Physical Memory

FW 0.931 Secure DRAM
On FW 0.931, SKBL is stored at physical address. So, on FW 0.931, which data are stored at ? Is it even considered as Secure DRAM?

ARZL compressed NSKBL is kept in place inside SKBL segment 0 (at offset 0x37100) til ARZL decoding to Non-secure DRAM at physical address.

FWs 0.990-0.995 Secure DRAM
On FWs 0.990-0.995, SKBL segment 0 starts at physical address.

ARZL compressed NSKBL is extracted from a kernel_boot_loader segment to Non-secure DRAM at physical address. It is then ARZL decoded to Non-secure DRAM at physical address.

FWs >=0.996 Secure DRAM
Since FW 0.996, SKBL segment 0 starts at physical address. This change could have come from the increasing SKBL segment 0 size with revisions.

Non-secure Shared DRAM
This region is used by both Secure and Non-Secure Kernel Boot Loaders, and by Secure Kernel modules.

NSKBL on FW 0.931
ARZL encoded size: 0x2541B.

NSKBL on FW 3.60
Notes:
 * The first 0xC0 bytes of the Text segment are the reset vector.
 * NSKBL is mapped in RWX mode so it may write itself to text segment.

Cmep registers
See also Cmep registers.

Each Cmep device has its own physical memory area.

PSP Emulator
PSP Emulator memory map