View source for Central Processing Unit (CPU)

This is an old revision of this page, as edited by RemmyLee at 02:22, 23 October 2026. Publishing it replaces the current version.
← Central Processing Unit (CPU)
You do not have permission to edit this page. Log in to edit.
---
title: Central Processing Unit (CPU)
type: component
summary: 32-bit RISC processor at the center of the PlayStation.
category: Hardware
---

## Overview

The PlayStation uses a customized CPU based on the R3000A. The R3000A is a 32-bit RISC CPU.[^hw23]

The CPU contains an instruction cache (I-cache) and a scratchpad memory. Main memory and an interrupt controller surround the CPU at the base of the PlayStation.[^hw14]

The GTE (Geometry Transformation Engine) is a coprocessor of the CPU.[^hw14]

The CPU has the following specifications:

Table: CPU specifications

| Item | Specification |
| --- | --- |
| System Clock | 33.8688 MHz |
| Bus Width | 32 bit |
| I cache | 4KB |
| D cache | 1KB (Scratch Pad) |
| Endian | Little |

## Memory

The PlayStation has 2 MB of main memory.[^hw23]

The R3000 TLB (the virtual memory management device) is not present. The relation between physical and logical addresses is therefore fixed.[^hw23]

The OS ROM is 512KB. It holds the OS kernel and the boot loader.[^hw23]

The [memory map](/hardware/memory-map/) page lists the address ranges.

## I-Cache

The I-cache holds 1K words (4K bytes) and is 1-way mapped. Logical space is divided into 4K-byte units that map onto the I-cache.[^hw25]

The top 4 bits of a logical address decide whether the I-cache is used.[^hw24]

The I-cache is used in segments A, B, P and Q. It is not used in segments C and R.[^hw24]

The I-cache is divided into 256 lines of 16 bytes. One line holds 4 instructions.[^hw28]

Each line has a tag. The tag records whether the line holds instructions and stores the upper 20 bits of their address.[^hw28]

Bits 5 to 12 of the instruction address select the line. A hit takes 1 cycle.[^hw28]

## Scratchpad

The D-cache of the PlayStation is called the Scratch Pad. Its size is 1KB.[^hw23]

The D-cache is a high-speed memory inside the CPU.[^hw25]

The scratchpad is mapped into memory as segment S. Data and programs can both be stored there.[^hw25]

The scratchpad reads and writes once per cycle. It cannot be the target of a DMA transfer.[^hw29]

## Write and Read Buffers

The R-buffer is a single 4-byte register that buffers read data.[^hw28]

A load from memory into the R-buffer takes 4 cycles. A read from the R-buffer to the CPU takes 1 cycle.[^hw28]

The W-buffer is a FIFO of 4 registers of 4 bytes each. Each write takes one register. The length of the write does not matter.[^hw28]

A write to the W-buffer takes 1 cycle. A write from the W-buffer to main memory takes 4 cycles.[^hw28]

When the W-buffer is full, a write waits until a register is freed.[^hw28]

A read from an address with a pending write waits for the write to complete. The read then gets the newest data.[^hw28]

Neither buffer can be accessed by bytes or halfwords.[^hw28]

The CPU manages the cache and the buffers. A program cannot control them.[^hw29]

The exact cycle count of a code segment therefore cannot be predicted.[^hw29]

## Access Timing

The access timing from the CPU to main memory is as follows:

Table: Memory access timing

| Contents | Number of Words | Penalty Cycles | Required Number of Cycles |
| --- | --- | --- | --- |
| I-Cache to CPU | 1 | 0 | 0 |
| ScratchPad to CPU | 1 | 0 | 0 |
| Main Memory to I-Cache | 1 | 5 | 4 |
| Main Memory to I-Cache | 2 | 6 | 5 |
| Main Memory to I-Cache | 3 | 7 | 6 |
| Main Memory to I-Cache | 4 | 8 | 7 |
| Main Memory to CPU | 1 | 5 | 4 |
| CPU to W Buffer | 1 | 0 | 0 |
| CPU to ScratchPad | 1 | 0 | 0 |
| W-Buffer to Main Memory | 1 | 0 | 4 |
| W-Buffer to Main Memory (same page) | 2 | 0 | 6 |
| W-Buffer to Main Memory (same page) | 3 | 0 | 8 |
| W-Buffer to Main Memory (same page) | 4 | 0 | 10 |

## Address Alignment

The R3000 requires strict address alignment. Word data starts at a multiple of 4 and halfword data at a multiple of 2.[^hw25]

A data load, data store or instruction fetch that breaks this rule causes an address error.[^hw25]

## Registers

The R3000 has 32 general-purpose registers of 32 bits. The compiler assigns each register a use.[^hw25]

The macros in the table are defined in asm.h.[^hw25]

Table: R3000 general-purpose registers

| Register # | Macro (1) | Macro (2) | Assembler | Assignment |
| --- | --- | --- | --- | --- |
| 0 | R_ZERO | R_R0 | Zero | 0 fixed |
| 1 | R_AT | R_R1 | AT | Assembler reserves |
| 2 | R_V0 | R_R2 | v0 | Function return value |
| 3 | R_V1 | R_R3 | v1 | Return value (for double type) |
| 4 to 7 | R_A0 to R_A3 | R_R4 to R_R7 | a0 to a3 | Arguments #0 to #3 |
| 8 to 15 | R_T0 to R_T7 | R_R8 to R_R15 | t0 to t7 | Destroyed in function |
| 16 to 23 | R_S0 to R_S7 | R_R16 to R_R23 | s0 to s7 | Saved in function |
| 24 to 25 | R_T8 to R_T9 | R_R24 to R_R25 | t8 to t9 | Saved in function |
| 26 to 27 | R_K0 to R_K1 | R_R26 to R_R27 | k0 to k1 | Kernel reserves |
| 28 | R_GP | R_R28 | gp | Global pointer |
| 29 | R_SP | R_R29 | sp | Stack pointer |
| 30 | R_FP | R_R30 | fp | Frame pointer |
| 31 | R_RA | R_R31 | ra | Return address |

The assembler uses AT as a work area. C code and assembler programmers may not use it.[^hw26]

The R3000 has no subroutine call. A jump instruction holds the return address in a register. The compiler always uses RA for it.[^hw26]

A C function receives its first 4 arguments in A0 to A3. Further arguments go on the stack.[^hw26]

The stack is a pointer kept in SP by the compiler. FP holds the head address of the function frame.[^hw27]

The compiler groups up to 64K bytes of variables in the bss section.[^hw27]

GP holds the center address of the bss section. One instruction reaches any variable in it.[^hw27]

## Program Counter

The program counter cannot be accessed directly. It takes the following values:

Table: Program counter values

| Timing | Program Counter |
| --- | --- |
| Immediately after power on reset | 0xbfc00000 fixed |
| When an external interrupt is generated | 0x00000080 fixed |
| When an exception interrupt is generated | 0x00000080 fixed |

## Exceptions

An error such as a bus error or a reserved instruction raises an exception.[^hw27]

On an exception the CPU jumps to 0x00000080. A device interrupt jumps to the same address.[^hw27]

An exception cannot be masked.[^hw27]

Table: Exception categories

| Code | Content |
| --- | --- |
| AdEL | Address error (during data loading or instruction fetching) |
| AdES | Address error (during data storage) |
| IBE | Bus error (during instruction fetching) |
| DBE | Bus error (during data loading or data storing) |
| Sys | System call (during syscall instruction execution) |
| Bp | Breakpoint (during break instruction execution) |

## References

[^hw14]: Sony Computer Entertainment Inc. PlayStation Hardware. August 1998. Page 1-4.
[^hw23]: Sony Computer Entertainment Inc. PlayStation Hardware. August 1998. Page 2-3, Table 2-1.
[^hw24]: Sony Computer Entertainment Inc. PlayStation Hardware. August 1998. Page 2-4.
[^hw25]: Sony Computer Entertainment Inc. PlayStation Hardware. August 1998. Page 2-5.
[^hw26]: Sony Computer Entertainment Inc. PlayStation Hardware. August 1998. Page 2-6, Table 2-3.
[^hw27]: Sony Computer Entertainment Inc. PlayStation Hardware. August 1998. Page 2-7, Figure 2-3, Table 2-4.
[^hw28]: Sony Computer Entertainment Inc. PlayStation Hardware. August 1998. Page 2-8.
[^hw29]: Sony Computer Entertainment Inc. PlayStation Hardware. August 1998. Page 2-9, Table 2-5.