Pervasive

Pervasive is a register group used for various purposes, such as controlling the clocks of most peripherals in Kermit.

The name probably comes from pervasive logic, a term used to describe logic present in hardware designs, yet not a part of the primary functionalities.

ScePervasiveMisc (0xE3100000)

Devices can be fully disabled? by writing a 1 to the corresponding bit of the ScePervasiveMisc (PA 0xE3100000) register. To disable the device dev_off, do *REG32(0xE3100000 + (dev_off / 32) * 4) = 1 << (31 - (dev_off % 32)).

Offset	Description
0x000	Read-only. revision0. ex:0x80000115
0x004	Read-only. Unknown - SKBL prints L2 Cache is defective if bit 0x2 is set
0x008	RAZ/WI
0x00C
0x010	Unknown. Only bit 0 is R/W
0x014	RAZ/WI
0x018
0x01C
0x020	Unknown. Only bits 0x8000003F are R/W.
0x024	RAZ/WI
0x028
0x02C
0x030	Unknown. Only bit 0 is R/W. Writing 1 hangs the system.
0x034	Related to GPU. Only bit 0 is R/W. Writing 1 triggers a DABT in gpu_es4.skprx.
0x038	Unknown. Only bit 0 is R/W. Writing 1 then 0 hangs the system.
0x03C	Related to GPU. Only bit 0 is R/W. Writing 1 triggers a DABT in gpu_es4.skprx
0x040	Unknown. Only bit 0 is R/W.
0x044	Unknown. Only bit 0 is R/W. Writing 1 hangs the system.
0x0048	Unknown. Only bit 0 is R/W.
0x04C	Unknown. Only bit 0 is R/W.
0x050	Unknown. Only bit 0 is R/W. Writing 1 hangs the system.
0x054	Unknown. Only bit 0 is R/W.
0x058	Unknown. Only bit 0 is R/W.
0x05C	RAZ/WI
0x060	Unknown. Only bit 0 is R/W.
0x064	RAZ/WI
0x068
0x06C
0x070
0x074
0x078
0x07C
0x080
0x084	Related to USB Device Controller
0x088	Related to USB Device Controller
0x08C	Related to USB Device Controller
0x090	RAZ/WI
0x094
0x098
0x09C
0x0A0	Unknown. Only bit 0 is R/W.
0x0A4	RAZ/WI
0x0A8
0x0AC
0x0B0	Unknown. Only bits 0x7FFFF are R/W. Example: 0x1F3DA
0x0B4	Unknown. Only bits 0xFF are R/W.
0x0B8	RAZ/WI
0x0BC
0x0C0
0x0C4	Unknown. Only bit 0 is R/W.
0x0C8	RAZ/WI
0x0CC
0x0D0	Unknown. Only bit 0 is R/W.
0x0D4	RAZ/WI
0x0D8
0x0DC
0x0E0	Unknown. Only bit 0 is R/W.
0x0E4	Unknown. Only bit 0 is R/W.
0x0E8	Unknown. Only bit 0 is R/W.
0x0EC	RAZ/WI
0x0F0
0x0F4
0x0F8
0x0FC
0x100
0x104
0x108
0x10C
0x110	SDIF related
0x114	SDIF related
0x118	SDIF related
0x11C	SDIF related
0x120	RAZ/WI
0x124	SDIF voltage control? - 3.3V by default; 1 << sdif_idx to set the SDIF to 1.8V
0x128	RAZ/WI
0x12C
0x130	PERVASIVE_SYS_SBEATB - Pervasive Secure Bus Error Attribute
0x134	PERVASIVE_SYS_SBEADR - Pervasive Secure Bus Error Address
0x138	PERVASIVE_SYS_BEATB - Pervasive Bus Error Attribute
0x13C	PERVASIVE_SYS_BEADR - Pervasive Bus Error Address
0x140	Related to DSI0
0x144	Related to CSI/CIF
0x148	Related to DSI1
0x14C	RAZ/WI
0x150	Read/write. Unknown.
0x154	Read/write. Unknown.
0x158	Unknown. Only bits 0xFFFF are R/W.
0x15C	RAZ/WI
0x160	Unknown. Only bits 0xFFFF are R/W.
0x164	Unknown. Only bits 0xFFFF are R/W.
0x168	RAZ/WI
0x16C
0x170	UDC-related? (similar to 0x17C)
0x174
0x178
0x17C	Related to USB Device Controller
0x180	Read/write. Unknown.
0x184	Unknown. Only bits 0xFF are R/W.
0x188	Unknown. Only bit 0 is R/W.
0x18C	Unknown. Only bits 0x3 are R/W.
0x190	Unknown. Only bit 0 is R/W.
0x194	Related to Game Card. Only bit 0 is R/W.
0x198	Unknown. Only bit 0 is R/W.
0x19C	RAZ/WI
0x1A0
0x1A4
0x1A8
0x1AC	Unknown. Only bits 0x3 are R/W.
0x1B0	RAZ/WI
0x1B4
0x1B8
0x1BC
0x1C0
0x1C4
0x1C8
0x1CC
0x1D0
0x1D4
0x1D8
0x1DC
0x1E0
0x1E4
0x1E8
0x1EC
0x1F0
0x1F4
0x1F8
0x1FC
0x200	Unknown. Only bits 0x3 are R/W.
0x204	RAZ/WI
0x208
0x20C
0x210	Unknown. Only bit 0 is R/W.
0x214	Unknown. Only bit 0 is R/W.
0x218	RAZ/WI
0x21C
0x220	Unknown. Only bit 0 is R/W.
0x224	Unknown. Only bit 0 is R/W.
0x228	Unknown. Only bits 0xFFFF are R/W.
0x22C	Unknown. Only bits 0x3 are R/W.
0x230	Unknown. Only bits 0x7 are R/W.
0x240	Unknown. Only bits 0x3 are R/W.
0x260	Unknown. Only bits 0xFF are R/W.
0x270	Unknown. Only bits 0x3 are R/W.
0x274	Unknown. Only bits 0x3 are R/W.
0x280	Unknown. Only bits 0x1F are R/W.
0x284	Unknown. Only bit 0 is R/W.
0x2F0	Unknown. Only bit 0 is R/W.
0x2F4	Unknown. Only bit 0 is R/W. Writing 1 hangs the system.
0x2F8	Related to GPU. Only bit 0 is R/W. Writing 1 triggers a GPU core dump.
0x2FC	Unknown. Only bit 0 is R/W.
0x300	Read-only? Unknown, equal to 0x3E8A8000.
0x304	Read-only? Unknown, equal to 0x65D3450C.
0x308	Read-only? Unknown, equal to 0x9C421841.
0x30C	RAZ/WI
0x310	RAZ/WI? SDIF related
0x314~0xFFC are RAZ/WI

revision0

Returned by SceLowio#scePervasiveGetSoCRevisionForDriver, read by SKBL/NSKBL/...

Contains the Kermit revision (see sceKernelSysrootGetKermitRevisionForKernel) and other information.

Bit mask	Information
0x80000000	Disable LPDDR2SUB. If set, it is not a DevKit.
0x20000000	Enable 4 LPDDR2 banks (used by SceCrashDump). Default is 2 LPPDR2 banks.
0x10000000	Enable 1 LPDDR2 bank (used by SceCrashDump). Default is 2 LPPDR2 banks.
0x0001FFFF	Kermit revision

Kermit revision

Bit mask	Information
0x0001FF00	Kermit new revision (new firmwares) (known values: 0 for KERMIT10_REV_ES4, 1 for KERMIT15_REV_ES1)
0x000000F0	Kermit major revision (old firmwares): Engineering Sample revision (1 = ES1, 2 = ES2, etc.)
0x0000000F	Kermit minor revision (old firmwares)

Known values

Hardware	Value
ES2.0 (according to System Software version 0.920)	0x0000002X
CXD5315GG-1	0x00000042
CXD5315GG	0x80000042
CXD5316GG	0x80000115
CXD5316BGG	0x94000115

ScePervasiveReset (0xE3101000)

Devices must be put out of reset (device reset disabled) before they are first used.

To enable reset of a device (put a device in reset), do *REG32(0xE3101000 + dev_off) |= mask.

To disable reset of a device (put a device out of reset), do *REG32(0xE3101000 + dev_off) &= ~mask.

dev_off	Access	Device	Reset Mask	Comment
0x4	Secure?	ARM Debugger?	1	Of ARM coprocessor 14?
0x10	Non-secure	GPU	1	enable: ScePervasiveForDriver_3E79D3D3/disable: ScePervasiveForDriver_8A85E36B
0x20	Secure	?	1	enable: ScePervasiveForDriver_377126CD/disable: ScePervasiveForDriver_6E11EB97
0x24	Secure	?	1	enable: ScePervasiveForDriver_7B0F388B/disable: ScePervasiveForDriver_4CCD40E6
0x28	Secure	CompatRAM	1	enable: ScePervasiveForDriver_7C285361/disable: ScePervasiveForDriver_E40BED0F
0x30	Non-secure	Venezia	1	enable: ScePervasiveForDriver_28731EC5/disable: ScePervasiveForDriver_A7E64C6F
0x34	Non-secure	Vip	1	enable: ScePervasiveForDriver_31C0A98B/disable: ScePervasiveForDriver_E2D8F6C3
0x40	Secure	SDIO0	1
0x44	Secure	SDIO1	1
0x48	Secure	DebugPA	1
0x4C	Secure	SceDbgSdio	1
0x50	Secure	DMAC0	1
0x54	Secure	DMAC1	1
0x58	Secure	DMAC2	1
0x5C	Secure	DMAC3	1
0x60	Secure	DMAC4	1
0x64	Secure	DMAC5	1
0x68	Secure	DMAC6	1	need devmode or dipsw 0xC0 or 0xC1 or 0xC2.
0x70	Non-secure	Csi	1	Camera Serial Interface
0x74
0x80	Non-secure	Dsi	1
0x84
0x88	Non-secure	Iftu	1	Integrated Facility Terminating Unit. See IFTU Registers. enable: ScePervasiveForDriver_B68254AD/disable: ScePervasiveForDriver_E92E28FF
0x8C	Non-secure	?	1	enable: ScePervasiveForDriver_7AE2F8E8/disable: ScePervasiveForDriver_17109C28
0x90	Non-secure	USB0/UDC0	0xB	See UDC. enable: ScePervasiveForDriver_4AF7A01E/disable: ScePervasiveForDriver_13CC07C9 0x1 - USB Host Controller 0x2 - USB Device Controller 0x8 - ????
0x94		USB1/UDC1
0x98		USB2/UDC2
0xA0	Non-secure	Sdif0 (emmc)	1	Storage Device InterFace
0xA4		Sdif1 (gcsd)
0xA8		Sdif2
0xAC		Sdif3
0xB0	Non-secure	Msif	1	Memory Stick InterFace. See MSIF Registers.
0xC0	Non-secure	I2S (Audio)	1	Inter-IC Sound
0xC4
0xC8
0xCC
0xD0
0xD4
0xD8
0xDC
0xE0	Non-secure	SrcMix	1	Source Mixer
0xE4
0xE8
0xF0	Non-secure	SPDIF (Audio)	1	Sony/Philips Digital InterFace
0x100	Non-secure	Gpio	1	General Purpose Input/Output. See GPIO Registers.
0x104	Non-secure	Spi (Syscon)	1	Serial Peripheral Interface. See SPI Registers.
0x108		Spi (Motion)
0x10C		Spi (OLED)
0x110	Non-secure	I2C	1	Inter-Integrated Circuit. See I2C Registers.
0x114
0x120	Non-secure	Uart0 (Console)	1	Universal Asynchronous Receiver Transmitter. See UART Registers.
0x124		Uart1
0x128		Uart2
0x12C		Uart3
0x130		Uart4
0x134		Uart5 (3G Modem)
0x138		Uart6
0x154	Secure?	Debug Bus	1	Taken out of reset by SKBL if Development mode or DIPsw 0xC0/0xC1/0xC2 is set
0x158	Secure?	?	1
0x160	Secure?	LPDDR2MAIN (DDRIF0)	1
0x164	Secure?	LPDDR2SUB (DDRIF1)	1
0x170	?	Timer	1?
0x178	Secure?	SPM32	4	Scratch Pad Memory 32KiB
		SPM128	8	Scratch Pad Memory 128KiB
0x17C	Secure?	Venezia?	1?	Must be != 0 for SceKernelBusError to dump Venezia registers.
0x180	Secure	VIP?	1	Must be != 0 for SceKernelBusError to dump VIP registers. enable: ScePervasiveForDriver_EBE9C84E/disable: ScePervasiveForDriver_8CF567AD
0x190	Secure	bigmac or emmc cryptor	?	This field is set to 0 by SK command 0xD01.

ScePervasiveGate (0xE3102000)

Devices can be clock gated to preserve battery.

To enable clock gate (request the clock of a device to be enabled), do *REG32(0xE3102000 + dev_off) |= mask.

To disable clock gate (request the clock of a device to be disabled), do *REG32(0xE3102000 + dev_off) &= ~mask.

dev_off	Access	Device	Gate Mask	Comment
0x0	Secure?	ARM?	0x00F10000
0x4	Secure?	ARM Debugger?	1	Of ARM coprocessor 14?
0x8	?	?	0xFFFFFFFF
0xC	?	N/A	N/A	Read-As-Zero / Write-Ignore
0x10	Non-secure	GPU	v & 0xF000F	enable: ScePervasiveForDriver_39E51AE2/disable: ScePervasiveForDriver_CA0ACFC5
0x14	?	N/A	N/A	RAZ/WI
0x18
0x1C
0x20	Secure	?	1 (or 2)	enable: ScePervasiveForDriver_8EE3AEDF/disable: ScePervasiveForDriver_3BF2A9B5
0x24	Secure	?	1	enable: ScePervasiveForDriver_7F4AB4AA/disable: ScePervasiveForDriver_0EBBE8DE
0x28	Secure	CompatRAM (2MiB)	1	enable: ScePervasiveForDriver_B2EE45C9/disable: ScePervasiveForDriver_39979C55
0x2C	?	N/A	N/A	RAZ/WI
0x30	Non-secure	Venezia	1 (2 for secure)	enable: ScePervasiveForDriver_FB01A2DD/disable: ScePervasiveForDriver_2EEBE9AE
0x34	Non-secure	Vip	1	enable: ScePervasiveForDriver_B1CFA18F/disable: ScePervasiveForDriver_03E1FAA6
0x38	?	N/A	N/A	RAZ/WI
0x3C
0x40	Secure	SceDbgSdio	1
0x44	Secure	SceDbgSdio	1
0x48	Secure	DebugPA	1 (or 2)
0x4C	Secure	SceDbgSdio	1	?RAZ/WI?
0x50	Secure	DMAC0	1
0x54	Secure	DMAC1	1
0x58	Secure	DMAC2	1
0x5C	Secure	DMAC3	1
0x60	Secure	DMAC4	1
0x64	Secure	DMAC5	1
0x68	Secure	DMAC6	1	need devmode or dipsw 0xC0 or 0xC1 or 0xC2.
0x6C	?	N/A	N/A	RAZ/WI
0x70	Non-secure	Csi	1	Camera Serial Interface
0x74
0x78	?	N/A	N/A	RAZ/WI
0x7C
0x80	Non-secure	Dsi	1 (or 0xF)
0x84
0x88	Non-secure	Iftu	1	See IFTU Registers. enable: ScePervasiveForDriver_07F2A738/disable: ScePervasiveForDriver_5AFE0AF0
0x8C	Non-secure	?	1	enable: ScePervasiveForDriver_C0C842FE/disable: ScePervasiveForDriver_9BB7B932
0x90	Non-secure	USB0/UDC0	0xB (or 0xF)	See UDC. enable: ScePervasiveForDriver_A2EFD7AF/disable: ScePervasiveForDriver_AD1E81EB 0x1 - USB Host Controller 0x2 - USB Device Controller 0x8 - ????
0x94		USB1/UDC1
0x98		USB2/UDC2
0x9C	?	N/A	N/A	RAZ/WI
0xA0	Non-secure	Sdif0 (emmc)	1	Storage Device InterFace
0xA4		Sdif1 (gcsd)
0xA8		Sdif2
0xAC		Sdif3
0xB0	Non-secure	Msif	1	Memory Stick InterFace. See MSIF Registers.
0xB4	?	N/A	N/A	RAZ/WI
0xB8
0xBC
0xC0	Non-secure	I2S (Audio)	1	Inter-IC Sound
0xC4
0xC8
0xCC
0xD0
0xD4
0xD8
0xDC
0xE0	Non-secure	SrcMix	1	Source Mixer
0xE4
0xE8
0xEC	?	N/A	N/A	RAZ/WI
0xF0	Non-secure	SPDIF (Audio)	1	Sony/Philips Digital InterFace
0xF4	?	N/A	N/A	RAZ/WI
0xF8
0xFC
0x100	Non-secure	Gpio	1	General Purpose Input/Output. See GPIO Registers.
0x104	Non-secure	Spi (Syscon)	1	Serial Peripheral Interface. See SPI Registers.
0x108		Spi (Motion)
0x10C		Spi (OLED)
0x110	Non-secure	I2C	1	Inter-Integrated Circuit. See I2C Registers.
0x114
0x118	?	N/A	N/A	RAZ/WI
0x11C
0x120	Non-secure	Uart0 (Console)	1	Universal Asynchronous Receiver Transmitter. See UART Registers.
0x124		Uart1
0x128		Uart2
0x12C		Uart3
0x130		Uart4
0x134		Uart5 (3G Modem)
0x138		Uart6
0x13C	?	N/A	N/A	RAZ/WI
0x140
0x144
0x148
0x14C
0x150
0x154	Secure?	Debug Bus	1	See ScePervasiveReset for details.
0x158	Secure?	?	1
0x15C	?	N/A	N/A	RAZ/WI
0x160	Secure?	LPDDR2MAIN (DDRIF0)	1
0x164	Secure?	LPDDR2SUB (DDRIF1)	1
0x168	?	N/A	N/A	RAZ/WI
0x16C
0x170	?	Timer	1?
0x174	?	?	1
0x178	Secure?	Compati2MiB	1	a.k.a. Tachyon-eDRAM, Camera SRAM, etc
		?	2	?
		SPM32	4	Scratch Pad Memory 32KiB
		SPM128	8	Scratch Pad Memory 128KiB
		?	0x10	?
0x17C	?	N/A	N/A	RAZ/WI
0x180	?	?	0xFF
0x184	?	?	0x3
0x188	?	N/A	N/A	RAZ/WI
0x18C
0x190~0xFFC are RAZ/WI

ScePervasiveBaseClk (0xE3103000)

“Base Clock” registers - used to control the clocks fed to various peripherals in the SoC.

Offset	Accessibly	Description
0x0/0x4	Non-Secure/Secure	ARM Clocks
0x10	Non-Secure/Secure	GPU Clock
0x20	Non-Secure/Secure (?)	VENEZIA Clock
0x30	Non-Secure	Vip Clock
0x40	Secure	CMeP Clock
0x44	Non-Secure	CameraBus Clock
0x50	Secure	Could be Center Xbar/Bus clock Set to 1 by First Loader under certain conditions
0x60	Non-Secure	Related to offset 0x60/0x64/0xA4.
0x64	Non-Secure	Related to offset 0x60/0x64/0xA4.
0x68	Non-Secure	Unknown. freq setting by ScePervasiveForDriver_A96642E3
0x70	Non-Secure	Related to Audio. freq setting by ScePervasiveForDriver_925D9D24
0x90	Secure	DRAM Main Clock
0x94	Secure	DRAM Sub Clock
0xA4	Non-Secure	Related to offset 0x60/0x64/0xA4.
0xB0	Non-Secure	Msif Clock
0xC4	Secure	Compat/GpuXbar Clock (PSP stuff)
0x100	Non-Secure	DSI1 Clock
0x180	Non-Secure	DSI0 Clock
0x1D0	Non-Secure	HDMI Clock
0x1F0	Non-Secure	Dmac5 Clock
0x210	Non-Secure	Related to Audio. freq setting by ScePervasiveForDriver_2FB5F88F
0x214	Non-Secure	Sys Clock

ARM Clocks

The ARM core clock and L2 cache clock consist of two registers 0xE3103000 and 0xE3103004.

Register 0xE3103000 selects the base clock frequency.

It seems that 42-freq is selected internally when Undefined index is selected

0xE3103000 ARM clock list

Index	ARM core freq	L2 cache freq
0	Undefined	Undefined
1	42	42
2	Undefined	Undefined
3	83	83
4	111	111
5	166	166
6	222	222
7	333	333
8	444	222
9	500	250
10	333	166
11	Undefined	Undefined
12	125	125
13	250	250
14	444	444
15	500	500

Register 0xE3103004 adjusts the selected base clock frequency.

0xE3103004 sets the index that adjusts the base clock frequency.

It seems that the adjustment can be expressed by the following formula.

f(n) = n(1 - adjust_index / 16)

adjust_index ranges from 0 to 8. Selecting 9 or higher selects 0 internally.

Also a joke-like approximation : f(n) = n(1 - aπ^-(1 + √2)).

However, not sure if this formula is completely correct, but It can see that it is very close to the value of yifan's clock analyzer.

ARM core measured adjust freq

base	0	1	2	3	4	5	6	7	8
1	41.666 MHz	39.62 MHz	36.458 MHz	33.854 MHz	31.249 MHz	28.645 MHz	26.41 MHz	23.437 MHz	20.833 MHz
3	83.333 MHz	78.124 MHz	72.916 MHz	67.708 MHz	62.499 MHz	57.291 MHz	52.83 MHz	46.874 MHz	41.666 MHz
4	111.111 MHz	104.166 MHz	97.222 MHz	90.277 MHz	83.333 MHz	76.388 MHz	69.444 MHz	62.499 MHz	55.555 MHz
5	166.666 MHz	156.249 MHz	145.833 MHz	135.416 MHz	124.999 MHz	114.583 MHz	104.166 MHz	93.749 MHz	83.333 MHz
6	222.222 MHz	208.333 MHz	194.444 MHz	180.555 MHz	166.666 MHz	152.777 MHz	138.888 MHz	124.999 MHz	111.111 MHz
7	333.333 MHz	312.499 MHz	291.666 MHz	270.833 MHz	249.999 MHz	229.166 MHz	208.333 MHz	187.499 MHz	166.666 MHz
8	444.444 MHz	416.666 MHz	388.888 MHz	361.111 MHz	333.333 MHz	305.555 MHz	277.777 MHz	249.999 MHz	222.222 MHz
9	500.0 MHz	468.749 MHz	437.499 MHz	406.249 MHz	374.999 MHz	343.749 MHz	312.499 MHz	281.249 MHz	249.999 MHz
10	333.333 MHz	312.499 MHz	291.666 MHz	270.833 MHz	249.999 MHz	229.166 MHz	208.333 MHz	187.499 MHz	166.666 MHz
12	124.999 MHz	117.187 MHz	109.374 MHz	101.562 MHz	93.749 MHz	85.937 MHz	78.124 MHz	70.312 MHz	62.499 MHz
13	249.999 MHz	234.374 MHz	218.749 MHz	203.124 MHz	187.499 MHz	171.874 MHz	156.249 MHz	140.624 MHz	124.999 MHz
14	444.444 MHz	416.666 MHz	388.888 MHz	361.111 MHz	333.333 MHz	305.555 MHz	277.777 MHz	249.999 MHz	222.222 MHz
15	500.0 MHz	468.749 MHz	437.499 MHz	406.249 MHz	374.999 MHz	343.749 MHz	312.499 MHz	281.249 MHz	249.999 MHz

ARM Clocks (by yifan's clock analyzer)

The ARM CPU clocks are controlled by two registers at physical address 0xE3103000 (ScePervasiveBaseClk). Currently, it is unknown how the values are interpreted. However, 0xE3103000 (one word) takes values 0 to 16, and increases clock speed while 0xE3103004 (single byte) takes values 0 to 8 and decreases clock speed. It is likely related to a PLL multiply and divide function. The input clock signal comes from a P1P40167 clock synthesizer (found on the bottom of the board under the main SoC). It takes a 27MHz crystal and generates a 37MHz clock which feeds directly into the SoC's internal PLL.

The following are tests run to determine what the values of each register corresponds to. It appears that the maximum clock speed is 499MHz and the minimum clock speed is 16MHz.

These clocks may be wrong. "Kernel Clock Speed" is "Clock Speed + 5". However, there is an error of ± 5 to 6 in "Clock Speed".

0xE3103000	0xE3103004	Clock Speed (MHz)	Kernel Clock Speed (MHz)
0	0	37	42
0	1	35	40
0	2	32	37
0	3	29	34
0	4	27	32
0	5	24	29
0	6	22	27
0	7	19	24
0	8	16	21
1	0	37	42
1	1	35	40
1	2	32	37
1	3	30	35
1	4	27	32
1	5	24	29
1	6	22	27
1	7	19	24
1	8	16	21
2	0	37	42
2	1	35	40
2	2	32	37
2	3	30	35
2	4	27	32
2	5	24	29
2	6	22	27
2	7	19	24
2	8	16	21
3	0	79	84
3	1	74	79
3	2	69	74
3	3	63	68
3	4	58	63
3	5	53	58
3	6	48	53
3	7	43	48
3	8	37	42
4	0	107	112
4	1	100	105
4	2	93	98
4	3	86	91
4	4	79	84
4	5	72	77
4	6	65	70
4	7	58	63
4	8	51	56
5	0	162	167
5	1	152	157
5	2	142	147
5	3	131	136
5	4	121	126
5	5	110	115
5	6	100	105
5	7	90	95
5	8	79	84
6	0	218	223
6	1	204	209
6	2	190	195
6	3	176	181
6	4	163	168
6	5	148	153
6	6	135	140
6	7	121	126
6	8	107	112
7	0	329	334
7	1	308	313
7	2	287	292
7	3	266	271
7	4	246	251
7	5	225	230
7	6	204	209
7	7	183	188
7	8	162	167
8	0	439	444
8	1	411	416
8	2	384	389
8	3	356	361
8	4	329	334
8	5	301	306
8	6	273	278
8	7	246	251
8	8	218	223
9	0	494	499
9	1	463	468
9	2	432	437
9	3	401	406
9	4	370	375
9	5	339	344
9	6	308	313
9	7	277	282
9	8	245	250
10	0	328	333
10	1	308	313
10	2	287	292
10	3	266	271
10	4	245	250
10	5	225	230
10	6	204	209
10	7	183	188
10	8	162	167
11	0	37	42
11	1	35	40
11	2	32	37
11	3	30	35
11	4	27	32
11	5	24	29
11	6	22	27
11	7	19	24
11	8	16	21
12	0	121	126
12	1	113	118
12	2	105	110
12	3	97	102
12	4	90	95
12	5	82	87
12	6	74	79
12	7	66	71
12	8	58	63
13	0	245	250
13	1	230	235
13	2	214	219
13	3	199	204
13	4	183	188
13	5	168	173
13	6	152	157
13	7	136	141
13	8	121	126
14	0	439	444
14	1	412	417
14	2	384	389
14	3	356	361
14	4	329	334
14	5	301	306
14	6	273	278
14	7	246	251
14	8	218	223
15	0	494	499
15	1	463	468
15	2	433	438
15	3	401	406
15	4	370	375
15	5	339	344
15	6	308	313
15	7	277	282
15	8	245	250
16	0	37	42
16	1	35	40
16	2	32	37
16	3	29	34
16	4	27	32
16	5	24	29
16	6	22	27
16	7	19	24
16	8	16	21

VENEZIA Clock

The register at physical address 0xE3103020 seems to control the clock frequency of VENEZIA.

Allowed register values

Value	Clock speed
0x1	41MHz
0x2	55MHz
0x3	83MHz
0x4	111MHz
0x5	166MHz
0x6	222MHz
0x7	333MHz

Vip Clock

Allowed register values

Value	Clock speed
0x1	41MHz
0x2	55MHz
0x3	83MHz
0x4	111MHz
0x5	166MHz
0x6	222MHz

CMeP Clock

The low 8 bits of the register at physical address 0xE3103040 control CMeP clock speed, and Main Xbar, I/O Bus speed too. This was guessed because it is used in a usleep()-like function to calculate the input for a sleep_for_cycles() function.

Testing was performed using SceLT5 as a time reference (µs-accurate), and compared against the hardcoded table in second_loader.

Value	Main Xbar	I/O Bus	CMeP speed (measured)	Table value
0x0	Unknown	Unknown	41.5 MHz	N/A
0x1	Unknown	Unknown	41.5 MHz
0x2	Unknown	Unknown	55.4 MHz
0x3	Unknown	Unknown	83.0 MHz
0x4	Unknown	Unknown	110.7 MHz
0x5	Unknown	Unknown	166.0 MHz
0x6	Unknown	Unknown	110.7 MHz
0x7	Unknown	Unknown	166.0 MHz
0x10000	Undefined	Undefined	27.7 MHz	50 MHz
0x10001	Undefined	Undefined	27.7 MHz	50 MHz
0x10002	56 MHz	27 MHz	27.7 MHz	27 MHz
0x10003	83 MHz	42 MHz	41.5 MHz	42 MHz
0x10004	111 MHz	56 MHz	55.3 MHz	56 MHz
0x10005	166 MHz	83 MHz	83.0 MHz	83 MHz
0x10006	222 MHz	111 MHz	110.7 MHz	111 MHz
0x10007	333 MHz	166 MHz	166.0 MHz	160 MHz

second_loader sets the register to 0x10005, meaning CMeP usually runs at 83MHz.

CameraBus Clock

Allowed register values

Value	Clock speed
1	41 MHz
2	67 MHz
3	83 MHz
4	133 MHz
5	166 MHz

DRAM Main Clock

Allowed register values

Value	Clock speed (measured)
1	170 MHz

DRAM Sub Clock

Allowed register values

Value	Clock speed (measured)
1	170 MHz

Msif Clock

Allowed register values

Value	Clock speed
0x10000	20 MHz
0x10001	40 MHz
0x10002	60 MHz

Bit 0x10000 is optional i.e by default Msif runs at 20 MHz. Its effect is unknown.

Compat/GpuXbar Clock

Allowed register values

Value	Compat Clock speed	GpuXbar Clock speed
0	333 MHz	166 MHz
1	Unknown	111 MHz
2	222 MHz	83 MHz

Dmac5 Clock

Allowed register values

Value	Clock speed
1	41 MHz
2	83 MHz
3	133 MHz
4	166 MHz

Sys Clock

Allowed register values

Value	Clock speed
0	222 MHz
1	190 MHz

ScePervasiveVid (0xE3104000)

Voltage integer data

Offset	Group	Value
0x0	ARM	0
0x4	ARM	0x1F
0x8	ARM	0x27
0xC	ARM	0x2F
0x10	ARM	0x31
0x14	ARM	0x31
0x40	?	0x1D
0x44	?	0x22
0x48	?	0x2E
0x4C	?	0x25
0x60	?	0x1D
0x64	?	0x27
0x68	?	0x2E
0x6C	?	0x30
0xA0	Bus	0
0xA4	Bus	0x1E
0xA8	Bus	0x27
0xAC	Bus	0x2E

ScePervasive2 (0xE3110000)

Offset	Description
0x248	VIP_PROT_BAP_ERRV
0x24C	VIP_PROT_BAP_ERRC
0x250	VIP_PROT_BAP_ERRA
0x254	VIP_PROT_VDPD_ERRV
0x258	VIP_PROT_VDPD_ERRC
0x25C	VIP_PROT_VDPD_ERRA
0x260	VIP_PROT_VDPM_ERRV
0x264	VIP_PROT_VDPM_ERRC
0x268	VIP_PROT_VDPM_ERRA
0x348	VENE_PROT_REG_ERRV
0x34C	VENE_PROT_REG_ERRC
0x350	VENE_PROT_REG_ERRA
0xC00	0x0 alias for ARM (0 / 1) = (0x1f000000 / 0x40000000)
0xD04	SPM128 Bus Error Address register
0xD08	SPM128 Bus Error Attribute register
0xD14	SPM32 Bus Error Address register
0xD18	SPM32 Bus Error Attribute register
0xD24	CompatRAM Bus Error Address register
0xD28	CompatRAM Bus Error Attribute register
0xD34	Pervasive2 Bus Error Address register - maybe PERVASIVE2_SYS_BEADR
0xD38	Pervasive2 Bus Error Attribute register - maybe PERVASIVE2_SYS_BEATB
0xD44	SPM128 Secure Bus Error Address register
0xD48	SPM128 Secure Bus Error Attribute register
0xD54	SPM32 Secure Bus Error Address register
0xD58	SPM32 Secure Bus Error Attribute register
0xD64	CompatRAM Secure Bus Error Address register
0xD68	CompatRAM Secure Bus Error Attribute register
0xD74	Pervasive2 Secure Bus Error Address register - maybe PERVASIVE2_SYS_SBEADR
0xD78	Pervasive2 Secure Bus Error Attribute register - maybe PERVASIVE2_SYS_SBEATB
0xD80	BET0 (Bus Error Target 0) - full name may be PERVASIVE2_SYS_BET0
0xD90	BET1 (Bus Error Target 1) - full name may be PERVASIVE2_SYS_BET1
0xD94	PERVASIVE2_SYS_BEBT - Bus Error ?Bus Target?
0xDC0	SBET0 (Secure Bus Error Target 0) - full name may be PERVASIVE2_SYS_SBET0
0xDD0	SBET1 (Secure Bus Error Target 1) - full name may be PERVASIVE2_SYS_SBET1
0xDD4	PERVASIVE2_SYS_SBEBT - Secure Bus Error ?Bus Target?
0xF30	USB PHY ready state - Bit 0 = Port 0, Bit 1 = Port 1, Bit 2 = Port 2
0xF34	USB PHY interrupt state - Bit 0 = Port 0, Bit 1 = Port 1, Bit 2 = Port 2
0xF40	Bit 0 = Memory Card insert state
0xF44	Memory Card insert interrupt state - Bit 0 = Card removed, Bit 1 = Card inserted
0xF50	USB VBUS state - Bit 0 = Port 0, Bit 1 = Port 1, Bit 2 = Port 2
0xF54	USB VBUS interrupt state