Hardware Registers

0xBC000000: Memory management

Physical Address	Size	R/W	Description
0xBC000000	4	RW	Memory Protection 0x08000000 -> 0x081FFFFFF

Bit(s)	Usage
31	0x081C0000 -> 0x081FFFFFF Kernel Write Enable
30	0x081C0000 -> 0x081FFFFFF Kernel Read Enable
29	0x081C0000 -> 0x081FFFFFF User Write Enable
28	0x081C0000 -> 0x081FFFFFF User Read Enable
27	0x08180000 -> 0x081BFFFFF Kernel Write Enable
26	0x08180000 -> 0x081BFFFFF Kernel Read Enable
25	0x08180000 -> 0x081BFFFFF User Write Enable
24	0x08180000 -> 0x081BFFFFF User Read Enable
23	0x08140000 -> 0x0817FFFFF Kernel Write Enable
22	0x08140000 -> 0x0817FFFFF Kernel Read Enable
21	0x08140000 -> 0x0817FFFFF User Write Enable
20	0x08140000 -> 0x0817FFFFF User Read Enable
19	0x08100000 -> 0x0813FFFFF Kernel Write Enable
18	0x08100000 -> 0x0813FFFFF Kernel Read Enable
17	0x08100000 -> 0x0813FFFFF User Write Enable
16	0x08100000 -> 0x0813FFFFF User Read Enable
15	0x080C0000 -> 0x080FFFFFF Kernel Write Enable
14	0x080C0000 -> 0x080FFFFFF Kernel Read Enable
13	0x080C0000 -> 0x080FFFFFF User Write Enable
12	0x080C0000 -> 0x080FFFFFF User Read Enable
11	0x08080000 -> 0x080BFFFFF Kernel Write Enable
10	0x08080000 -> 0x080BFFFFF Kernel Read Enable
9	0x08080000 -> 0x080BFFFFF User Write Enable
8	0x08080000 -> 0x080BFFFFF User Read Enable
7	0x08040000 -> 0x0807FFFFF Kernel Write Enable
6	0x08040000 -> 0x0807FFFFF Kernel Read Enable
5	0x08040000 -> 0x0807FFFFF User Write Enable
4	0x08040000 -> 0x0807FFFFF User Read Enable
3	0x08000000 -> 0x08003FFFF Kernel Write Enable
2	0x08000000 -> 0x08003FFFF Kernel Read Enable
1	0x08000000 -> 0x08003FFFF User Write Enable
0	0x08000000 -> 0x08003FFFF User Read Enable

Physical Address	Size	R/W	Description
0xBC000004	4	RW	Memory Protection 0x08200000 -> 0x083FFFFFF

Bit(s)	Usage
31	0x083C0000 -> 0x083FFFFFF Kernel Write Enable
30	0x083C0000 -> 0x083FFFFFF Kernel Read Enable
29	0x083C0000 -> 0x083FFFFFF User Write Enable
28	0x083C0000 -> 0x083FFFFFF User Read Enable
27	0x083C0000 -> 0x083BFFFFF Kernel Write Enable
26	0x083C0000 -> 0x083BFFFFF Kernel Read Enable
25	0x08380000 -> 0x083BFFFFF User Write Enable
24	0x08380000 -> 0x083BFFFFF User Read Enable
23	0x08340000 -> 0x0837FFFFF Kernel Write Enable
22	0x08340000 -> 0x0837FFFFF Kernel Read Enable
21	0x08340000 -> 0x0837FFFFF User Write Enable
20	0x08340000 -> 0x0837FFFFF User Read Enable
19	0x08300000 -> 0x0833FFFFF Kernel Write Enable
18	0x08300000 -> 0x0833FFFFF Kernel Read Enable
17	0x08300000 -> 0x0833FFFFF User Write Enable
16	0x08300000 -> 0x0833FFFFF User Read Enable
15	0x082C0000 -> 0x082FFFFFF Kernel Write Enable
14	0x082C0000 -> 0x082FFFFFF Kernel Read Enable
13	0x082C0000 -> 0x082FFFFFF User Write Enable
12	0x082C0000 -> 0x082FFFFFF User Read Enable
11	0x08280000 -> 0x082BFFFFF Kernel Write Enable
10	0x08280000 -> 0x082BFFFFF Kernel Read Enable
9	0x08280000 -> 0x082BFFFFF User Write Enable
8	0x08280000 -> 0x082BFFFFF User Read Enable
7	0x08240000 -> 0x0827FFFFF Kernel Write Enable
6	0x08240000 -> 0x0827FFFFF Kernel Read Enable
5	0x08240000 -> 0x0827FFFFF User Write Enable
4	0x08240000 -> 0x0827FFFFF User Read Enable
3	0x08200000 -> 0x08203FFFF Kernel Write Enable
2	0x08200000 -> 0x08203FFFF Kernel Read Enable
1	0x08200000 -> 0x08203FFFF User Write Enable
0	0x08200000 -> 0x08203FFFF User Read Enable

Physical Address	Size	R/W	Description
0xBC000008	4	RW	Memory Protection 0x08400000 -> 0x085FFFFFF

Bit(s)	Usage
31	0x085c0000 -> 0x085FFFFFF Kernel Write Enable
30	0x085c0000 -> 0x085FFFFFF Kernel Read Enable
29	0x085c0000 -> 0x085FFFFFF User Write Enable
28	0x085c0000 -> 0x085FFFFFF User Read Enable
27	0x08580000 -> 0x085BFFFFF Kernel Write Enable
26	0x08580000 -> 0x085BFFFFF Kernel Read Enable
25	0x08580000 -> 0x085BFFFFF User Write Enable
24	0x08580000 -> 0x085BFFFFF User Read Enable
23	0x08540000 -> 0x0857FFFFF Kernel Write Enable
22	0x08540000 -> 0x0857FFFFF Kernel Read Enable
21	0x08540000 -> 0x0857FFFFF User Write Enable
20	0x08540000 -> 0x0857FFFFF User Read Enable
19	0x08500000 -> 0x0853FFFFF Kernel Write Enable
18	0x08500000 -> 0x0853FFFFF Kernel Read Enable
17	0x08500000 -> 0x0853FFFFF User Write Enable
16	0x08500000 -> 0x0853FFFFF User Read Enable
15	0x084c0000 -> 0x084FFFFFF Kernel Write Enable
14	0x084c0000 -> 0x084FFFFFF Kernel Read Enable
13	0x084c0000 -> 0x084FFFFFF User Write Enable
12	0x084c0000 -> 0x084FFFFFF User Read Enable
11	0x08480000 -> 0x084BFFFFF Kernel Write Enable
10	0x08480000 -> 0x084BFFFFF Kernel Read Enable
9	0x08480000 -> 0x084BFFFFF User Write Enable
8	0x08480000 -> 0x084BFFFFF User Read Enable
7	0x08440000 -> 0x0847FFFFF Kernel Write Enable
6	0x08440000 -> 0x0847FFFFF Kernel Read Enable
5	0x08440000 -> 0x0847FFFFF User Write Enable
4	0x08440000 -> 0x0847FFFFF User Read Enable
3	0x08400000 -> 0x08403FFFF Kernel Write Enable
2	0x08400000 -> 0x08403FFFF Kernel Read Enable
1	0x08400000 -> 0x08403FFFF User Write Enable
0	0x08400000 -> 0x08403FFFF User Read Enable

Physical Address	Size	R/W	Description
0xBC00000C	4	RW	Memory Protection 0x08600000 -> 0x087FFFFFF

Bit(s)	Usage
31	0x087c0000 -> 0x087FFFFFF Kernel Write Enable
30	0x087c0000 -> 0x087FFFFFF Kernel Read Enable
29	0x087c0000 -> 0x087FFFFFF User Write Enable
28	0x087c0000 -> 0x087FFFFFF User Read Enable
27	0x08780000 -> 0x087BFFFFF Kernel Write Enable
26	0x08780000 -> 0x087BFFFFF Kernel Read Enable
25	0x08780000 -> 0x087BFFFFF User Write Enable
24	0x08780000 -> 0x087BFFFFF User Read Enable
23	0x08740000 -> 0x0877FFFFF Kernel Write Enable
22	0x08740000 -> 0x0877FFFFF Kernel Read Enable
21	0x08740000 -> 0x0877FFFFF User Write Enable
20	0x08740000 -> 0x0877FFFFF User Read Enable
19	0x08700000 -> 0x0873FFFFF Kernel Write Enable
18	0x08700000 -> 0x0873FFFFF Kernel Read Enable
17	0x08700000 -> 0x0873FFFFF User Write Enable
16	0x08700000 -> 0x0873FFFFF User Read Enable
15	0x086c0000 -> 0x086FFFFFF Kernel Write Enable
14	0x086c0000 -> 0x086FFFFFF Kernel Read Enable
13	0x086c0000 -> 0x086FFFFFF User Write Enable
12	0x086c0000 -> 0x086FFFFFF User Read Enable
11	0x08680000 -> 0x086BFFFFF Kernel Write Enable
10	0x08680000 -> 0x086BFFFFF Kernel Read Enable
9	0x08680000 -> 0x086BFFFFF User Write Enable
8	0x08680000 -> 0x086BFFFFF User Read Enable
7	0x08640000 -> 0x0867FFFFF Kernel Write Enable
6	0x08640000 -> 0x0867FFFFF Kernel Read Enable
5	0x08640000 -> 0x0867FFFFF User Write Enable
4	0x08640000 -> 0x0867FFFFF User Read Enable
3	0x08600000 -> 0x08603FFFF Kernel Write Enable
2	0x08600000 -> 0x08603FFFF Kernel Read Enable
1	0x08600000 -> 0x08603FFFF User Write Enable
0	0x08600000 -> 0x08603FFFF User Read Enable

Physical Address	Size	R/W	Description
0xBC000030	32	RW	Hardware register user read/write enable (range unknown). Used to access profiler from an user.
0xBC000034	32	RW	Hardware register user read/write enable (range unknown)
0xBC000038	32	RW	Hardware register user read/write enable (range unknown)
0xBC00003C	32	RW	Hardware register user read/write enable (range unknown)
0xBC000040	32	RW	Hardware register user read/write enable (range unknown)
0xBC000044	32	RW	Hardware register user read/write enable (range unknown)
0xBC000048	32	RW	Hardware register user read/write enable (range unknown)
0xBC00004C	32	RW	Hardware register user read/write enable (range unknown)

Granularity that these work on is not known. For each 1 bit an IO range is exposed to usermode for Read/Write. To find the usermode address, subtract 0x60000000 from the kernelmode one.

Physical Address	Size	R/W	Description
0xBC000050	32	?	Reads 0x07EFFFFF

0xBC500000: Hardware Timer

Physical Address	Size	R/W	Description
0xBC500000	4	RW	Timer data for hardware timer 0. Bits 31-22: the current timer mode. Bits 21-0: The system time when the timer was stopped. It is overwritten every time the timer is stopped.
0xBC500004	4	R?	The base time of the hardware timer 0 (assumed)
0xBC500008	4	RW	The numerator of the timer's prescale
0xBC50000C	4	RW	The denominator of the timer's prescale
0xBC500010	4	RW	Same as above, for hardware timer 1
0xBC500014	4	R?	Same as above, for hardware timer 1
0xBC500018	4	RW	Same as above, for hardware timer 1
0xBC50001C	4	RW	Same as above, for hardware timer 1
0xBC500020	4	RW	Same as above, for hardware timer 2
0xBC500024	4	R?	Same as above, for hardware timer 2
0xBC500028	4	RW	Same as above, for hardware timer 2
0xBC50002C	4	RW	Same as above, for hardware timer 2
0xBC500030	4	RW	Same as above, for hardware timer 3
0xBC500034	4	R?	Same as above, for hardware timer 3
0xBC500038	4	RW	Same as above, for hardware timer 3
0xBC50003C	4	RW	Same as above, for hardware timer 3
0xBC5003D0	4	RW	Same as 0xBC500000, but with the current PSP's system time value. A timer's current count is computed by subtracting the timer's base time (the init time point) from this value.
0xBC5003E0	4	RW	Same as above, for hardware timer 1
0xBC5003F0	4	RW	Same as above, for hardware timer 2
0xBC500400	4	RW	Same as above, for hardware timer 3

0xBC600000: System time

Physical Address	Size	R/W	Description
0xBC600000	32	RW	System time in microseconds. Wraps around every 1.1 hours?
0xBC600004	32	RW	Alarm time, raises interrupt (19?) when system time hits this number
0xBC600008	32	RW	Unknown, typically 0x30 but can be written
0xBC60000C	32	RW	Unknown, typically 1 but can be written. (Writing 0 caused a hang, maybe disables timer incrementing?)
0xBC600010	32	RW	Unknown, typically 0

0xBC800000: DMACPlus

DMACPlus general registers

Address	Size	Read/write	Description
0xBC800004	4	RW	Pending "operation success" interrupts
0xBC800008	4	RW	Clear "operation success" interrupts
0xBC80000C	4	RW	Pending "operation error" interrupts
0xBC800010	4	RW	Clear "operation error" interrupts
0xBC800014	4	RW	Enable "operation success" interrupts
0xBC800018	4	RW	Enable "operation error" interrupts

Interrupt bits

Bit	Interrupt
0	DmacplusLcdc
1	AVC
2	Sc2Me
3	Me2Sc
4	Sc128

Framebuffer scanout registers (DmacplusLcdc)

Address	Size	Read/write	Description
0xBC800100	4	RW	Framebuffer address (bits[28:0])
0xBC800104	4	RW	Framebuffer pixelformat (0 = RGBA8888, 1 = RGB565, 2 = RGBA5551, 3 = RGBA4444)
0xBC800108	4	RW	Framebuffer width
0xBC80010C	4	RW	Framebuffer stride
0xBC800110	4	RW	Framebuffer scanout configuration: Bit[0] = Enable framebuffer scanout to LCD controller, Bits[31:29] = ??

CSC registers

Address	Size	Read/write	Description
0xBC800120	4	RW	CSC source buffer pYBuffer address
0xBC800124	4	RW	CSC source buffer pYBuffer2 address
0xBC800128	4	RW	CSC source buffer pCrBuffer address
0xBC80012C	4	RW	CSC source buffer pCbBuffer address
0xBC800130	4	RW	CSC source buffer pCrBuffer2 address
0xBC800134	4	RW	CSC source buffer pCbBuffer2 address
0xBC800138	4	RW	CSC source buffer height
0xBC80013C	4	RW	CSC source buffer width
0xBC800140	4	RW	Buffer size: Bits[22:16] = height/16, Bits[13:8] = width/16, Bit[2] = unk, Bit[1] = unk, Bit[0] = use VME or AVC (AVC = 0, VME = 1)
0xBC800144	4	RW	CSC destination RGB buffer address
0xBC800148	4	RW	CSC destination RGB2 buffer address
0xBC80014C	4	RW	CSC parameters: Bit[0] = has RGB2 buffer, Bits[7:1] = pixelformat, Bits[31:8] = buffer stride
0xBC800150	4	RW	First row (3 values) of the 3x3 CSC matrix. Each value is 10 bits long, Q3.7 fixed-point format, starting at bit i * 16 of the register.
0xBC800154	4	RW	Second row (3 values) of the 3x3 CSC matrix. Each value is 10 bits long, Q3.7 fixed-point format, starting at bit i * 16 of the register.
0xBC800158	4	RW	Third row (3 values) of the 3x3 CSC matrix. Each value is 10 bits long, Q3.7 fixed-point format, starting at bit i * 16 of the register.
0xBC80015C	4	RW	Other parameters of CSC matrix (post matrix multiplication addition coefficients, etc). Bits[7:0] = footroom, Bit[8] = unk.
0xBC800160	4	RW	Start CSC? 0xD is written here.

CSC source buffer valid ranges

Note: It seems the CSC source buffer address can only be inside one of the following ranges in the following table (otherwise AVC "operation error" interrupt is triggered). The destination buffer doesn't have such limitations.

Start	End	Notes
0x00000000	0x00400000
0x04000000	0x04200000	VRAM? always read as 0s
0x08300000	0x0C000000

0xBE140000: LCDC

Address	Size	Read/write	Description
0xBE140000	4	RW	First LCDC controller enable

Bit(s)	Usage
0-1	3: enable first LCDC controller (tachyon version < 0x800000; otherwise it's set to 0)

Address	Size	Read/write	Description
0xBE140004	4	RW	Synchronization difference: (xsync / zoom) - ysync
0xBE140008	4	RW	Unknown (fourth argument of sceLcdcCheckMode and sceLcdcSetMode)
0xBE140010	4	RW	X back porch
0xBE140014	4	RW	X sync width
0xBE140018	4	RW	X front porch
0xBE14001C	4	RW	X resolution
0xBE140020	4	RW	Y back porch
0xBE140024	4	RW	Y sync width
0xBE140028	4	RW	Y front porch
0xBE14002C	4	RW	Y resolution
0xBE140030	4	R	HPC (?), returned by sceLcdcReadHPC()
0xBE140034	4	R	VPC (?), returned by sceLcdcReadVPC()
0xBE140040	4	RW	Y shift (between hardware & software resolution)
0xBE140044	4	RW	X shift (between hardware & software resolution)
0xBE140048	4	RW	Scaled X resolution
0xBE14004C	4	RW	Scaled Y resolution (same as the physical Y resolution)
0xBE140050	4	RW	Unknown, set to 1, maybe used by sceLcdcReadUnderflow (to be verified)
0xBE140070	4	W	Set to 1 when running sceLcdcResume() or sceLcdcInit() on tachyon version >= 0x5000000

The exact same registers are at 0xBE1401.., these ones being used for tachyon version >= 0x8000000 (PSP Go?).
These registers are only set on tachyo version >= 0x8000000:

Address	Size	Read/write	Description
0xBE140180	4	RW	Always set to 1 when 0xBE140184 - 0xBE140198 are used
0xBE140184	4	RW	Scaled X resolution (read instead of the (real) X resolution above when enabled)
0xBE140188	4	RW	Y resolution (read instead of the (real) Y resolution above when enabled)
0xBE14018C	4	RW	Unknown (0x580 - 0x678)
0xBE140190	4	RW	Unknown (0x4C4 - 0x71C)
0xBE140194	4	RW	Unknown (0xAFC - 0xCEC)
0xBE140198	4	RW	Unknown (0x910 - 0xE38)
0xBE140200	4	W	Set to 1 on initialization