Main table
Top Group
| Address
|
Size
|
Description
|
| 0x00000000
|
0x820000
|
Device Boot.
|
| 0x1A000000
|
0x3000
|
ARM cache controller.
|
| 0x1C000000
|
0x200000
|
Scratch 2MiB SRAM.
|
| 0x1F000000
|
0x8000
|
Alias of address 0x00000000.
|
| 0x1F840000
|
0x20000
|
Boot store and VIP scratch.
|
| 0x20000000
|
0x8000000
|
128MiB CDRAM.
|
| 0x30000000
|
?
|
Unknown CMeP device.
|
| 0x40000000
|
0x20000000
|
512MiB DRAM.
|
| 0x60000000
|
0x40000000
|
1GiB DRAM for Development Kit.
|
| 0xE0000000
|
0x100000
|
CMeP's Control Register.
|
| 0xE0100000
|
0x1000
|
Gpio 1.
|
| 0xE0400000
|
0x20000
|
Dmac part 4~5.
|
| 0xE0420000
|
0xC0000
|
Audio Control.
|
| 0xE04E0000
|
0x1000~0x20000
|
Dmac Keyring Control.
|
| 0xE0500000
|
0x20000
|
I2c.
|
| 0xE0900000
|
0x10000
|
Msif.
|
| 0xE0A00000
|
0x30000
|
Spi.
|
| 0xE0B00000
|
0x130000
|
Sdif.
|
| 0xE2030000
|
0x70000
|
Uart.
|
| 0xE20A0000
|
0x10000
|
Gpio 0.
|
| 0xE20B0000
|
0x10000
|
Timer.
|
| 0xE20C0000
|
0x10000
|
Pwn.
|
| 0xE3000000
|
0x20000
|
Dmac part 0~1.
|
| 0xE3020000
|
0x20000
|
Cif.
|
| 0xE3050000
|
0x20000
|
Csi.
|
| 0xE3100000
|
0x20000
|
Pervasive.
|
| 0xE3200000
|
0x130000
|
ARM Debugger.
|
| 0xE4020000
|
0xD0000
|
USB Control.
|
| 0xE5000000
|
0x20000
|
Dmac part 2~3.
|
| 0xE5020000
|
0x50000
|
Display Control.
|
| 0xE5070000
|
0x10000
|
Compat.
|
| 0xE50C0000
|
0x10000
|
Dmac part 6.
|
| 0xE50D0000
|
0x10000
|
ARM PA.
|
| 0xE5800000
|
0x20000
|
Sdio Control for Development Kit.
|
| 0xE5880000
|
0x10000
|
DRAM Control for Development Kit.
|
| 0xE6000000
|
0x10000
|
DRAM Control.
|
| 0xE8000000
|
0x10000
|
GPU Control.
|
| 0xE8100000
|
0x10000
|
Compat Shared SRAM.
|
| 0xE8200000
|
0x10000
|
Emc.
|
| 0xE8300000
|
0x10000
|
Grab.
|
| 0xE8400000
|
0x10000
|
SGX543.
|
| 0xEC000000
|
x
|
Main Xbar
|
| 0xEC100000
|
x
|
Center Xbar
|
| 0xEC200000
|
x
|
Video Xbar
|
| 0xEC300000
|
x
|
IFTU Xbar
|
| 0xEC400000
|
x
|
VIP Xbar
|
| 0xEC500000
|
x
|
Debug Bus
|
| 0xEC600000
|
x
|
DMAC Xbar
|
| 0xED000000
|
x
|
IO Slave Bus
|
| 0xED100000
|
x
|
IO Master Bus
|
| 0xED200000
|
x
|
Pervasive Bus
|
| 0xED300000
|
x
|
Misc IO Bus
|
| 0xED400000
|
x
|
North IO Master Bus
|
| 0xED500000
|
x
|
Audio Bus
|
| 0xED600000
|
x
|
North IO Slave Bus
|
| 0xED700000
|
x
|
SRC Bus
|
| 0xED800000
|
x
|
GPU Register Bus
|
| 0xED900000
|
x
|
IFTU Register Bus
|
| 0xEE000000
|
x
|
Camera Slave Bus
|
| 0xEE100000
|
x
|
Camera Master Bus
|
| 0xEE200000
|
x
|
USB Slave Bus
|
| 0xEE300000
|
x
|
USB Master Bus
|
| 0xEE400000
|
x
|
SubLCD Slave Bus
|
| 0xEE500000
|
x
|
SubLCD Master Bus
|
| 0xEE600000
|
x
|
Camera Register Bus
|
Main Xbar
| Address
|
Description
|
| 0xEC040000
|
SSX_MainXB_IA_ARM0
|
| 0xEC040400
|
SSX_MainXB_IA_ARM1
|
| 0xEC048000
|
SSX_MainXB_IA_CenterXbar0
|
| 0xEC048400
|
SSX_MainXB_IA_CenterXbar1
|
| 0xEC048800
|
SSX_MainXB_IA_CenterXbar2
|
| 0xEC048C00
|
SSX_MainXB_IA_IoMasterBus
|
| 0xEC049000
|
SSX_MainXB_IA_DmacXbar0
|
| 0xEC049400
|
SSX_MainXB_IA_DmacXbar1
|
| 0xEC050000
|
SSX_MainXB_TA_Spad_32KiB
|
| 0xEC050400
|
SSX_MainXB_TA_LPDDR0
|
| 0xEC050800
|
SSX_MainXB_TA_ACP
|
| 0xEC058000
|
SSX_MainXB_TA_CenterXbar0
|
| 0xEC058400
|
SSX_MainXB_TA_CenterXbar1
|
| 0xEC058800
|
SSX_MainXB_TA_IoSlaveBus
|
Center Xbar
| Address
|
Description
|
| 0xEC140000
|
SSX_CenterXB_IA_GPUXbar
|
| 0xEC148000
|
SSX_CenterXB_IA_MainXbar0
|
| 0xEC148400
|
SSX_CenterXB_IA_MainXbar1
|
| 0xEC148800
|
SSX_CenterXB_IA_VideoXbar0
|
| 0xEC148C00
|
SSX_CenterXB_IA_VideoXbar1
|
| 0xEC149000
|
SSX_CenterXB_IA_IoMasterBus
|
| 0xEC149400
|
SSX_CenterXB_IA_DmacXbar0
|
| 0xEC149800
|
SSX_CenterXB_IA_DmacXbar1
|
| 0xEC150000
|
SSX_CenterXB_TA_Compati_2MiB
|
| 0xEC150400
|
SSX_CenterXB_TA_DevNull
|
| 0xEC150800
|
SSX_CenterXB_TA_GpuXbar
|
| 0xEC158000
|
SSX_CenterXB_TA_MainXbar0
|
| 0xEC158400
|
SSX_CenterXB_TA_MainXbar1
|
| 0xEC158800
|
SSX_CenterXB_TA_MainXbar2
|
| 0xEC158C00
|
SSX_CenterXB_TA_VideoXbar
|
Video Xbar
| Address
|
Description
|
| 0xEC240000
|
SSX_VideoXB_IA_DMAC2
|
| 0xEC240400
|
SSX_VideoXB_IA_DMAC3
|
| 0xEC240800
|
SSX_VideoXB_IA_Venezia
|
| 0xEC240C00
|
SSX_VideoXB_IA_LCDDMAC
|
| 0xEC248000
|
SSX_VideoXB_IA_CenterXbar
|
| 0xEC248400
|
SSX_VideoXB_IA_IftuXbar0
|
| 0xEC248800
|
SSX_VideoXB_IA_IftuXbar1
|
| 0xEC248C00
|
SSX_VideoXB_IA_VipXbar0
|
| 0xEC249000
|
SSX_VideoXB_IA_VipXbar1
|
| 0xEC249400
|
SSX_VideoXB_IA_DebugBus
|
| 0xEC250000
|
SSX_VideoXB_TA_Spad_128KiB
|
| 0xEC250400
|
SSX_VideoXB_TA_GpuXbar0
|
| 0xEC250800
|
SSX_VideoXB_TA_GpuXbar1
|
| 0xEC250C00
|
SSX_VideoXB_TA_GpuXbar2
|
| 0xEC258000
|
SSX_VideoXB_TA_CenterXbar0
|
| 0xEC258400
|
SSX_VideoXB_TA_CenterXbar1
|
| 0xEC258800
|
SSX_VideoXB_TA_DebugBus
|
IFTU Xbar
| Address
|
Description
|
| 0xEC340000
|
SSX_IftuXB_IA_IFTU0a
|
| 0xEC340400
|
SSX_IftuXB_IA_IFTU0b
|
| 0xEC340800
|
SSX_IftuXB_IA_IFTU1a
|
| 0xEC340C00
|
SSX_IftuXB_IA_IFTU1b
|
| 0xEC341000
|
SSX_IftuXB_IA_IFTU2
|
| 0xEC348000
|
SSX_IftuXB_IA_IftuRegBus
|
| 0xEC358000
|
SSX_IftuXB_TA_VideoXbar0
|
| 0xEC358400
|
SSX_IftuXB_TA_VideoXbar1
|
VIP Xbar
| Address
|
Description
|
| 0xEC440000
|
SSX_VipXB_IA_VDP0
|
| 0xEC440400
|
SSX_VipXB_IA_VDP1
|
| 0xEC440800
|
SSX_VipXB_IA_VDP2
|
| 0xEC440C00
|
SSX_VipXB_IA_VDP3
|
| 0xEC441000
|
SSX_VipXB_IA_VDPMeP
|
| 0xEC441400
|
SSX_VipXB_IA_BAPMeP
|
| 0xEC448000
|
SSX_VipXB_IA_GpuRegBus
|
| 0xEC450000
|
SSX_VipXB_TA_GpuXbar
|
| 0xEC458000
|
SSX_VipXB_TA_VideoXbar0
|
| 0xEC458400
|
SSX_VipXB_TA_VideoXbar1
|
Debug Bus
| Address
|
Description
|
| 0xEC540000
|
SSX_DebugBus_IA_DMAC6
|
| 0xEC540400
|
SSX_DebugBus_IA_PA
|
| 0xEC548000
|
SSX_DebugBus_IA_VideoXbar
|
| 0xEC550000
|
SSX_DebugBus_TA_SDIO0
|
| 0xEC550400
|
SSX_DebugBus_TA_SDIO1
|
| 0xEC550800
|
SSX_DebugBus_TA_LPDDR1
|
| 0xEC558000
|
SSX_DebugBus_TA_VideoXbar
|
DMAC Xbar
| Address
|
Description
|
| 0xEC640000
|
SSX_DmacXB_IA_DMAC0
|
| 0xEC640400
|
SSX_DmacXB_IA_DMAC1
|
| 0xEC648000
|
SSX_DmacXB_IA_IoSlaveBus
|
| 0xEC658000
|
SSX_DmacXB_TA_MainXbar0
|
| 0xEC658400
|
SSX_DmacXB_TA_MainXbar1
|
| 0xEC658800
|
SSX_DmacXB_TA_CenterXbar0
|
| 0xEC658C00
|
SSX_DmacXB_TA_CenterXbar1
|
IO Slave Bus
| Address
|
Description
|
| 0xED048000
|
SSX_IoSlaveBus_IA_MainXbar
|
| 0xED058000
|
SSX_IoSlaveBus_TA_PervasiveBus
|
| 0xED058400
|
SSX_IoSlaveBus_TA_NorthIoBus
|
| 0xED058800
|
SSX_IoSlaveBus_TA_GpuRegBus
|
| 0xED058C00
|
SSX_IoSlaveBus_TA_MiscIoBus
|
| 0xED059000
|
SSX_IoSlaveBus_TA_CameraSlaveBus0
|
| 0xED059400
|
SSX_IoSlaveBus_TA_CameraSlaveBus1
|
| 0xED059800
|
SSX_IoSlaveBus_TA_CameraSlaveBus2
|
| 0xED059C00
|
SSX_IoSlaveBus_TA_IoMasterBus
|
| 0xED05A000
|
SSX_IoSlaveBus_TA_DmacXbar
|
IO Master Bus
| Address
|
Description
|
| 0xED148000
|
SSX_IoMasterBus_IA_NorthIoBus
|
| 0xED148400
|
SSX_IoMasterBus_IA_CameraMasterBus
|
| 0xED148800
|
SSX_IoMasterBus_IA_IoSlaveBus
|
| 0xED158000
|
SSX_IoMasterBus_TA_MainXbar
|
| 0xED158400
|
SSX_IoMasterBus_TA_CenterXbar
|
Pervasive Bus
| Address
|
Description
|
| 0xED248000
|
SSX_PervasiveBus_IA_IoSlaveBus
|
| 0xED250000
|
SSX_PervasiveBus_TA_DMAC0
|
| 0xED250000
|
SSX_PervasiveBus_TA_DMAC1
|
| 0xED250800
|
SSX_PervasiveBus_TA_Pervasive
|
| 0xED250C00
|
SSX_PervasiveBus_TA_CoreSight
|
| 0xED251000
|
SSX_PervasiveBus_TA_VFPINT
|
Misc IO Bus
| Address
|
Description
|
| 0xED348000
|
SSX_MiscIoBus_IA_IoSlaveBus
|
| 0xED350000
|
SSX_MiscIoBus_TA_UART0
|
| 0xED350400
|
SSX_MiscIoBus_TA_UART1
|
| 0xED350800
|
SSX_MiscIoBus_TA_UART2
|
| 0xED350C00
|
SSX_MiscIoBus_TA_UART3
|
| 0xED351000
|
SSX_MiscIoBus_TA_UART4
|
| 0xED351400
|
SSX_MiscIoBus_TA_UART5
|
| 0xED351800
|
SSX_MiscIoBus_TA_UART6
|
| 0xED351C00
|
SSX_MiscIoBus_TA_GPIO0
|
| 0xED352000
|
SSX_MiscIoBus_TA_Timer
|
| 0xED352400
|
SSX_MiscIoBus_TA_PWM
|
North IO Master Bus
| Address
|
Description
|
| 0xED440000
|
SSX_NIoMasterBus_IA_DMAC4
|
| 0xED440400
|
SSX_NIoMasterBus_IA_DMAC5
|
| 0xED440800
|
SSX_NIoMasterBus_IA_HSMMC1
|
| 0xED440C00
|
SSX_NIoMasterBus_IA_HSMMC2
|
| 0xED441000
|
SSX_NIoMasterBus_IA_HSMMC3
|
| 0xED448000
|
SSX_NIoMasterBus_IA_NIoSlaveBus
|
| 0xED450000
|
SSX_NIoMasterBus_TA_KeyRing
|
| 0xED458000
|
SSX_NIoMasterBus_TA_AudioBus
|
| 0xED458400
|
SSX_NIoMasterBus_TA_SrcBus
|
| 0xED458800
|
SSX_NIoMasterBus_TA_IoMasterBus0
|
| 0xED458C00
|
SSX_NIoMasterBus_TA_IoMasterBus1
|
Audio Bus
| Address
|
Description
|
| 0xED548000
|
SSX_AudioBus_IA_NIoMasterBus
|
| 0xED550000
|
SSX_AudioBus_TA_I2S0
|
| 0xED550400
|
SSX_AudioBus_TA_I2S1
|
| 0xED550800
|
SSX_AudioBus_TA_I2S2
|
| 0xED550C00
|
SSX_AudioBus_TA_I2SD0
|
| 0xED551000
|
SSX_AudioBus_TA_I2SD1
|
| 0xED551400
|
SSX_AudioBus_TA_I2S4
|
| 0xED551C00
|
SSX_AudioBus_TA_I2S7
|
| 0xED552000
|
SSX_AudioBus_TA_SPDIF
|
North IO Slave Bus
| Address
|
Description
|
| 0xED648000
|
SSX_NIoSlaveBus_IA_IoSlaveBus
|
| 0xED650000
|
SSX_NIoSlaveBus_TA_DMAC4
|
| 0xED650400
|
SSX_NIoSlaveBus_TA_DMAC5
|
| 0xED650800
|
SSX_NIoSlaveBus_TA_I2C0
|
| 0xED650C00
|
SSX_NIoSlaveBus_TA_I2C1
|
| 0xED651000
|
SSX_NIoSlaveBus_TA_HSMMC1
|
| 0xED651400
|
SSX_NIoSlaveBus_TA_HSMMC2
|
| 0xED651800
|
SSX_NIoSlaveBus_TA_HSMMC3
|
| 0xED658000
|
SSX_NIoSlaveBus_TA_NIoMasterBus
|
SRC Bus
| Address
|
Description
|
| 0xED748000
|
SSX_SrcBus_IA_NIoMasterBus
|
| 0xED750000
|
SSX_SrcBus_TA_SRC0
|
| 0xED750400
|
SSX_SrcBus_TA_SRC1
|
| 0xED750800
|
SSX_SrcBus_TA_SRC2
|
GPU Register Bus
| Address
|
Description
|
| 0xED848000
|
SSX_GpuRegBus_IA_IoSlaveBus
|
| 0xED850000
|
SSX_GpuRegBus_TA_DMAC2
|
| 0xED850400
|
SSX_GpuRegBus_TA_DMAC3
|
| 0xED850800
|
SSX_GpuRegBus_TA_LCDDMAC
|
| 0xED850C00
|
SSX_GpuRegBus_TA_DMAC6
|
| 0xED851000
|
SSX_GpuRegBus_TA_PA
|
| 0xED851400
|
SSX_GpuRegBus_TA_Pervasive2
|
| 0xED851800
|
SSX_GpuRegBus_TA_SonyRegBus
|
| 0xED858000
|
SSX_GpuRegBus_TA_IftuRegBus
|
| 0xED858400
|
SSX_GpuRegBus_TA_VipXbar
|
IFTU Register Bus
| Address
|
Description
|
| 0xED948000
|
SSX_IftuRegBus_IA_GpuRegBus
|
| 0xED950000
|
SSX_IftuRegBus_TA_IFTU0
|
| 0xED950400
|
SSX_IftuRegBus_TA_IFTU1
|
| 0xED950800
|
SSX_IftuRegBus_TA_IFTU2
|
| 0xED950C00
|
SSX_IftuRegBus_TA_DSI0
|
| 0xED951000
|
SSX_IftuRegBus_TA_DSI1
|
| 0xED958000
|
SSX_IftuRegBus_TA_IftuXbar
|
Camera Slave Bus
| Address
|
Description
|
| 0xEE048000
|
SSX_CameraSlaveBus_IA_IoSlaveBus0
|
| 0xEE048400
|
SSX_CameraSlaveBus_IA_IoSlaveBus1
|
| 0xEE048800
|
SSX_CameraSlaveBus_IA_IoSlaveBus2
|
| 0xEE050000
|
SSX_CameraSlaveBus_TA_GPIO1
|
| 0xEE058000
|
SSX_CameraSlaveBus_TA_CameraRegBus
|
| 0xEE058400
|
SSX_CameraSlaveBus_TA_SlcdSlaveBus0
|
| 0xEE058800
|
SSX_CameraSlaveBus_TA_UsbSlaveBus
|
| 0xEE058C00
|
SSX_CameraSlaveBus_TA_SlcdSlaveBus1
|
| 0xEE059000
|
SSX_CameraSlaveBus_TA_CameraMasterBus
|
Camera Master Bus
| Address
|
Description
|
| 0xEE140000
|
SSX_CameraMasterBus_IA_CameraIf0
|
| 0xEE140400
|
SSX_CameraMasterBus_IA_CameraIf1
|
| 0xEE148000
|
SSX_CameraMasterBus_IA_SlcdMasterBus
|
| 0xEE148400
|
SSX_CameraMasterBus_IA_UsbMasterBus
|
| 0xEE148800
|
SSX_CameraMasterBus_IA_CameraSlaveBus
|
| 0xEE158000
|
SSX_CameraMasterBus_TA_IoMasterBus0
|
| 0xEE158400
|
SSX_CameraMasterBus_TA_IoMasterBus1
|
USB Slave Bus
| Address
|
Description
|
| 0xEE248000
|
SSX_UsbSlaveBus_IA_CameraSlaveBus
|
| 0xEE250000
|
SSX_UsbSlaveBus_TA_USB0HOST
|
| 0xEE250400
|
SSX_UsbSlaveBus_TA_USB1HOST
|
| 0xEE250800
|
SSX_UsbSlaveBus_TA_USB2HOST
|
| 0xEE252C00
|
SSX_UsbSlaveBus_TA_USB1DEVICE
|
| 0xEE253000
|
SSX_UsbSlaveBus_TA_USB2DEVICE
|
| 0xEE253400
|
SSX_UsbSlaveBus_TA_USB0DEVICE
|
| 0xEE258000
|
SSX_UsbSlaveBus_TA_UsbMasterBus
|
USB Master Bus
| Address
|
Description
|
| 0xEE340400
|
SSX_UsbMasterBus_IA_USB1OHCI
|
| 0xEE340800
|
SSX_UsbMasterBus_IA_USB1EHCI
|
| 0xEE340C00
|
SSX_UsbMasterBus_IA_USB2OHCI
|
| 0xEE341000
|
SSX_UsbMasterBus_IA_USB2EHCI
|
| 0xEE341400
|
SSX_UsbMasterBus_IA_USB0OHCI
|
| 0xEE341800
|
SSX_UsbMasterBus_IA_USB0EHCI
|
| 0xEE343400
|
SSX_UsbMasterBus_IA_USB1DEVICE
|
| 0xEE343800
|
SSX_UsbMasterBus_IA_USB2DEVICE
|
| 0xEE343C00
|
SSX_UsbMasterBus_IA_USB0DEVICE
|
| 0xEE348000
|
SSX_UsbMasterBus_IA_UsbSlaveBus
|
| 0xEE358000
|
SSX_UsbMasterBus_TA_CameraMasterBus
|
SubLCD Slave Bus
| Address
|
Description
|
| 0xEE448000
|
SSX_SlcdSlaveBus_IA_CameraSlaveBus0
|
| 0xEE448400
|
SSX_SlcdSlaveBus_IA_CameraSlaveBus1
|
| 0xEE450000
|
SSX_SlcdSlaveBus_TA_HSMMC0
|
| 0xEE450400
|
SSX_SlcdSlaveBus_TA_SubLCD
|
| 0xEE450800
|
SSX_SlcdSlaveBus_TA_SMSHC
|
| 0xEE450C00
|
SSX_SlcdSlaveBus_TA_SPI0
|
| 0xEE451000
|
SSX_SlcdSlaveBus_TA_SPI1
|
| 0xEE451400
|
SSX_SlcdSlaveBus_TA_SPI2
|
| 0xEE458000
|
SSX_SlcdSlaveBus_TA_SlcdMasterBus
|
SubLCD Master Bus
| Address
|
Description
|
| 0xEE540000
|
SSX_SlcdMasterBus_IA_HSMMC0
|
| 0xEE540400
|
SSX_SlcdMasterBus_IA_SubLCD
|
| 0xEE540800
|
SSX_SlcdMasterBus_IA_SMSHC
|
| 0xEE548000
|
SSX_SlcdMasterBus_IA_SlcdSlaveBus
|
| 0xEE558000
|
SSX_SlcdMasterBus_TA_CameraMasterBus
|
Camera Register Bus
| Address
|
Description
|
| 0xEE648000
|
SSX_CameraRegBus_IA_CameraSlaveBus
|
| 0xEE650000
|
SSX_CameraRegBus_TA_CameraIf0
|
| 0xEE650400
|
SSX_CameraRegBus_TA_CameraIf1
|
| 0xEE650800
|
SSX_CameraRegBus_TA_CSI0
|
| 0xEE650C00
|
SSX_CameraRegBus_TA_CSI1
|
| Start
|
End
|
Size
|
World
|
Comments
|
| 0x00000000
|
0x00007FFF
|
0x8000
|
NS/S
|
ARM Boot. Alias of physical address 0x1F000000 i.e. ScePower scratchpad.
|
| 0x00040000
|
0x0005FFFF
|
0x20000
|
S
|
MeP boot. Mirror of physical address 0x00800000.
|
| 0x00300000
|
0x0030FFFF
|
0x10000
|
S
|
cmep icache
|
| 0x00310000
|
0x0031FFFF
|
0x10000
|
S
|
cmep icache tag
|
| 0x00320000
|
0x0032FFFF
|
0x10000
|
S
|
cmep dcache
|
| 0x00330000
|
0x0033FFFF
|
0x10000
|
S
|
cmep dcache tag
|
| 0x004B0000
|
0x005FFFFF
|
0x150000
|
S
|
Reverved for Venezia
|
| 0x00600000
|
0x007FFFFF
|
0x200000
|
S
|
Reserved for MeP
|
| 0x00800000
|
0x0081FFFF
|
0x20000
|
S
|
cmep 128KiB SRAM. second_loader, secure kernel, sm location.
|
| 0x1A000000
|
0x1A001FFF
|
0x2000
|
NS/S
|
ARM. SceInterruptControllerReg, ScePeriphReg, Interrupts (PERIPHBASE). Stores SCU_CONTROL_REG, SCU_SAC_REG.
|
| 0x1A002000
|
0x1A002FFF
|
0x1000
|
NS/S
|
ARM. ScePl310Reg, SceL2CacheReg, L2 Cache Controller. Stores SCU_CONFIG_REG, PL310_CACHE_ID, PL310_CACHE_TYPE.
|
| 0x1C000000
|
0x1C1FFFFF
|
0x200000
|
NS/S
|
SRAM. SRAM used to store ARZL decoded SceSysmem by SKBL, SceDisplay / SceCamera SRAM (only 960x544 pixels * 4 bytes = 0x1FE000 bytes mapped), Compatibility SRAM for PspEmu (Tachyon-eDRAM), SceKernelBsodSram for SceKernelBlueScreenOfDeath.
|
| 0x1F000000
|
0x1F007FFF
|
0x8000
|
NS/S
|
SPAD32K, ScePowerScratchPad32KiB. After suspend, SKBL stores there "Non-secure power.kprx resume" using suspendinfo then jumps to it.
|
| 0x1F840000
|
0x1F85FFFF
|
0x20000
|
NS/S
|
SPAD128K. SceVeneziaSpram. Stores Secure Kernel on boot.
|
| 0x20000000
|
0x27FFFFFF
|
0x8000000
|
NS
|
VRAM. Graphics bar
|
| 0x30000000
|
?
|
?
|
S
|
Unknown. Used by first_loader (proto:0x5C398) and second_loader (3.60:0x808208).
|
| 0x40000000
|
0x401FFFFF on FWs < 3.50
0x401FFFFF on FWs >= 3.50
|
0x300000 on FWs < 3.50
0x200000 on FWs >= 3.50
|
S
|
Secure DRAM
|
| 0x40300000 on FWs < 3.50
0x40200000 on FWs >= 3.50
|
0xBFFFFFFF
|
0x7FD00000 on FWs < 3.50
0x7FE00000 on FWs >= 3.50
|
NS/S
|
Non-secure Shared DRAM
|
| 0xC0000000
|
0xDFFFFFFF
|
0x20000000
|
NS/S
|
Reserved for Venezia. Maybe unused.
|
| 0xE0000000
|
0xE00FFFFF
|
0x100000
|
S
|
Control Register. cmep
|
| 0xE0100000
|
0xE0100FFF
|
0x1000
|
NS
|
SceGpio1Reg
|
| 0xE0400000
|
0xE0400FFF
|
0x1000
|
NS
|
SceDmacmgrDmac4Reg
|
| 0xE0410000
|
0xE0410FFF
|
0x1000
|
NS
|
SceDmacmgrDmac5Reg
|
| 0xE0420000
|
0xE0420FFF
|
0x1000
|
NS
|
SceI2s0Reg
|
| 0xE0430000
|
0xE0430FFF
|
0x1000
|
NS
|
SceI2s1Reg
|
| 0xE0440000
|
0xE0440FFF
|
0x1000
|
NS
|
SceI2s2Reg
|
| 0xE0450000
|
0xE0450FFF
|
0x1000
|
NS
|
SceI2s3Reg
|
| 0xE0460000
|
0xE0460FFF
|
0x1000
|
NS
|
SceI2s5Reg
|
| 0xE0470000
|
0xE0470FFF
|
0x1000
|
NS
|
SceI2s4Reg
|
| 0xE0490000
|
0xE0490FFF
|
0x1000
|
NS
|
SceI2s7Reg
|
| 0xE04A0000
|
0xE04A0FFF
|
0x1000
|
NS
|
SceSrcMix0Reg
|
| 0xE04B0000
|
0xE04B0FFF
|
0x1000
|
NS
|
SceSrcMix1Reg
|
| 0xE04C0000
|
0xE04C0FFF
|
0x1000
|
NS
|
SceSrcMix2Reg
|
| 0xE04D0000
|
0xE04D3FFF
|
0x4000
|
NS
|
SceSpdifReg
|
| 0xE04DC000
|
0xE04DCFFF
|
0x1000
|
NS
|
SceAclkgenReg
|
| 0xE04E0000
|
0xE04E0FFF
|
0x1000
|
NS/S
|
SceDmacmgrKeyringReg, SceSblDMAC5DmacKRBase, DMAC Register base
|
| 0xE0500000
|
0xE0500FFF
|
0x1000
|
NS
|
SceI2c0Reg
|
| 0xE0510000
|
0xE0510FFF
|
0x1000
|
NS
|
SceI2c1Reg
|
| 0xE0900000
|
0xE0900FFF
|
0x1000
|
NS
|
SceMsif
|
| 0xE0A00000
|
0xE0A00FFF
|
0x1000
|
NS
|
SceSpi0Reg (SceSyscon)
|
| 0xE0A10000
|
0xE0A10FFF
|
0x1000
|
NS
|
SceSpi1Reg (SceMotionDev)
|
| 0xE0A20000
|
0xE0A20FFF
|
0x1000
|
NS
|
SceSpi2Reg (SceOled)
|
| 0xE0B00000
|
0xE0B00FFF
|
0x1000
|
NS
|
SceSdif0
|
| 0xE0C00000
|
0xE0C00FFF
|
0x1000
|
NS
|
SceSdif1
|
| 0xE0C10000
|
0xE0C10FFF
|
0x1000
|
NS
|
SceSdif2
|
| 0xE0C20000
|
?
|
?
|
?
|
SceSdif3 (not present on FW 1.69, does FW 3.60 use only NSKBL?)
|
| 0xE2030000
|
0xE209FFFF
|
0x70000
|
NS
|
SceUartReg
|
| 0xE20A0000
|
0xE20AFFFF
|
0x10000
|
NS/S
|
SceGpio0Reg / SceLedReg
|
| 0xE20B1000
|
0xE20B5FFF
|
0x5000
|
NS
|
SceLongRangeTimerReg
|
| 0xE20B6000
|
0xE20B6FFF
|
0x1000
|
NS
|
SceLT5, Clock in usec (part of SceLongRangeTimerReg)
|
| 0xE20B7000
|
0xE20BDFFF
|
0x7000
|
NS
|
SceWordTimerReg
|
| 0xE20BE000
|
0xE20BEFFF
|
0x1000
|
S?
|
SceTimerForUsleep (part of SceWordTimerReg)
|
| 0xE20C0000
|
0xE20C0FFF
|
0x1000
|
NS
|
ScePwmReg
|
| 0xE3000000
|
0xE3000FFF
|
0x1000
|
NS
|
SceDmacmgrDmac0Reg
|
| 0xE3010000
|
0xE3010FFF
|
0x1000
|
NS
|
SceDmacmgrDmac1Reg
|
| 0xE3020000
|
0xE3020FFF
|
0x1000
|
NS
|
SceCif0Reg
|
| 0xE3030000
|
0xE3030FFF
|
0x1000
|
NS
|
SceCif1Reg
|
| 0xE3050000
|
0xE3050FFF
|
0x1000
|
NS
|
SceCsi0Reg
|
| 0xE3060000
|
0xE3060FFF
|
0x1000
|
NS
|
SceCsi1Reg
|
| 0xE3100000
|
0xE3100FFF
|
0x1000
|
NS
|
ScePervasiveMisc
|
| 0xE3101000
|
0xE3101FFF
|
0x1000
|
NS
|
ScePervasiveResetReg
|
| 0xE3102000
|
0xE3102FFF
|
0x1000
|
NS
|
ScePervasiveGate
|
| 0xE3103000
|
0xE3103FFF
|
0x1000
|
NS
|
ScePervasiveBaseClk
|
| 0xE3104000
|
0xE3104FFF
|
0x1000
|
NS
|
ScePervasiveVid
|
| 0xE3105000
|
0xE3105FFF
|
0x1000
|
NS
|
SceUartClkgenReg
|
| 0xE3106000
|
0xE3106FFF
|
0x1000
|
NS
|
ScePervasiveMailboxReg
|
| 0xE3108000
|
0xE3108FFF
|
0x1000
|
NS
|
ScePervasiveTas0
|
| 0xE3109000
|
0xE3109FFF
|
0x1000
|
NS
|
ScePervasiveTas1
|
| 0xE310A000
|
0xE310AFFF
|
0x1000
|
NS
|
ScePervasiveTas2
|
| 0xE310B000
|
0xE310BFFF
|
0x1000
|
NS
|
ScePervasiveTas3
|
| 0xE310C000
|
0xE310CFFF
|
0x1000
|
NS
|
ScePervasiveTas4
|
| 0xE310D000
|
0xE310DFFF
|
0x1000
|
NS
|
ScePervasiveTas5
|
| 0xE310E000
|
0xE310EFFF
|
0x1000
|
NS
|
ScePervasiveTas6
|
| 0xE310F000
|
0xE310FFFF
|
0x1000
|
NS
|
ScePervasiveTas7
|
| 0xE3110000
|
0xE3110FFF
|
0x1000
|
NS
|
SPM32, SPM128, Compati SRAM, ScePervasive2Reg, SceUdcd0
|
| 0xE3200000
|
0xE3200FFF
|
0x1000
|
S
|
Base Debug ROM Table
|
| 0xE3203000
|
0xE3203FFF
|
0x1000
|
NS
|
SceTpiuReg
|
| 0xE3204000
|
0xE3204FFF
|
0x1000
|
NS
|
SceFunnelReg
|
| 0xE3205000
|
0xE3205FFF
|
0x1000
|
NS
|
SceItmReg
|
| 0xE3300000
|
0xE3300FFF
|
0x1000
|
S
|
ARM Cortex-A9 Debug ROM Table
|
| 0xE3310000
|
0xE3310FFF
|
0x1000
|
NS
|
SceDbg0Reg, Debugger Interface
|
| 0xE3311000
|
0xE3311FFF
|
0x1000
|
NS
|
ScePmu0Reg
|
| 0xE3312000
|
0xE3312FFF
|
0x1000
|
NS
|
SceDbg1Reg, Debugger Interface
|
| 0xE3313000
|
0xE3313FFF
|
0x1000
|
NS
|
ScePmu1Reg
|
| 0xE3314000
|
0xE3314FFF
|
0x1000
|
NS
|
SceDbg2Reg, Debugger Interface
|
| 0xE3315000
|
0xE3315FFF
|
0x1000
|
NS
|
ScePmu2Reg
|
| 0xE3316000
|
0xE3316FFF
|
0x1000
|
NS
|
SceDbg3Reg, Debugger Interface
|
| 0xE3317000
|
0xE3317FFF
|
0x1000
|
NS
|
ScePmu3Reg
|
| 0xE3318000
|
0xE3318FFF
|
0x1000
|
NS
|
SceCti0Reg
|
| 0xE3319000
|
0xE3319FFF
|
0x1000
|
NS
|
SceCti1Reg
|
| 0xE331A000
|
0xE331AFFF
|
0x1000
|
NS
|
SceCti2Reg
|
| 0xE331B000
|
0xE331BFFF
|
0x1000
|
NS
|
SceCti3Reg
|
| 0xE331C000
|
0xE331CFFF
|
0x1000
|
NS
|
ScePtm0Reg
|
| 0xE331D000
|
0xE331DFFF
|
0x1000
|
NS
|
ScePtm1Reg
|
| 0xE331E000
|
0xE331EFFF
|
0x1000
|
NS
|
ScePtm2Reg
|
| 0xE331F000
|
0xE331FFFF
|
0x1000
|
NS
|
ScePtm3Reg
|
| 0xE3320000
|
0xE3323FFF
|
0x4000
|
NS
|
ARM-VFP. SceIntrmgrVfpIntRegs
|
| 0xE4020000
|
0xE4020FFF
|
0x1000
|
NS
|
USB2_OHCI. SceUsbdEhci
|
| 0xE40B0000
|
0xE40B0FFF
|
0x1000
|
NS
|
SceUsbdEhci
|
| 0xE40C0000
|
0xE40C0FFF
|
0x1000
|
NS
|
SceUdcd1
|
| 0xE40D0000
|
0xE40D0FFF
|
0x1000
|
NS
|
SceUdcd2
|
| 0xE40E0000
|
0xE40E0FFF
|
0x1000
|
NS
|
SceUsbdEhci
|
| 0xE5000000
|
0xE5000FFF
|
0x1000
|
NS
|
SceDmacmgrDmac2Reg
|
| 0xE5010000
|
0xE5010FFF
|
0x1000
|
NS
|
SceDmacmgrDmac3Reg
|
| 0xE5020000
|
0xE5020FFF
|
0x1000
|
NS
|
SceIftu0RegA (OLED FB)
|
| 0xE5021000
|
0xE5021FFF
|
0x1000
|
NS
|
SceIftu0RegB
|
| 0xE5022000
|
0xE5022FFF
|
0x1000
|
NS
|
SceIftuc0Reg
|
| 0xE5030000
|
0xE5030FFF
|
0x1000
|
NS
|
SceIftu1RegA (HDMI FB)
|
| 0xE5031000
|
0xE5031FFF
|
0x1000
|
NS
|
SceIftu1RegB
|
| 0xE5032000
|
0xE5032FFF
|
0x1000
|
NS
|
SceIftuc1Reg
|
| 0xE5040000
|
0xE5040FFF
|
0x1000
|
NS
|
SceIftu2Reg
|
| 0xE5050000
|
0xE5050FFF
|
0x1000
|
NS
|
SceDsi0Reg
|
| 0xE5060000
|
0xE5060FFF
|
0x1000
|
NS
|
SceDsi1Reg
|
| 0xE5070000
|
0xE5070FFF
|
0x1000
|
NS
|
SceCompatMailbox
|
| 0xE5071000
|
0xE5071FFF
|
0x1000
|
NS
|
SceCompatLCDDMA
|
| 0xE50C0000
|
0xE50C0FFF
|
0x1000
|
NS
|
SceDmacmgrDmac6Reg
|
| 0xE50D0000
|
0xE50D1FFF
|
0x2000
|
NS
|
Debug/PA, ScePfmReg, SceDeci4pDtracepPaReg
|
| 0xE5800000
|
0xE580FFFF
|
0x10000
|
NS
|
SceSDbgSdio0
|
| 0xE5810000
|
0xE581FFFF
|
0x10000
|
NS
|
SceDbgSdio1
|
| 0xE5880000
|
0xE588FFFF
|
0x10000
|
?
|
LPDDR2 I/F CH1. LPDDR2SUB (1st 256MiB DRAM bank config regs) (?)
|
| 0xE6000000
|
0xE600FFFF
|
0x10000
|
?
|
LPDDR2 I/F CH0. LPDDR2"TOP" (2nd 256MiB DRAM bank config regs) (?). Stores DDRSC_CONF.
|
| 0xE8000000
|
0xE8001FFF
|
0x2000
|
S
|
SceSonyRegbus. GPU Control
|
| 0xE8100000
|
0xE8100FFF
|
0x1000
|
NS/S
|
SceCompatSharedSram (0xBFC00000 in PSP)
|
| 0xE8200000
|
0xE8200FFF
|
0x1000
|
S
|
SceEmcTop (External Memory Controller, VRAM?)
|
| 0xE8300000
|
0xE8301FFF
|
0x2000
|
S
|
SceGrab
|
| 0xE8400000
|
0xE841FFFF
|
0x20000
|
NS
|
SceSGX543Reg. See SGX543.
|
| 0xEC000000
|
?
|
?
|
?
|
Mapped by SKBL
|
| 0xED000000
|
?
|
?
|
?
|
Mapped by SKBL
|
| 0xEE000000
|
?
|
?
|
?
|
Mapped by SKBL
|
| 0xF0000000
|
?
|
?
|
?
|
Reserved for Venezia
|
Secure DRAM
FW 0.931 Secure DRAM
On FW 0.931, SKBL is stored at physical address 0x50000000. So, on FW 0.931, which data are stored at 0x40040000? Is it even considered as Secure DRAM?
ARZL compressed NSKBL is kept in place inside SKBL segment 0 (at offset 0x37100) til ARZL decoding to Non-secure DRAM at physical address 0x51000000.
FWs 0.990-0.995 Secure DRAM
On FWs 0.990-0.995, SKBL segment 0 starts at physical address 0x40040000.
ARZL compressed NSKBL is extracted from a kernel_boot_loader segment to Non-secure DRAM at physical address 0x50000000. It is then ARZL decoded to Non-secure DRAM at physical address 0x51000000.
FWs >=0.996 Secure DRAM
Since FW 0.996, SKBL segment 0 starts at physical address 0x40020000. This change could have come from the increasing SKBL segment 0 size with revisions.
FW 3.60 Secure DRAM
| Start
|
End
|
Size
|
Comments
|
| 0x40000000
|
0x400000BF
|
0xC0
|
SKBL Reset Vector
|
| 0x40000500
|
0x400099FF
|
0x9500
|
kprx_auth_sm.self. This area is also used as a scratchpad at boot.
|
| 0x40009B00
|
0x4000A27F
|
0x780
|
prog_rvk.srvk
|
| 0x4001FD00
|
0x4001FEFF
|
0x100
|
SceKblParam with magic not set
|
| 0x40020000
|
0x400570C7
|
0x370C8
|
SKBL segment 0
|
| 0x40057100
|
0x400571DF
|
0xE0
|
SKBL segment 1
|
| 0x40073570
|
0x4007376F
|
0x200
|
SceKblParam
|
Non-secure Shared DRAM
This region is used by both Secure and Non-Secure Kernel Boot Loaders, and by Secure Kernel modules.
| Start
|
End
|
Size
|
Comments
|
| 0x40200000 on FW 3.60, 0x40300000 on FW 1.69
|
0x4FFFFFFF
|
0x0FE00000 on FW 3.60, 0x0FD00000 on FW 1.69
|
TrustZone region. ?First 0x1000 bytes are a Reset Vector named SceKernelReset whose first 0x100 bytes are identical as in uncompressed NSKBL (need to check)?
|
| 0x50000000
|
0x50FFFFFF
|
0x1000000
|
ARZL compressed NSKBL. Comes from one of kernel_boot_loader.self segments.
|
| 0x51000000
|
0x51FFFFFF
|
0x1000000
|
SceBootKernelImage. Uncompressed NSKBL. Comes from ARZL compressed NSKBL.
|
| 0x52000000
|
0x5FFFFFFF
|
0xE000000
|
Non-secure kernel and usermode modules
|
| 0x60000000
|
0x7FFFFFFF
|
0x20000000
|
DevKit additional 512MiB. LDDR2TOP.
|
| 0x80000000
|
0x9FFFFFFF
|
0x20000000
|
DevKit additional 512MiB. LDDR2SUB. For perf (not published anywhere).
|
| 0xA0000000
|
0xBFFFFFFF
|
0x20000000
|
DevKit additional 512MiB. LDDR2SUB. For perf (not published anywhere, disabled).
|
NSKBL Layout
NSKBL on FW 0.931
ARZL encoded size: 0x2541B.
NSKBL on FW 3.60
| Start
|
End
|
Size
|
Comments
|
| 0x51000000
|
0x51028087
|
0x28088
|
NSKBL Text segment
|
| ???
|
???
|
???
|
NSKBL Data segment
|
Notes:
- The first 0xC0 bytes of the Text segment are the reset vector.
- NSKBL is mapped in RWX mode so it may write itself to text segment.
cmep
Each cmep device has its own physical memory area.
Interrupt registers
| Start
|
End
|
Comments
|
| 0xE3100138
|
0xE310013B
|
BEATB
|
| 0xE310013C
|
0xE310013F
|
BEADR
|
| 0xE3110D80
|
0xE3110D83
|
BET0
|
| 0xE3110D90
|
0xE3110D93
|
BET1
|
| 0xE3110D94
|
0xE3110D97
|
BEBT
|
| 0xE3000110
|
0xE3000113
|
DMAC0 - address
|
| 0xE3000114
|
0xE3000117
|
DMAC0 - attribute
|
| 0xE3010110
|
0xE3010113
|
DMAC1 - address
|
| 0xE3010114
|
0xE3010117
|
DMAC1 - attribute
|
| 0xE5000110
|
0xE5000113
|
DMAC2 - address
|
| 0xE5000114
|
0xE5000117
|
DMAC2 - attribute
|
| 0xE5010110
|
0xE5010113
|
DMAC3 - address
|
| 0xE5010114
|
0xE5010117
|
DMAC3 - attribute
|
| 0xE0400810
|
0xE0400813
|
DMAC4 - address
|
| 0xE0400814
|
0xE0400817
|
DMAC4 - attribute
|
| 0xE50C0110
|
0xE50C0113
|
DMAC6 - address
|
| 0xE50C0114
|
0xE50C0117
|
DMAC6 - attribute
|
| 0xE3110D14
|
0xE3110D17
|
SPM32 - address
|
| 0xE3110D18
|
0xE3110D1B
|
SPM32 - attribute
|
| 0xE3110D04
|
0xE3110D07
|
SPM128 - address
|
| 0xE3110D08
|
0xE3110D0B
|
SPM128 - attribute
|
| 0xE600C008
|
0xE600C00B
|
LPDDR2 I/F CH0 - address
|
| 0xE600C000
|
0xE600C003
|
LPDDR2 I/F CH0 - attribute
|
| 0xE588C008
|
0xE588C00B
|
LPDDR2 I/F CH1 - address
|
| 0xE588C000
|
0xE588C003
|
LPDDR2 I/F CH1 - attribute
|
| 0xE310013C
|
0xE310013F
|
Pervasive - address
|
| 0xE3100138
|
0xE310013B
|
Pervasive - attribute
|
| 0xE50D10F0
|
0xE50D10F3
|
Debug/PA - address
|
| 0xE50D10F4
|
0xE50D10F7
|
Debug/PA - attribute
|
| 0xE3110D34
|
0xE3110D37
|
Pervasive2 - address
|
| 0xE3110D38
|
0xE3110D3B
|
Pervasive2 - attribute
|
| 0xE580FFF0
|
0xE580FFF3
|
SDIO0 - address
|
| 0xE580FFF4
|
0xE580FFF7
|
SDIO0 - attribute
|
| 0xE581FFF0
|
0xE581FFF3
|
SDIO1 - address
|
| 0xE581FFF4
|
0xE581FFF7
|
SDIO1 - attribute
|
PSP Emulator
PSP Emulator memory map