Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Starlet memory map
00000000-04000000: MEM1 area (2 mirrors, 0x2000000 each)
0000000-1800000: MEM1 (0x1800000)
1800000-2000000: unimplemented / bus noise / junk? (looks like uninitialized memory but unwritable)
04000000-08000000: unimplemented, read as zeroes
08000000-10000000: register/SRAM area (8 mirrors, 0x800000 each)
000000-400000: registers (4 mirrors, 0x100000 each) CANONICAL ADDRESSES: 0x0d000000 and 0x0d800000
000000-010000: GC / Hollywood registers (2 mirrors, 0x8000 each)
if address bit 0x00800000 is set, then access with Starlet permissions
else use Broadway permissions
0000-6000: Hollywood registers (24 mirrors, 0x400 each)
6000-6400: DI registers (16 mirrors, 0x40 each)
6400-6800: SI registers (4 mirrors, 0x100 each)
6800-6c00: EXI registers (8 mirrors, 0x80 each)
00-40: GC EXI registers
40-80: EXI boot buffer
6c00-7000: AI registers (32 mirrors, 0x20 each)
7000-8000: Hollywood registers (4 mirrors, 0x400 each, see above)
010000-020000: NAND controller (64 mirrors, 0x400 each)
020000-030000: AES accelerator (64 mirrors, 0x400 each)
030000-040000: SHA-1 accelerator (64 mirrors, 0x400 each)
040000-050000: EHCI controller (256 mirrors, 0x100 each)
050000-060000: OHCI controller 1 (128 mirrors, 0x200 each)
060000-070000: OHCI controller 2 (128 mirrors, 0x200 each)
070000-080000: SD Host Controller (128 mirrors, 0x200 each)
080000-090000: SDIO Host Controller (WLAN) (128 mirrors, 0x200 each)
090000-0a0000: unimplemented, read as zeroes
0a0000-0b0000: Starlet SRAM or ROM (see below)
0b0000-0c0000: Memory controller stuff (0x10000)
Only works through 0x0dxbxxxx, anything else causes crash!
00000-00800: Memory controller stuff?? (0x800)
Starlet only (address bit 0x00800000 is set), otherwise read as zeroes
00800-04000: Memory prefetch / bus crap / who knows (56 mirrors, 0x100 each)
000-040: Block 0
040-080: Block 1
080-0c0: Block 2
0c0-100: Block 3
Seem to contain data from four recently used 64-byte areas from MEM2
The four areas need not be consecutive
04000-10000: Memory controller stuff?? (48 mirrors, 0x400 each)
Starlet only (address bit 0x00800000 is set), otherwise read as zeroes
0c0000-100000: unimplemented, read as zeroes
400000-800000: Starlet SRAM or ROM (32 mirrors, 0x20000 each) CANONICAL ADDRESS: 0x0d400000
00000-08000:
if HOLLYWOOD[0x60] bit 0x20 is clear, maps to SRAM bank A1
if set, maps to either BOOT0 or SRAM bank B
08000-10000:
if HOLLYWOOD[0x60] bit 0x20 is clear, maps to SRAM bank A2
if set, maps to either BOOT0 or bus crap
10000-18000:
if HOLLYWOOD[0x60] bit 0x20 is clear, maps to SRAM bank B
if set, maps to either BOOT0 or SRAM bank A1
18000-10000:
if HOLLYWOOD[0x60] bit 0x20 is clear, maps to bus crap
if set, maps to either BOOT0 or SRAM bank A2
10000000-20000000: MEM2 (4 mirrors, 0x4000000 each)
20000000-80000000: unimplemented memory / registers (3 mirrors, 0x20000000 each)
00000000-08000000: unimplemented, read as zeroes
08000000-10000000: register/SRAM area mirror (8 mirrors, 0x800000 each, see above)
10000000-20000000: unimplemented, read as zeroes
80000000-fffe0000: Starlet SRAM or ROM (16383 mirrors, 0x20000 each) CANONICAL ADDRESS: 0xfff00000
See "Starlet SRAM or ROM" above
fffe0000-100000000: Starlet SRAM or ROM (0x20000)
00000-08000:
if HOLLYWOOD[0x60] bit 0x20 is clear, maps to SRAM bank A1
if set, maps to either BOOT0 or SRAM bank B
08000-10000:
if HOLLYWOOD[0x60] bit 0x20 is clear, maps to SRAM bank A2
if set, maps to either BOOT0 or bus crap
10000-18000:
if HOLLYWOOD[0x60] bit 0x20 is clear, maps to either BOOT0 or SRAM bank B
if set, maps to SRAM bank A1
18000-10000:
if HOLLYWOOD[0x60] bit 0x20 is clear, maps to either BOOT0 or bus crap
if set, maps to SRAM bank A2
===== SRAM and BOOT0 mapping explained =====
SRAM and BOOT0 map into two main canonical areas (with tons of mirrors):
- 0x0d400000 - 0x0d41ffff
- 0xfffe0000 - 0xffffffff
Mirrors of note:
0xfff00000-0xfff1ffff is equivalent to 0x0d400000-0x0d41ffff.
This is actually mirrored until 0xfffe0000 (or 0xffff0000 if you count half a mirroring block), where the mapping starts to differ.
BOOT0 runs from 0xffff0000 and loads BOOT1 into 0x0d400000, with HOLLYWOOD[0x60] off
BOOT1 runs from 0xfff00000, with HOLLYWOOD[0x60] off
ELFLOADER runs from MEM1, switches HOLLYWOOD[0x60] on, then loads BOOT2
BOOT2/IOS runs from 0xffff0000, switches off BOOT0, then uses 0xfffe0000 as data RAM too, with HOLLYWOOD[0x60] on
These are the maps:
--- BOOT0 enabled (HOLLYWOOD[0x18c] bit 0x1000 is clear) ---
HOLLYWOOD[0x60] clear HOLLYWOOD[0x60] set
fff00000 fff00000
0d400000 fffe0000 0d400000 fffe0000
+---------+ +---------+ +---------+ +---------+ +00000
| | | | | | | |
| | | | | | | |
| | | | | | | |
| SRAM A | | SRAM A | | | | BOOT0 | +08000
| | | | | | | x8 |
| | | | | | | |
| | | | | | | |
+---------+ +---------+ | BOOT0 | +---------+ +10000
| | | | | x16 | | |
| SRAM B | | | | | | |
| | | | | | | |
+---------+ | BOOT0 | | | | SRAM A | +18000
| | | x8 | | | | |
| JUNK | | | | | | |
| | | | | | | |
+---------+ +---------+ +---------+ +---------+ +20000
--- BOOT0 disabled (HOLLYWOOD[0x18c] bit 0x1000 is set) ---
HOLLYWOOD[0x60] clear HOLLYWOOD[0x60] set
fff00000 fff00000
0d400000 fffe0000 0d400000 fffe0000
+---------+ +---------+ +---------+ +---------+ +00000
| | | | | | | |
| | | | | SRAM B | | SRAM B |
| | | | | | | |
| SRAM A | | SRAM A | +---------+ +---------+ +08000
| | | | | | | |
| | | | | JUNK | | JUNK |
| | | | | | | |
+---------+ +---------+ +---------+ +---------+ +10000
| | | | | | | |
| SRAM B | | SRAM B | | | | |
| | | | | | | |
+---------+ +---------+ | SRAM A | | SRAM A | +18000
| | | | | | | |
| JUNK | | JUNK | | | | |
| | | | | | | |
+---------+ +---------+ +---------+ +---------+ +20000
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment