In memory of Ben “bushing” Byer, who passed away on Monday, February 8th, 2016.

Difference between revisions of "Memory map"

From WiiUBrew
Jump to navigation Jump to search
(More findings)
 
(21 intermediate revisions by 10 users not shown)
Line 3: Line 3:
 
{| class="wikitable"
 
{| class="wikitable"
 
|-
 
|-
−
! Start Address
+
! Address
−
! End Address
 
 
! Size
 
! Size
−
! Chip
+
! Type
 
! Description
 
! Description
 
|-
 
|-
 
| 0x00000000
 
| 0x00000000
−
| 0x01FFFFFF
 
 
| 0x2000000
 
| 0x2000000
 
| MEM1
 
| MEM1
Line 20: Line 18:
 
|-
 
|-
 
| 0x08000000
 
| 0x08000000
−
| 0x0811FFFF
 
 
| 0x120000
 
| 0x120000
 
| MEM0
 
| MEM0
Line 27: Line 24:
 
  MEM0-B: 0x08100000 to 0x0811FFFF (0x20000)<br>
 
  MEM0-B: 0x08100000 to 0x0811FFFF (0x20000)<br>
 
  MEM0 foreground: 0x080C0000 to 0x0811FFFF (0x60000)<br>
 
  MEM0 foreground: 0x080C0000 to 0x0811FFFF (0x60000)<br>
−
  PPC kernel ancast image
+
  Cafe OS kernel ancast image
 
|-
 
|-
 
| 0x08120000
 
| 0x08120000
−
| 0x081BFFFF
 
 
| 0xA0000
 
| 0xA0000
 
| MEM0
 
| MEM0
−
| [[IOSU#Kernel|IOSU kernel]]
+
| [[IOS#Kernel|IOS-KERNEL]]
 
|-
 
|-
 
| 0x081C0000
 
| 0x081C0000
−
| 0x0827FFFF
 
 
| 0xC0000
 
| 0xC0000
 
| MEM0
 
| MEM0
−
| [[:/dev/mcp|IOSU MCP process]]
+
| [[:/dev/mcp|IOS-MCP]]
 
|-
 
|-
 
| 0x08280000
 
| 0x08280000
−
| 0x082AFFFF
 
 
| 0x30000
 
| 0x30000
 
| MEM0
 
| MEM0
−
| [[:/dev/crypto|IOSU CRYPTO process]]
+
| [[:/dev/crypto|IOS-CRYPTO]]
 
|-
 
|-
 
| 0x082C0000
 
| 0x082C0000
−
| 0x082DFFFF
 
 
| 0x20000
 
| 0x20000
 
| MEM0
 
| MEM0
−
| Reserved (IOSU)
+
| Reserved
 +
|-
 +
| 0x0C000000
 +
| 0x6000
 +
| MMIO
 +
| PI
 +
|-
 +
| 0x0C006000
 +
| 0x400
 +
| MMIO
 +
| IO_DI
 +
|-
 +
| 0x0C006400
 +
| 0x400
 +
| MMIO
 +
| IO_SI
 +
|-
 +
| 0x0C006800
 +
| 0x400
 +
| MMIO
 +
| IO_EXI
 +
|-
 +
| 0x0C0C0000
 +
| 0x120000
 +
| MMIO
 +
| MEM
 +
|-
 +
| 0x0C1E0000
 +
| 0x20000
 +
| MMIO
 +
| VI
 +
|-
 +
| 0x0C200000
 +
| 0x80000
 +
| MMIO
 +
| GFXSP
 +
|-
 +
| 0x0C280000
 +
| 0x20000
 +
| MMIO
 +
| DSP
 +
|-
 +
| 0x0C2A0000
 +
| 0x20000
 +
| MMIO
 +
| WG0
 +
|-
 +
| 0x0C2C0000
 +
| 0x20000
 +
| MMIO
 +
| WG1
 +
|-
 +
| 0x0C2E0000
 +
| 0x20000
 +
| MMIO
 +
| WG2
 +
|-
 +
| 0x0C300000
 +
| 0x20000
 +
| MMIO
 +
|
 +
|-
 +
| 0x0C320000
 +
| 0x20000
 +
| MMIO
 +
|
 +
|-
 +
| 0x0C340000
 +
| 0xC00
 +
| MMIO
 +
|
 +
|-
 +
| 0x0C340C00
 +
| 0x400
 +
| MMIO
 +
| IO_AI
 +
|-
 +
| 0x0D000000
 +
| 0x6000
 +
| MMIO
 +
| [[:Hardware/Latte_registers|ACR_REGS]]
 +
|-
 +
| 0x0D006000
 +
| 0x400
 +
| MMIO
 +
| [[:Hardware/Drive_interface|AIP_DI]]
 +
|-
 +
| 0x0D006400
 +
| 0x400
 +
| MMIO
 +
| [[:Hardware/Serial_interface|AIP_SI]]
 +
|-
 +
| 0x0D006800
 +
| 0x400
 +
| MMIO
 +
| [[:Hardware/External_interface|AIP_EXI]]
 +
|-
 +
| 0x0D006C00
 +
| 0x200
 +
| MMIO
 +
| [[:Hardware/Audio_interface|AIP_AI_I2S3]]
 +
|-
 +
| 0x0D006E00
 +
| 0x200
 +
| MMIO
 +
| [[:Hardware/Audio_interface|AIP_AI_I2S5]]
 +
|-
 +
| 0x0D010000
 +
| 0x10000
 +
| MMIO
 +
| [[:Hardware/NAND_interface|FLA]]
 +
|-
 +
| 0x0D020000
 +
| 0x10000
 +
| MMIO
 +
| [[:Hardware/AES_engine|AES]]
 +
|-
 +
| 0x0D030000
 +
| 0x10000
 +
| MMIO
 +
| [[:Hardware/SHA-1_engine|SHA]]
 +
|-
 +
| 0x0D040000
 +
| 0x10000
 +
| MMIO
 +
| [[:Hardware/USB_Host_Controller|EH0]]
 +
|-
 +
| 0x0D050000
 +
| 0x10000
 +
| MMIO
 +
| [[:Hardware/USB_Host_Controller|OH00]]
 +
|-
 +
| 0x0D060000
 +
| 0x10000
 +
| MMIO
 +
| [[:Hardware/USB_Host_Controller|OH01]]
 +
|-
 +
| 0x0D070000
 +
| 0x10000
 +
| MMIO
 +
| [[:Hardware/SD_Host_Controller|SD0]]
 +
|-
 +
| 0x0D080000
 +
| 0x10000
 +
| MMIO
 +
| [[:Hardware/802.11_Wireless|SD1]] (802.11 Wireless)
 +
|-
 +
| 0x0D090000
 +
| 0x10000
 +
| MMIO
 +
| BMD
 +
|-
 +
| 0x0D0A0000
 +
| 0x10000
 +
| MMIO
 +
| SRN
 +
|-
 +
| 0x0D0B0000
 +
| 0x4000
 +
| MMIO
 +
| [[:Hardware/AHM_controller|AHM]]
 +
|-
 +
| 0x0D0B4000
 +
| 0xC000
 +
| MMIO
 +
| [[:Hardware/Memory_controller|MEM_REGS]]
 +
|-
 +
| 0x0D0C0000
 +
| 0x10000
 +
| MMIO
 +
| BMC
 +
|-
 +
| 0x0D100000
 +
| 0x10000
 +
| MMIO
 +
| [[:Hardware/SD_Host_Controller|SD2]] (eMMC)
 +
|-
 +
| 0x0D110000
 +
| 0x10000
 +
| MMIO
 +
| [[:Hardware/Toucan|SD3]] (Toucan)
 +
|-
 +
| 0x0D120000
 +
| 0x10000
 +
| MMIO
 +
| [[:Hardware/USB_Host_Controller|EH1]]
 +
|-
 +
| 0x0D130000
 +
| 0x10000
 +
| MMIO
 +
| [[:Hardware/USB_Host_Controller|OH10]]
 +
|-
 +
| 0x0D140000
 +
| 0x10000
 +
| MMIO
 +
| [[:Hardware/USB_Host_Controller|EH2]]
 +
|-
 +
| 0x0D150000
 +
| 0x10000
 +
| MMIO
 +
| [[:Hardware/USB_Host_Controller|OH20]]
 +
|-
 +
| 0x0D160000
 +
| 0x10000
 +
| MMIO
 +
| [[:Hardware/SATA_Controller|SATA]]
 +
|-
 +
| 0x0D180000
 +
| 0x10000
 +
| MMIO
 +
| [[:Hardware/AES_engine|AESS]]
 +
|-
 +
| 0x0D190000
 +
| 0x10000
 +
| MMIO
 +
| [[:Hardware/SHA-1_engine|SHAS]]
 +
|-
 +
| 0x0D1A0000
 +
| 0x10000
 +
| MMIO
 +
| BMD2
 +
|-
 +
| 0x0D1B0000
 +
| 0x10000
 +
| MMIO
 +
| BMC2
 +
|-
 +
| 0x0D400000
 +
| 0x10000
 +
| SRAM1
 +
| [[boot1]]
 +
|-
 +
| 0x0D410000
 +
| 0x10000
 +
| SRAM0
 +
| [[boot0]]
 +
|-
 +
| 0x0D800000
 +
| 0x400000
 +
| MMIO
 +
| Mirror of 0x0D000000 (AHB_TRUSTED)
 
|-
 
|-
 
| 0x10000000
 
| 0x10000000
−
| 0x100FFFFF
 
 
| 0x100000
 
| 0x100000
 
| MEM2
 
| MEM2
−
| Unknown (IOSU)
+
| [[Boot1#get_boot_info|PRSH/PRST]]
 
|-
 
|-
 
| 0x10100000
 
| 0x10100000
−
| 0x104CFFFF
 
 
| 0x3D0000
 
| 0x3D0000
 
| MEM2
 
| MEM2
−
| [[:/dev/uhs|IOSU USB process]]
+
| [[:/dev/uhs|IOS-USB]]
 
|-
 
|-
 
| 0x10800000
 
| 0x10800000
−
| 0x11EDFFFF
 
 
| 0x16E0000
 
| 0x16E0000
 
| MEM2
 
| MEM2
−
| [[:/dev/fsa|IOSU FS process]]
+
| [[:/dev/fsa|IOS-FS]]
 
|-
 
|-
 
| 0x11F00000
 
| 0x11F00000
−
| 0x1215FFFF
 
 
| 0x260000
 
| 0x260000
 
| MEM2
 
| MEM2
−
| IOSU PAD process
+
| IOS-PAD
 
|-
 
|-
 
| 0x12300000
 
| 0x12300000
−
| 0x1288FFFF
 
 
| 0x590000
 
| 0x590000
 
| MEM2
 
| MEM2
−
| IOSU NET process
+
| IOS-NET
 
|-
 
|-
 
| 0x12900000
 
| 0x12900000
−
| 0x12B6FFFF
 
 
| 0x270000
 
| 0x270000
 
| MEM2
 
| MEM2
−
| IOSU ACP process
+
| IOS-ACP
 
|-
 
|-
 
| 0x12BC0000
 
| 0x12BC0000
−
| 0x12EAFFFF
 
 
| 0x2F0000
 
| 0x2F0000
 
| MEM2
 
| MEM2
−
| IOSU NSEC process
+
| IOS-NSEC
 
|-
 
|-
 
| 0x12EC0000
 
| 0x12EC0000
−
| 0x1358FFFF
 
 
| 0x6D0000
 
| 0x6D0000
 
| MEM2
 
| MEM2
−
| IOSU NIM-BOSS process
+
| IOS-NIM-BOSS
 
|-
 
|-
 
| 0x13640000
 
| 0x13640000
−
| 0x1393FFFF
 
 
| 0x300000
 
| 0x300000
 
| MEM2
 
| MEM2
−
| IOSU FPD process
+
| IOS-FPD
 
|-
 
|-
 
| 0x13A40000
 
| 0x13A40000
−
| 0x13B9FFFF
 
 
| 0x160000
 
| 0x160000
 
| MEM2
 
| MEM2
−
| IOSU TEST process
+
| IOS-TEST
 
|-
 
|-
 
| 0x13C00000
 
| 0x13C00000
−
| 0x13C70000
 
 
| 0x70000
 
| 0x70000
 
| MEM2
 
| MEM2
−
| IOSU AUXIL process
+
| IOS-AUXIL
 
|-
 
|-
 
| 0x13CC0000
 
| 0x13CC0000
−
| 0x13D7FFFF
 
 
| 0xC0000
 
| 0xC0000
 
| MEM2
 
| MEM2
−
| IOSU BSP process
+
| IOS-BSP
 
|-
 
|-
 
| 0x13D80000
 
| 0x13D80000
−
| 0x13DBFFFF
 
 
| 0x40000
 
| 0x40000
 
| MEM2
 
| MEM2
−
| [[:/dev/mcp|IOSU MCP process]] (debug and recovery mode)
+
| [[:/dev/mcp|IOS-MCP]] (development and recovery mode)
 
|-
 
|-
 
| 0x14000000
 
| 0x14000000
−
| 0x1CFFFFFF
 
 
| 0x9000000
 
| 0x9000000
 
| MEM2
 
| MEM2
Line 142: Line 361:
 
|-
 
|-
 
| 0x1D000000
 
| 0x1D000000
−
| 0x1FAFFFFF
 
 
| 0x2B00000
 
| 0x2B00000
 
| MEM2
 
| MEM2
−
| IOSU global heap
+
| IOS global heap
 
|-
 
|-
 
| 0x1FB00000
 
| 0x1FB00000
−
| 0x1FDFFFFF
 
 
| 0x300000
 
| 0x300000
 
| MEM2
 
| MEM2
−
| IOSU global IOB (input/output block)
+
| IOS global IOB (input/output block)
 
|-
 
|-
 
| 0x1FE00000
 
| 0x1FE00000
−
| 0x1FE3FFFF
 
 
| 0x40000
 
| 0x40000
 
| MEM2
 
| MEM2
−
| MCP shared region (for IOSU)
+
| IOS-MCP shared region
 
|-
 
|-
 
| 0x1FE40000
 
| 0x1FE40000
−
| 0x1FFFFFFF
 
 
| 0x1C0000
 
| 0x1C0000
 
| MEM2
 
| MEM2
−
| MCP setup region (launch, ramdisk and file system cache)
+
| IOS-MCP setup region (launch, ramdisk and file system cache)
 
|-
 
|-
 
| 0x20000000
 
| 0x20000000
−
| 0x27FFFFFF
 
 
| 0x8000000
 
| 0x8000000
 
| MEM2
 
| MEM2
−
| Unknown (IOSU)
+
| RAMDISK
 
|-
 
|-
 
| 0x28000000
 
| 0x28000000
−
| 0xCFFFFFFF
 
 
| 0xA8000000
 
| 0xA8000000
 
| MEM2
 
| MEM2
 
|  
 
|  
−
  MEM2-B: 0x28000000 to 0xCFFFFFFF (0xA8000000)<br>
+
  MEM2-B: 0x28000000 to 0xCFFFFFFF (0xA8000000). The 0x10000000 vmem is mapped to the following areas depending on the RAMPID:<br>
 
   - Home Menu (RAMPID 5): 0x28000000 to 0x2FFFFFFF (0x8000000)<br>
 
   - Home Menu (RAMPID 5): 0x28000000 to 0x2FFFFFFF (0x8000000)<br>
 
   - root.rpx (RAMPID 1): 0x30000000 to 0x31FFFFFF (0x2000000)<br>
 
   - root.rpx (RAMPID 1): 0x30000000 to 0x31FFFFFF (0x2000000)<br>
Line 187: Line 400:
 
  Cafe OS loader, libraries and apps
 
  Cafe OS loader, libraries and apps
 
|-
 
|-
−
| 0xFFE00000
+
| 0xFFC00000
−
| 0xFFF1FFFF
+
| 0x280000
−
| 0x120000
+
| UNK
−
| MEM0
+
| Used by Cafe OS (codegen and PPC kernel ancast image mirror)
−
| PPC Cafe OS kernel (mirror of ancast)
 
 
|-
 
|-
 
| 0xFFF00000
 
| 0xFFF00000
−
| 0xFFF07FFF
 
 
| 0x8000
 
| 0x8000
−
| SRAM?
+
| SRAM1
−
| Unknown (IOSU seems to see this area, but with no relation to PPC)
+
| C2W (cafe2wii) boot heap (used to store the old Wii SEEPROM data)
 +
|-
 +
| 0xFFFE0000
 +
| 0x8000
 +
| SRAM1
 +
| Mirror of SRAM1. Hai C2W uses this one for (some) Hai params instead of the former?<br>IOS80 also uses this one for SEEPROM data despite the data being written to the former.
 
|-
 
|-
 
| 0xFFFF0000
 
| 0xFFFF0000
−
| 0xFFFFFFFF
 
 
| 0x10000
 
| 0x10000
−
| SRAM
+
| SRAM0
−
| IOSU kernel SRAM
+
| IOS-KERNEL SRAM / C2W (cafe2wii)
 
|}
 
|}

Latest revision as of 01:34, 25 April 2025

The Wii U has a variety of physical memory sources. There is the 2 GiB of DDR3 split into 4 chips (MEM2), 32 MiB of fast 1T SRAM (MEM1), and the old GX framebuffer (MEM0).

Address Size Type Description
0x00000000 0x2000000 MEM1 
MEM1-A: 0x00000000 to 0x00000FFF (0x1000)

MEM1-B: 0x00001000 to 0x01FFFFFF (0x1FFF000)

MEM1 foreground: 0x00000000 to 0x01FFFFFF (0x2000000)

Used by Cafe OS apps
0x08000000 0x120000 MEM0 
MEM0-A: 0x08000000 to 0x080FFFFF (0x100000)

MEM0-B: 0x08100000 to 0x0811FFFF (0x20000)

MEM0 foreground: 0x080C0000 to 0x0811FFFF (0x60000)

Cafe OS kernel ancast image
0x08120000 0xA0000 MEM0 IOS-KERNEL
0x081C0000 0xC0000 MEM0 IOS-MCP
0x08280000 0x30000 MEM0 IOS-CRYPTO
0x082C0000 0x20000 MEM0 Reserved
0x0C000000 0x6000 MMIO PI
0x0C006000 0x400 MMIO IO_DI
0x0C006400 0x400 MMIO IO_SI
0x0C006800 0x400 MMIO IO_EXI
0x0C0C0000 0x120000 MMIO MEM
0x0C1E0000 0x20000 MMIO VI
0x0C200000 0x80000 MMIO GFXSP
0x0C280000 0x20000 MMIO DSP
0x0C2A0000 0x20000 MMIO WG0
0x0C2C0000 0x20000 MMIO WG1
0x0C2E0000 0x20000 MMIO WG2
0x0C300000 0x20000 MMIO
0x0C320000 0x20000 MMIO
0x0C340000 0xC00 MMIO
0x0C340C00 0x400 MMIO IO_AI
0x0D000000 0x6000 MMIO ACR_REGS
0x0D006000 0x400 MMIO AIP_DI
0x0D006400 0x400 MMIO AIP_SI
0x0D006800 0x400 MMIO AIP_EXI
0x0D006C00 0x200 MMIO AIP_AI_I2S3
0x0D006E00 0x200 MMIO AIP_AI_I2S5
0x0D010000 0x10000 MMIO FLA
0x0D020000 0x10000 MMIO AES
0x0D030000 0x10000 MMIO SHA
0x0D040000 0x10000 MMIO EH0
0x0D050000 0x10000 MMIO OH00
0x0D060000 0x10000 MMIO OH01
0x0D070000 0x10000 MMIO SD0
0x0D080000 0x10000 MMIO SD1 (802.11 Wireless)
0x0D090000 0x10000 MMIO BMD
0x0D0A0000 0x10000 MMIO SRN
0x0D0B0000 0x4000 MMIO AHM
0x0D0B4000 0xC000 MMIO MEM_REGS
0x0D0C0000 0x10000 MMIO BMC
0x0D100000 0x10000 MMIO SD2 (eMMC)
0x0D110000 0x10000 MMIO SD3 (Toucan)
0x0D120000 0x10000 MMIO EH1
0x0D130000 0x10000 MMIO OH10
0x0D140000 0x10000 MMIO EH2
0x0D150000 0x10000 MMIO OH20
0x0D160000 0x10000 MMIO SATA
0x0D180000 0x10000 MMIO AESS
0x0D190000 0x10000 MMIO SHAS
0x0D1A0000 0x10000 MMIO BMD2
0x0D1B0000 0x10000 MMIO BMC2
0x0D400000 0x10000 SRAM1 boot1
0x0D410000 0x10000 SRAM0 boot0
0x0D800000 0x400000 MMIO Mirror of 0x0D000000 (AHB_TRUSTED)
0x10000000 0x100000 MEM2 PRSH/PRST
0x10100000 0x3D0000 MEM2 IOS-USB
0x10800000 0x16E0000 MEM2 IOS-FS
0x11F00000 0x260000 MEM2 IOS-PAD
0x12300000 0x590000 MEM2 IOS-NET
0x12900000 0x270000 MEM2 IOS-ACP
0x12BC0000 0x2F0000 MEM2 IOS-NSEC
0x12EC0000 0x6D0000 MEM2 IOS-NIM-BOSS
0x13640000 0x300000 MEM2 IOS-FPD
0x13A40000 0x160000 MEM2 IOS-TEST
0x13C00000 0x70000 MEM2 IOS-AUXIL
0x13CC0000 0xC0000 MEM2 IOS-BSP
0x13D80000 0x40000 MEM2 IOS-MCP (development and recovery mode)
0x14000000 0x9000000 MEM2 
MEM2-A: 0x14000000 to 0x1CFFFFFF (0x9000000)

 - Loader data: 0x1B900000 to 0x1B97FFFF (0x80000)

PPC region

The loader's data is allocated here
0x1D000000 0x2B00000 MEM2 IOS global heap
0x1FB00000 0x300000 MEM2 IOS global IOB (input/output block)
0x1FE00000 0x40000 MEM2 IOS-MCP shared region
0x1FE40000 0x1C0000 MEM2 IOS-MCP setup region (launch, ramdisk and file system cache)
0x20000000 0x8000000 MEM2 RAMDISK
0x28000000 0xA8000000 MEM2 
MEM2-B: 0x28000000 to 0xCFFFFFFF (0xA8000000). The 0x10000000 vmem is mapped to the following areas depending on the RAMPID:

 - Home Menu (RAMPID 5): 0x28000000 to 0x2FFFFFFF (0x8000000)

 - root.rpx (RAMPID 1): 0x30000000 to 0x31FFFFFF (0x2000000)

 - Cafe OS loader and libraries: 0x32000000 to 0x327FFFFF (0x800000)

 - Error display (RAMPID 6): 0x33000000 to 0x33FFFFFF (0x1000000)

 - Background app memory (RAMPID 4): 0x34000000 to 0x4FFFFFFF (0x1C000000)

 - Foreground app memory (RAMPID 7): 0x50000000 to 0x8FFFFFFF (0x40000000)

 - Extra app memory for devkits: 0x90000000 to 0xCFFFFFFF (0x40000000)

PPC region

Cafe OS loader, libraries and apps
0xFFC00000 0x280000 UNK Used by Cafe OS (codegen and PPC kernel ancast image mirror)
0xFFF00000 0x8000 SRAM1 C2W (cafe2wii) boot heap (used to store the old Wii SEEPROM data)
0xFFFE0000 0x8000 SRAM1 Mirror of SRAM1. Hai C2W uses this one for (some) Hai params instead of the former?
IOS80 also uses this one for SEEPROM data despite the data being written to the former.
0xFFFF0000 0x10000 SRAM0 IOS-KERNEL SRAM / C2W (cafe2wii)
Retrieved from "https://wiiubrew.org/w/index.php?title=Memory_map&oldid=4197"