Physical Memory

Main table

Top Group

Address	Size	Description
0x00000000	0x820000	Device Boot.
0x1A000000	0x3000	ARM cache controller.
0x1C000000	0x200000	Scratch 2MiB SRAM.
0x1F000000	0x8000	Alias of address 0x00000000.
0x1F840000	0x20000	Boot store and VIP scratch.
0x20000000	0x8000000	128MiB CDRAM.
0x30000000	?	Unknown CMeP device.
0x40000000	0x20000000	512MiB DRAM.
0x60000000	0x40000000	1GiB DRAM for Development Kit.
0xE0000000	0x100000	CMeP's Control Register.
0xE0100000	0x1000	Gpio 1.
0xE0400000	0x20000	Dmac part 4~5.
0xE0420000	0xC0000	Audio Control.
0xE04E0000	0x1000~0x20000	Dmac Keyring Control.
0xE0500000	0x20000	I2c.
0xE0900000	0x10000	Msif.
0xE0A00000	0x30000	Spi.
0xE0B00000	0x130000	Sdif.
0xE2030000	0x70000	Uart.
0xE20A0000	0x10000	Gpio 0.
0xE20B0000	0x10000	Timer.
0xE20C0000	0x10000	Pwn.
0xE3000000	0x20000	Dmac part 0~1.
0xE3020000	0x20000	Cif.
0xE3050000	0x20000	Csi.
0xE3100000	0x20000	Pervasive.
0xE3200000	0x130000	ARM Debugger.
0xE4020000	0xD0000	USB Control.
0xE5000000	0x20000	Dmac part 2~3.
0xE5020000	0x50000	Display Control.
0xE5070000	0x10000	Compat.
0xE50C0000	0x10000	Dmac part 6.
0xE50D0000	0x10000	ARM PA.
0xE5800000	0x20000	Sdio Control for Development Kit.
0xE5880000	0x10000	DRAM Control for Development Kit.
0xE6000000	0x10000	DRAM Control.
0xE8000000	0x10000	GPU Control.
0xE8100000	0x10000	Compat Shared SRAM.
0xE8200000	0x10000	Emc.
0xE8300000	0x10000	Grab.
0xE8400000	0x10000	SGX543.
0xEC000000	x	Main Xbar
0xEC100000	x	Center Xbar
0xEC200000	x	Video Xbar
0xEC300000	x	IFTU Xbar
0xEC400000	x	VIP Xbar
0xEC500000	x	Debug Bus
0xEC600000	x	DMAC Xbar
0xED000000	x	IO Slave Bus
0xED100000	x	IO Master Bus
0xED200000	x	Pervasive Bus
0xED300000	x	Misc IO Bus
0xED400000	x	North IO Master Bus
0xED500000	x	Audio Bus
0xED600000	x	North IO Slave Bus
0xED700000	x	SRC Bus
0xED800000	x	GPU Register Bus
0xED900000	x	IFTU Register Bus
0xEE000000	x	Camera Slave Bus
0xEE100000	x	Camera Master Bus
0xEE200000	x	USB Slave Bus
0xEE300000	x	USB Master Bus
0xEE400000	x	SubLCD Slave Bus
0xEE500000	x	SubLCD Master Bus
0xEE600000	x	Camera Register Bus

Main Xbar

Address	Description
0xEC040000	SSX_MainXB_IA_ARM0
0xEC040400	SSX_MainXB_IA_ARM1
0xEC048000	SSX_MainXB_IA_CenterXbar0
0xEC048400	SSX_MainXB_IA_CenterXbar1
0xEC048800	SSX_MainXB_IA_CenterXbar2
0xEC048C00	SSX_MainXB_IA_IoMasterBus
0xEC049000	SSX_MainXB_IA_DmacXbar0
0xEC049400	SSX_MainXB_IA_DmacXbar1
0xEC050000	SSX_MainXB_TA_Spad_32KiB
0xEC050400	SSX_MainXB_TA_LPDDR0
0xEC050800	SSX_MainXB_TA_ACP
0xEC058000	SSX_MainXB_TA_CenterXbar0
0xEC058400	SSX_MainXB_TA_CenterXbar1
0xEC058800	SSX_MainXB_TA_IoSlaveBus

Center Xbar

Address	Description
0xEC140000	SSX_CenterXB_IA_GPUXbar
0xEC148000	SSX_CenterXB_IA_MainXbar0
0xEC148400	SSX_CenterXB_IA_MainXbar1
0xEC148800	SSX_CenterXB_IA_VideoXbar0
0xEC148C00	SSX_CenterXB_IA_VideoXbar1
0xEC149000	SSX_CenterXB_IA_IoMasterBus
0xEC149400	SSX_CenterXB_IA_DmacXbar0
0xEC149800	SSX_CenterXB_IA_DmacXbar1
0xEC150000	SSX_CenterXB_TA_Compati_2MiB
0xEC150400	SSX_CenterXB_TA_DevNull
0xEC150800	SSX_CenterXB_TA_GpuXbar
0xEC158000	SSX_CenterXB_TA_MainXbar0
0xEC158400	SSX_CenterXB_TA_MainXbar1
0xEC158800	SSX_CenterXB_TA_MainXbar2
0xEC158C00	SSX_CenterXB_TA_VideoXbar

Video Xbar

Address	Description
0xEC240000	SSX_VideoXB_IA_DMAC2
0xEC240400	SSX_VideoXB_IA_DMAC3
0xEC240800	SSX_VideoXB_IA_Venezia
0xEC240C00	SSX_VideoXB_IA_LCDDMAC
0xEC248000	SSX_VideoXB_IA_CenterXbar
0xEC248400	SSX_VideoXB_IA_IftuXbar0
0xEC248800	SSX_VideoXB_IA_IftuXbar1
0xEC248C00	SSX_VideoXB_IA_VipXbar0
0xEC249000	SSX_VideoXB_IA_VipXbar1
0xEC249400	SSX_VideoXB_IA_DebugBus
0xEC250000	SSX_VideoXB_TA_Spad_128KiB
0xEC250400	SSX_VideoXB_TA_GpuXbar0
0xEC250800	SSX_VideoXB_TA_GpuXbar1
0xEC250C00	SSX_VideoXB_TA_GpuXbar2
0xEC258000	SSX_VideoXB_TA_CenterXbar0
0xEC258400	SSX_VideoXB_TA_CenterXbar1
0xEC258800	SSX_VideoXB_TA_DebugBus

IFTU Xbar

Address	Description
0xEC340000	SSX_IftuXB_IA_IFTU0a
0xEC340400	SSX_IftuXB_IA_IFTU0b
0xEC340800	SSX_IftuXB_IA_IFTU1a
0xEC340C00	SSX_IftuXB_IA_IFTU1b
0xEC341000	SSX_IftuXB_IA_IFTU2
0xEC348000	SSX_IftuXB_IA_IftuRegBus
0xEC358000	SSX_IftuXB_TA_VideoXbar0
0xEC358400	SSX_IftuXB_TA_VideoXbar1

VIP Xbar

Address	Description
0xEC440000	SSX_VipXB_IA_VDP0
0xEC440400	SSX_VipXB_IA_VDP1
0xEC440800	SSX_VipXB_IA_VDP2
0xEC440C00	SSX_VipXB_IA_VDP3
0xEC441000	SSX_VipXB_IA_VDPMeP
0xEC441400	SSX_VipXB_IA_BAPMeP
0xEC448000	SSX_VipXB_IA_GpuRegBus
0xEC450000	SSX_VipXB_TA_GpuXbar
0xEC458000	SSX_VipXB_TA_VideoXbar0
0xEC458400	SSX_VipXB_TA_VideoXbar1

Debug Bus

Address	Description
0xEC540000	SSX_DebugBus_IA_DMAC6
0xEC540400	SSX_DebugBus_IA_PA
0xEC548000	SSX_DebugBus_IA_VideoXbar
0xEC550000	SSX_DebugBus_TA_SDIO0
0xEC550400	SSX_DebugBus_TA_SDIO1
0xEC550800	SSX_DebugBus_TA_LPDDR1
0xEC558000	SSX_DebugBus_TA_VideoXbar

DMAC Xbar

Address	Description
0xEC640000	SSX_DmacXB_IA_DMAC0
0xEC640400	SSX_DmacXB_IA_DMAC1
0xEC648000	SSX_DmacXB_IA_IoSlaveBus
0xEC658000	SSX_DmacXB_TA_MainXbar0
0xEC658400	SSX_DmacXB_TA_MainXbar1
0xEC658800	SSX_DmacXB_TA_CenterXbar0
0xEC658C00	SSX_DmacXB_TA_CenterXbar1

IO Slave Bus

Address	Description
0xED048000	SSX_IoSlaveBus_IA_MainXbar
0xED058000	SSX_IoSlaveBus_TA_PervasiveBus
0xED058400	SSX_IoSlaveBus_TA_NorthIoBus
0xED058800	SSX_IoSlaveBus_TA_GpuRegBus
0xED058C00	SSX_IoSlaveBus_TA_MiscIoBus
0xED059000	SSX_IoSlaveBus_TA_CameraSlaveBus0
0xED059400	SSX_IoSlaveBus_TA_CameraSlaveBus1
0xED059800	SSX_IoSlaveBus_TA_CameraSlaveBus2
0xED059C00	SSX_IoSlaveBus_TA_IoMasterBus
0xED05A000	SSX_IoSlaveBus_TA_DmacXbar

IO Master Bus

Address	Description
0xED148000	SSX_IoMasterBus_IA_NorthIoBus
0xED148400	SSX_IoMasterBus_IA_CameraMasterBus
0xED148800	SSX_IoMasterBus_IA_IoSlaveBus
0xED158000	SSX_IoMasterBus_TA_MainXbar
0xED158400	SSX_IoMasterBus_TA_CenterXbar

Pervasive Bus

Address	Description
0xED248000	SSX_PervasiveBus_IA_IoSlaveBus
0xED250000	SSX_PervasiveBus_TA_DMAC0
0xED250000	SSX_PervasiveBus_TA_DMAC1
0xED250800	SSX_PervasiveBus_TA_Pervasive
0xED250C00	SSX_PervasiveBus_TA_CoreSight
0xED251000	SSX_PervasiveBus_TA_VFPINT

Misc IO Bus

Address	Description
0xED348000	SSX_MiscIoBus_IA_IoSlaveBus
0xED350000	SSX_MiscIoBus_TA_UART0
0xED350400	SSX_MiscIoBus_TA_UART1
0xED350800	SSX_MiscIoBus_TA_UART2
0xED350C00	SSX_MiscIoBus_TA_UART3
0xED351000	SSX_MiscIoBus_TA_UART4
0xED351400	SSX_MiscIoBus_TA_UART5
0xED351800	SSX_MiscIoBus_TA_UART6
0xED351C00	SSX_MiscIoBus_TA_GPIO0
0xED352000	SSX_MiscIoBus_TA_Timer
0xED352400	SSX_MiscIoBus_TA_PWM

North IO Master Bus

Address	Description
0xED440000	SSX_NIoMasterBus_IA_DMAC4
0xED440400	SSX_NIoMasterBus_IA_DMAC5
0xED440800	SSX_NIoMasterBus_IA_HSMMC1
0xED440C00	SSX_NIoMasterBus_IA_HSMMC2
0xED441000	SSX_NIoMasterBus_IA_HSMMC3
0xED448000	SSX_NIoMasterBus_IA_NIoSlaveBus
0xED450000	SSX_NIoMasterBus_TA_KeyRing
0xED458000	SSX_NIoMasterBus_TA_AudioBus
0xED458400	SSX_NIoMasterBus_TA_SrcBus
0xED458800	SSX_NIoMasterBus_TA_IoMasterBus0
0xED458C00	SSX_NIoMasterBus_TA_IoMasterBus1

Audio Bus

Address	Description
0xED548000	SSX_AudioBus_IA_NIoMasterBus
0xED550000	SSX_AudioBus_TA_I2S0
0xED550400	SSX_AudioBus_TA_I2S1
0xED550800	SSX_AudioBus_TA_I2S2
0xED550C00	SSX_AudioBus_TA_I2SD0
0xED551000	SSX_AudioBus_TA_I2SD1
0xED551400	SSX_AudioBus_TA_I2S4
0xED551C00	SSX_AudioBus_TA_I2S7
0xED552000	SSX_AudioBus_TA_SPDIF

North IO Slave Bus

Address	Description
0xED648000	SSX_NIoSlaveBus_IA_IoSlaveBus
0xED650000	SSX_NIoSlaveBus_TA_DMAC4
0xED650400	SSX_NIoSlaveBus_TA_DMAC5
0xED650800	SSX_NIoSlaveBus_TA_I2C0
0xED650C00	SSX_NIoSlaveBus_TA_I2C1
0xED651000	SSX_NIoSlaveBus_TA_HSMMC1
0xED651400	SSX_NIoSlaveBus_TA_HSMMC2
0xED651800	SSX_NIoSlaveBus_TA_HSMMC3
0xED658000	SSX_NIoSlaveBus_TA_NIoMasterBus

SRC Bus

Address	Description
0xED748000	SSX_SrcBus_IA_NIoMasterBus
0xED750000	SSX_SrcBus_TA_SRC0
0xED750400	SSX_SrcBus_TA_SRC1
0xED750800	SSX_SrcBus_TA_SRC2

GPU Register Bus

Address	Description
0xED848000	SSX_GpuRegBus_IA_IoSlaveBus
0xED850000	SSX_GpuRegBus_TA_DMAC2
0xED850400	SSX_GpuRegBus_TA_DMAC3
0xED850800	SSX_GpuRegBus_TA_LCDDMAC
0xED850C00	SSX_GpuRegBus_TA_DMAC6
0xED851000	SSX_GpuRegBus_TA_PA
0xED851400	SSX_GpuRegBus_TA_Pervasive2
0xED851800	SSX_GpuRegBus_TA_SonyRegBus
0xED858000	SSX_GpuRegBus_TA_IftuRegBus
0xED858400	SSX_GpuRegBus_TA_VipXbar

IFTU Register Bus

Address	Description
0xED948000	SSX_IftuRegBus_IA_GpuRegBus
0xED950000	SSX_IftuRegBus_TA_IFTU0
0xED950400	SSX_IftuRegBus_TA_IFTU1
0xED950800	SSX_IftuRegBus_TA_IFTU2
0xED950C00	SSX_IftuRegBus_TA_DSI0
0xED951000	SSX_IftuRegBus_TA_DSI1
0xED958000	SSX_IftuRegBus_TA_IftuXbar

Camera Slave Bus

Address	Description
0xEE048000	SSX_CameraSlaveBus_IA_IoSlaveBus0
0xEE048400	SSX_CameraSlaveBus_IA_IoSlaveBus1
0xEE048800	SSX_CameraSlaveBus_IA_IoSlaveBus2
0xEE050000	SSX_CameraSlaveBus_TA_GPIO1
0xEE058000	SSX_CameraSlaveBus_TA_CameraRegBus
0xEE058400	SSX_CameraSlaveBus_TA_SlcdSlaveBus0
0xEE058800	SSX_CameraSlaveBus_TA_UsbSlaveBus
0xEE058C00	SSX_CameraSlaveBus_TA_SlcdSlaveBus1
0xEE059000	SSX_CameraSlaveBus_TA_CameraMasterBus

Camera Master Bus

Address	Description
0xEE140000	SSX_CameraMasterBus_IA_CameraIf0
0xEE140400	SSX_CameraMasterBus_IA_CameraIf1
0xEE148000	SSX_CameraMasterBus_IA_SlcdMasterBus
0xEE148400	SSX_CameraMasterBus_IA_UsbMasterBus
0xEE148800	SSX_CameraMasterBus_IA_CameraSlaveBus
0xEE158000	SSX_CameraMasterBus_TA_IoMasterBus0
0xEE158400	SSX_CameraMasterBus_TA_IoMasterBus1

USB Slave Bus

Address	Description
0xEE248000	SSX_UsbSlaveBus_IA_CameraSlaveBus
0xEE250000	SSX_UsbSlaveBus_TA_USB0HOST
0xEE250400	SSX_UsbSlaveBus_TA_USB1HOST
0xEE250800	SSX_UsbSlaveBus_TA_USB2HOST
0xEE252C00	SSX_UsbSlaveBus_TA_USB1DEVICE
0xEE253000	SSX_UsbSlaveBus_TA_USB2DEVICE
0xEE253400	SSX_UsbSlaveBus_TA_USB0DEVICE
0xEE258000	SSX_UsbSlaveBus_TA_UsbMasterBus

USB Master Bus

Address	Description
0xEE340400	SSX_UsbMasterBus_IA_USB1OHCI
0xEE340800	SSX_UsbMasterBus_IA_USB1EHCI
0xEE340C00	SSX_UsbMasterBus_IA_USB2OHCI
0xEE341000	SSX_UsbMasterBus_IA_USB2EHCI
0xEE341400	SSX_UsbMasterBus_IA_USB0OHCI
0xEE341800	SSX_UsbMasterBus_IA_USB0EHCI
0xEE343400	SSX_UsbMasterBus_IA_USB1DEVICE
0xEE343800	SSX_UsbMasterBus_IA_USB2DEVICE
0xEE343C00	SSX_UsbMasterBus_IA_USB0DEVICE
0xEE348000	SSX_UsbMasterBus_IA_UsbSlaveBus
0xEE358000	SSX_UsbMasterBus_TA_CameraMasterBus

SubLCD Slave Bus

Address	Description
0xEE448000	SSX_SlcdSlaveBus_IA_CameraSlaveBus0
0xEE448400	SSX_SlcdSlaveBus_IA_CameraSlaveBus1
0xEE450000	SSX_SlcdSlaveBus_TA_HSMMC0
0xEE450400	SSX_SlcdSlaveBus_TA_SubLCD
0xEE450800	SSX_SlcdSlaveBus_TA_SMSHC
0xEE450C00	SSX_SlcdSlaveBus_TA_SPI0
0xEE451000	SSX_SlcdSlaveBus_TA_SPI1
0xEE451400	SSX_SlcdSlaveBus_TA_SPI2
0xEE458000	SSX_SlcdSlaveBus_TA_SlcdMasterBus

SubLCD Master Bus

Address	Description
0xEE540000	SSX_SlcdMasterBus_IA_HSMMC0
0xEE540400	SSX_SlcdMasterBus_IA_SubLCD
0xEE540800	SSX_SlcdMasterBus_IA_SMSHC
0xEE548000	SSX_SlcdMasterBus_IA_SlcdSlaveBus
0xEE558000	SSX_SlcdMasterBus_TA_CameraMasterBus

Camera Register Bus

Address	Description
0xEE648000	SSX_CameraRegBus_IA_CameraSlaveBus
0xEE650000	SSX_CameraRegBus_TA_CameraIf0
0xEE650400	SSX_CameraRegBus_TA_CameraIf1
0xEE650800	SSX_CameraRegBus_TA_CSI0
0xEE650C00	SSX_CameraRegBus_TA_CSI1

Start	End	Size	World	Comments
0x00000000	0x00007FFF	0x8000	NS/S	ARM Boot. Alias of physical address 0x1F000000 i.e. ScePower scratchpad. Cannot be used by CMeP, even if it is read-only. However, CMeP can use 0x1F000000.
0x00040000	0x0005FFFF	0x20000	S	MeP boot. Mirror of physical address 0x00800000.
0x00300000	0x0030FFFF	0x10000	S	cmep icache
0x00310000	0x0031FFFF	0x10000	S	cmep icache tag
0x00320000	0x0032FFFF	0x10000	S	cmep dcache
0x00330000	0x0033FFFF	0x10000	S	cmep dcache tag
0x004B0000	0x005FFFFF	0x150000	S	Reserved for Venezia
0x00600000	0x007FFFFF	0x200000	S	Reserved for MeP
0x00800000	0x0081FFFF	0x20000	S	cmep 128KiB SRAM. second_loader, secure kernel, sm location.
0x1A000000	0x1A001FFF	0x2000	NS/S	ARM. SceInterruptControllerReg, ScePeriphReg, Interrupts (PERIPHBASE). Stores SCU_CONTROL_REG, SCU_SAC_REG.
0x1A002000	0x1A002FFF	0x1000	NS/S	ARM. ScePl310Reg, SceL2CacheReg, L2 Cache Controller. Stores SCU_CONFIG_REG, PL310_CACHE_ID, PL310_CACHE_TYPE.
0x1C000000	0x1C1FFFFF	0x200000	NS/S	SRAM. SRAM used to store ARZL decoded SceSysmem by SKBL, SceDisplay / SceCamera SRAM (only 960x544 pixels * 4 bytes = 0x1FE000 bytes mapped), Compatibility SRAM for PspEmu (Tachyon-eDRAM), SceKernelBsodSram for SceKernelBlueScreenOfDeath.
0x1F000000	0x1F007FFF	0x8000	NS/S	SPAD32K, ScePowerScratchPad32KiB. After suspend, SKBL stores there "Non-secure power.kprx resume" using suspendinfo then jumps to it.
0x1F840000	0x1F85FFFF	0x20000	NS/S	SPAD128K. SceVeneziaSpram. Stores Secure Kernel on boot.
0x20000000	0x27FFFFFF	0x8000000	NS	VRAM. Graphics bar
0x30000000	?	?	S	Unknown. Used by first_loader (proto:0x5C398) and second_loader (3.60:0x808208).
0x40000000	0x401FFFFF on FWs < 3.50 0x401FFFFF on FWs >= 3.50	0x300000 on FWs < 3.50 0x200000 on FWs >= 3.50	S	Secure DRAM
0x40300000 on FWs < 3.50 0x40200000 on FWs >= 3.50	0xBFFFFFFF	0x7FD00000 on FWs < 3.50 0x7FE00000 on FWs >= 3.50	NS/S	Non-secure Shared DRAM
0xC0000000	0xDFFFFFFF	0x20000000	NS/S	Reserved for Venezia. Maybe unused.
0xE0000000	0xE00FFFFF	0x100000	S	Control Register. cmep
0xE0100000	0xE0100FFF	0x1000	NS	SceGpio1Reg
0xE0400000	0xE0400FFF	0x1000	NS	SceDmacmgrDmac4Reg
0xE0410000	0xE0410FFF	0x1000	NS	SceDmacmgrDmac5Reg
0xE0420000	0xE0420FFF	0x1000	NS	SceI2s0Reg
0xE0430000	0xE0430FFF	0x1000	NS	SceI2s1Reg
0xE0440000	0xE0440FFF	0x1000	NS	SceI2s2Reg
0xE0450000	0xE0450FFF	0x1000	NS	SceI2s3Reg
0xE0460000	0xE0460FFF	0x1000	NS	SceI2s5Reg
0xE0470000	0xE0470FFF	0x1000	NS	SceI2s4Reg
0xE0490000	0xE0490FFF	0x1000	NS	SceI2s7Reg
0xE04A0000	0xE04A0FFF	0x1000	NS	SceSrcMix0Reg
0xE04B0000	0xE04B0FFF	0x1000	NS	SceSrcMix1Reg
0xE04C0000	0xE04C0FFF	0x1000	NS	SceSrcMix2Reg
0xE04D0000	0xE04D3FFF	0x4000	NS	SceSpdifReg
0xE04DC000	0xE04DCFFF	0x1000	NS	SceAclkgenReg
0xE04E0000	0xE04E0FFF	0x1000	NS/S	SceDmacmgrKeyringReg, SceSblDMAC5DmacKRBase, DMAC Register base
0xE0500000	0xE0500FFF	0x1000	NS	SceI2c0Reg
0xE0510000	0xE0510FFF	0x1000	NS	SceI2c1Reg
0xE0900000	0xE0900FFF	0x1000	NS	SceMsif
0xE0A00000	0xE0A00FFF	0x1000	NS	SceSpi0Reg (SceSyscon)
0xE0A10000	0xE0A10FFF	0x1000	NS	SceSpi1Reg (SceMotionDev)
0xE0A20000	0xE0A20FFF	0x1000	NS	SceSpi2Reg (SceOled)
0xE0B00000	0xE0B00FFF	0x1000	NS	SceSdif0
0xE0C00000	0xE0C00FFF	0x1000	NS	SceSdif1
0xE0C10000	0xE0C10FFF	0x1000	NS	SceSdif2
0xE0C20000	?	?	?	SceSdif3 (not present on FW 1.69, does FW 3.60 use only NSKBL?)
0xE2030000	0xE209FFFF	0x70000	NS	SceUartReg
0xE20A0000	0xE20AFFFF	0x10000	NS/S	SceGpio0Reg / SceLedReg
0xE20B1000	0xE20B5FFF	0x5000	NS	SceLongRangeTimerReg
0xE20B6000	0xE20B6FFF	0x1000	NS	SceLT5, Clock in usec (part of SceLongRangeTimerReg)
0xE20B7000	0xE20BDFFF	0x7000	NS	SceWordTimerReg
0xE20BE000	0xE20BEFFF	0x1000	S?	SceTimerForUsleep (part of SceWordTimerReg)
0xE20C0000	0xE20C0FFF	0x1000	NS	ScePwmReg
0xE3000000	0xE3000FFF	0x1000	NS	SceDmacmgrDmac0Reg
0xE3010000	0xE3010FFF	0x1000	NS	SceDmacmgrDmac1Reg
0xE3020000	0xE3020FFF	0x1000	NS	SceCif0Reg
0xE3030000	0xE3030FFF	0x1000	NS	SceCif1Reg
0xE3050000	0xE3050FFF	0x1000	NS	SceCsi0Reg
0xE3060000	0xE3060FFF	0x1000	NS	SceCsi1Reg
0xE3100000	0xE3100FFF	0x1000	NS	ScePervasiveMisc
0xE3101000	0xE3101FFF	0x1000	NS	ScePervasiveResetReg
0xE3102000	0xE3102FFF	0x1000	NS	ScePervasiveGate
0xE3103000	0xE3103FFF	0x1000	NS	ScePervasiveBaseClk
0xE3104000	0xE3104FFF	0x1000	NS	ScePervasiveVid
0xE3105000	0xE3105FFF	0x1000	NS	SceUartClkgenReg
0xE3106000	0xE3106FFF	0x1000	NS	ScePervasiveMailboxReg
0xE3108000	0xE3108FFF	0x1000	NS	ScePervasiveTas0
0xE3109000	0xE3109FFF	0x1000	NS	ScePervasiveTas1
0xE310A000	0xE310AFFF	0x1000	NS	ScePervasiveTas2
0xE310B000	0xE310BFFF	0x1000	NS	ScePervasiveTas3
0xE310C000	0xE310CFFF	0x1000	NS	ScePervasiveTas4
0xE310D000	0xE310DFFF	0x1000	NS	ScePervasiveTas5
0xE310E000	0xE310EFFF	0x1000	NS	ScePervasiveTas6
0xE310F000	0xE310FFFF	0x1000	NS	ScePervasiveTas7
0xE3110000	0xE3110FFF	0x1000	NS	SPM32, SPM128, Compati SRAM, ScePervasive2Reg, SceUdcd0
0xE3200000	0xE3200FFF	0x1000	S	Base Debug ROM Table
0xE3203000	0xE3203FFF	0x1000	NS	SceTpiuReg
0xE3204000	0xE3204FFF	0x1000	NS	SceFunnelReg
0xE3205000	0xE3205FFF	0x1000	NS	SceItmReg
0xE3300000	0xE3300FFF	0x1000	S	ARM Cortex-A9 Debug ROM Table
0xE3310000	0xE3310FFF	0x1000	NS	SceDbg0Reg, Debugger Interface
0xE3311000	0xE3311FFF	0x1000	NS	ScePmu0Reg
0xE3312000	0xE3312FFF	0x1000	NS	SceDbg1Reg, Debugger Interface
0xE3313000	0xE3313FFF	0x1000	NS	ScePmu1Reg
0xE3314000	0xE3314FFF	0x1000	NS	SceDbg2Reg, Debugger Interface
0xE3315000	0xE3315FFF	0x1000	NS	ScePmu2Reg
0xE3316000	0xE3316FFF	0x1000	NS	SceDbg3Reg, Debugger Interface
0xE3317000	0xE3317FFF	0x1000	NS	ScePmu3Reg
0xE3318000	0xE3318FFF	0x1000	NS	SceCti0Reg
0xE3319000	0xE3319FFF	0x1000	NS	SceCti1Reg
0xE331A000	0xE331AFFF	0x1000	NS	SceCti2Reg
0xE331B000	0xE331BFFF	0x1000	NS	SceCti3Reg
0xE331C000	0xE331CFFF	0x1000	NS	ScePtm0Reg
0xE331D000	0xE331DFFF	0x1000	NS	ScePtm1Reg
0xE331E000	0xE331EFFF	0x1000	NS	ScePtm2Reg
0xE331F000	0xE331FFFF	0x1000	NS	ScePtm3Reg
0xE3320000	0xE3323FFF	0x4000	NS	ARM-VFP. SceIntrmgrVfpIntRegs
0xE4020000	0xE4020FFF	0x1000	NS	USB2_OHCI. SceUsbdEhci
0xE40B0000	0xE40B0FFF	0x1000	NS	SceUsbdEhci
0xE40C0000	0xE40C0FFF	0x1000	NS	SceUdcd1
0xE40D0000	0xE40D0FFF	0x1000	NS	SceUdcd2
0xE40E0000	0xE40E0FFF	0x1000	NS	SceUsbdEhci
0xE5000000	0xE5000FFF	0x1000	NS	SceDmacmgrDmac2Reg
0xE5010000	0xE5010FFF	0x1000	NS	SceDmacmgrDmac3Reg
0xE5020000	0xE5020FFF	0x1000	NS	SceIftu0RegA (OLED FB)
0xE5021000	0xE5021FFF	0x1000	NS	SceIftu0RegB
0xE5022000	0xE5022FFF	0x1000	NS	SceIftuc0Reg
0xE5030000	0xE5030FFF	0x1000	NS	SceIftu1RegA (HDMI FB)
0xE5031000	0xE5031FFF	0x1000	NS	SceIftu1RegB
0xE5032000	0xE5032FFF	0x1000	NS	SceIftuc1Reg
0xE5040000	0xE5040FFF	0x1000	NS	SceIftu2Reg
0xE5050000	0xE5050FFF	0x1000	NS	SceDsi0Reg
0xE5060000	0xE5060FFF	0x1000	NS	SceDsi1Reg
0xE5070000	0xE5070FFF	0x1000	NS	SceCompatMailbox
0xE5071000	0xE5071FFF	0x1000	NS	SceCompatLCDDMA
0xE50C0000	0xE50C0FFF	0x1000	NS	SceDmacmgrDmac6Reg
0xE50D0000	0xE50D1FFF	0x2000	NS	Debug/PA, ScePfmReg, SceDeci4pDtracepPaReg
0xE5800000	0xE580FFFF	0x10000	NS	SceSDbgSdio0
0xE5810000	0xE581FFFF	0x10000	NS	SceDbgSdio1
0xE5880000	0xE588FFFF	0x10000	?	LPDDR2 I/F CH1. LPDDR2SUB (1st 256MiB DRAM bank config regs) (?)
0xE6000000	0xE600FFFF	0x10000	?	LPDDR2 I/F CH0. LPDDR2"TOP" (2nd 256MiB DRAM bank config regs) (?). Stores DDRSC_CONF.
0xE8000000	0xE8001FFF	0x2000	S	SceSonyRegbus. GPU Control
0xE8100000	0xE8100FFF	0x1000	NS/S	SceCompatSharedSram (0xBFC00000 in PSP)
0xE8200000	0xE8200FFF	0x1000	S	SceEmcTop (External Memory Controller, VRAM?)
0xE8300000	0xE8301FFF	0x2000	S	SceGrab
0xE8400000	0xE841FFFF	0x20000	NS	SceSGX543Reg. See SGX543.
0xEC000000	?	?	?	Mapped by SKBL
0xED000000	?	?	?	Mapped by SKBL
0xEE000000	?	?	?	Mapped by SKBL
0xF0000000	?	?	?	Reserved for Venezia

Secure DRAM

FW 0.931 Secure DRAM

On FW 0.931, SKBL is stored at physical address 0x50000000. So, on FW 0.931, which data are stored at 0x40040000? Is it even considered as Secure DRAM?

ARZL compressed NSKBL is kept in place inside SKBL segment 0 (at offset 0x37100) til ARZL decoding to Non-secure DRAM at physical address 0x51000000.

FWs 0.990-0.995 Secure DRAM

On FWs 0.990-0.995, SKBL segment 0 starts at physical address 0x40040000.

ARZL compressed NSKBL is extracted from a kernel_boot_loader segment to Non-secure DRAM at physical address 0x50000000. It is then ARZL decoded to Non-secure DRAM at physical address 0x51000000.

FWs >=0.996 Secure DRAM

Since FW 0.996, SKBL segment 0 starts at physical address 0x40020000. This change could have come from the increasing SKBL segment 0 size with revisions.

FW 3.60 Secure DRAM

Start	End	Size	Comments
0x40000000	0x400000BF	0xC0	SKBL Reset Vector
0x40000500	0x400099FF	0x9500	kprx_auth_sm.self. This area is also used as a scratchpad at boot.
0x40009B00	0x4000A27F	0x780	prog_rvk.srvk
0x4001FD00	0x4001FEFF	0x100	SceKblParam with magic not set
0x40020000	0x400570C7	0x370C8	SKBL segment 0
0x40057100	0x400571DF	0xE0	SKBL segment 1
0x40073570	0x4007376F	0x200	SceKblParam

Non-secure Shared DRAM

This region is used by both Secure and Non-Secure Kernel Boot Loaders, and by Secure Kernel modules.

Start	End	Size	Comments
0x40200000 on FW 3.60 0x40300000 on FW 1.69	0x4FFFFFFF	0x0FE00000 on FW 3.60 0x0FD00000 on FW 1.69	TrustZone region. ?First 0x1000 bytes are a Reset Vector named SceKernelReset whose first 0x100 bytes are identical as in uncompressed NSKBL (need to check)?
0x50000000	0x50FFFFFF	0x1000000	ARZL compressed NSKBL. Comes from one of kernel_boot_loader.self segments.
0x51000000	0x51FFFFFF	0x1000000	SceBootKernelImage. Uncompressed NSKBL. Comes from ARZL compressed NSKBL.
0x52000000	0x5FFFFFFF	0xE000000	Non-secure kernel and usermode modules
0x60000000	0x7FFFFFFF	0x20000000	DevKit additional 512MiB. LDDR2TOP.
0x80000000	0x9FFFFFFF	0x20000000	DevKit additional 512MiB. LDDR2SUB. For perf (not published anywhere). This memory is mapped on usermode VA 0x40000000.
0xA0000000	0xBFFFFFFF	0x20000000	DevKit additional 512MiB. LDDR2SUB. For perf (not published anywhere, disabled).

NSKBL Layout

NSKBL on FW 0.931

ARZL encoded size: 0x2541B.

NSKBL on FW 3.60

Start	End	Size	Comments
0x51000000	0x51028087	0x28088	NSKBL Text segment
???	???	???	NSKBL Data segment

Notes:

• The first 0xC0 bytes of the Text segment are the reset vector.
• NSKBL is mapped in RWX mode so it may write itself to text segment.

cmep

Each cmep device has its own physical memory area.

Start	End	Comments
0xE0000000	0xE000FFFF	ARM/F00D communication F00D Communication Ports
0xE0010000	0xE001FFFF	cmep Reset
0xE0020000	0xE002FFFF	Unknown device. See ReadAs. Related to DMA.
0xE0030000	0xE003FFFF	F00D Key Ring Controller. ?EEPROM programmer?
0xE0040000	0xE004FFFF	F00D Math Processor (Bignum worker)
0xE0050000	0xE0050FFF?	Bigmac crypto engine, similar to DMAC5
0xE0058000	0xE0067FFF	F00D Keyring Regs F00D Key Ring Base. EEPROM / Bigmac key rings, 0x800 entries, 0x20 bytes for each key ring
0xE0070000	?	SceEmmcController
0xE00C0000	0xE00CFFFF	?

Interrupt registers

Start	End	Comments
0xE3100138	0xE310013B	BEATB
0xE310013C	0xE310013F	BEADR
0xE3110D80	0xE3110D83	BET0
0xE3110D90	0xE3110D93	BET1
0xE3110D94	0xE3110D97	BEBT
0xE3000110	0xE3000113	DMAC0 - address
0xE3000114	0xE3000117	DMAC0 - attribute
0xE3010110	0xE3010113	DMAC1 - address
0xE3010114	0xE3010117	DMAC1 - attribute
0xE5000110	0xE5000113	DMAC2 - address
0xE5000114	0xE5000117	DMAC2 - attribute
0xE5010110	0xE5010113	DMAC3 - address
0xE5010114	0xE5010117	DMAC3 - attribute
0xE0400810	0xE0400813	DMAC4 - address
0xE0400814	0xE0400817	DMAC4 - attribute
0xE50C0110	0xE50C0113	DMAC6 - address
0xE50C0114	0xE50C0117	DMAC6 - attribute
0xE3110D14	0xE3110D17	SPM32 - address
0xE3110D18	0xE3110D1B	SPM32 - attribute
0xE3110D04	0xE3110D07	SPM128 - address
0xE3110D08	0xE3110D0B	SPM128 - attribute
0xE600C008	0xE600C00B	LPDDR2 I/F CH0 - address
0xE600C000	0xE600C003	LPDDR2 I/F CH0 - attribute
0xE588C008	0xE588C00B	LPDDR2 I/F CH1 - address
0xE588C000	0xE588C003	LPDDR2 I/F CH1 - attribute
0xE310013C	0xE310013F	Pervasive - address
0xE3100138	0xE310013B	Pervasive - attribute
0xE50D10F0	0xE50D10F3	Debug/PA - address
0xE50D10F4	0xE50D10F7	Debug/PA - attribute
0xE3110D34	0xE3110D37	Pervasive2 - address
0xE3110D38	0xE3110D3B	Pervasive2 - attribute
0xE580FFF0	0xE580FFF3	SDIO0 - address
0xE580FFF4	0xE580FFF7	SDIO0 - attribute
0xE581FFF0	0xE581FFF3	SDIO1 - address
0xE581FFF4	0xE581FFF7	SDIO1 - attribute

PSP Emulator

PSP Emulator memory map