Physical Memory

Main table

Start	End	Size	World	Comments
0x00000000	0x00007FFF	0x8000	NS/S	ARM Boot. Alias of physical address 0x1F000000 i.e. ScePower scratchpad.
0x00040000	0x0005FFFF	0x20000	S	MeP boot. Mirror of physical address 0x00800000.
0x00300000	0x0030FFFF	0x10000	S	cmep icache
0x00310000	0x0031FFFF	0x10000	S	cmep icache tag
0x00320000	0x0032FFFF	0x10000	S	cmep dcache
0x00330000	0x0033FFFF	0x10000	S	cmep dcache tag
0x004B0000	0x005FFFFF	0x150000	S	Reverved for Venezia
0x00600000	0x007FFFFF	0x200000	S	Reserved for MeP
0x00800000	0x0081FFFF	0x20000	S	cmep 128KiB SRAM. second_loader, secure kernel, sm location.
0x1A000000	0x1A001FFF	0x2000	NS/S	ARM. SceInterruptControllerReg, ScePeriphReg, Interrupts (PERIPHBASE). Stores SCU_CONTROL_REG, SCU_SAC_REG.
0x1A002000	0x1A002FFF	0x1000	NS/S	ARM. ScePl310Reg, SceL2CacheReg, L2 Cache Controller. Stores SCU_CONFIG_REG, PL310_CACHE_ID, PL310_CACHE_TYPE.
0x1C000000	0x1C1FFFFF	0x200000	NS/S	Compatibility SRAM. SRAM used by SKBL to store ARZL decoded SceSysmem, SceDisplay / SceCamera SRAM (only 960x544 pixels * 4 bytes = 0x1FE000 bytes mapped), PspEmu Tachyon-eDRAM.
0x1F000000	0x1F007FFF	0x8000	NS/S	SPAD32K, ScePowerScratchPad32KiB. After suspend, SKBL stores there "Non-secure power.kprx resume" using suspendinfo then jumps to it.
0x1F840000	0x1F85FFFF	0x20000	NS/S	SPAD128K. SceVeneziaSpram. Stores Secure Kernel on boot.
0x20000000	0x27FFFFFF	0x8000000	NS	VRAM. Graphics bar
0x30000000	?	?	S	Unknown. Used by first_loader (proto:0x5C398) and second_loader (3.60:0x808208)
0x40000000	0x401FFFFF on FWs < 3.50 0x401FFFFF on FWs >= 3.50	0x300000 on FWs < 3.50 0x200000 on FWs >= 3.50	S	Secure DRAM
0x40300000 on FWs < 3.50 0x40200000 on FWs >= 3.50	0xBFFFFFFF	0x7FD00000 on FWs < 3.50 0x7FE00000 on FWs >= 3.50	NS/S	Non-secure Shared DRAM
0xC0000000	0xDFFFFFFF	0x20000000	NS/S	Reserved for Venezia. Maybe unused.
0xE0000000	0xE00FFFFF	0x100000	S	Control Register. cmep
0xE0100000	0xE0100FFF	0x1000	NS	SceGpio1Reg
0xE0400000	0xE0400FFF	0x1000	NS	SceDmacmgrDmac4Reg
0xE0410000	0xE0410FFF	0x1000	NS	SceDmacmgrDmac5Reg
0xE0420000	0xE0420FFF	0x1000	NS	SceI2s0Reg
0xE0430000	0xE0430FFF	0x1000	NS	SceI2s1Reg
0xE0440000	0xE0440FFF	0x1000	NS	SceI2s2Reg
0xE0450000	0xE0450FFF	0x1000	NS	SceI2s3Reg
0xE0460000	0xE0460FFF	0x1000	NS	SceI2s5Reg
0xE0470000	0xE0470FFF	0x1000	NS	SceI2s4Reg
0xE0490000	0xE0490FFF	0x1000	NS	SceI2s7Reg
0xE04A0000	0xE04A0FFF	0x1000	NS	SceSrcMix0Reg
0xE04B0000	0xE04B0FFF	0x1000	NS	SceSrcMix1Reg
0xE04C0000	0xE04C0FFF	0x1000	NS	SceSrcMix2Reg
0xE04D0000	0xE04D3FFF	0x4000	NS	SceSpdifReg
0xE04DC000	0xE04DCFFF	0x1000	NS	SceAclkgenReg
0xE04E0000	0xE04E0FFF	0x1000	NS/S	SceDmacmgrKeyringReg, SceSblDMAC5DmacKRBase, DMAC Register base
0xE0500000	0xE0500FFF	0x1000	NS	SceI2c0Reg
0xE0510000	0xE0510FFF	0x1000	NS	SceI2c1Reg
0xE0900000	0xE0900FFF	0x1000	NS	SceMsif
0xE0A00000	0xE0A00FFF	0x1000	NS	SceSpi0Reg (SceSyscon)
0xE0A10000	0xE0A10FFF	0x1000	NS	SceSpi1Reg (SceMotionDev)
0xE0A20000	0xE0A20FFF	0x1000	NS	SceSpi2Reg (SceOled)
0xE0B00000	0xE0B00FFF	0x1000	NS	SceSdif0
0xE0C00000	0xE0C00FFF	0x1000	NS	SceSdif1
0xE0C10000	0xE0C10FFF	0x1000	NS	SceSdif2
0xE0C20000	?	?	?	SceSdif3 (not present on FW 1.69, does FW 3.60 use only NSKBL?)
0xE2030000	0xE209FFFF	0x70000	NS	SceUartReg
0xE20A0000	0xE20A0FFF	0x1000	NS	SceGpio0Reg / SceLedReg
0xE20A1000	0xE20AFFFF	0xF000	NS	SceLedReg
0xE20B1000	0xE20B5FFF	0x5000	NS	SceLongRangeTimerReg
0xE20B6000	0xE20B6FFF	0x1000	NS	SceLT5, Clock in usec (part of SceLongRangeTimerReg)
0xE20B7000	0xE20BDFFF	0x7000	NS	SceWordTimerReg
0xE20BE000	0xE20BEFFF	0x1000	S?	SceTimerForUsleep (part of SceWordTimerReg)
0xE20C0000	0xE20C0FFF	0x1000	NS	ScePwmReg
0xE3000000	0xE3000FFF	0x1000	NS	SceDmacmgrDmac0Reg
0xE3010000	0xE3010FFF	0x1000	NS	SceDmacmgrDmac1Reg
0xE3020000	0xE3020FFF	0x1000	NS	SceCif0Reg
0xE3030000	0xE3030FFF	0x1000	NS	SceCif1Reg
0xE3050000	0xE3050FFF	0x1000	NS	SceCsi0Reg
0xE3060000	0xE3060FFF	0x1000	NS	SceCsi1Reg
0xE3100000	0xE3100FFF	0x1000	NS	ScePervasiveMisc
0xE3101000	0xE3101FFF	0x1000	NS	ScePervasiveResetReg
0xE3102000	0xE3102FFF	0x1000	NS	ScePervasiveGate
0xE3103000	0xE3103FFF	0x1000	NS	ScePervasiveBaseClk
0xE3104000	0xE3104FFF	0x1000	NS	ScePervasiveVid
0xE3105000	0xE3105FFF	0x1000	NS	SceUartClkgenReg
0xE3106000	0xE3106FFF	0x1000	NS	ScePervasiveMailboxReg
0xE3108000	0xE3108FFF	0x1000	NS	ScePervasiveTas0
0xE3109000	0xE3109FFF	0x1000	NS	ScePervasiveTas1
0xE310A000	0xE310AFFF	0x1000	NS	ScePervasiveTas2
0xE310B000	0xE310BFFF	0x1000	NS	ScePervasiveTas3
0xE310C000	0xE310CFFF	0x1000	NS	ScePervasiveTas4
0xE310D000	0xE310DFFF	0x1000	NS	ScePervasiveTas5
0xE310E000	0xE310EFFF	0x1000	NS	ScePervasiveTas6
0xE310F000	0xE310FFFF	0x1000	NS	ScePervasiveTas7
0xE3110000	0xE3110FFF	0x1000	NS	SPM32, SPM128, Compati SRAM, ScePervasive2Reg, SceUdcd0
0xE3200000	0xE3200FFF	0x1000	S	Base Debug ROM Table
0xE3203000	0xE3203FFF	0x1000	NS	SceTpiuReg
0xE3204000	0xE3204FFF	0x1000	NS	SceFunnelReg
0xE3205000	0xE3205FFF	0x1000	NS	SceItmReg
0xE3300000	0xE3300FFF	0x1000	S	ARM Cortex-A9 Debug ROM Table
0xE3310000	0xE3310FFF	0x1000	NS	SceDbg0Reg, Debugger Interface
0xE3311000	0xE3311FFF	0x1000	NS	ScePmu0Reg
0xE3312000	0xE3312FFF	0x1000	NS	SceDbg1Reg, Debugger Interface
0xE3313000	0xE3313FFF	0x1000	NS	ScePmu1Reg
0xE3314000	0xE3314FFF	0x1000	NS	SceDbg2Reg, Debugger Interface
0xE3315000	0xE3315FFF	0x1000	NS	ScePmu2Reg
0xE3316000	0xE3316FFF	0x1000	NS	SceDbg3Reg, Debugger Interface
0xE3317000	0xE3317FFF	0x1000	NS	ScePmu3Reg
0xE3318000	0xE3318FFF	0x1000	NS	SceCti0Reg
0xE3319000	0xE3319FFF	0x1000	NS	SceCti1Reg
0xE331A000	0xE331AFFF	0x1000	NS	SceCti2Reg
0xE331B000	0xE331BFFF	0x1000	NS	SceCti3Reg
0xE331C000	0xE331CFFF	0x1000	NS	ScePtm0Reg
0xE331D000	0xE331DFFF	0x1000	NS	ScePtm1Reg
0xE331E000	0xE331EFFF	0x1000	NS	ScePtm2Reg
0xE331F000	0xE331FFFF	0x1000	NS	ScePtm3Reg
0xE3320000	0xE3323FFF	0x4000	NS	ARM-VFP. SceIntrmgrVfpIntRegs
0xE4020000	0xE4020FFF	0x1000	NS	USB2_OHCI. SceUsbdEhci
0xE40B0000	0xE40B0FFF	0x1000	NS	SceUsbdEhci
0xE40C0000	0xE40C0FFF	0x1000	NS	SceUdcd1
0xE40D0000	0xE40D0FFF	0x1000	NS	SceUdcd2
0xE40E0000	0xE40E0FFF	0x1000	NS	SceUsbdEhci
0xE5000000	0xE5000FFF	0x1000	NS	SceDmacmgrDmac2Reg
0xE5010000	0xE5010FFF	0x1000	NS	SceDmacmgrDmac3Reg
0xE5020000	0xE5020FFF	0x1000	NS	SceIftu0RegA (OLED FB)
0xE5021000	0xE5021FFF	0x1000	NS	SceIftu0RegB
0xE5022000	0xE5022FFF	0x1000	NS	SceIftuc0Reg
0xE5030000	0xE5030FFF	0x1000	NS	SceIftu1RegA (HDMI FB)
0xE5031000	0xE5031FFF	0x1000	NS	SceIftu1RegB
0xE5032000	0xE5032FFF	0x1000	NS	SceIftuc1Reg
0xE5040000	0xE5040FFF	0x1000	NS	SceIftu2Reg
0xE5050000	0xE5050FFF	0x1000	NS	SceDsi0Reg
0xE5060000	0xE5060FFF	0x1000	NS	SceDsi1Reg
0xE5070000	0xE5070FFF	0x1000	NS	SceCompatMailbox
0xE5071000	0xE5071FFF	0x1000	NS	SceCompatLCDDMA
0xE50C0000	0xE50C0FFF	0x1000	NS	SceDmacmgrDmac6Reg
0xE50D0000	0xE50D1FFF	0x2000	NS	Debug/PA, ScePfmReg, SceDeci4pDtracepPaReg
0xE5800000	0xE580FFFF	0x10000	NS	SceSDbgSdio0
0xE5810000	0xE581FFFF	0x10000	NS	SceDbgSdio1
0xE5880000	0xE5889FFF	0x10000	?	LPDDR2 I/F CH1. LPDDR2SUB (1st 256MiB DRAM bank config regs) (?)
0xE6000000	0xE6009FFF	0x10000	?	LPDDR2 I/F CH0. LPDDR2"TOP" (2nd 256MiB DRAM bank config regs) (?). Stores DDRSC_CONF.
0xE8000000	0xE8001FFF	0x2000	S	SceSonyRegbus. GPU Control
0xE8100000	0xE8100FFF	0x1000	NS/S	SceCompatSharedSram (0xBFC00000 in PSP)
0xE8200000	0xE8200FFF	0x1000	S	SceEmcTop (External Memory Controller, VRAM?)
0xE8300000	0xE8301FFF	0x2000	S	SceGrab
0xE8400000	0xE841FFFF	0x20000	NS	SceSGX543Reg. See SGX543.
0xEC000000	?	?	?	Mapped by SKBL
0xEC060000	?	?	?	Mapped by SKBL. Maybe related to cmep reset.
0xED000000	?	?	?	Mapped by SKBL
0xEE000000	?	?	?	Mapped by SKBL
0xF0000000	?	?	?	Reserved for Venezia

Secure DRAM

FW 0.931 Secure DRAM

On FW 0.931, SKBL is stored at physical address 0x50000000. So, on FW 0.931, which data are stored at 0x40040000? Is it even considered as Secure DRAM?

ARZL compressed NSKBL is kept in place inside SKBL segment 0 (at offset 0x37100) til ARZL decoding to Non-secure DRAM at physical address 0x51000000.

FWs 0.990-0.995 Secure DRAM

On FWs 0.990-0.995, SKBL segment 0 starts at physical address 0x40040000.

ARZL compressed NSKBL is extracted from a kernel_boot_loader segment to Non-secure DRAM at physical address 0x50000000. It is then ARZL decoded to Non-secure DRAM at physical address 0x51000000.

FWs >=0.996 Secure DRAM

Since FW 0.996, SKBL segment 0 starts at physical address 0x40020000. This change could have come from the increasing SKBL segment 0 size with revisions.

FW 3.60 Secure DRAM

Start	End	Size	Comments
0x40000000	0x400000BF	0xC0	SKBL Reset Vector
0x40000500	0x400099FF	0x9500	kprx_auth_sm.self. This area is also used as a scratchpad at boot.
0x40009B00	0x4000A27F	0x780	prog_rvk.srvk
0x4001FD00	0x4001FEFF	0x100	SceKblParam with magic not set
0x40020000	0x400570C7	0x370C8	SKBL segment 0
0x40057100	0x400571DF	0xE0	SKBL segment 1
0x40073570	0x4007376F	0x200	SceKblParam

Non-secure Shared DRAM

This region is used by both Secure and Non-Secure Kernel Boot Loaders, and by Secure Kernel modules.

Start	End	Size	Comments
0x40200000 on FW 3.60, 0x40300000 on FW 1.69	0x4FFFFFFF	0x0FE00000 on FW 3.60, 0x0FD00000 on FW 1.69	TrustZone region. ?First 0x1000 bytes are a Reset Vector named SceKernelReset whose first 0x100 bytes are identical as in uncompressed NSKBL (need to check)?
0x50000000	0x50FFFFFF	0x1000000	ARZL compressed NSKBL. Comes from one of kernel_boot_loader.self segments.
0x51000000	0x51FFFFFF	0x1000000	SceBootKernelImage. Uncompressed NSKBL. Comes from ARZL compressed NSKBL.
0x52000000	0x5FFFFFFF	0xE000000	Non-secure kernel and usermode modules
0x60000000	0x7FFFFFFF	0x20000000	DevKit additional 512MiB. LDDR2TOP.
0x80000000	0x9FFFFFFF	0x20000000	DevKit additional 512MiB. LDDR2SUB. For perf (not published anywhere).
0xA0000000	0xBFFFFFFF	0x20000000	DevKit additional 512MiB. LDDR2SUB. For perf (not published anywhere, disabled).

NSKBL Layout

NSKBL on FW 0.931

ARZL encoded size: 0x2541B.

NSKBL on FW 3.60

Start	End	Size	Comments
0x51000000	0x51028087	0x28088	NSKBL Text segment
???	???	???	NSKBL Data segment

Notes:

• The first 0xC0 bytes of the Text segment are the reset vector.
• NSKBL is mapped in RWX mode so it may write itself to text segment.

cmep

Each cmep device has its own physical memory area.

Start	End	Comments
0xE0000000	0xE000FFFF	ARM/F00D communication F00D Communication Ports
0xE0010000	0xE001FFFF	cmep Reset
0xE0020000	0xE002FFFF	Unknown device. See ReadAs. Related to DMA.
0xE0030000	0xE003FFFF	F00D Key Ring Controller. ?EEPROM programmer?
0xE0040000	0xE004FFFF	F00D Math Processor (Bignum worker)
0xE0050000	0xE0050FFF?	Bigmac crypto engine, similar to DMAC5
0xE0058000	0xE0067FFF	F00D Keyring Regs F00D Key Ring Base. EEPROM / Bigmac key rings, 0x800 entries, 0x20 bytes for each key ring
0xE0070000	?	SceEmmcController
0xE00C0000	0xE00CFFFF	?

Interrupt registers

Start	End	Comments
0xE3100138	0xE310013B	BEATB
0xE310013C	0xE310013F	BEADR
0xE3110D80	0xE3110D83	BET0
0xE3110D90	0xE3110D93	BET1
0xE3110D94	0xE3110D97	BEBT
0xE3000110	0xE3000113	DMAC0 - address
0xE3000114	0xE3000117	DMAC0 - attribute
0xE3010110	0xE3010113	DMAC1 - address
0xE3010114	0xE3010117	DMAC1 - attribute
0xE5000110	0xE5000113	DMAC2 - address
0xE5000114	0xE5000117	DMAC2 - attribute
0xE5010110	0xE5010113	DMAC3 - address
0xE5010114	0xE5010117	DMAC3 - attribute
0xE0400810	0xE0400813	DMAC4 - address
0xE0400814	0xE0400817	DMAC4 - attribute
0xE50C0110	0xE50C0113	DMAC6 - address
0xE50C0114	0xE50C0117	DMAC6 - attribute
0xE3110D14	0xE3110D17	SPM32 - address
0xE3110D18	0xE3110D1B	SPM32 - attribute
0xE3110D04	0xE3110D07	SPM128 - address
0xE3110D08	0xE3110D0B	SPM128 - attribute
0xE600C008	0xE600C00B	LPDDR2 I/F CH0 - address
0xE600C000	0xE600C003	LPDDR2 I/F CH0 - attribute
0xE588C008	0xE588C00B	LPDDR2 I/F CH1 - address
0xE588C000	0xE588C003	LPDDR2 I/F CH1 - attribute
0xE310013C	0xE310013F	Pervasive - address
0xE3100138	0xE310013B	Pervasive - attribute
0xE50D10F0	0xE50D10F3	Debug/PA - address
0xE50D10F4	0xE50D10F7	Debug/PA - attribute
0xE3110D34	0xE3110D37	Pervasive2 - address
0xE3110D38	0xE3110D3B	Pervasive2 - attribute
0xE580FFF0	0xE580FFF3	SDIO0 - address
0xE580FFF4	0xE580FFF7	SDIO0 - attribute
0xE581FFF0	0xE581FFF3	SDIO1 - address
0xE581FFF4	0xE581FFF7	SDIO1 - attribute

PSP Emulator

PSP Emulator memory map