User talk:Zecoxao
Jump to navigation
Jump to search
Borrowing this for a while. Checking if i can make it better :)
Memories
MMIO / Memorymap
| Physical Address | Size | ID | Usage | Address in HV dump (3.15) |
Notes |
|---|---|---|---|---|---|
| 0x800000 | 0x20000 | LV0 Code Region | |||
| 0x200000 | 0x400000 | LV1 Code Region | |||
| 0xF000000 | 0x40000 | GameOS HTAB | |||
| 0x1FC00000 NAND 0x1FCC0000 NOR |
0x40000 | SysRom/Bootldr | |||
| 0x20000000000 | 0x80000 | SPE0 MMIO Memory Region | |||
| 0x20000080000 | 0x80000 | SPE1 MMIO Memory Region | 0x003ABC20 | ||
| 0x20000100000 | 0x80000 | SPE2 MMIO Memory Region | 0x003AAD70 | ||
| 0x20000180000 | 0x80000 | SPE3 MMIO Memory Region | 0x003A8880 | panic on read | |
| 0x20000200000 | 0x80000 | SPE4 MMIO Memory Region | 0x003B4F70 | ||
| 0x20000280000 | 0x80000 | SPE5 MMIO Memory Region | 0x003AB700 | ||
| 0x20000300000 | 0x80000 | SPE6 MMIO Memory Region | 0x003B5BE0 | ||
| 0x20000380000 | 0x80000 | SPE7 MMIO Memory Region | 0->08->1->18->2->28->3->38? 0->1->2->3->4->5->6->7? | ||
| 0x1000 | SPE1 Shadow Registers Memory Region | 0x003ABDA0 | |||
| 0x1000 | SPE2 Shadow Registers Memory Region | 0x003B4290 | |||
| 0x1000 | SPE3 Shadow Registers Memory Region | 0x003A8A00 | |||
| 0x1000 | SPE4 Shadow Registers Memory Region | 0x003B50F0 | |||
| 0x1000 | SPE5 Shadow Registers Memory Region | 0x001FFC90 | |||
| 0x1000 | SPE6 Shadow Registers Memory Region | 0x003AE5B0 | |||
| 0x2000050A0C8 | 0x4 | XDR Memory Channel Size (Type 1) | Shift right 49 and add 0x20 for size. | ||
| 0x2000050A188 | 0x4 | XDR Memory Channel Size (Type 0) | Shift right 49 and add 0x20 for size. | ||
| 0x2000050A210 | 0x4 | XDR Memory Channel Type | For use with above memory locations | ||
| 0x24000000000 | SB bus subsystem | ||||
| 0x24000002000 | 0x200 | 1 | SATA Controller 1 | ||
| 0x24000002200 | 0x200 | 2 | SATA Controller 2 | ||
| 0x24000002400 | 0x200 | 3 | USB Controller 1 | ||
| 0x24000002600 | 0x200 | 4 | USB Controller 2 | ||
| 0x24000002800 | 0x200 | 0 | Gelic Device | ||
| 0x24000002C00 | 0x200 | 7 | ENCDEC Device | ||
| 0x24000008000 | 0x1000 | SB bus External interrupt controller | Found while looking at linux kernel src. (spider-pic.c) | ||
| 0x24000008100 | SB bus interrupt handler | 0x002B9CC4 | |||
| 0x24000008104 | SB bus interrupt handler | ||||
| 0x24000087000 | SB status/info | ||||
| 0x2400008C000 | SYSCON (receive packetheader) | ||||
| 0x2400008C010 | SYSCON (receive packetbody) | ||||
| 0x2400008CFF0 | SYSCON (receive ?) | ||||
| 0x2400008CFF4 | SYSCON (send ?) | ||||
| 0x2400008D000 | SYSCON (send packetheader) | ||||
| 0x2400008D010 | SYSCON (send packetbody) | ||||
| 0x2400008DFF0 | SYSCON (send ?) | ||||
| 0x2400008DFF4 | SYSCON (receive ?) | ||||
| 0x2400008E000 | SYSCON (receive ?) | ||||
| 0x2400008E004 | SYSCON (receive test bit 0x2) | ||||
| 0x2400008E100 | SYSCON (send notify) | ||||
| 0x24003000000 | 0x1000 | 1 | SATA Controller 1 | ||
| 0x24003001000 | 0x1000 | 2 | SATA Controller 2 | ||
| 0x24003004000 | 0x1000 | 0 | Gelic Device | ||
| 0x24003005000 | 0x1000 | 7 | ENCDEC Device | ||
| 0x24003005200 | 0x4 | 7 | ENCDEC Device | 0 != ENCDEC Test Mode | |
| 0x24003006000 | 0x1000 | 7 | ENCDEC Device | ||
| 0x240030060A0 | 0x4 | 7 | ENCDEC Device | EdecKgenFlash Command (0x84) | |
| 0x24003010000 | 0x10000 | 3 | USB Controller 1 | 0x001FDF00 | |
| 0x24003020000 | 0x10000 | 4 | USB Controller 2 | 0x003B3850 | |
| 0x24003800000 | 0x1000 | 1 | SATA Controller 1 | ||
| 0x24003801000 | 0x1000 | 2 | SATA Controller 2 | ||
| 0x24003802000 | 0x1000 | 1 | SATA Controller 1 | ||
| 0x24003803000 | 0x1000 | 2 | SATA Controller 2 | ||
| 0x24003810000 | 0x10000 | 3 | USB Controller 1 | 0x003B6E50 | |
| 0x24003820000 | 0x10000 | 4 | USB Controller 2 | 0x003B9950 | |
| 0x2401F000000 | 0x1000000 | NOR Flash | |||
| 0x28000000000 | 0x2000 | AV Manager (/dev/ioif0) | only mmap system call | ||
| 0x28001800000 | 0x1000 | AV Manager (/dev/ioif0) | only mmap system call | ||
| 0x28000600000 | 0x4000 | AV Manager (/dev/ioif0) - Output Control Registers | only mmap system call. First 0x2000 for head 0. Next 0x2000 for head 1. | ||
| 0x28000680000 | 0x4000 | AV Manager (/dev/ioif0) - PLL Control Registers | only mmap system call. First 0x2000 for head 0. Next 0x2000 for head 1. | ||
| 0x28000080000 | 0x8000 | AV Manager (/dev/ioif0) | only mmap system call | ||
| 0x28000088000 | 0x1000 | AV Manager (/dev/ioif0) | only mmap system call | ||
| 0x2800000C000 | 0x1000 | AV Manager (/dev/ioif0) | only mmap system call | ||
| 0x2800008A000 | 0x1000 | AV Manager (/dev/ioif0) | only mmap system call | ||
| 0x2800008C000 | 0x1000 | AV Manager (/dev/ioif0) | only mmap system call | ||
| 0x28080000000 | 0xFE00000 | 1 | GPU Device Memory Region | 0x003AF380 | |
| 0x3C0000 | 0xC000 | 2 | GPU Device Memory Region | 0x003AF500 | |
| 0x2808FE00000 | 0x40000 | 3 | GPU Device Memory Region | 0x003AF680 | |
| 0x28000C00000 | 0x20000 | 4 | GPU Device Memory Region | 0x003AFC30 | |
| 0x28000080100 | 0x8000 | 5 | GPU Device Memory Region | 0x003BB420 | |
| 9 | FLASH Controller device (StarShip - SS) | FLASH controller doesn't have MMIO regions | |||
| 0x000000000000 | 0x1000000 | LPAR Memory Region | http://pastie.org/private/rcmxn0cqd1xirxsgrp1k3a | ||
| 0x500000300000 | 0xA0000 | LPAR1 Memory Region | http://pastie.org/private/rcmxn0cqd1xirxsgrp1k3a | ||
| 0x700020000000 | 0xE900000 | LPAR2 Memory Region | http://pastie.org/private/rcmxn0cqd1xirxsgrp1k3a |
Elusive calls?
lv1_construct_logical_spe_type1 construct_logical_partition destruct_logical_partition get_logical_partition_info set_scheduling_slot destruct_virtual_uart construct_virtual_uart decrypt_user_token decrypt_and_verify_update_package load_spm_policy load_additional_policy load_internal_policy load_revoke_list_from_initial_storage load_module load_profile load_gos (Guest OS) unload_gos load_lv2 disable_reqsense enable_reqsense disable_ata enable_ata set_encdec_key disable_spu_execution pmi_storage_send_device_command pmi_net_set_hardware_info pmi_net_set_eurus_firmware_buffer pmi_set_guest_os_mode lv1_ioctl
see also http://www.psdevwiki.com/ps3/Hypervisor_Reverse_Engineering#System_call_numbers_2 and http://pastie.org/private/tkcto4eocqrltpyxhtnhq (removed repeated patterns)