PS2 Memory and Hardware Mapped Registers Layout

----------------------------------------------RAM Sizes - Overview

-------------------EE - 32 MB
GS - 4 MB
IOP - 2 MB
SPU - 2 MB
Logical Address Range
Size
------------------------0x80000000-0x800FFFFF
1 MB
0x00100000-0x01FFFFFF
31 MB
0x20100000-0x21FFFFFF
31 MB
0x30100000-0x31FFFFFF
31 MB
0x10000000-0x11FFFFFF
32 MB
0x12000000-0x13FFFFFF
32 MB
0x1FC00000-0x1FFFFFFF
4 MB
0x9FC00000-0x9FFFFFFF
4 MB
0xBFC00000-0xBFFFFFFF
4 MB
0xBE000000-0xBE040000
256 KB
0xBE400000-0xBE440000
256 KB
0xBC000000-0xBC1FFFFF
2 MB
0x70000000-0x70003FFF
16 KB

Physical Address Range Description

---------------------- ----------0x00000000-0x000FFFFF

EE Kernel

0x00100000-0x01FFFFFF

EE RAM (Cached)

0x00100000-0x01FFFFFF

EE RAM (Uncached)

0x00100000-0x01FFFFFF

EE RAM (Uncached&accelerated)

0x10000000-0x11FFFFFF

EE Registers (uncached)

0x12000000-0x13FFFFFF

GS Registers (uncached)

0x1FC00000-0x1FFFFFFF? Boot ROM0 (uncached)

0x1FC00000-0x1FFFFFFF? Boot ROM09 (cached)
0x1FC00000-0x1FFFFFFF? Boot ROM0b (uncached)
0x1E000000-0x1E03FFFF? Boot ROM1
0x1E400000-0x1E43FFFF? Boot ROM2
0x1C000000-0x1C1FFFFF? IOP RAM
---------------------- Scratch Pad

Kernel empty and unused areas (NB: On non-modded consoles)

---------------------------------------------------------Area
Logical Address Range Physical Address Range
------------------------ ---------------------#1
0x80030000-0x80074FFF 0x00030000-0x00074FFF
ytes
#2
0x80078250-0x8007FFFF 0x00078250-0x0007FFFF
tes

Size
---282624 B

RAM Mirror Modes

---------------Cached
Uncached
Uncached&accelerated

Logical Address Range

--------------------0x00100000-0x01FFFFFF
0x20100000-0x21FFFFFF
0x30100000-0x31FFFFFF

Physical Address Range

---------------------0x00100000-0x01FFFFFF
0x00100000-0x01FFFFFF
0x00100000-0x01FFFFFF

Size
---31 MB
31 MB
31 MB

Operating Modes
--------------USEG
KSEG0

Logical Address Range

--------------------0x00000000-0x01FFFFFF
0x80000000-0x81FFFFFF

Physical Address Range

---------------------0x00000000-0x01FFFFFF
0x00000000-0x01FFFFFF

Size
---32 MB
32 MB

32176 By

KSEG1

0xA0000000-0xA1FFFFFF

0x00000000-0x01FFFFFF

Hardware Mapped Registers

------------------------COUNTERS' REGISTERS
------------------10000000
T0_COUNT
10000010
T0_MODE
10000020
T0_COMP
10000030
T0_HOLD

Timer
Timer
Timer
Timer

Count
Mode
Compare value
Pause

10000800
10000810
10000820
10000830

T1_COUNT
T1_MODE
T1_COMP
T1_HOLD

Timer
Timer
Timer
Timer

Count
Mode
Compare value
Pause

10001000
10001010
10001020

T2_COUNT
T2_MODE
T2_COMP

Timer Count
Timer Mode
Timer Compare value

10001810
10001820
10001830

T3_COUNT
T3_MODE
T3_COMP

Timer Count
Timer Mode
Timer Compare value

IPU REGISTERS (MPEG2 DECODER)

----------------------------10002000
IPU_CMD
10002010
IPU_CTRL
10002020
IPU_BP
10002030
IPU_TOP
GIF REGISTERS
------------10003000
10003010
10003020
10003040
10003050
10003060
10003070
10003080
10003090
100030a0

GIF_CTRL
GIF_MODE
GIF_STAT
GIF_TAG0
GIF_TAG1
GIF_TAG2
GIF_TAG3
GIF_CNT
GIF_P3CNT
GIF_P3TAG

VIF0 REGISTERS
-------------10003800
10003810
10003820
10003830
10003840
10003850
10003860
10003870
10003880
10003890
100038d0
10003900
10003910

VIF0_STAT
VIF0_FBRST
VIF0_ERR
VIF0_MARK
VIF0_CYCLE
VIF0_MODE
VIF0_NUM
VIF0_MASK
VIF0_CODE
VIF0_ITOPS
VIF0_ITOP
VIF0_R0
VIF0_R1

VIF0 Status

32 MB

10003920
10003930
10003940
10003950
10003960
10003970

VIF0_R2
VIF0_R3
VIF0_C0
VIF0_C1
VIF0_C2
VIF0_C3

VIF1 REGISTERS
-------------10003c00
10003c10
10003c20
10003c30
10003c40
10003c50
10003c60
10003c70
10003c80
10003c90
10003ca0
10003cb0
10003cc0
10003cd0
10003ce0
10003d00
10003d10
10003d20
10003d30
10003d40
10003d50
10003d60
10003d70

VIF1_STAT
VIF1_FBRST
VIF1_ERR
VIF1_MARK
VIF1_CYCLE
VIF1_MODE
VIF1_NUM
VIF1_MASK
VIF1_CODE
VIF1_ITOPS
VIF1_BASE
VIF1_OFST
VIF1_TOPS
VIF1_ITOP
VIF1_TOP
VIF1_R0
VIF1_R1
VIF1_R2
VIF1_R3
VIF1_C0
VIF1_C1
VIF1_C2
VIF1_C3

FIFO
---10004000
10005000

VIF0_FIFO(write)
VIF1_FIFO(read/write)

10006000
10006010
10006020

GIF_FIFO0
GIF_FIFO1
GIF_FIFO2

10007000
10007010

IPU_out_FIFO(read)
IPU_in_FIFO(write)

DMA CH0 REGISTERS (Linked to VIF0)

---------------------------------10008000
D0_CHCR
DMA-0 Channel Control
10008010
D0_MADR
Memory Address
10008020
D0_SIZE
Transfer Size (they call it D0_QWC)
10008030
D0_TAG
DMA Tag (they call it D0_TADR)
10008040
D0_??LO
they call it D0_ASR0
10008050
D0_??HI
they call it D0_ASR1
DMA CH1 REGISTERS (Linked to VIF1)
---------------------------------10009000
D1_CHCR
DMA-1 Channel Control
10009010
D1_MADR
Memory Address
10009020
D1_SIZE
Transfer Size (they call it D1_QWC)
10009030
D1_TAG
DMA Tag (they call it D1_TADR)

10009040
10009050

D1_??LO
D1_??HI

they call it D1_ASR0

they call it D1_ASR1

DMA CH2 REGISTERS (Linked to GIF)

--------------------------------1000A000
D2_CHCR
DMA-2 Channel Control
1000A010
D2_MADR
Memory Address
1000A020
D2_SIZE
Transfer Size (they call it D2_QWC)
1000A030
D2_TAG
DMA Tag (they call it D2_TADR)
1000A040
D2_??LO
they call it D2_ASR0
1000A050
D2_??HI
they call it D2_ASR1
1000A080
D2_SADR
DMA CH3 REGISTERS (Linked to IPU (FROM???))
-------------------------------------------1000B000
D3_CHCR
DMA-3 Channel Control
1000B010
D3_MADR
Memory Address
1000B020
D3_QWC
Transfer Size
DMA CH4 REGISTERS (Linked to IPU (TO???))
----------------------------------------1000B400
D4_CHCR
DMA-4 Channel Control
1000B410
D4_MADR
Memory Address
1000B420
D4_QWC
Transfer Size
1000B430
D4_TADR
DMA Tag
DMA CH5 REGISTERS (Linked to SIF0)
---------------------------------1000C000
D5_CHCR
DMA-4 Channel Control
1000C010
D5_MADR
Memory Address
1000C020
D5_QWC
Transfer Size
DMA CH6 REGISTERS (Linked to SIF1)
---------------------------------1000C400
D6_CHCR
DMA-6 Channel Control
1000C410
D6_MADR
Memory Address
1000C420
D6_QWC
Transfer Size
1000C430
D6_TADR
DMA Tag
DMA CH7 REGISTERS (Linked to SIF2)
---------------------------------1000C800
D7_CHCR
DMA-7 Channel Control
1000C810
D7_MADR
Memory Address
1000C820
D7_QWC
Transfer Size
DMA CH8 REGISTERS (Linked to SPR (form SCRATCH PAD to RAM???)
-------------------------------------------------------------1000D000
D8_CHCR
DMA-8 Channel Control
1000D010
D8_MADR
Memory Address
1000D020
D8_QWC
Transfer Size
1000D080
D8_MCR
???
DMA CH9 REGISTERS (Linked to SPR (form RAM to SCRATCH PAD???)
-------------------------------------------------------------1000D400
D9_CHCR
DMA-9 Channel Control
1000D410
D9_MADR
Memory Address
1000D420
D9_QWC
Transfer Size
1000D430
D9_TADR
DMA Tag
1000D480
D9_MCR?
???

DMA CONTROL REGISTERS

--------------------1000E000
1000E010
1000E020
1000E030
1000E040
1000E050
1000E060

D_CTRL
D_STAT
D_PCR
D_SQWC
D_RBSR
D_RBOR
D_STADR

1000F000
1000F010

INTC_STAT
INTC_MASK

1000F100
1000F120
1000F130
1000F140
1000F150
1000F180

STD-OUT STATUS???

1000F230

SBUS_SMFLG

DMA Control
DMA Status

STD-OUT DATA???

1000F410
1000F430
1000F440
1000F480
1000F490
1000F500
1000f520
1000f590

D_ENABLEW
D_ENABLER

VU MAPPED MEMORY REGISTERS

-------------------------11000000
VU0 PROGRAM MEMORY
11001000
VU0 MEMORY
11008000
VU1 PROGAM MEMORY
1100C000
VU1 MEMORY
GS
-12000000
12000010
12000020
12000030
12000040
12000050
12000060
12000070
12000080
12000090
120000a0
120000b0
120000c0
120000d0
120000e0
12001000
12001010

GS_PMODE
GS_SMODE1
GS_SMODE2
GS_SRFSH
GS_SYNCH1
GS_SYNCH2
GS_SYNCV
GS_DISPFB1
GS_DISPLAY1
GS_DISPFB2
GS_DISPLAY2
GS_EXTBUF
GS_EXTDATA
GS_EXTWRITE
GS_BGCOLOR
GS_CSR
GS_IMR

Program Memory (4K ROM)

Memory (4K ROM)
VU1 Program Memory (16K ROM)
VU1 Memory (16K ROM)

12001040
12001080

GS_BUSDIR
GS_SIGLBLID

Scratch Pad RAM Address Range

----------------------------0x70000000-0x70003FFF
ROM BIOS Mirror Address Range
----------------------------Uncached
Cached
Uncached

Logical Address Range

--------------------0x1FC00000-0x1FFFFFFF
0x9FC00000-0x9FFFFFFF
0xBFC00000-0xBFFFFFFF

Physical Address Range

---------------------0x1FC00000-0x1FFFFFFF
0x1FC00000-0x1FFFFFFF
0x1FC00000-0x1FFFFFFF

Some Acronyms
-------EE
- Emotion Engine (main CPU)
GS
- Graphics Synthesizer
IOP - Input/Output Processor
SPU - Sound Processor Unit
USEG - User Mode Segment
KSEG0 - Kernel Mode, Segment 0
KSEG1 - Kernel Mode, Segment 1
Sources
------TX System RISC TX79 Core Architecture (Symmetric 2-way superscalar 64-bit CPU) R
ev. 2.0
(http://lukasz.dk/files/tx79architecture.pdf)
PS2 MEMORY & HARDWARE MAPPED REGISTERS LAYOUT, by Minmei (http://ps2dev.org/ps2/
Technical_Documentation/Other/PS2_Memory_and_Hardware_Mapped_Registers_Layout.do
wnload)
Kernel empty and unused areas, by GTLCPIMP (https://artemis.bountysource.com/tas
k/show/2270)
dump2mass, by misfire (https://artemis.bountysource.com/solution/show/1074)
... and others ones spreaded out on the World Wide Web which I can't remember