Memory map: Difference between revisions

Jump to navigation Jump to search
5,447 bytes added ,  6 months ago
No edit summary
(18 intermediate revisions by 2 users not shown)
== Physical Memory Map ==
{| class="wikitable"
!Bus / Device
! colspan=2 | Address Range !! Name !! Description
|-
| rowspan="3" |RDRAM
| 0x00000000 || 0x003FFFFF || RDRAM || RDRAM located on motherboard
| 0x00000000 || 0x03EFFFFF || [[RDRAM]] memory-space || RDRAM memory. See [[RDRAM_Interface#Memory_addressing]] and [[RDRAM#RDRAM_addressing]] for details about their mapping.
|-
| 0x03F00000 || 0x03F7FFFF || [[RDRAM#Registers|RDRAM Registers]] || RDRAM registers. See [[RDRAM_Interface#Memory_addressing]] and [[RDRAM#RDRAM_addressing]] for details about their mapping.
| 0x00400000 || 0x007FFFFF || RDRAM || RDRAM from [[Expansion Pak]] (if present)
|-
| 0x03F80000 || 0x03FFFFFF || [[RDRAM#Registers|RDRAM Registers]] (broadcast) || Write-only. All connected RDRAM will act on this register write request. See [[RDRAM_Interface#Memory_addressing]] and [[RDRAM#RDRAM_addressing]] for details.
| 0x00800000 || 0x03EFFFFF || Reserved || Unknown usage
|-
| 0x03F00000 || 0x03FFFFFF || [[RDRAM#Registers|RDRAM Registers]]|| RDRAM configuration registers
|-
| rowspan="13" |RCP
| 0x04000000 || 0x04000FFF || [[Reality Signal Processor/Interface#DMEM and IMEM|RSP DMEM]]|| RSP Data Memory
|-
| 0x04001000 || 0x04001FFF || [[Reality Signal Processor/Interface#DMEM and IMEM|RSP IMEM]]|| RSP Instruction Memory
|-
| 0x04002000 || 0x0403FFFF || UnknownRSP DMEM/IMEM Mirrors || UnknownMirrors of DMEM and IMEM (repeat every 8Kb)
|-
| 0x04040000 || 0x040FFFFF || [[RSP|RSP Registers]] || RSP DMAs, status, semaphore, program counter, IMEM BIST status
| 0x04900000 || 0x04FFFFFF || Unused || Unused
|-
| rowspan="4" |PI external bus
| 0x05000000 || 0x05FFFFFF || Cartridge Domain 2 Address 1 || N64DD control registers (if present)
|-
| 0x10000000 || 0x1FBFFFFF || Cartridge Domain 1 Address 2 || [[ROM Header|Cartridge ROM]]
|-
| rowspan="3" |SI external bus
| 0x1FC00000 || 0x1FC007BF || PIF ROM ([[Initial Program Load|IPL1/2]]) || Executed on boot
|-
| 0x1FC00800 || 0x1FCFFFFF || Reserved || Unknown usage
|-
|PI external bus
| 0x1FD00000 || 0x7FFFFFFF || Cartridge Domain 1 Address 3 || Mapped to same address range on physical cartridge port
|-
|-
| 0x80000000 || 0xFFFFFFFF || External SysAD device bus || Unknown usage (Unconfirmed: possibly used by processors, cache, and/or RAM for communication)
| 0x80000000 || 0xFFFFFFFF || Unmapped || Unmapped area
|}
Cartridge Domains 1 and 2 are mapped one-to-one on the cartridge/bottom port. It is not known at this time what Domain 1 Address 3 was used for, if at all, but flash carts may have some use for that address range.
 
== Physical Memory Map accesses ==
The wholephysical memory map is implemented by RCP, as the VR4300 only talks directly to RCP. The bus between VR4300 and RCP is called [[SysAD Interface|SysAD]]. The RCP behaves differently with different access sizes depending on the specific area of the map and the subcomponent in charge of implementing it.
 
The SysAD bus is described at the hardware level in the [[SysAD Interface|SysAD page]], but to understand the effects on memory map it is sufficient to understand how data is marshalled for reads and writes. Since SysAD is a 32-bit bus, 32-bit accesses are the "native" ones, and the other access sizes are made in a weird way built upon a 32-bit data exchange.
 
* Reads: VR4300 puts the address on the bus and the size of the access (8, 16, 32, 64). The RCP typically returns a full (aligned) 32-bit word address (or two, in case of a 64-bit read), from which the VR4300 extracts the correct portion. For instance, when reading 8-bit from address <code>0x0000'0001</code>, the RCP will put on the bus the 32-bit values at <code>0x0000'0000 - 0x0000'0003</code>, and the VR4300 will then just isolate the requested 8 bits.
* Writes: VR4300 puts the address on the bus, the size of the access, and then the 32-bit value to be written. When the access is made using 8 or 16 bits, the value on the bus is prepared to match with the aligned 32-bit address. This is the same of what happens for reads, but this time it is the VR4300 to prepare the data. For instance, if register <code>S0=0x1234'5678</code>, <code>A0=0x0000'0001</code> and the opcode <code>SB S0, 0(A0)</code> is run, the VR4300 puts on the bus the value <code>S0 << 16</code>, that is <code>0x5678'0000</code>. It is then up to the RCP to see that, since the address is <code>0x0000'0001</code> (so offset 1 within the 32-bit word), it needs to isolate the the second byte <code>0x78</code>. So even if it is a 8-bit write opcode, other bits of the register <code>S0</code> "leak" on the bus.
 
Notice that misaligned address are forbidden by MIPS architecture and they will result in an Address Exception. So all accesses that go through the memory map are always aligned to the access size (eg: aligned to 2 bytes for 16-bit reads/writes).
 
=== Range 0x0000'0000 - 0x007F0x03EF'FFFF (RDRAM memory) ===
The accesses in this area are handled by RCP via RI (Ram Interface). When the VR4300 reads or writes a location in this range, it gets stalled while the RI communicates with the RDRAM via the RAMBUS serial protocol. As soon as the read or write is finished, the VR4300 is released. Effectively, all reads and writes are synchronous (blocking) from the point of view of the VR4300, as you would expect when accessing a RAM. All access sizes work correctly: 8-bit, 16-bit, 32-bit, 64-bit.
 
=== Range 0x03F0'0000 - 0x004F0x03FF'FFFF (RCPRDRAM registers) ===
The accesses in this area are handled by RCP itselfvia withoutRI going(Ram toInterface). anWhen externalthe bus,VR4300 andreads areor dispatchedwrites internallya tolocation thein correctthis subsystem.range, Accessit togets astalled registerwhile mightthe optionallyRI stallcommunicates with the VR4300RDRAM ifvia the subsystemRAMBUS serial protocol. As soon as the read or write is designedfinished, tothe doVR4300 sois (eg:released. toEffectively, performall areads longand blockingwrites operationare onsynchronous write(blocking), butfrom inthe generalpoint forof standardview registers,of theythe areVR4300, immediateas andyou takewould onlyexpect 1when PClockaccessing cycle.a RAM.
 
=== Range 0x0400'0000 - 0x04FF'FFFF (RCP registers) ===
The accesses in this area are handled by RCP itself without going to an external bus, and are dispatched internally to the correct subsystem. Access to a register might optionally stall the VR4300 if the subsystem is designed to do so (eg: to perform a long blocking operation on write), but in general for standard registers, they are quite fast and take only 5-6 PClock cycles (MI regs are a bit faster and take about 2 cycles).
 
Accesses in this area are affected by a simplified hardware implementation of the RCP SysAD bus, so '''''access size is ignored'''''. This means that:
 
* Reads: RCP will ignore the requested access size and will just put the requested 32-bit word on the bus. Luckily, this is the correct behavior for 8-bit and 16-bit accesses (as explained above), so the VR4300 will be able to extract the correct portion. 64-bit reads instead will completely freeze the VR4300 (and thus the whole console), because it will stall waiting for the second word to appear on the bus that the RCP will never put.
* Writes: RCP will ignore the requested access size and just write the word that was put on the bus directly into the hardware register. For 8-bit and 16-bit accesses, this means that the shifted value prepared by the VR4300 is the one that will be written verbatim. Reprising the example above, if <code>S0=0x1234'5678</code>, <code>A0=0x0460'0011</code>, running <code>SB S0, 0(A0)</code> will write the value <code>0x5678'0000</code> to the RCP hardware register <code>0x0460'0010</code>. For 64-bit accesses, as they are written on the bus MSB-first, the RCP will write the MSB to the hardware register, ignoring the LSB.
 
=== Range 0x1FC0'0000 - 0x1FCF'FFFF (SI external bus) ===
TODO
 
=== Ranges 0x0500'0000 - 0x1FBF'FFFF and 0x1FD0'0000 - 0x7FFF'FFFF (PI external bus) ===
All accesses made by the VR4300 in these ranges are forward externally by RCP on the external PI bus. This allows the CPU to access external devices connected to the parallel bus like the cartridge ROM and SRAM.
 
Accesses in this area are affected by the same simplified SysAD implementation described above, so '''access size is ignored.''' The effect is the same described before.
 
Moreover, there are two important additional details:
 
* All writes are performed '''asynchronously''' by the PI. Making a write in this area will in fact just cause the PI to latch the value internally, and release the VR4300 immediately. The write will then happen in background. The status of the ongoing write will be reflected by the PI "I/O busy" status bit, which will be set to 1 until the write is finalized. While a write is ongoing, further writes are ignored, and reads (from any address) return the 32-bit value that is being written. For further information on this, please check the [[Peripheral Interface|PI page]]. Notice that the PI doesn't know whether a certain device is read-only, so even writes in the ROM area follow this pattern; they are just ignored by the ROM itself.
Internally, all registers are 32-bits and are thus accessed as 32-bit. When the VR4300 requests a read using 8-bit or 16-bit access sizes, the data is correctly returned as expected. Notice that the register is still read in full and put it on the bus as 32-bit, but the VR4300 is able to extract the correct portion, just like reading from RAM. When the VR4300 requests a read using 64-bit, the data is also returned as expected. Two subsequence 32-bit register reads are performed, each on returning the correct value, and the VR4300 is able to recompose the final 64-bit value. So for instance, from the VR4300 side, reading 64-bit from physical address 0x0046'0010 will return a 64-bit value obtained by composing the value of the register 0x0046'0010 as MSB, and the register 0x0046'0014 as LSB.
* The external PI bus is 16-bit. Given that the RCP only knows of 32-bit accesses (as access size is ignored), this means that each read or write performed by the VR4300 will cause exactly two reads or two writes on the PI bus: first the MSB at the address specified by the CPU (ignoring bit 0, so that the address is aligned to 16 bit), then the LSB at address+2. This might seem a small implementation detail, but it does actually cause an important and visible bug. For instance, if the VR4300 requests a 16-bit read at address <code>0x1000'0002</code>, the RCP (that ignores access sizes) will do two 16-bit reads on the cartridge bus at <code>0x1000'0002</code> and <code>0x1000'0004</code>, and will put on the SysAD bus the 32-bit word at <code>0x1000'0002 - 0x1000'0005</code>. This is a violation of the SysAD protocol explained above: in fact, in reply to a 16-bit read at <code>0x1000'0002</code>, the RCP should have put on the bus the 32-bit word at <code>0x1000'0000 - 0x1000'0003</code> instead. Because of this, effectively a 16-bit read at <code>0x1000'0002</code> returns the 16-bit word at <code>0x1000'0004</code> instead.
 
=== Range 0x8000'0000 - 0xFFFF'FFFF (Unmapped) ===
Writes, instead, do not work correctly at all access sizes because the RCP does not implement the required circuitry to perform them. What happens is that the VR4300 puts the full register value on the bus for the write, with the correct shift (as required by the SysAD protocol), but the RCP basically ignores the access size.
This range is not handled by RCP. All writes are ignored, and reads lock up the VR4300 because the RCP is stalled and does not return any data on the bus.
Cookies help us deliver our services. By using our services, you agree to our use of cookies.

Navigation menu