I know its possible to access IOP's memory from the EE, and I've heard things like the SPU/etc can be reached over the SIF... I'd like to know how. Before I start fooling with memory locations and sending random data can someone give me some pointers?
Just use the same register address that you would use on the IOP. You won't be able to receive interrupts or transfer DMA to/from those devices using the EE.
Yeah, it's the same address. And you want to use the 0xbxxxxxxx version on the EE since it's uncached access. You'll need to switch into Kernel Mode first.