starlet_memory_map.txt

Starlet memory map

00000000-04000000: MEM1 area (2 mirrors, 0x2000000 each)
	0000000-1800000: MEM1 (0x1800000)
	1800000-2000000: unimplemented / bus noise / junk? (looks like uninitialized memory but unwritable)

04000000-08000000: unimplemented, read as zeroes

08000000-10000000: register/SRAM area (8 mirrors, 0x800000 each)
	000000-400000: registers (4 mirrors, 0x100000 each) CANONICAL ADDRESSES: 0x0d000000 and 0x0d800000
		000000-010000: GC / Hollywood registers (2 mirrors, 0x8000 each)
			if address bit 0x00800000 is set, then access with Starlet permissions
			else use Broadway permissions
			0000-6000: Hollywood registers (24 mirrors, 0x400 each)
			6000-6400: DI registers (16 mirrors, 0x40 each)
			6400-6800: SI registers (4 mirrors, 0x100 each)
			6800-6c00: EXI registers (8 mirrors, 0x80 each)
				00-40: GC EXI registers
				40-80: EXI boot buffer
			6c00-7000: AI registers (32 mirrors, 0x20 each)
			7000-8000: Hollywood registers (4 mirrors, 0x400 each, see above)
		010000-020000: NAND controller (64 mirrors, 0x400 each)
		020000-030000: AES accelerator (64 mirrors, 0x400 each)
		030000-040000: SHA-1 accelerator (64 mirrors, 0x400 each)
		040000-050000: EHCI controller (256 mirrors, 0x100 each)
		050000-060000: OHCI controller 1 (128 mirrors, 0x200 each)
		060000-070000: OHCI controller 2 (128 mirrors, 0x200 each)
		070000-080000: SD Host Controller (128 mirrors, 0x200 each)
		080000-090000: SDIO Host Controller (WLAN) (128 mirrors, 0x200 each)
		090000-0a0000: unimplemented, read as zeroes
		0a0000-0b0000: Starlet SRAM or ROM (see below)
		0b0000-0c0000: Memory controller stuff (0x10000)
			Only works through 0x0dxbxxxx, anything else causes crash!
			00000-00800: Memory controller stuff?? (0x800)
				Starlet only (address bit 0x00800000 is set), otherwise read as zeroes
			00800-04000: Memory prefetch / bus crap / who knows (56 mirrors, 0x100 each)
				000-040: Block 0
				040-080: Block 1
				080-0c0: Block 2
				0c0-100: Block 3
				Seem to contain data from four recently used 64-byte areas from MEM2
				The four areas need not be consecutive
			04000-10000: Memory controller stuff?? (48 mirrors, 0x400 each)
				Starlet only (address bit 0x00800000 is set), otherwise read as zeroes
		0c0000-100000: unimplemented, read as zeroes
				
	400000-800000: Starlet SRAM or ROM (32 mirrors, 0x20000 each) CANONICAL ADDRESS: 0x0d400000
		00000-08000:
			if HOLLYWOOD[0x60] bit 0x20 is clear, maps to SRAM bank A1
			if set, maps to either BOOT0 or SRAM bank B
		08000-10000:
			if HOLLYWOOD[0x60] bit 0x20 is clear, maps to SRAM bank A2
			if set, maps to either BOOT0 or bus crap
		10000-18000:
			if HOLLYWOOD[0x60] bit 0x20 is clear, maps to SRAM bank B
			if set, maps to either BOOT0 or SRAM bank A1
		18000-10000:
			if HOLLYWOOD[0x60] bit 0x20 is clear, maps to bus crap
			if set, maps to either BOOT0 or SRAM bank A2
		
10000000-20000000: MEM2 (4 mirrors, 0x4000000 each)

20000000-80000000: unimplemented memory / registers (3 mirrors, 0x20000000 each)
	00000000-08000000: unimplemented, read as zeroes
	08000000-10000000: register/SRAM area mirror (8 mirrors, 0x800000 each, see above)
	10000000-20000000: unimplemented, read as zeroes

80000000-fffe0000: Starlet SRAM or ROM (16383 mirrors, 0x20000 each) CANONICAL ADDRESS: 0xfff00000
	See "Starlet SRAM or ROM" above

fffe0000-100000000: Starlet SRAM or ROM (0x20000)
	00000-08000:
		if HOLLYWOOD[0x60] bit 0x20 is clear, maps to SRAM bank A1
		if set, maps to either BOOT0 or SRAM bank B
	08000-10000:
		if HOLLYWOOD[0x60] bit 0x20 is clear, maps to SRAM bank A2
		if set, maps to either BOOT0 or bus crap
	10000-18000:
		if HOLLYWOOD[0x60] bit 0x20 is clear, maps to either BOOT0 or SRAM bank B
		if set, maps to SRAM bank A1
	18000-10000:
		if HOLLYWOOD[0x60] bit 0x20 is clear, maps to either BOOT0 or bus crap
		if set, maps to SRAM bank A2

===== SRAM and BOOT0 mapping explained =====

SRAM and BOOT0 map into two main canonical areas (with tons of mirrors):
 - 0x0d400000 - 0x0d41ffff
 - 0xfffe0000 - 0xffffffff

Mirrors of note:

0xfff00000-0xfff1ffff is equivalent to 0x0d400000-0x0d41ffff.
This is actually mirrored until 0xfffe0000 (or 0xffff0000 if you count half a mirroring block), where the mapping starts to differ.

BOOT0 runs from 0xffff0000 and loads BOOT1 into 0x0d400000, with HOLLYWOOD[0x60] off
BOOT1 runs from 0xfff00000, with HOLLYWOOD[0x60] off
ELFLOADER runs from MEM1, switches HOLLYWOOD[0x60] on, then loads BOOT2
BOOT2/IOS runs from 0xffff0000, switches off BOOT0, then uses 0xfffe0000 as data RAM too, with HOLLYWOOD[0x60] on

These are the maps:

--- BOOT0 enabled (HOLLYWOOD[0x18c] bit 0x1000 is clear) ---

 HOLLYWOOD[0x60] clear          HOLLYWOOD[0x60] set

 fff00000                       fff00000
 0d400000     fffe0000          0d400000     fffe0000
+---------+  +---------+       +---------+  +---------+  +00000
|         |  |         |       |         |  |         |
|         |  |         |       |         |  |         |
|         |  |         |       |         |  |         |
| SRAM A  |  | SRAM A  |       |         |  |  BOOT0  |  +08000
|         |  |         |       |         |  |   x8    |
|         |  |         |       |         |  |         |
|         |  |         |       |         |  |         |
+---------+  +---------+       |  BOOT0  |  +---------+  +10000
|         |  |         |       |   x16   |  |         |
| SRAM B  |  |         |       |         |  |         |
|         |  |         |       |         |  |         |
+---------+  |  BOOT0  |       |         |  | SRAM A  |  +18000
|         |  |   x8    |       |         |  |         |
|  JUNK   |  |         |       |         |  |         |
|         |  |         |       |         |  |         |
+---------+  +---------+       +---------+  +---------+  +20000

--- BOOT0 disabled (HOLLYWOOD[0x18c] bit 0x1000 is set) ---

 HOLLYWOOD[0x60] clear          HOLLYWOOD[0x60] set

 fff00000                       fff00000
 0d400000     fffe0000          0d400000     fffe0000
+---------+  +---------+       +---------+  +---------+  +00000
|         |  |         |       |         |  |         |
|         |  |         |       | SRAM B  |  | SRAM B  |
|         |  |         |       |         |  |         |
| SRAM A  |  | SRAM A  |       +---------+  +---------+  +08000
|         |  |         |       |         |  |         |
|         |  |         |       |  JUNK   |  |  JUNK   |
|         |  |         |       |         |  |         |
+---------+  +---------+       +---------+  +---------+  +10000
|         |  |         |       |         |  |         |
| SRAM B  |  | SRAM B  |       |         |  |         |
|         |  |         |       |         |  |         |
+---------+  +---------+       | SRAM A  |  | SRAM A  |  +18000
|         |  |         |       |         |  |         |
|  JUNK   |  | JUNK    |       |         |  |         |
|         |  |         |       |         |  |         |
+---------+  +---------+       +---------+  +---------+  +20000