CPU Instruction Set

Encoding, operation and timing of every R3000A instruction on the PlayStation.

Summary

The PlayStation CPU executes the R3000A instruction set. Every instruction is one 32-bit word, and bits 26 to 31 hold the primary opcode. Primary opcode 00h (SPECIAL) uses bits 0 to 5 as a secondary opcode, and primary opcode 01h (BcondZ) uses bits 16 to 20 to choose the branch condition.¹

An opcode marked N/A in the tables below causes a reserved instruction exception (excode 0Ah). Unused operand bits, such as bits 21 to 25 of LUI, should be zero, but setting them does not necessarily cause an exception.²

Registers

The CPU has 32 general-purpose registers of 32 bits, a program counter and the HI and LO registers that receive multiply and divide results. R0 always reads 0. The compiler assigns each register a use, and assembler code that works with compiled code must follow the same assignment. The CPU page lists the assignments in Sony's table.³⁴

R31 (RA) is an ordinary register, but JAL, BLTZAL and BGEZAL write their return address there. JALR may write its return address to any register from R1 to R30 instead, and exceptions store theirs in the COP0 EPC register.⁴

Instruction Encoding

The fields of an instruction word are as follows:¹

Primary Opcodes

Secondary Opcodes

Instruction Formats

Each group of instructions places its operands as shown below:¹

Load and Store Instructions

Loads and stores address memory as rs plus a sign-extended 16-bit offset. A load that faults leaves rt unchanged.⁵

Alignment

The R3000 requires strict address alignment. Word data must start at a multiple of 4 and halfword data at a multiple of 2, and a data load, data store or instruction fetch that breaks this rule causes an address error. Bytes have no alignment restriction.³⁵

Load Delay

The loaded data is not available to the next instruction, because the target register is updated only after that instruction completes. If the next instruction reads the target register it usually receives the old value. However, if an interrupt occurs between the two instructions, the load completes during the interrupt and the next instruction receives the new value.⁶

Reads from coprocessor registers with MFC2 and CFC2 have the same 1-instruction delay.⁶

Stores and the Write Queue

A store enters the 4-word write queue and completes in one cycle unless the queue is full, in which case the CPU waits for a free entry. During an 8-bit or 16-bit store all 32 bits of the source register are placed on the bus. A narrow store to a 32-bit I/O register therefore writes the full register value.⁷

Unaligned Access

LWL, LWR, SWL and SWR access a word at any address. LWR and SWR transfer the low bytes of rt up to the next word boundary, and LWL and SWL transfer the high bytes down to the previous boundary. The bytes not transferred stay unchanged in both rt and memory, so a pair of instructions covers a whole unaligned word.⁸

LWL and LWR need no delay between them, even though both write the same register. The load delay applies only after the second of the two:⁸

lwl   r2,$0003(t0)   ;no delay required between these
lwr   r2,$0000(t0)   ;although both access r2
nop                  ;load delay before reading r2
and   r2,r2,0ffffh   ;r2 now holds the unaligned data

ALU Instructions

ADD, SUB and ADDI trap on signed overflow and leave the destination unchanged. The other arithmetic instructions never trap, and the shift instructions do not raise exceptions on overflow either.⁹

SLTIU sign-extends its immediate and then compares without sign. Its immediate therefore covers 0 to 7FFFh and FFFF8000h to FFFFFFFFh.⁹

The logical instructions with an immediate zero-extend it:⁹

Unlike most instructions, the shifts take rt as their second operand rather than their third. A variable shift uses only the low 5 bits of rs.⁹

Multiply and Divide

The multiply and divide instructions write their result to HI and LO. Starting the operation takes one cycle, and the CPU continues with the next instructions while the unit works. A read of HI or LO before the operation is complete halts the CPU until the result is ready.¹⁰

A multiply takes longer as rs grows. A small value in rs times a large value in rt is therefore faster than the reverse. A divide always takes 36 cycles:¹⁰

For example, up to six cached ALU instructions, or one read from main RAM with its 6-cycle access time, fit between MULTU 123h,12345678h and MFLO without slowing the program.¹⁰

A divide never raises an exception. A division by zero or the overflow of -80000000h / -1 gives the following results:¹⁰

psx-spx also notes an unconfirmed rule that HI and LO should not be touched in the 2 cycles after they are accessed.¹⁰

Jump and Branch Instructions

The instruction after a jump or branch, the branch delay slot, is always executed. A branch adds its sign-extended offset times 4 to the address of the delay slot, while J and JAL replace the low 28 bits of the program counter.¹¹

BLTZAL and BGEZAL write RA whether or not the branch is taken. When rs is RA, they compare the value RA held before the link.¹¹

JR and JALR may jump to an unaligned address. The address error (AdEL) is then raised on the next instruction fetch.¹¹

JALR Cautions

Assemblers differ in their JALR syntax: the IDT79R3041 manual writes "jalr rs,rd" and the MIPS32 manual "jalr rd,rs". JALR must not use one register for both operands (for example "jalr r31,r31").¹²

The reason is the delay slot. If an interrupt occurs between JALR and its delay slot, BD is set and EPC points back to the JALR. The JALR therefore executes a second time, and by then its target register has been overwritten with the return address.¹²

Exception Instructions

SYSCALL raises a system call exception and BREAK raises a breakpoint exception. Unlike jumps and branches they take effect at once, and the next instruction is not executed. The CPU ignores the 20-bit field in bits 6 to 25. The exception handler may read the field from the instruction word.¹³

The COP0 page describes exception handling.

Coprocessor Instructions

The coprocessor instructions move data to and from the data and control registers of a coprocessor and send it commands. On the PlayStation they reach COP0 and COP2 (the GTE), since COP1 and COP3 do not exist.¹⁴¹⁵

COP0 accepts only the RFE command. The TLB commands TLBR, TLBWI, TLBWR and TLBP (COP0 commands 01h, 02h, 06h and 08h) cause a reserved instruction exception.¹⁴¹⁶

Coprocessor Load and Store Delays

A read from a coprocessor register has the same 1-instruction load delay as a read from memory. Some documents give the delay as two instructions, but the PlayStation completes both COP0 and COP2 reads after one.¹⁴

Writes to COP0 take effect at once, apart from the COP2 enable bit in SR bit 30, which takes about 2 cycles. Writes to COP2 registers take 2 to 3 cycles, the 3-cycle case being IRGB because it also changes IR1 to IR3. These delays are counted in clock cycles. A 3-cycle delay therefore needs 3 cached instructions or one uncached instruction.¹⁴

Pseudo Instructions

Assemblers provide pseudo instructions that expand to one or more real instructions. Some of them use R1 (AT) as a scratch register, so code that uses R1 must be sure its assembler does not change it behind its back. Sony's register table also reserves AT for the assembler, and C code may not use it.¹⁷¹⁸

Stack Convention

The CPU has no stack instructions. By convention R29 (SP) is the stack pointer, and the compiler stores the head address of the function frame in FP.¹⁹²⁰

The BIOS uses a full decrementing stack with wasted argument space. SP is decremented to allocate, and it points to the lowest allocated word. A caller that passes N arguments reserves N words at SP+0 upward, and the called function may use and destroy them. For example, a function that saves RA, R16 and R17 subtracts 20h from SP and stores RA at SP+14h, R16 at SP+18h and R17 at SP+1Ch. The 20h bytes are then used as follows:²⁰

References