View source for BIOS

You do not have permission to edit this page. Log in to edit.
---
title: BIOS
type: component
summary: 512KB OS ROM that holds the PlayStation kernel, boot loader, shell and fonts.
category: System software
info: Size = 512KB
info: Address = 0xBFC00000
info: Kernel RAM = 0x00000000 to 0x0000FFFF
---

## Overview

The PlayStation has a 512KB OS ROM, which stores the OS kernel and the boot loader. Sony prohibits direct access to the ROM and does not disclose its internal addresses.[^hw23] The ROM is mapped at 0x1FC00000 to 0x1FC7FFFF in segments P, Q and R, and the CPU starts executing at 0xBFC00000 immediately after power on reset.[^hw24][^hw27] The kernel in the ROM is the [PS-X OS](/system/ps-x-os/), and its services are called through the A, B and C function tables and the syscall instruction described below.

Programmers know the ROM as the BIOS. Besides the kernel it holds the intro screens, the boot menu that appears when no disc is inserted, and the character sets used by Krom2RawAdd().[^spxover][^spxcs] The boot menu plays audio CDs and copies and erases saved games on Memory Cards.[^spxover]

The ROM has an 8-bit data bus, so it is slow to execute from. For this reason part of the kernel is copied into the first 64K bytes of main memory at boot. The original BIOS nevertheless runs most of its functions from uncached ROM, and a call such as memcpy() takes about 160 cycles per byte.[^spxover][^spxslow]

## ROM Map

The 512KB ROM is divided as shown below.[^spxrom]

Table: BIOS ROM map

| Address | Contents |
| --- | --- |
| 0xBFC00000 | Kernel part 1 (executed in uncached ROM) |
| 0xBFC10000 | Kernel part 2 (relocated to cached RAM) |
| 0xBFC18000 | Intro and boot menu (decompressed and relocated to RAM) |
| 0xBFC64000 | Character sets |
| 0xBFC7FF32 | Version and copyright strings |

The kernel header near the start of the ROM identifies the build.[^spxrom]

Table: BIOS ROM header

| Address | Contents |
| --- | --- |
| 0xBFC00100 | Kernel date in BCD (YYYYMMDD) |
| 0xBFC00104 | Console type |
| 0xBFC00108 | Kernel maker and version strings |
| 0xBFC7FF32 | GUI version and copyright strings (absent in SCPH-1000) |

## Kernel Memory

The kernel uses the first 64K bytes of main memory, and the addresses available to the user begin at 0x00010000.[^lo207] The fixed locations in that area are shown below.[^spxmap]

Table: BIOS RAM map

| Address | Size | Contents |
| --- | --- | --- |
| 0x00000000 | 0x10 | Copy of the exception handler, partly overwritten |
| 0x00000040 | 0x20 | COP0 debug break vector (not used by the kernel) |
| 0x00000060 | 4 | RAM size in megabytes (2 or 8) |
| 0x00000080 | 0x10 | Exception vector (in KSEG0, at 0x80000080) |
| 0x000000A0 | 0x10 | A function vector |
| 0x000000B0 | 0x10 | B function vector |
| 0x000000C0 | 0x10 | C function vector |
| 0x00000100 | 0x58 | Table of Tables (ToT) |
| 0x00000180 | 0x80 | Argument string from the BOOT line of SYSTEM.CNF |
| 0x00000200 | 0x300 | A function jump table |
| 0x00000500 | | Kernel code and data relocated from ROM |
| 0x0000DF80 | 0x80 | Used by game patches to the BIOS |
| 0x0000DFFC | 4 | Response value from the intro and boot menu |
| 0x0000E000 | 0x2000 | Kernel memory for ExCBs, EvCBs and TCBs |
| 0x00010000 | | Start of user RAM |
| 0x001FFF00 | | Default stack top |

A few early games read address 0 through uninitialized pointers. They therefore depend on the leftover bytes there, which are a copy of the 16-byte exception handler with the first word overwritten by 0x00000003.[^spxgarb]

The kernel keeps a 4K interrupt stack for event handlers in its reserved area. GetSysSp() returns the highest address of this stack.[^lo209][^lr138] The Run-Time Library Reference gives the size of this stack as 2K bytes.[^lr138] The kernel does not allocate or use the scratchpad at 0x1F800000 to 0x1F8003FF, so a program may use all 1K bytes of it.[^spxalloc]

## Table of Tables

The kernel represents its system tables with the structure ToT (Table of Tables) at address 0x00000100. Each entry holds the start address and the size in bytes of one table, so a program can reach every table in the same way.[^lo204] The entries are shown below with the names used by Sony and by psx-spx.

Table: ToT entries

| Address | Entry | Sony (Run-Time Library Overview) | Sony (PlayStation Operating System) | psx-spx |
| --- | --- | --- | --- | --- |
| 0x00000100 | 0 | System reserved | Queue header requires interrupt processing | ExCB, 4 x 8 bytes |
| 0x00000108 | 1 | TCBH (pointer to execution TCB) | Task state queue header | PCB, 1 x 4 bytes |
| 0x00000110 | 2 | Task control block (TCB) array | Task management block | TCB, N x 0xC0 bytes |
| 0x00000118 | 3 | System reserved | System reserved | Unused |
| 0x00000120 | 4 | Event control block array | Event management block | EvCB, N x 0x1C bytes |
| 0x00000128 | 5 to 7 | System reserved | System reserved | Unused |
| 0x00000140 | 8 | System reserved | System reserved | FCB, 16 x 0x2C bytes |
| 0x00000150 | 10 | System reserved | System reserved | DCB, 10 x 0x50 bytes |

The sources for this table are the Run-Time Library Overview, the PlayStation Operating System manual, and psx-spx.[^lo204][^os26][^spxtot] Sony lists entries 5 to 31 as system reserved, while psx-spx finds the file and device control blocks at entries 8 and 10.

A file descriptor fd converts to its FCB as [0x140] + fd * 0x2C, and an event descriptor converts to its EvCB as [0x120] + (event AND 0xFFFF) * 0x1C.[^spxtot]

## Calling the BIOS

Kernel services are reached through three function vectors and the syscall instruction. A caller loads the function number into R9 and jumps to 0xA0, 0xB0 or 0xC0. The syscall functions instead take their number in R4.[^spxfn] The function tables are listed on separate pages:

- [A functions](/system/bios/a-functions/): file I/O, standard C functions, executable loading, GPU, CD-ROM and Memory Card helpers.
- [B functions](/system/bios/b-functions/): timers, events, threads, controllers, exceptions, file system and devices.
- [C functions](/system/bios/c-functions/): interrupt chains, kernel setup and device internals.
- [Syscalls and breaks](/system/bios/syscalls/): critical sections and the PC file server.

Arguments are passed in R4 to R7 and then on the stack from [SP+0x10] up. The caller must reserve one stack word for every argument, including the first four, because the called function may use those words. The return value is in R2.[^spxfn] A BIOS function or callback may destroy R1 to R15, R24, R25, R31 and HI/LO, but must preserve R16 to R23, SP and FP. R26 (K0) is reserved for the exception handler.[^spxfn]

Sony's kernel library libapi gives applications a C interface to the same services. Its reference documents many functions under the same names, such as OpenEvent(), LoadExec() and _96_init().[^lr154][^lr147][^lr178]

## Related Pages

- [Events](/system/bios/events/): event classes, types, modes and control blocks.
- [Threads](/system/bios/threads/): TCB layout and thread switching.
- [File I/O](/system/bios/file-io/): devices and the CD-ROM and Memory Card file functions.
- [Boot](/system/bios/boot/): boot sequence, license check and executable loading.

## Kernel Versions

The kernel was changed only a few times. Most consoles have the kernel dated 4 December 1995 with no PAL or NTSC differences.[^spxver] The date and version string can be read with GetSystemInfo().[^spxver]

Table: Kernel versions

| Date | Version string | Used in |
| --- | --- | --- |
| 28 July 1994 | DTL-H2000 | Pre-retail development board |
| 22 September 1994 | CEX-1000 KT-3 by S.O. | BIOS v1.0 to v2.0 |
| (same date) | CEX-3000 KT-3 by K.S. | BIOS v2.1 |
| 4 December 1995 | CEX-3000/1001/1002 by K.S. | BIOS v2.2 to v4.5, except v4.0 |
| 29 May 1997 | CEX-7000/-7001 by K.S. | BIOS v4.0 |
| 17 January 2000 | PS compatible mode by M.T. | BIOS v5.0 (PlayStation 2) |

The CEX-7000 kernel differs from the 1995 kernel mainly in its first instruction, which sets the BIOS ROM size in port 0x1F801010 to 1MB instead of 512KB.[^spxver]

## Boot Menu Versions

The intro and boot menu part of the ROM was updated more often than the kernel. It is customized for PAL or NTSC display, for language, and for the region check.[^spxver] Games communicate only with the kernel, so the differences in this part have little effect on compatibility.[^spxver] The known versions are shown below.[^spxver]

Table: BIOS versions

| Version | CRC32 | Used in | System ROM version string |
| --- | --- | --- | --- |
| 0.xj | 18D0F7D8 | DTL-H2000 | none |
| 1.0j | 3B601FC8 | SCPH-1000, DTL-H1000 | none |
| 1.1j | 3539DEF6 | SCPH-3000, DTL-H1000H | 1.1 01/22/95 |
| 2.0a | 55847D8C | DTL-H1001 | 2.0 05/07/95 A |
| 2.0e | 9BB87C4B | SCPH-1002, DTL-H1002 | 2.0 05/10/95 E |
| 2.1j | BC190209 | SCPH-3500 | 2.1 07/17/95 J |
| 2.1a | AFF00F2F | SCPH-1001, DTL-H1101 | 2.1 07/17/95 A |
| 2.1e | 86C30531 | SCPH-1002, DTL-H1102 | 2.1 07/17/95 E |
| 2.2j | 24FC7E17 | SCPH-5000, DTL-H1200 | 2.2 12/04/95 J |
| 2.2a | 37157331 | SCPH-1001, DTL-H1201, DTL-H3001 | 2.2 12/04/95 A |
| 2.2e | 1E26792F | SCPH-1002, DTL-H1202, DTL-H3002 | 2.2 12/04/95 E |
| 2.2v | 446EC5B2 | SCPH-5903 (Video CD, 1MB) | 2.2 12/04/95 J |
| 2.2d | DECB22F5 | DTL-H1100 | 2.2 03/06/96 D |
| 3.0j | FF3EEB8C | SCPH-5500 | 3.0 09/09/96 J |
| 3.0a | 8D8CB7E4 | SCPH-5501, SCPH-7003 | 3.0 11/18/96 A |
| 3.0e | D786F0B9 | SCPH-5502, SCPH-5552 | 3.0 01/06/97 E |
| 4.0j | EC541CD0 | SCPH-7000, SCPH-9000 | 4.0 08/18/97 J |
| 4.1a | 502224B6 | SCPH-7001, SCPH-7501, SCPH-7503, SCPH-9001 | 4.1 12/16/97 A |
| 4.1e | 318178BF | SCPH-7002, SCPH-7502, SCPH-9002 | 4.1 12/16/97 E |
| 4.3j | F2AF798B | SCPH-100 (PSone) | 4.3 03/11/00 J |
| 4.4e | 0BAD7EA9 | SCPH-102 (PSone) | 4.4 03/24/00 E |
| 4.5a | 171BDCEC | SCPH-101 (PSone) | 4.5 05/25/00 A |
| 4.5e | 76B880E5 | SCPH-102 (PSone) | 4.5 05/25/00 E |
| 5.0t | B7EF81A9 | SCPH-10000 (PlayStation 2) | 5.0 01/17/00 T |

The SCPH-1000 runs uncompressed boot menu code and shows the Sony Computer Entertainment intro. Later versions use self-decompressing code and show both the Sony Computer Entertainment and the PlayStation intro screens.[^spxver] In v4.1 and v4.5 the A and E regions use the same GUI code, and the last letter of the version string selects PAL or NTSC.[^spxver]

## Character Sets

The kernel ROM includes a 16 x 16 dot 2-value bitmap kanji font with a character size of 15 x 15 dots. It covers the JIS first standard kanji and non-kanji in Shift-JIS order. Because the font data is not stored consecutively, Krom2RawAdd() is used to obtain the start address of each character from its Shift-JIS code.[^lo220][^lr144] In each pattern the upper left byte comes first, followed by the upper right byte, and the most significant bit is on the left.[^lo221]

Krom2RawAdd() accepts Shift-JIS codes 0x8140 to 0x84BE and 0x889F to 0x9872. A code that falls on a blank area of the code table returns an unrelated pattern, and Sony therefore recommends Krom2RawAdd2(), which returns a space pattern in that case.[^lr144][^lr145] The character sets occupy 112K bytes of the ROM as shown below.[^spxcs]

Table: Character sets in ROM

| Address | Contents |
| --- | --- |
| 0xBFC64000 | Charset 1, 16 x 15 letters with accent marks (not in Japanese BIOS) |
| 0xBFC66000 | Charset 2, 16 x 15 alphabets and symbols (Shift-JIS 0x8140 to 0x84BE) |
| 0xBFC69D68 | Charset 3, 16 x 15 kanji (Shift-JIS 0x889F to 0x9872) |
| 0xBFC7F8DE | Charset 4, 8 x 15 ASCII characters 0x21 to 0x7E |
| 0xBFC7FE6F | Charset 5, 8 x 15 additional punctuation (not in PlayStation 2) |
| 0xBFC7FF32 | Version and copyright strings (not in SCPH-1000) |
| 0xBFC7FF8C | Charset 6, 8 x 15 Japanese characters (not in PlayStation 2) |

## References

[^hw23]: Sony Computer Entertainment Inc. PlayStation Hardware. August 1998. Page 2-3.
[^hw24]: Sony Computer Entertainment Inc. PlayStation Hardware. August 1998. Page 2-4, Table 2-2.
[^hw27]: Sony Computer Entertainment Inc. PlayStation Hardware. August 1998. Page 2-7, Figure 2-3.
[^os26]: Sony Computer Entertainment Inc. PlayStation Operating System. August 1998. Page 2-6, Table 2-3.
[^lo204]: Sony Computer Entertainment Inc. Run-Time Library Overview. January 1999. Page 2-4, Table 2-2.
[^lo207]: Sony Computer Entertainment Inc. Run-Time Library Overview. January 1999. Page 2-7.
[^lo209]: Sony Computer Entertainment Inc. Run-Time Library Overview. January 1999. Page 2-9.
[^lo220]: Sony Computer Entertainment Inc. Run-Time Library Overview. January 1999. Page 2-20, Table 2-30.
[^lo221]: Sony Computer Entertainment Inc. Run-Time Library Overview. January 1999. Page 2-21, Table 2-31.
[^lr138]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-38, GetSysSp.
[^lr144]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-44, Krom2RawAdd.
[^lr145]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-45, Krom2RawAdd2.
[^lr147]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-47, LoadExec.
[^lr154]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-54, OpenEvent.
[^lr178]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-78, _96_init.
[^spxover]: psx-spx. Kernel (BIOS), BIOS Overview. https://psx-spx.consoledev.net/kernelbios/
[^spxrom]: psx-spx. Kernel (BIOS), BIOS ROM Map and BIOS ROM Header/Footer. https://psx-spx.consoledev.net/kernelbios/
[^spxmap]: psx-spx. Kernel (BIOS), BIOS RAM Map and User Memory. https://psx-spx.consoledev.net/kernelbios/
[^spxgarb]: psx-spx. Kernel (BIOS), Garbage Area at Address 00000000h. https://psx-spx.consoledev.net/kernelbios/
[^spxtot]: psx-spx. Kernel (BIOS), Table of Tables. https://psx-spx.consoledev.net/kernelbios/
[^spxfn]: psx-spx. Kernel (BIOS), BIOS Function Summary. https://psx-spx.consoledev.net/kernelbios/
[^spxslow]: psx-spx. Kernel (BIOS), BIOS Memory Fill/Copy/Compare (SLOW). https://psx-spx.consoledev.net/kernelbios/
[^spxalloc]: psx-spx. Kernel (BIOS), BIOS Memory Allocation, Scratchpad Note. https://psx-spx.consoledev.net/kernelbios/
[^spxver]: psx-spx. Kernel (BIOS), BIOS Versions. https://psx-spx.consoledev.net/kernelbios/
[^spxcs]: psx-spx. Kernel (BIOS), BIOS Character Sets. https://psx-spx.consoledev.net/kernelbios/