio Control.
0xE04E0000 0x1000~0x20000 Dmac Keyring Control.
0xE0500000 0x20000 I2c.
0xE0900000 0x10000 Msif.
0xE0A00000 0x30000 Spi.
0xE0B00000 0x130000 Sdif.
0xE2030000 0x70000 Uart.
0xE20A0000 0x10000 Gpio 0.
0xE20B0000 0x10000 Timer.
0xE20C0000 0x10000 Pwn.
0xE3000000 0x20000 Dmac part 0~1.
0xE3020000 0x20000 Cif.
0xE3050000 0x20000 Csi.
0xE3100000 0x20000 Pervasive.
0xE3200000 0x130000 ARM Debugger.
0xE4020000 0xD0000 USB Control.
0xE5000000 0x20000 Dmac part 2~3.
0xE5020000 0x50000 Display Control.
0xE5070000 0x10000 Compat.
0xE50C0000 0x10000 Dmac part 6.
0xE50D0000 0x10000 ARM PA.
0xE5800000 0x20000 Sdio Control for Development Kit.
0xE5880000 0x10000 DRAM Control for Development Kit.
0xE6000000 0x10000 DRAM Control.
0xE8000000 0x10000 GPU Control.
0xE8100000 0x10000 Compat Shared SRAM.
0xE8200000 0x10000 Emc.
0xE8300000 0x10000 Grab.
0xE8400000 0x10000 SGX543.
0xEC000000 x Main Xbar
0xEC100000 x Center Xbar
0xEC200000 x Video Xbar
0xEC300000 x IFTU Xbar
0xEC400000 x VIP Xbar
0xEC500000 x Debug Bus
0xEC600000 x DMAC Xbar
0xED000000 x IO Slave Bus
0xED100000 x IO Master Bus
0xED200000 x Pervasive Bus
0xED300000 x Misc IO Bus
0xED400000 x North IO Master Bus
0xED500000 x Audio Bus
0xED600000 x North IO Slave Bus
0xED700000 x SRC Bus
0xED800000 x GPU Register Bus
0xED900000 x IFTU Register Bus
0xEE000000 x Camera Slave Bus
0xEE100000 x Camera Master Bus
0xEE200000 x USB Slave Bus
0xEE300000 x USB Master Bus
0xEE400000 x SubLCD Slave Bus
0xEE500000 x SubLCD Master Bus
0xEE600000 x Camera Register Bus
Main Xbar
Address Description
0xEC040000 SSX_MainXB_IA_ARM0
0xEC040400 SSX_MainXB_IA_ARM1
0xEC048000 SSX_MainXB_IA_CenterXbar0
0xEC048400 SSX_MainXB_IA_CenterXbar1
0xEC048800 SSX_MainXB_IA_CenterXbar2
0xEC048C00 SSX_MainXB_IA_IoMasterBus
0xEC049000 SSX_MainXB_IA_DmacXbar0
0xEC049400 SSX_MainXB_IA_DmacXbar1
0xEC050000 SSX_MainXB_TA_Spad_32KiB
0xEC050400 SSX_MainXB_TA_LPDDR0
0xEC050800 SSX_MainXB_TA_ACP
0xEC058000 SSX_MainXB_TA_CenterXbar0
0xEC058400 SSX_MainXB_TA_CenterXbar1
0xEC058800 SSX_MainXB_TA_IoSlaveBus
Center Xbar
Address Description
0xEC140000 SSX_CenterXB_IA_GPUXbar
0xEC148000 SSX_CenterXB_IA_MainXbar0
0xEC148400 SSX_CenterXB_IA_MainXbar1
0xEC148800 SSX_CenterXB_IA_VideoXbar0
0xEC148C00 SSX_CenterXB_IA_VideoXbar1
0xEC149000 SSX_CenterXB_IA_IoMasterBus
0xEC149400 SSX_CenterXB_IA_DmacXbar0
0xEC149800 SSX_CenterXB_IA_DmacXbar1
0xEC150000 SSX_CenterXB_TA_Compati_2MiB
0xEC150400 SSX_CenterXB_TA_DevNull
0xEC150800 SSX_CenterXB_TA_GpuXbar
0xEC158000 SSX_CenterXB_TA_MainXbar0
0xEC158400 SSX_CenterXB_TA_MainXbar1
0xEC158800 SSX_CenterXB_TA_MainXbar2
0xEC158C00 SSX_CenterXB_TA_VideoXbar
Video Xbar
Address Description
0xEC240000 SSX_VideoXB_IA_DMAC2
0xEC240400 SSX_VideoXB_IA_DMAC3
0xEC240800 SSX_VideoXB_IA_Venezia
0xEC240C00 SSX_VideoXB_IA_LCDDMAC
0xEC248000 SSX_VideoXB_IA_CenterXbar
0xEC248400 SSX_VideoXB_IA_IftuXbar0
0xEC248800 SSX_VideoXB_IA_IftuXbar1
0xEC248C00 SSX_VideoXB_IA_VipXbar0
0xEC249000 SSX_VideoXB_IA_VipXbar1
0xEC249400 SSX_VideoXB_IA_DebugBus
0xEC250000 SSX_VideoXB_TA_Spad_128KiB
0xEC250400 SSX_VideoXB_TA_GpuXbar0
0xEC250800 SSX_VideoXB_TA_GpuXbar1
0xEC250C00 SSX_VideoXB_TA_GpuXbar2
0xEC258000 SSX_VideoXB_TA_CenterXbar0
0xEC258400 SSX_VideoXB_TA_CenterXbar1
0xEC258800 SSX_VideoXB_TA_DebugBus
IFTU Xbar
Address Description
0xEC340000 SSX_IftuXB_IA_IFTU0a
0xEC340400 SSX_IftuXB_IA_IFTU0b
0xEC340800 SSX_IftuXB_IA_IFTU1a
0xEC340C00 SSX_IftuXB_IA_IFTU1b
0xEC341000 SSX_IftuXB_IA_IFTU2
0xEC348000 SSX_IftuXB_IA_IftuRegBus
0xEC358000 SSX_IftuXB_TA_VideoXbar0
0xEC358400 SSX_IftuXB_TA_VideoXbar1
VIP Xbar
Address Description
0xEC440000 SSX_VipXB_IA_VDP0
0xEC440400 SSX_VipXB_IA_VDP1
0xEC440800 SSX_VipXB_IA_VDP2
0xEC440C00 SSX_VipXB_IA_VDP3
0xEC441000 SSX_VipXB_IA_VDPMeP
0xEC441400 SSX_VipXB_IA_BAPMeP
0xEC448000 SSX_VipXB_IA_GpuRegBus
0xEC450000 SSX_VipXB_TA_GpuXbar
0xEC458000 SSX_VipXB_TA_VideoXbar0
0xEC458400 SSX_VipXB_TA_VideoXbar1
Debug Bus
Address Description
0xEC540000 SSX_DebugBus_IA_DMAC6
0xEC540400 SSX_DebugBus_IA_PA
0xEC548000 SSX_DebugBus_IA_VideoXbar
0xEC550000 SSX_DebugBus_TA_SDIO0
0xEC550400 SSX_DebugBus_TA_SDIO1
0xEC550800 SSX_DebugBus_TA_LPDDR1
0xEC558000 SSX_DebugBus_TA_VideoXbar
DMAC Xbar
Address Description
0xEC640000 SSX_DmacXB_IA_DMAC0
0xEC640400 SSX_DmacXB_IA_DMAC1
0xEC648000 SSX_DmacXB_IA_IoSlaveBus
0xEC658000 SSX_DmacXB_TA_MainXbar0
0xEC658400 SSX_DmacXB_TA_MainXbar1
0xEC658800 SSX_DmacXB_TA_CenterXbar0
0xEC658C00 SSX_DmacXB_TA_CenterXbar1
IO Slave Bus
Address Description
0xED048000 SSX_IoSlaveBus_IA_MainXbar
0xED058000 SSX_IoSlaveBus_TA_PervasiveBus
0xED058400 SSX_IoSlaveBus_TA_NorthIoBus
0xED058800 SSX_IoSlaveBus_TA_GpuRegBus
0xED058C00 SSX_IoSlaveBus_TA_MiscIoBus
0xED059000 SSX_IoSlaveBus_TA_CameraSlaveBus0
0xED059400 SSX_IoSlaveBus_TA_CameraSlaveBus1
0xED059800 SSX_IoSlaveBus_TA_CameraSlaveBus2
0xED059C00 SSX_IoSlaveBus_TA_IoMasterBus
0xED05A000 SSX_IoSlaveBus_TA_DmacXbar
IO Master Bus
Address Description
0xED148000 SSX_IoMasterBus_IA_NorthIoBus
0xED148400 SSX_IoMasterBus_IA_CameraMasterBus
0xED148800 SSX_IoMasterBus_IA_IoSlaveBus
0xED158000 SSX_IoMasterBus_TA_MainXbar
0xED158400 SSX_IoMasterBus_TA_CenterXbar
Pervasive Bus
Address Description
0xED248000 SSX_PervasiveBus_IA_IoSlaveBus
0xED250000 SSX_PervasiveBus_TA_DMAC0
0xED250000 SSX_PervasiveBus_TA_DMAC1
0xED250800 SSX_PervasiveBus_TA_Pervasive
0xED250C00 SSX_PervasiveBus_TA_CoreSight
0xED251000 SSX_PervasiveBus_TA_VFPINT
Misc IO Bus
Address Description
0xED348000 SSX_MiscIoBus_IA_IoSlaveBus
0xED350000 SSX_MiscIoBus_TA_UART0
0xED350400 SSX_MiscIoBus_TA_UART1
0xED350800 SSX_MiscIoBus_TA_UART2
0xED350C00 SSX_MiscIoBus_TA_UART3
0xED351000 SSX_MiscIoBus_TA_UART4
0xED351400 SSX_MiscIoBus_TA_UART5
0xED351800 SSX_MiscIoBus_TA_UART6
0xED351C00 SSX_MiscIoBus_TA_GPIO0
0xED352000 SSX_MiscIoBus_TA_Timer
0xED352400 SSX_MiscIoBus_TA_PWM
North IO Master Bus
Address Description
0xED440000 SSX_NIoMasterBus_IA_DMAC4
0xED440400 SSX_NIoMasterBus_IA_DMAC5
0xED440800 SSX_NIoMasterBus_IA_HSMMC1
0xED440C00 SSX_NIoMasterBus_IA_HSMMC2
0xED441000 SSX_NIoMasterBus_IA_HSMMC3
0xED448000 SSX_NIoMasterBus_IA_NIoSlaveBus
0xED450000 SSX_NIoMasterBus_TA_KeyRing
0xED458000 SSX_NIoMasterBus_TA_AudioBus
0xED458400 SSX_NIoMasterBus_TA_SrcBus
0xED458800 SSX_NIoMasterBus_TA_IoMasterBus0
0xED458C00 SSX_NIoMasterBus_TA_IoMasterBus1
Audio Bus
Address Description
0xED548000 SSX_AudioBus_IA_NIoMasterBus
0xED550000 SSX_AudioBus_TA_I2S0
0xED550400 SSX_AudioBus_TA_I2S1
0xED550800 SSX_AudioBus_TA_I2S2
0xED550C00 SSX_AudioBus_TA_I2SD0
0xED551000 SSX_AudioBus_TA_I2SD1
0xED551400 SSX_AudioBus_TA_I2S4
0xED551C00 SSX_AudioBus_TA_I2S7
0xED552000 SSX_AudioBus_TA_SPDIF
North IO Slave Bus
Address Description
0xED648000 SSX_NIoSlaveBus_IA_IoSlaveBus
0xED650000 SSX_NIoSlaveBus_TA_DMAC4
0xED650400 SSX_NIoSlaveBus_TA_DMAC5
0xED650800 SSX_NIoSlaveBus_TA_I2C0
0xED650C00 SSX_NIoSlaveBus_TA_I2C1
0xED651000 SSX_NIoSlaveBus_TA_HSMMC1
0xED651400 SSX_NIoSlaveBus_TA_HSMMC2
0xED651800 SSX_NIoSlaveBus_TA_HSMMC3
0xED658000 SSX_NIoSlaveBus_TA_NIoMasterBus
SRC Bus
Address Description
0xED748000 SSX_SrcBus_IA_NIoMasterBus
0xED750000 SSX_SrcBus_TA_SRC0
0xED750400 SSX_SrcBus_TA_SRC1
0xED750800 SSX_SrcBus_TA_SRC2
GPU Register Bus
Address Description
0xED848000 SSX_GpuRegBus_IA_IoSlaveBus
0xED850000 SSX_GpuRegBus_TA_DMAC2
0xED850400 SSX_GpuRegBus_TA_DMAC3
0xED850800 SSX_GpuRegBus_TA_LCDDMAC
0xED850C00 SSX_GpuRegBus_TA_DMAC6
0xED851000 SSX_GpuRegBus_TA_PA
0xED851400 SSX_GpuRegBus_TA_Pervasive2
0xED851800 SSX_GpuRegBus_TA_SonyRegBus
0xED858000 SSX_GpuRegBus_TA_IftuRegBus
0xED858400 SSX_GpuRegBus_TA_VipXbar
IFTU Register Bus
Address Description
0xED948000 SSX_IftuRegBus_IA_GpuRegBus
0xED950000 SSX_IftuRegBus_TA_IFTU0
0xED950400 SSX_IftuRegBus_TA_IFTU1
0xED950800 SSX_IftuRegBus_TA_IFTU2
0xED950C00 SSX_IftuRegBus_TA_DSI0
0xED951000 SSX_IftuRegBus_TA_DSI1
0xED958000 SSX_IftuRegBus_TA_IftuXbar
Camera Slave Bus
Address Description
0xEE048000 SSX_CameraSlaveBus_IA_IoSlaveBus0
0xEE048400 SSX_CameraSlaveBus_IA_IoSlaveBus1
0xEE048800 SSX_CameraSlaveBus_IA_IoSlaveBus2
0xEE050000 SSX_CameraSlaveBus_TA_GPIO1
0xEE058000 SSX_CameraSlaveBus_TA_CameraRegBus
0xEE058400 SSX_CameraSlaveBus_TA_SlcdSlaveBus0
0xEE058800 SSX_CameraSlaveBus_TA_UsbSlaveBus
0xEE058C00 SSX_CameraSlaveBus_TA_SlcdSlaveBus1
0xEE059000 SSX_CameraSlaveBus_TA_CameraMasterBus
Camera Master Bus
Address Description
0xEE140000 SSX_CameraMasterBus_IA_CameraIf0
0xEE140400 SSX_CameraMasterBus_IA_CameraIf1
0xEE148000 SSX_CameraMasterBus_IA_SlcdMasterBus
0xEE148400 SSX_CameraMasterBus_IA_UsbMasterBus
0xEE148800 SSX_CameraMasterBus_IA_CameraSlaveBus
0xEE158000 SSX_CameraMasterBus_TA_IoMasterBus0
0xEE158400 SSX_CameraMasterBus_TA_IoMasterBus1
USB Slave Bus
Address Description
0xEE248000 SSX_UsbSlaveBus_IA_CameraSlaveBus
0xEE250000 SSX_UsbSlaveBus_TA_USB0HOST
0xEE250400 SSX_UsbSlaveBus_TA_USB1HOST
0xEE250800 SSX_UsbSlaveBus_TA_USB2HOST
0xEE252C00 SSX_UsbSlaveBus_TA_USB1DEVICE
0xEE253000 SSX_UsbSlaveBus_TA_USB2DEVICE
0xEE253400 SSX_UsbSlaveBus_TA_USB0DEVICE
0xEE258000 SSX_UsbSlaveBus_TA_UsbMasterBus
USB Master Bus
Address Description
0xEE340400 SSX_UsbMasterBus_IA_USB1OHCI
0xEE340800 SSX_UsbMasterBus_IA_USB1EHCI
0xEE340C00 SSX_UsbMasterBus_IA_USB2OHCI
0xEE341000 SSX_UsbMasterBus_IA_USB2EHCI
0xEE341400 SSX_UsbMasterBus_IA_USB0OHCI
0xEE341800 SSX_UsbMasterBus_IA_USB0EHCI
0xEE343400 SSX_UsbMasterBus_IA_USB1DEVICE
0xEE343800 SSX_UsbMasterBus_IA_USB2DEVICE
0xEE343C00 SSX_UsbMasterBus_IA_USB0DEVICE
0xEE348000 SSX_UsbMasterBus_IA_UsbSlaveBus
0xEE358000 SSX_UsbMasterBus_TA_CameraMasterBus
SubLCD Slave Bus
Address Description
0xEE448000 SSX_SlcdSlaveBus_IA_CameraSlaveBus0
0xEE448400 SSX_SlcdSlaveBus_IA_CameraSlaveBus1
0xEE450000 SSX_SlcdSlaveBus_TA_HSMMC0
0xEE450400 SSX_SlcdSlaveBus_TA_SubLCD
0xEE450800 SSX_SlcdSlaveBus_TA_SMSHC
0xEE450C00 SSX_SlcdSlaveBus_TA_SPI0
0xEE451000 SSX_SlcdSlaveBus_TA_SPI1
0xEE451400 SSX_SlcdSlaveBus_TA_SPI2
0xEE458000 SSX_SlcdSlaveBus_TA_SlcdMasterBus
SubLCD Master Bus
Address Description
0xEE540000 SSX_SlcdMasterBus_IA_HSMMC0
0xEE540400 SSX_SlcdMasterBus_IA_SubLCD
0xEE540800 SSX_SlcdMasterBus_IA_SMSHC
0xEE548000 SSX_SlcdMasterBus_IA_SlcdSlaveBus
0xEE558000 SSX_SlcdMasterBus_TA_CameraMasterBus
Camera Register Bus
Address Description
0xEE648000 SSX_CameraRegBus_IA_CameraSlaveBus
0xEE650000 SSX_CameraRegBus_TA_CameraIf0
0xEE650400 SSX_CameraRegBus_TA_CameraIf1
0xEE650800 SSX_CameraRegBus_TA_CSI0
0xEE650C00 SSX_CameraRegBus_TA_CSI1
Start End Size World Comments
0x00000000 0x0003FFFF 0x40000 NS/S ARM Boot. By default, alias of physical address 0x1F000000 i.e. ScePower scratchpad.

Can be remapped.

0x00040000 0x0005FFFF 0x20000 S MeP boot. Mirror of physical address 0x00800000.
0x00300000 0x0030FFFF 0x10000 S cmep icache
0x00310000 0x0031FFFF 0x10000 S cmep icache tag
0x00320000 0x0032FFFF 0x10000 S cmep dcache
0x00330000 0x0033FFFF 0x10000 S cmep dcache tag
0x004B0000 0x005FFFFF 0x150000 S Reserved for Venezia
0x00600000 0x007FFFFF 0x200000 S Reserved for MeP
0x00800000 0x0081FFFF 0x20000 S Cmep 128KiB SRAM. Stores second_loader, secure_kernel and Secure Modules.
0x1A000000 0x1A001FFF 0x2000 NS/S ARM. SceInterruptControllerReg, ScePeriphReg, Interrupts (PERIPHBASE). Stores SCU_CONTROL_REG, SCU_SAC_REG.
0x1A002000 0x1A002FFF 0x1000 NS/S ARM. ScePl310Reg, SceL2CacheReg, L2 Cache Controller. Stores SCU_CONFIG_REG, PL310_CACHE_ID, PL310_CACHE_TYPE.
0x1C000000 0x1C1FFFFF 0x200000 NS/S SRAM. SRAM used to store First Loader loaded from boot ROM storage, CMeP exception vectors and raw SLSK loaded from eMMC or SD/GCSD by First Loader, ARZL decoded SceSysmem by SKBL, SceDisplay / SceCamera SRAM (only 960x544 pixels * 4 bytes = 0x1FE000 bytes mapped), Compatibility SRAM for PspEmu (Tachyon-eDRAM), SceKernelBsodSram for SceKernelBlueScreenOfDeath. Cleared with zeroes on soft reset.
0x1D000000 0x1D000FFF 0x1000 ? /dev/null - memory that reads as zero and ignores writes. Used by SceMsif.
0x1D001000 0x1D001FFF 0x1000 ? /dev/null (E) - does not exist on Kermit ES4 (Address Space Hole)
0x1F000000 0x1F007FFF 0x8000 NS/S SPAD32K, ScePowerScratchPad32KiB. After suspend, SKBL stores there "Non-secure power.kprx resume" using suspendinfo then jumps to it.
0x1F840000 0x1F85FFFF 0x20000 NS/S SPAD128K. SceVeneziaSpram. Stores Secure Kernel on boot.
0x20000000 0x27FFFFFF 0x8000000 NS VRAM. Graphics bar
0x30000000 ?0x3FFFFFFF? ?0x10000000? S Unknown secure area used by Cmep. Used by first_loader (prototype:0x5C398) and second_loader (3.600.011:0x808208).
0x40000000 0x401FFFFF on FWs < 3.50

0x401FFFFF on FWs >= 3.50

0x300000 on FWs < 3.50

0x200000 on FWs >= 3.50

S Secure DRAM
0x40300000 on FWs < 3.50

0x40200000 on FWs >= 3.50

0xBFFFFFFF 0x7FD00000 on FWs < 3.50

0x7FE00000 on FWs >= 3.50

NS/S Non-secure Shared DRAM
0xC0000000 0xDFFFFFFF 0x20000000 NS/S Reserved for Venezia. Maybe unused.
0xE0000000 0xE00FFFFF 0x100000 S Control Register. cmep
0xE0100000 0xE0100FFF 0x1000 NS SceGpio1Reg
0xE0400000 0xE0400FFF 0x1000 NS SceDmacmgrDmac4Reg
0xE0410000 0xE0410FFF 0x1000 NS SceDmacmgrDmac5Reg
0xE0420000 0xE0420FFF 0x1000 NS SceI2s0Reg
0xE0430000 0xE0430FFF 0x1000 NS SceI2s1Reg
0xE0440000 0xE0440FFF 0x1000 NS SceI2s2Reg
0xE0450000 0xE0450FFF 0x1000 NS SceI2s3Reg
0xE0460000 0xE0460FFF 0x1000 NS SceI2s5Reg
0xE0470000 0xE0470FFF 0x1000 NS SceI2s4Reg
0xE0490000 0xE0490FFF 0x1000 NS SceI2s7Reg
0xE04A0000 0xE04A0FFF 0x1000 NS SceSrcMix0Reg
0xE04B0000 0xE04B0FFF 0x1000 NS SceSrcMix1Reg
0xE04C0000 0xE04C0FFF 0x1000 NS SceSrcMix2Reg
0xE04D0000 0xE04D3FFF 0x4000 NS SceSpdifReg
0xE04DC000 0xE04DCFFF 0x1000 NS SceAclkgenReg
0xE04E0000 0xE04E0FFF 0x1000 NS/S SceDmacmgrKeyringReg, SceSblDMAC5DmacKRBase, DMAC Register base
0xE0500000 0xE0500FFF 0x1000 NS SceI2c0Reg
0xE0510000 0xE0510FFF 0x1000 NS SceI2c1Reg
0xE0900000 0xE0900FFF 0x1000 NS SceMsif
0xE0A00000 0xE0A00FFF 0x1000 NS SceSpi0Reg (SceSyscon)
0xE0A10000 0xE0A10FFF 0x1000 NS SceSpi1Reg (SceMotionDev)
0xE0A20000 0xE0A20FFF 0x1000 NS SceSpi2Reg (SceOled)
0xE0B00000 0xE0B00FFF 0x10000 NS SceSdif0
0xE0C00000 0xE0C00FFF 0x10000 NS SceSdif1
0xE0C10000 0xE0C10FFF 0x10000 NS SceSdif2
0xE0C20000 ? ? ? SceSdif3 (not present on FW 1.69, does FW 3.60 use only NSKBL?)
0xE2030000 0xE209FFFF 0x70000 NS SceUartReg
0xE20A0000 0xE20AFFFF 0x10000 NS/S SceGpio0Reg / SceLedReg
0xE20B0000 0xE20B0FFF 0x1000 NS Global Timer
0xE20B1000 0xE20B5FFF 0x5000 NS SceLongRangeTimerReg
0xE20B6000 0xE20B6FFF 0x1000 NS SceLT5 - holds System Time in usec (part of SceLongRangeTimerReg)
0xE20B7000 0xE20BDFFF 0x7000 NS SceWordTimerReg
0xE20BE000 0xE20BEFFF 0x1000 NS/S SceTimerForUsleep (part of SceWordTimerReg)
0xE20BF000 0xE20BFFFF 0x1000 NS/S Timer Bus Error Registers
0xE20C0000 0xE20C0FFF 0x1000 NS ScePwmReg
0xE3000000 0xE3000FFF 0x1000 NS SceDmacmgrDmac0Reg
0xE3010000 0xE3010FFF 0x1000 NS SceDmacmgrDmac1Reg
0xE3020000 0xE3020FFF 0x1000 NS SceCif0Reg
0xE3030000 0xE3030FFF 0x1000 NS SceCif1Reg
0xE3050000 0xE3050FFF 0x1000 NS SceCsi0Reg
0xE3060000 0xE3060FFF 0x1000 NS SceCsi1Reg
0xE3100000 0xE3100FFF 0x1000 NS ScePervasiveMisc
0xE3101000 0xE3101FFF 0x1000 NS ScePervasiveResetReg
0xE3102000 0xE3102FFF 0x1000 NS ScePervasiveGate
0xE3103000 0xE3103FFF 0x1000 NS ScePervasiveBaseClk
0xE3104000 0xE3104FFF 0x1000 NS ScePervasiveVid
0xE3105000 0xE3105FFF 0x1000 NS SceUartClkgenReg
0xE3106000 0xE3106FFF 0x1000 NS ScePervasiveMailboxReg
0xE3108000 0xE3108FFF 0x1000 NS ScePervasiveTas0
0xE3109000 0xE3109FFF 0x1000 NS ScePervasiveTas1
0xE310A000 0xE310AFFF 0x1000 NS ScePervasiveTas2
0xE310B000 0xE310BFFF 0x1000 NS ScePervasiveTas3
0xE310C000 0xE310CFFF 0x1000 NS ScePervasiveTas4
0xE310D000 0xE310DFFF 0x1000 NS ScePervasiveTas5
0xE310E000 0xE310EFFF 0x1000 NS ScePervasiveTas6
0xE310F000 0xE310FFFF 0x1000 NS ScePervasiveTas7
0xE3110000 0xE3110FFF 0x1000 NS SPM32, SPM128, Compati SRAM, ScePervasive2Reg, SceUdcd0
0xE3200000 0xE3200FFF 0x1000 S Base Debug ROM Table
0xE3203000 0xE3203FFF 0x1000 NS SceTpiuReg
0xE3204000 0xE3204FFF 0x1000 NS SceFunnelReg
0xE3205000 0xE3205FFF 0x1000 NS SceItmReg
0xE3300000 0xE3300FFF 0x1000 S ARM Cortex-A9 Debug ROM Table
0xE3310000 0xE3310FFF 0x1000 NS SceDbg0Reg, Debugger Interface
0xE3311000 0xE3311FFF 0x1000 NS ScePmu0Reg
0xE3312000 0xE3312FFF 0x1000 NS SceDbg1Reg, Debugger Interface
0xE3313000 0xE3313FFF 0x1000 NS ScePmu1Reg
0xE3314000 0xE3314FFF 0x1000 NS SceDbg2Reg, Debugger Interface
0xE3315000 0xE3315FFF 0x1000 NS ScePmu2Reg
0xE3316000 0xE3316FFF 0x1000 NS SceDbg3Reg, Debugger Interface
0xE3317000 0xE3317FFF 0x1000 NS ScePmu3Reg
0xE3318000 0xE3318FFF 0x1000 NS SceCti0Reg
0xE3319000 0xE3319FFF 0x1000 NS SceCti1Reg
0xE331A000 0xE331AFFF 0x1000 NS SceCti2Reg
0xE331B000 0xE331BFFF 0x1000 NS SceCti3Reg
0xE331C000 0xE331CFFF 0x1000 NS ScePtm0Reg
0xE331D000 0xE331DFFF 0x1000 NS ScePtm1Reg
0xE331E000 0xE331EFFF 0x1000 NS ScePtm2Reg
0xE331F000 0xE331FFFF 0x1000 NS ScePtm3Reg
0xE3320000 0xE3323FFF 0x4000 NS ARM-VFP. SceIntrmgrVfpIntRegs
0xE4020000 0xE4020FFF 0x1000 NS USB2_OHCI. SceUsbdEhci
0xE40B0000 0xE40B0FFF 0x1000 NS SceUsbdEhci
0xE40C0000 0xE40C0FFF 0x1000 NS SceUdcd1
0xE40D0000 0xE40D0FFF 0x1000 NS SceUdcd2
0xE40E0000 0xE40E0FFF 0x1000 NS SceUsbdEhci
0xE5000000 0xE5000FFF 0x1000 NS SceDmacmgrDmac2Reg
0xE5010000 0xE5010FFF 0x1000 NS SceDmacmgrDmac3Reg
0xE5020000 0xE5020FFF 0x1000 NS SceIftu0RegA (OLED FB)
0xE5021000 0xE5021FFF 0x1000 NS SceIftu0RegB
0xE5022000 0xE5022FFF 0x1000 NS SceIftuc0Reg
0xE5030000 0xE5030FFF 0x1000 NS SceIftu1RegA (HDMI FB)
0xE5031000 0xE5031FFF 0x1000 NS SceIftu1RegB
0xE5032000 0xE5032FFF 0x1000 NS SceIftuc1Reg
0xE5040000 0xE5040FFF 0x1000 NS SceIftu2Reg
0xE5050000 0xE5050FFF 0x1000 NS SceDsi0Reg
0xE5060000 0xE5060FFF 0x1000 NS SceDsi1Reg
0xE5070000 0xE5070FFF 0x1000 NS SceCompatMailbox
0xE5071000 0xE5071FFF 0x1000 NS SceCompatLCDDMA
0xE50C0000 0xE50C0FFF 0x1000 NS SceDmacmgrDmac6Reg
0xE50D0000 0xE50D1FFF 0x2000 NS Debug/PA, ScePfmReg, SceDeci4pDtracepPaReg
0xE5800000 0xE580FFFF 0x10000 NS SceSDbgSdio0
0xE5810000 0xE581FFFF 0x10000 NS SceDbgSdio1
0xE5880000 0xE588FFFF 0x10000 ? LPDDR2 I/F CH1. LPDDR2SUB (1st 256MiB DRAM bank config regs) (?)
0xE6000000 0xE600FFFF 0x10000 ? LPDDR2 I/F CH0. LPDDR2"TOP" (2nd 256MiB DRAM bank config regs) (?). Stores DDRSC_CONF.
0xE8000000 0xE80FFFFF 0x1000000 S SceSonyRegbus. GPU Control
0xE8100000 0xE8100FFF 0x1000 NS/S SceCompatSharedSram (0xBFC00000 in PSP)
0xE8200000 0xE8200FFF 0x1000 S SceEmcTop (External Memory Controller, VRAM?)
0xE8300000 0xE8301FFF 0x2000 S SceGrab
0xE8400000 0xE841FFFF 0x20000 NS SceSGX543Reg. See SGX543.
0xEC000000 ? ? NS/S Xbar
0xED000000 ? ? NS/S Xbar
0xEE000000 ? ? NS/S Xbar
0xF0000000 ? ? ? Reserved for Venezia

Secure DRAM

System Software version 0.931.010 Secure DRAM

On System Software version 0.931.010, SKBL is stored at physical address 0x50000000. So, on System Software version 0.931.010, which data are stored at 0x40040000? Is it even considered as Secure DRAM?

ARZL compressed NSKBL is kept in place inside SKBL segment 0 (at offset 0x37100) til ARZL decoding to Non-secure DRAM at physical address 0x51000000.

FWs 0.990-0.995 Secure DRAM

On FWs 0.990-0.995, SKBL segment 0 starts at physical address 0x40040000.

ARZL compressed NSKBL is extracted from a kernel_boot_loader segment to Non-secure DRAM at physical address 0x50000000. It is then ARZL decoded to Non-secure DRAM at physical address 0x51000000.

FWs >=0.996 Secure DRAM

Since FW 0.996, SKBL segment 0 starts at physical address 0x40020000. This change could have come from the increasing SKBL segment 0 size with revisions.

FW 3.60 Secure DRAM

Start End Size Comments
0x40000000 0x400000BF 0xC0 SKBL Reset Vector
0x40000500 0x400099FF 0x9500 kprx_auth_sm.self. This area is also used as a scratchpad at boot.
0x40009B00 0x4000A27F 0x780 prog_rvk.srvk
0x4001FD00 0x4001FEFF 0x100 SceKblParam with magic not set
0x40020000 0x400570C7 0x370C8 SKBL segment 0
0x40057100 0x400571DF 0xE0 SKBL segment 1
0x40073570 0x4007376F 0x200 SceKblParam

Non-secure Shared DRAM

This region is used by both Secure and Non-Secure Kernel Boot Loaders, and by Secure Kernel modules.

Start End Size Comments
0x40200000 on FW 3.60

0x40300000 on FW 1.69

0x4FFFFFFF 0x0FE00000 on FW 3.60

0x0FD00000 on FW 1.69

TrustZone region. ?First 0x1000 bytes are a Reset Vector named SceKernelReset whose first 0x100 bytes are identical as in uncompressed NSKBL (need to check)?
0x50000000 0x50FFFFFF 0x1000000 ARZL compressed NSKBL. Comes from one of kernel_boot_loader.self segments.
0x51000000 0x51FFFFFF 0x1000000 SceBootKernelImage. Uncompressed NSKBL. Comes from ARZL compressed NSKBL.
0x52000000 0x5FFFFFFF 0xE000000 Non-secure kernel and usermode modules
0x60000000 0x7FFFFFFF 0x20000000 DevKit additional 512MiB. LDDR2TOP.
0x80000000 0x9FFFFFFF 0x20000000 DevKit additional 512MiB. LDDR2SUB. For perf (not published anywhere). This memory is mapped on usermode VA 0x40000000.
0xA0000000 0xBFFFFFFF 0x20000000 DevKit additional 512MiB. LDDR2SUB. For perf (not published anywhere, disabled).

NSKBL Layout

NSKBL on FW 0.931

ARZL encoded size: 0x2541B.

NSKBL on FW 3.60

Start End Size Comments
0x51000000 0x51028087 0x28088 NSKBL Text segment
??? ??? ??? NSKBL Data segment

Notes:

  • The first 0xC0 bytes of the Text segment are the reset vector.
  • NSKBL is mapped in RWX mode so it may write itself to text segment.

Cmep registers

See also Cmep registers.

Each Cmep device has its own physical memory area.

Start End Comments
0xE0000000 0xE000FFFF ARM/Cmep communication
0xE0010000 0xE001FFFF Cmep Reset
0xE0020000 0xE002FFFF Unknown device. See ReadAs. Related to DMA.
0xE0030000 0xE003FFFF Bigmac Key Ring controller. ?EEPROM programmer?
0xE0040000 0xE004FFFF Cmep Math Processor (Bignum worker)
0xE0050000 0xE0050FFF? Bigmac DMAC/crypto engine (similar to DMAC5)
0xE0058000 0xE0067FFF Cmep registers Cmep Key Ring Base. EEPROM / Bigmac key ring, 0x800 entries, 0x20 bytes for each slot
0xE0070000 ? SceEmmcController
0xE00C0000 0xE00CFFFF ?

Interrupt registers

Start End Comments
0xE3100138 0xE310013B BEATB
0xE310013C 0xE310013F BEADR
0xE3110D80 0xE3110D83 BET0
0xE3110D90 0xE3110D93 BET1
0xE3110D94 0xE3110D97 BEBT
0xE3000110 0xE3000113 DMAC0 - address
0xE3000114 0xE3000117 DMAC0 - attribute
0xE3010110 0xE3010113 DMAC1 - address
0xE3010114 0xE3010117 DMAC1 - attribute
0xE5000110 0xE5000113 DMAC2 - address
0xE5000114 0xE5000117 DMAC2 - attribute
0xE5010110 0xE5010113 DMAC3 - address
0xE5010114 0xE5010117 DMAC3 - attribute
0xE0400810 0xE0400813 DMAC4 - address
0xE0400814 0xE0400817 DMAC4 - attribute
0xE50C0110 0xE50C0113 DMAC6 - address
0xE50C0114 0xE50C0117 DMAC6 - attribute
0xE3110D14 0xE3110D17 SPM32 - address
0xE3110D18 0xE3110D1B SPM32 - attribute
0xE3110D04 0xE3110D07 SPM128 - address
0xE3110D08 0xE3110D0B SPM128 - attribute
0xE600C008 0xE600C00B LPDDR2 I/F CH0 - address
0xE600C000 0xE600C003 LPDDR2 I/F CH0 - attribute
0xE588C008 0xE588C00B LPDDR2 I/F CH1 - address
0xE588C000 0xE588C003 LPDDR2 I/F CH1 - attribute
0xE310013C 0xE310013F Pervasive - address
0xE3100138 0xE310013B Pervasive - attribute
0xE50D10F0 0xE50D10F3 Debug/PA - address
0xE50D10F4 0xE50D10F7 Debug/PA - attribute
0xE3110D34 0xE3110D37 Pervasive2 - address
0xE3110D38 0xE3110D3B Pervasive2 - attribute
0xE580FFF0 0xE580FFF3 SDIO0 - address
0xE580FFF4 0xE580FFF7 SDIO0 - attribute
0xE581FFF0 0xE581FFF3 SDIO1 - address
0xE581FFF4 0xE581FFF7 SDIO1 - attribute

PSP Emulator

PSP Emulator memory map

Retrieved from "http://wiki.henkaku.xyz/index.php?title=Physical_Memory&oldid=21431"