Physical Memory: Difference between revisions
Jump to navigation
Jump to search
Line 738: | Line 738: | ||
| ? | | ? | ||
| ? | | ? | ||
| | | Mapped by SKBL | ||
|- | |- | ||
| 0xED000000 | | 0xED000000 | ||
Line 744: | Line 744: | ||
| ? | | ? | ||
| ? | | ? | ||
| | | Mapped by SKBL | ||
|- | |- | ||
| 0xEE000000 | | 0xEE000000 | ||
Line 750: | Line 750: | ||
| ? | | ? | ||
| ? | | ? | ||
| | | Mapped by SKBL | ||
|} | |} | ||
Revision as of 06:21, 11 January 2021
Main table
Start | End | Size | World | Comments |
---|---|---|---|---|
0x00000000 | 0x00007FFF | 0x8000 | NS | Alias of 0x1F000000 , ScePower scratch buffer
|
0x00040000 | 0x0004AFFF | 0xB000 | S | Mirror of 0x00800000. |
0x0004B000 | 0x0005FFFF | 0x15000 | S | Mirror of 0x0080B000. |
0x00800000 | 0x0080AFFF | 0xB000 | S | secure kernel |
0x0080B000 | 0x0081FFFF | 0x15000 | S | sm location |
0x1A000000 | 0x1A001FFF | 0x2000 | NS | SceInterruptControllerReg / ScePeriphReg, Interrupts (PERIPHBASE )
|
0x1A002000 | 0x1A002FFF | 0x1000 | NS | ScePl310Reg / SceL2CacheReg, L2 Cache Controller |
0x1C000000 | 0x1C1FFFFF | 0x200000 | NS/S | SceDisplay / SceCameraSRAM (only 960x544 mapped) |
0x1F000000 | 0x1F007FFF | 0x8000 | NS/S | ScePowerScratchPad32KiB |
0x1F840000 | 0x1F85FFFF | 0x20000 | NS/S | SceVeneziaSpram - Stores Secure Kernel on boot |
0x20000000 | 0x27FFFFFF | 0x8000000 | NS | VRAM |
0x40000000 | 0x401FFFFF | 0x200000 | S | Secure DRAM (extra 1 Mega before FW 3.52) |
0x40200000 | 0x5FFFFFFF | 0x1FE00000 | NS/S | Shared DRAM (starts at 0x40300000 before FW 3.52) |
0x60000000 | 0x7FFFFFFF | 0x20000000 | NS | Shared DRAM DevKit additional 512MiB |
0x80000000 | 0x9FFFFFFF | 0x20000000 | NS | Unused or DRAM ? |
0xE0000000 | ? | ? | S | F00D Processor |
0xE0100000 | 0xE0100FFF | 0x1000 | NS | SceGpio1Reg |
0xE0400000 | 0xE0400FFF | 0x1000 | NS | SceDmacmgrDmac4Reg |
0xE0410000 | 0xE0410FFF | 0x1000 | NS | SceDmacmgrDmac5Reg |
0xE0420000 | 0xE0420FFF | 0x1000 | NS | SceI2s0Reg |
0xE0430000 | 0xE0430FFF | 0x1000 | NS | SceI2s1Reg |
0xE0440000 | 0xE0440FFF | 0x1000 | NS | SceI2s2Reg |
0xE0450000 | 0xE0450FFF | 0x1000 | NS | SceI2s3Reg |
0xE0460000 | 0xE0460FFF | 0x1000 | NS | SceI2s5Reg |
0xE0470000 | 0xE0470FFF | 0x1000 | NS | SceI2s4Reg |
0xE0490000 | 0xE0490FFF | 0x1000 | NS | SceI2s7Reg |
0xE04A0000 | 0xE04A0FFF | 0x1000 | NS | SceSrcMix0Reg |
0xE04B0000 | 0xE04B0FFF | 0x1000 | NS | SceSrcMix1Reg |
0xE04C0000 | 0xE04C0FFF | 0x1000 | NS | SceSrcMix2Reg |
0xE04D0000 | 0xE04D3FFF | 0x4000 | NS | SceSpdifReg |
0xE04DC000 | 0xE04DCFFF | 0x1000 | NS | SceAclkgenReg |
0xE04E0000 | 0xE04E0FFF | 0x1000 | NS/S | SceDmacmgrKeyringReg / SceSblDMAC5DmacKRBase / DMAC Register base |
0xE0500000 | 0xE0500FFF | 0x1000 | NS | SceI2c0Reg |
0xE0510000 | 0xE0510FFF | 0x1000 | NS | SceI2c1Reg |
0xE0900000 | 0xE0900FFF | 0x1000 | NS | SceMsif |
0xE0A00000 | 0xE0A00FFF | 0x1000 | NS | SceSpi0Reg (SceSyscon) |
0xE0A10000 | 0xE0A10FFF | 0x1000 | NS | SceSpi1Reg (SceMotionDev) |
0xE0A20000 | 0xE0A20FFF | 0x1000 | NS | SceSpi2Reg (SceOled) |
0xE0B00000 | 0xE0B00FFF | 0x1000 | NS | SceSdif0 |
0xE0C00000 | 0xE0C00FFF | 0x1000 | NS | SceSdif1 |
0xE0C10000 | 0xE0C10FFF | 0x1000 | NS | SceSdif2 |
0xE0C20000 | ? | ? | ? | SceSdif3 (not present on 1.69, Does 3.60 use only nsbl?) |
0xE2030000 | 0xE209FFFF | 0x70000 | NS | SceUartReg |
0xE20A0000 | 0xE20A0FFF | 0x1000 | NS | SceGpio0Reg / SceLedReg |
0xE20A1000 | 0xE20AFFFF | 0xF000 | NS | SceLedReg |
0xE20B1000 | 0xE20B5FFF | 0x5000 | NS | SceLongRangeTimerReg |
0xE20B6000 | 0xE20B6FFF | 0x1000 | NS | SceLT5, Clock in usec |
0xE20B7000 | 0xE20BFFFF | 0x9000 | NS | SceWordTimerReg |
0xE20BE000 | 0xE20BEFFF | 0x1000 | ? | Timer for usleep |
0xE20C0000 | 0xE20C0FFF | 0x1000 | NS | ScePwmReg |
0xE3000000 | 0xE3000FFF | 0x1000 | NS | SceDmacmgrDmac0Reg |
0xE3010000 | 0xE3010FFF | 0x1000 | NS | SceDmacmgrDmac1Reg |
0xE3020000 | 0xE3020FFF | 0x1000 | NS | SceCif0Reg |
0xE3030000 | 0xE3030FFF | 0x1000 | NS | SceCif1Reg |
0xE3050000 | 0xE3050FFF | 0x1000 | NS | SceCsi0Reg |
0xE3060000 | 0xE3060FFF | 0x1000 | NS | SceCsi1Reg |
0xE3100000 | 0xE3100FFF | 0x1000 | NS | ScePervasiveMisc |
0xE3101000 | 0xE3101FFF | 0x1000 | NS | ScePervasiveResetReg |
0xE3102000 | 0xE3102FFF | 0x1000 | NS | ScePervasiveGate |
0xE3103000 | 0xE3103FFF | 0x1000 | NS | ScePervasiveBaseClk |
0xE3104000 | 0xE3104FFF | 0x1000 | NS | ScePervasiveVid |
0xE3105000 | 0xE3105FFF | 0x1000 | NS | SceUartClkgenReg |
0xE3106000 | 0xE3106FFF | 0x1000 | NS | ScePervasiveMailboxReg |
0xE3108000 | 0xE3108FFF | 0x1000 | NS | ScePervasiveTas0 |
0xE3109000 | 0xE3109FFF | 0x1000 | NS | ScePervasiveTas1 |
0xE310A000 | 0xE310AFFF | 0x1000 | NS | ScePervasiveTas2 |
0xE310B000 | 0xE310BFFF | 0x1000 | NS | ScePervasiveTas3 |
0xE310C000 | 0xE310CFFF | 0x1000 | NS | ScePervasiveTas4 |
0xE310D000 | 0xE310DFFF | 0x1000 | NS | ScePervasiveTas5 |
0xE310E000 | 0xE310EFFF | 0x1000 | NS | ScePervasiveTas6 |
0xE310F000 | 0xE310FFFF | 0x1000 | NS | ScePervasiveTas7 |
0xE3110000 | 0xE3110FFF | 0x1000 | NS | SceUdcd0 / ScePervasive2Reg |
0xE3200000 | 0xE3200FFF | 0x1000 | S | Base Debug ROM Table |
0xE3203000 | 0xE3203FFF | 0x1000 | NS | SceTpiuReg |
0xE3204000 | 0xE3204FFF | 0x1000 | NS | SceFunnelReg |
0xE3205000 | 0xE3205FFF | 0x1000 | NS | SceItmReg |
0xE3300000 | 0xE3300FFF | 0x1000 | S | Cortex A9 Debug ROM Table |
0xE3310000 | 0xE3310FFF | 0x1000 | NS | SceDbg0Reg, Debugger Interface |
0xE3311000 | 0xE3311FFF | 0x1000 | NS | ScePmu0Reg |
0xE3312000 | 0xE3312FFF | 0x1000 | NS | SceDbg1Reg, Debugger Interface |
0xE3313000 | 0xE3313FFF | 0x1000 | NS | ScePmu1Reg |
0xE3314000 | 0xE3314FFF | 0x1000 | NS | SceDbg2Reg, Debugger Interface |
0xE3315000 | 0xE3315FFF | 0x1000 | NS | ScePmu2Reg |
0xE3316000 | 0xE3316FFF | 0x1000 | NS | SceDbg3Reg, Debugger Interface |
0xE3317000 | 0xE3317FFF | 0x1000 | NS | ScePmu3Reg |
0xE3318000 | 0xE3318FFF | 0x1000 | NS | SceCti0Reg |
0xE3319000 | 0xE3319FFF | 0x1000 | NS | SceCti1Reg |
0xE331A000 | 0xE331AFFF | 0x1000 | NS | SceCti2Reg |
0xE331B000 | 0xE331BFFF | 0x1000 | NS | SceCti3Reg |
0xE331C000 | 0xE331CFFF | 0x1000 | NS | ScePtm0Reg |
0xE331D000 | 0xE331DFFF | 0x1000 | NS | ScePtm1Reg |
0xE331E000 | 0xE331EFFF | 0x1000 | NS | ScePtm2Reg |
0xE331F000 | 0xE331FFFF | 0x1000 | NS | ScePtm3Reg |
0xE3320000 | 0xE3323FFF | 0x4000 | NS | SceIntrmgrVfpIntRegs |
0xE4020000 | 0xE4020FFF | 0x1000 | NS | SceUsbdEhci |
0xE40B0000 | 0xE40B0FFF | 0x1000 | NS | SceUsbdEhci |
0xE40C0000 | 0xE40C0FFF | 0x1000 | NS | SceUdcd1 |
0xE40D0000 | 0xE40D0FFF | 0x1000 | NS | SceUdcd2 |
0xE40E0000 | 0xE40E0FFF | 0x1000 | NS | SceUsbdEhci |
0xE5000000 | 0xE5000FFF | 0x1000 | NS | SceDmacmgrDmac2Reg |
0xE5010000 | 0xE5010FFF | 0x1000 | NS | SceDmacmgrDmac3Reg |
0xE5020000 | 0xE5020FFF | 0x1000 | NS | SceIftu0RegA (OLED FB) |
0xE5021000 | 0xE5021FFF | 0x1000 | NS | SceIftu0RegB |
0xE5022000 | 0xE5022FFF | 0x1000 | NS | SceIftuc0Reg |
0xE5030000 | 0xE5030FFF | 0x1000 | NS | SceIftu1RegA (HDMI FB) |
0xE5031000 | 0xE5031FFF | 0x1000 | NS | SceIftu1RegB |
0xE5032000 | 0xE5032FFF | 0x1000 | NS | SceIftuc1Reg |
0xE5040000 | 0xE5040FFF | 0x1000 | NS | SceIftu2Reg |
0xE5050000 | 0xE5050FFF | 0x1000 | NS | SceDsi0Reg |
0xE5060000 | 0xE5060FFF | 0x1000 | NS | SceDsi1Reg |
0xE5070000 | 0xE5070FFF | 0x1000 | NS | SceCompatMailbox |
0xE5071000 | 0xE5071FFF | 0x1000 | NS | SceCompatLCDDMA |
0xE50C0000 | 0xE50C0FFF | 0x1000 | NS | SceDmacmgrDmac6Reg |
0xE50D0000 | 0xE50D1FFF | 0x2000 | NS | ScePfmReg / SceDeci4pDtracepPaReg |
0xE5880000 | 0xE5888FFF (?) | 0x9000 (?) | ? | LPDDR2SUB (1st 256MiB DRAM bank config regs) (?) |
0xE6000000 | 0xE6008FFF (?) | 0x9000 (?) | ? | LPDDR2"TOP" (2nd 256MiB DRAM bank config regs) (?) |
0xE8000000 | 0xE8001FFF | 0x2000 | S | SceSonyRegbus |
0xE8100000 | 0xE8100FFF | 0x1000 | NS/S | SceCompatSharedSram (0xBFC00000 in PSP)
|
0xE8200000 | 0xE8200FFF | 0x1000 | S | SceEmcTop (External Memory Controller, VRAM?) |
0xE8300000 | 0xE8301FFF | 0x2000 | S | SceGrab |
0xE8400000 | 0xE841FFFF | 0x20000 | NS | SceSGX543Reg |
0xEC000000 | ? | ? | ? | Mapped by SKBL |
0xED000000 | ? | ? | ? | Mapped by SKBL |
0xEE000000 | ? | ? | ? | Mapped by SKBL |
Secure DRAM
Start | End | Size | Comments |
---|---|---|---|
0x40000000 | 0x400000BF | 0xC0 | some Reset Vector, like 0x51000000 |
0x40000500 | 0x400099FF | 0x9500 | kprx_auth_sm.self raw data (encrypted) |
0x40009B00 | 0x4000A27F | 0x780 | some self raw data (encrypted) ?rvk? |
0x4001FD00 | 0x4001FCFF | 0x100 | KblParam but Magic is not set |
0x40020000 | 0x400570C7 | 0x370C8 | secure kernel bootloader text segment |
0x40057100 | ? | ? | secure kernel bootloader data segment |
0x40073570 | 0x4007376F | 0x200 | SceKblParam |
Start | End | Size | Comments |
---|---|---|---|
0x40200000 | 0x4FFFFFFF | 0xFE00000 | First 0x100 bytes are identical as uncompressed NSKBL (0x51000000) |
0x50000000 | 0x50FFFFFF | 0x1000000 | ARZL compressed NSKBL |
0x510000C0 | 0x51FFFFFF | 0x1000000 | uncompressed NSKBL |
0x52000000 | 0x5FFFFFFF | 0xE000000 | non-secure kernel and userland modules |
NSKBL Layout
Start | End | Size | Comments |
---|---|---|---|
0x51000000 | 0x51028087 | 0x28088 | NSKBL Text segment |
??? | ??? | ??? | NSKBL Data segment |
Notes
The first 0xC0 byte of the Text segment is the reset vector.
NSKBL is mapped in RWX so it may write to text segment.
F00D Processor
Each F00D device has its own physical memory area.
Start | End | Comments |
---|---|---|
0xE0000000 | 0xE000FFFF | ARM/F00D communication F00D Communication Ports |
0xE0010000 | 0xE001FFFF | F00D Reset |
0xE0020000 | 0xE002FFFF | ? |
0xE0030000 | 0xE003FFFF | F00D Key Ring Controller. ?EEPROM programmer? |
0xE0040000 | 0xE004FFFF | F00D Math Processor (Bignum worker) |
0xE0050000 | 0xE0050FFF? | Bigmac crypto engine, similar to DMAC5 |
0xE0058000 | 0xE0067FFF | F00D Keyring Regs F00D Key Ring Base. EEPROM / Bigmac keyslots, 0x800 entries, 0x20 bytes each key
|
0xE0070000 | ? | SceEmmcController |
0xE00C0000 | 0xE00CFFFF | ? |
Interrupt registers
Start | End | Comments |
---|---|---|
0xE3100138 | 0xE310013B | BEATB |
0xE310013C | 0xE310013F | BEADR |
0xE3110D80 | 0xE3110D83 | BET0 |
0xE3110D90 | 0xE3110D93 | BET1 |
0xE3110D94 | 0xE3110D97 | BEBT |
0xE3000110 | 0xE3000113 | DMAC0 - address |
0xE3000114 | 0xE3000117 | DMAC0 - attribute |
0xE3010110 | 0xE3010113 | DMAC1 - address |
0xE3010114 | 0xE3010117 | DMAC1 - attribute |
0xE5000110 | 0xE5000113 | DMAC2 - address |
0xE5000114 | 0xE5000117 | DMAC2 - attribute |
0xE5010110 | 0xE5010113 | DMAC3 - address |
0xE5010114 | 0xE5010117 | DMAC3 - attribute |
0xE0400810 | 0xE0400813 | DMAC4 - address |
0xE0400814 | 0xE0400817 | DMAC4 - attribute |
0xE50C0110 | 0xE50C0113 | DMAC6 - address |
0xE50C0114 | 0xE50C0117 | DMAC6 - attribute |
0xE3110D14 | 0xE3110D17 | SPM32 - address |
0xE3110D18 | 0xE3110D1B | SPM32 - attribute |
0xE3110D04 | 0xE3110D07 | SPM128 - address |
0xE3110D08 | 0xE3110D0B | SPM128 - attribute |
0xE600C008 | 0xE600C00B | LPDDR2 I/F CH0 - address |
0xE600C000 | 0xE600C003 | LPDDR2 I/F CH0 - attribute |
0xE588C008 | 0xE588C00B | LPDDR2 I/F CH1 - address |
0xE588C000 | 0xE588C003 | LPDDR2 I/F CH1 - attribute |
0xE310013C | 0xE310013F | Pervasive - address |
0xE3100138 | 0xE310013B | Pervasive - attribute |
0xE50D10F0 | 0xE50D10F3 | Debug/PA - address |
0xE50D10F4 | 0xE50D10F7 | Debug/PA - attribute |
0xE3110D34 | 0xE3110D37 | Pervasive2 - address |
0xE3110D38 | 0xE3110D3B | Pervasive2 - attribute |
0xE580FFF0 | 0xE580FFF3 | SDIO0 - address |
0xE580FFF4 | 0xE580FFF7 | SDIO0 - attribute |
0xE581FFF0 | 0xE581FFF3 | SDIO1 - address |
0xE581FFF4 | 0xE581FFF7 | SDIO1 - attribute |