Central Processing Unit (CPU): Difference between revisions
| Revision as of 02:22, 23 October 2026 RemmyLee (Hardware and system software pages from the Sony manuals) | Revision as of 02:46, 23 October 2026 RemmyLee (SPU and CD-ROM at register depth; CPU overview rewritten) | ||
| Line 8: | Line 8: | ||
| ## Overview | ## Overview | ||
| − | The PlayStation uses a customized CPU based on the R3000A. The R3000A is a 32-bit RISC CPU.[^hw23] | + | The PlayStation uses a customized CPU based on the R3000A, which is a 32-bit RISC CPU. Its D-cache is used as a scratchpad, and fixed address areas are accessed with the same block number as cache memory. The specifications are as below:[^hw23] |
| − | The CPU contains an instruction cache (I-cache) and a scratchpad memory. Main memory and an interrupt controller surround the CPU at the base of the PlayStation.[^hw14] | ||
| − | |||
| − | The GTE (Geometry Transformation Engine) is a coprocessor of the CPU.[^hw14] | ||
| − | |||
| − | The CPU has the following specifications: | ||
| − | |||
| Table: CPU specifications | Table: CPU specifications | ||
| Line 26: | Line 20: | ||
| | Endian | Little | | | Endian | Little | | ||
| − | ## Memory | + | The basic part of the PlayStation is composed of the CPU with a main memory and an interrupt controller. The CPU contains an instruction cache and the scratchpad memory and manages the actual memory. The GTE (Geometry Transformation Engine) is a coprocessor of the CPU that performs coordinate transformation and light source calculation.[^hw14] |
| − | The PlayStation has 2 MB of main memory.[^hw23] | + | The R3000 TLB, the virtual memory management device, is not mounted. The relationship between the physical address and the logical address of the memory space is therefore always fixed, as the [memory map](/hardware/memory-map/) shows.[^hw23] |
| − | The R3000 TLB (the virtual memory management device) is not present. The relation between physical and logical addresses is therefore fixed.[^hw23] | + | The following pages describe the CPU in detail: |
| − | The OS ROM is 512KB. It holds the OS kernel and the boot loader.[^hw23] | + | Table: CPU reference pages |
| − | The [memory map](/hardware/memory-map/) page lists the address ranges. | + | | Page | Content | |
| + | | --- | --- | | ||
| + | | [Instruction set](/hardware/cpu/instruction-set/) | Encoding, operation and timing of every instruction | | ||
| + | | [COP0](/hardware/cpu/cop0/) | Exception, status, cache and debug registers | | ||
| + | | [Memory map](/hardware/memory-map/) | Segments, mirrors and memory exceptions | | ||
| + | | [I/O map](/hardware/io-map/) | Addresses of all hardware registers | | ||
| + | | [Memory control](/hardware/memory-control/) | Bus timing, RAM and cache configuration registers | | ||
| + | | [Interrupt controller](/hardware/interrupts/) | I_STAT, I_MASK and the interrupt sources | | ||
| + | | [DMA controller](/hardware/dma/) | The 7 DMA channels | | ||
| + | | [Root counters](/hardware/timers/) | The hardware timers | | ||
| + | ## Memory | ||
| + | |||
| + | There is 2 MB of main memory installed in the PlayStation, and a 512KB OS ROM holds the OS kernel and the boot loader. Sony prohibits access to the ROM and does not disclose its addresses.[^hw23] | ||
| + | |||
| + | The kernel uses the first 64K bytes of main memory. Addresses for the application therefore begin at 0x00010000.[^ovr27] | ||
| + | |||
| ## I-Cache | ## I-Cache | ||
| − | The I-cache holds 1K words (4K bytes) and is 1-way mapped. Logical space is divided into 4K-byte units that map onto the I-cache.[^hw25] | + | The top 4 bits of a logical address determine whether the instruction cache (I-cache) is effective. Of the segments that correspond to memory devices, the I-cache is effective with A, B, P and Q but not with C and R. When it is effective, instruction codes are read into the I-cache in units, and an instruction found there needs no memory access over the bus.[^hw24][^hw25] |
| − | The top 4 bits of a logical address decide whether the I-cache is used.[^hw24] | + | The I-cache holds 1K words (4K bytes) and is 1-way mapped. Logical space is therefore divided into 4K-byte units, and these units are mapped onto the I-cache in multiplex.[^hw25] |
| − | The I-cache is used in segments A, B, P and Q. It is not used in segments C and R.[^hw24] | + | The I-cache is divided into 256 lines of 16 bytes, and each line holds the equivalent of 4 instructions. Each line has a tag that records whether its instructions have been read and stores the upper 20 bits of their memory address. When an instruction is fetched, the line is selected by the address, and the CPU reads the instruction from the line in 1 cycle if the tag matches.[^hw28] |
| − | The I-cache is divided into 256 lines of 16 bytes. One line holds 4 instructions.[^hw28] | + | Sony's manual gives bits 5 to 12 of the address as the line number. psx-spx gives bits 4 to 11, so that 80001234h and 800F1234h both use line 23h and cannot be cached at the same time.[^hw28][^ic] |
| − | Each line has a tag. The tag records whether the line holds instructions and stores the upper 20 bits of their address.[^hw28] | + | On a miss the CPU reads the line from memory starting with the next cycle. If the target instruction is not on a line boundary, the instructions below it in the line are not read. The fill then takes 4 to 7 cycles into the R-buffer, plus one cycle to pass the line to the CPU.[^hw28] |
| − | Bits 5 to 12 of the instruction address select the line. A hit takes 1 cycle.[^hw28] | + | ### Tags and Valid Bits |
| − | ## Scratchpad | + | psx-spx gives the tag in more detail. Each tag holds bits 12 to 31 of the physical address and one valid bit for each of the 4 words. Because the tag holds the physical address, KUSEG and KSEG0 accesses to one location share a cache entry, while KSEG1 accesses bypass the cache.[^ic] |
| − | The D-cache of the PlayStation is called the Scratch Pad. Its size is 1KB.[^hw23] | + | A miss fills the line from the accessed word to the end of the line without wrapping. A fill entered at word 0 sets all four valid bits (0Fh), one entered at word 2 sets only those of words 2 and 3 (0Ch), and later fills of the same line add their valid bits. A tag that matches with the word's valid bit clear counts as a miss and refills the whole line.[^ic] |
| − | The D-cache is a high-speed memory inside the CPU.[^hw25] | + | Table: I-cache fill by entry word |
| − | The scratchpad is mapped into memory as segment S. Data and programs can both be stored there.[^hw25] | + | | Entry word | Words filled | Valid bits | |
| + | | --- | --- | --- | | ||
| + | | 0 | 0, 1, 2, 3 | 0Fh | | ||
| + | | 1 | 1, 2, 3 | 0Eh | | ||
| + | | 2 | 2, 3 | 0Ch | | ||
| + | | 3 | 3 | 08h | | ||
| − | The scratchpad reads and writes once per cycle. It cannot be the target of a DMA transfer.[^hw29] | + | The IBLKSZ field of the BCC register limits the burst length. With IBLKSZ = 0 a fill entered at word 0 reads only words 0 and 1 (valid bits 03h), while fills entered at words 1 to 3 are unaffected.[^ic] |
| − | ## Write and Read Buffers | + | ### Self-Modifying Code |
| − | The R-buffer is a single 4-byte register that buffers read data.[^hw28] | + | Stores to RAM do not affect the I-cache, which is independent of the data write path. Code written over a cached address through either KSEG0 or KSEG1 therefore leaves the cached instructions in place, and the CPU runs the old instructions until the cache is flushed. Formula One 2001 loads new code over itself and relies on this behavior until it calls the FlushCache system call.[^ic] |
| − | A load from memory into the R-buffer takes 4 cycles. A read from the R-buffer to the CPU takes 1 cycle.[^hw28] | + | The I-cache is flushed by isolating the cache in COP0 SR and writing the tag memory through the BCC register. The [memory control](/hardware/memory-control/) page gives the BIOS sequence.[^bcc] |
| − | The W-buffer is a FIFO of 4 registers of 4 bytes each. Each write takes one register. The length of the write does not matter.[^hw28] | + | ## Scratchpad |
| − | A write to the W-buffer takes 1 cycle. A write from the W-buffer to main memory takes 4 cycles.[^hw28] | + | The D-cache is composed of a high-speed memory housed in the CPU. It has a scratchpad structure and is mapped in the memory space as segment S, so that game programmers can access it. Both data and programs can be stored in this segment, but it is not a subject for DMA transmission.[^hw25] |
| − | When the W-buffer is full, a write waits until a register is freed.[^hw28] | + | The scratchpad can read and write at high speed (once per cycle). Sony suggests the S segment as a way to raise execution speed.[^hw29][^os44] |
| − | A read from an address with a pending write waits for the write to complete. The read then gets the newest data.[^hw28] | + | psx-spx adds the following. The scratchpad occupies 1F800000h to 1F8003FFh and is mirrored in KUSEG and KSEG0 only. Neither the kernel nor the Sony libraries use it, so the whole 1K is free for the program. However, it cannot execute code, and a jump into it raises a bus error on the first instruction fetch even with the swapped cache bit set in SR.[^sp] |
| − | Neither buffer can be accessed by bytes or halfwords.[^hw28] | + | The hardware manual states that programs can be stored in the scratchpad, while psx-spx states that code there cannot run.[^hw25][^sp] |
| − | The CPU manages the cache and the buffers. A program cannot control them.[^hw29] | + | ## Read and Write Buffers |
| − | The exact cycle count of a code segment therefore cannot be predicted.[^hw29] | + | Three high-speed memories sit between the CPU and main memory to reduce access time: the I-cache and two buffer memories. The buffers are transparent to a running program. Their side effect is that the exact timing of a program cannot be predicted.[^hw27] |
| + | The R-buffer is a single 4-byte register that buffers read data. Loading data from memory into the R-buffer takes 4 cycles and reading it from the R-buffer to the CPU takes 1 cycle, so a pure data read takes 5 cycles. The R-buffer cannot be accessed by bytes or halfwords. Reading one word as several bytes or halfwords therefore takes 5 cycles for each read instruction.[^hw28] | ||
| + | |||
| + | The W-buffer is a FIFO of 4 registers of 4 bytes, and each write takes one register whatever its length. A write to the W-buffer takes 1 cycle, so the CPU does not wait for main memory. When all 4 registers are full the next write waits until the oldest is written to main memory. Writing one word from the W-buffer to main memory takes 4 cycles. Continuous writes to the same 1K-byte page take 2 more cycles for each further word, as the access timing table shows.[^hw28][^hw29] | ||
| + | |||
| + | A write pending in the W-buffer completes before the CPU reads the same address. The read therefore always obtains the newest data, although write timing is otherwise not guaranteed.[^hw28] | ||
| + | |||
| + | ### The Write Queue and I/O Registers | ||
| + | |||
| + | psx-spx calls the W-buffer the write queue. It is meant for normal memory, and a device with an internal state machine can see its accesses in the wrong order. For example, the three writes of a JEDEC flash ID sequence followed by two reads reach the bus interleaved in the order store load store load store.[^wq] | ||
| + | |||
| + | KSEG1 does not use the write queue, and any KSEG1 access stalls the CPU until the queue is empty. psx-spx therefore recommends the KSEG1 addresses for hardware registers (BF80180xh for the CD-ROM, for example). Sony's code uses the KUSEG addresses and writes 4 dummy values to flush the queue, while a single read of BFC00000h also flushes it.[^wq] | ||
| + | |||
| ## Access Timing | ## Access Timing | ||
| − | The access timing from the CPU to main memory is as follows: | + | The cache and buffers are managed by the CPU and cannot be controlled from a program. It is therefore not possible to predict the exact number of cycles a segment of code needs. However, best and worst case times can be computed from the access timing below:[^hw29] |
| Table: Memory access timing | Table: Memory access timing | ||
| Line 104: | Line 130: | ||
| ## Address Alignment | ## Address Alignment | ||
| − | The R3000 requires strict address alignment. Word data starts at a multiple of 4 and halfword data at a multiple of 2.[^hw25] | + | The R3000 requires strict address alignment. Word-length (4-byte) data must start at a multiple of 4, and halfword-length (2-byte) data at a multiple of 2. A data store, data load or instruction fetch that does not comply causes an address error.[^hw25] |
| − | A data load, data store or instruction fetch that breaks this rule causes an address error.[^hw25] | ||
| − | |||
| ## Registers | ## Registers | ||
| − | The R3000 has 32 general-purpose registers of 32 bits. The compiler assigns each register a use.[^hw25] | + | The R3000 has 32 general-purpose registers of 32 bits and a program counter. The compiler assigns each register a use, and threaded code or assembler code must use the registers in the same way. The macros in the table are defined in asm.h.[^hw25] |
| − | The macros in the table are defined in asm.h.[^hw25] | ||
| − | |||
| Table: R3000 general-purpose registers | Table: R3000 general-purpose registers | ||
| Line 132: | Line 154: | ||
| | 31 | R_RA | R_R31 | ra | Return address | | | 31 | R_RA | R_R31 | ra | Return address | | ||
| − | The assembler uses AT as a work area. C code and assembler programmers may not use it.[^hw26] | + | The hardware manual lists t8 and t9 as saved in a function. The PlayStation Operating System manual lists them as temporaries, and psx-spx agrees that a subroutine may change them. The same OS manual table lists R_T7 as a saved temporary.[^hw26][^os27][^reg] |
| − | The R3000 has no subroutine call. A jump instruction holds the return address in a register. The compiler always uses RA for it.[^hw26] | + | ### Register Conventions |
| − | A C function receives its first 4 arguments in A0 to A3. Further arguments go on the stack.[^hw26] | + | The assembler uses AT as a work area, and the C compiler and assembler programmers may not use it. The R3000 has no subroutine call. A jump instruction holds the return address in a register instead, and the compiler always uses RA for it.[^hw26] |
| − | The stack is a pointer kept in SP by the compiler. FP holds the head address of the function frame.[^hw27] | + | A C function receives up to 4 arguments in A0 to A3 in order from the left. With 5 or more arguments the rest are stored on the stack, where space is also reserved for the first 4 although their values travel in registers. A return value of 32 bits or less is stored in V0, and for a 64-bit double the high 32 bits are stored in V1.[^hw26][^os28] |
| − | The compiler groups up to 64K bytes of variables in the bss section.[^hw27] | + | The R3000 has no stack either. The compiler keeps a stack pointer in SP and stores the head address of the function frame in FP, which is set to SP when a module starts.[^hw27] |
| − | GP holds the center address of the bss section. One instruction reaches any variable in it.[^hw27] | + | Memory access uses register indirect addressing with a signed 16-bit offset. The compiler therefore gathers up to 64K bytes of variables in a block called the bss section and keeps the center address of the block in GP. Any variable in the block is then reached by one instruction, and this global pointer does not change within the module.[^hw27] |
| + | K0 and K1 are reserved for the kernel. An exception handler cannot preserve every register because it must load its return address into one (conventionally K0). Code that uses K0 must therefore be sure no interrupt or exception can occur, while the PlayStation kernel leaves K1 unchanged.[^reg][^rp] | ||
| + | |||
| ## Program Counter | ## Program Counter | ||
| − | The program counter cannot be accessed directly. It takes the following values: | + | The program counter cannot be accessed directly. It takes the following values:[^hw27] |
| Table: Program counter values | Table: Program counter values | ||
| Line 158: | Line 182: | ||
| ## Exceptions | ## Exceptions | ||
| − | An error such as a bus error or a reserved instruction raises an exception.[^hw27] | + | An error such as a bus error or a reserved instruction execution generates an exception. An exception jumps to 0x00000080 in the same way as an interrupt from a device, but it cannot be masked. The [COP0](/hardware/cpu/cop0/) page describes the exception codes, the status register and the return from an exception.[^hw27] |
| − | On an exception the CPU jumps to 0x00000080. A device interrupt jumps to the same address.[^hw27] | ||
| − | |||
| − | An exception cannot be masked.[^hw27] | ||
| − | |||
| − | Table: Exception categories | ||
| − | |||
| − | | Code | Content | | ||
| − | | --- | --- | | ||
| − | | AdEL | Address error (during data loading or instruction fetching) | | ||
| − | | AdES | Address error (during data storage) | | ||
| − | | IBE | Bus error (during instruction fetching) | | ||
| − | | DBE | Bus error (during data loading or data storing) | | ||
| − | | Sys | System call (during syscall instruction execution) | | ||
| − | | Bp | Breakpoint (during break instruction execution) | | ||
| − | |||
| ## References | ## References | ||
| Line 185: | Line 194: | ||
| [^hw28]: Sony Computer Entertainment Inc. PlayStation Hardware. August 1998. Page 2-8. | [^hw28]: Sony Computer Entertainment Inc. PlayStation Hardware. August 1998. Page 2-8. | ||
| [^hw29]: Sony Computer Entertainment Inc. PlayStation Hardware. August 1998. Page 2-9, Table 2-5. | [^hw29]: Sony Computer Entertainment Inc. PlayStation Hardware. August 1998. Page 2-9, Table 2-5. | ||
| + | [^os27]: Sony Computer Entertainment Inc. PlayStation Operating System. August 1998. Page 2-7, Table 2-4. | ||
| + | [^os28]: Sony Computer Entertainment Inc. PlayStation Operating System. August 1998. Page 2-8. | ||
| + | [^os44]: Sony Computer Entertainment Inc. PlayStation Operating System. August 1998. Page 4-4. | ||
| + | [^ovr27]: Sony Computer Entertainment Inc. Run-Time Library Overview. January 1999. Page 2-7. | ||
| + | [^ic]: psx-spx. Memory Map, i-Cache. https://psx-spx.consoledev.net/memorymap/ | ||
| + | [^sp]: psx-spx. Memory Map, Scratchpad. https://psx-spx.consoledev.net/memorymap/ | ||
| + | [^wq]: psx-spx. Memory Map, Write queue. https://psx-spx.consoledev.net/memorymap/ | ||
| + | [^bcc]: psx-spx. Memory Control, FFFE0130h - BCC, BIU/Cache Configuration Register. https://psx-spx.consoledev.net/memorycontrol/ | ||
| + | [^reg]: psx-spx. CPU Specifications, CPU Registers. https://psx-spx.consoledev.net/cpuspecifications/ | ||
| + | [^rp]: psx-spx. Unpredictable Things, CPU Register Problems - R1 (AT), R26 (K0), R29 (SP). https://psx-spx.consoledev.net/unpredictablethings/ | ||