System Control Coprocessor (COP0)

Coprocessor 0 registers for exceptions, interrupts, cache isolation and breakpoints.

This is an old revision of this page, as edited by RemmyLee at 02:44, 23 October 2026. Edit this revision | Latest revision

Summary

COP0 is the section of the R3000 that handles errors and interrupts. When an external interrupt or an error other than a debug error occurs, the content of the program counter is saved to the EPC register of COP0 and the processor jumps to 0x00000080.¹

The PlayStation has no TLB, so the virtual memory registers of other MIPS processors are absent. COP0 keeps the exception registers, the status register, a revision register and a set of debug registers. They are read with MFC0 and written with MTC0, and the RFE instruction is the only COP0 command.²³⁴⁵

Reading cop0r0 to r2, r4, r10 or any control register causes a reserved instruction exception (excode 0Ah). The TLB commands TLBR, TLBWI, TLBWR and TLBP cause the same exception. The conditional COP0 branches and the COP0 load and store instructions instead cause a coprocessor unusable exception (excode 0Bh).⁵

Exceptions

An exception is raised when an error such as a bus error or a reserved instruction is detected. It triggers a jump to 0x00000080 in the same way as a device interrupt, but unlike a device interrupt it cannot be masked. Sony's manual lists the following exception categories:⁶

Exception Vectors

The BEV bit of SR selects the exception vectors. The PlayStation uses only the BEV=0 vectors, and apart from the reset vector the BIOS ROM contains none of the BEV=1 vectors. Sony's manuals give the general vector as 0x00000080 and psx-spx as 80000080h. KUSEG is a mirror of KSEG0, so both addresses reach the same memory.⁷⁸

psx-spx reports that a change to the vectors at 800000xxh was sometimes seen by the I-cache without a flush, but not always. A change at the KUSEG mirror 000000xxh needs a flush, and flushing after any change to the vector code is the safe course.⁷

Exception Priority

When several exceptions occur at once the highest one is taken. psx-spx gives this order from highest to lowest:⁹

cop0r13 - CAUSE - Exception Cause

CAUSE describes the most recent exception. It is read only, except that the two software interrupt bits can be written.¹⁰

A pending interrupt bit causes an interrupt while the matching mask bit in SR is set. On the PlayStation only IP bit 10 is wired to the interrupt controller. Software sets bits 8 and 9 to request an exception and must clear them before it returns from the handler.¹⁰¹¹

An address error is raised by a misaligned address and by an access outside KUSEG in user mode.¹⁰

cop0r12 - SR - Status Register

SR holds the interrupt enable and kernel mode bits as a three-level stack, the interrupt mask, the cache isolation bits and the coprocessor enables:¹²

With IsC set, loads and stores reach the cache instead of main memory. Which part of the I-cache they reach depends on the BCC register at FFFE0130h. With TAG and IS1 set the stores write the tag memory, and with IS1 alone they write the code words. The kernel flushes the I-cache this way, as the memory control page shows.¹²

The COP2 enable bit takes effect after a delay of about 2 cycles. It is the only COP0 write with a known delay.¹³

cop0r14 - EPC - Exception Program Counter

EPC holds the address at which the exception occurred. When BD in CAUSE is set the exception occurred in a branch delay slot, and EPC then holds the address of the branch instead. That address is 4 less than the address of the faulting instruction.¹⁴

An interrupt handler should always return to EPC+0 whatever the value of BD is. If BD is set, the branch then executes again, which is needed because EPC does not store the branch destination. Other exceptions may need BD handled, and when BD is 0 the handler may return to EPC+0 to retry the instruction or EPC+4 to skip it.¹⁴

A jump to an invalid address executes without an exception. The error is raised at the target, so EPC (and BadA for an address error) points to the faulty address rather than to the jump.¹⁴

Interrupts and GTE Commands

When an interrupt occurs on a GTE command, the command is executed but EPC still points to it. A handler that returns to EPC would therefore execute the command twice, and the second run can give a wrong result if it reuses the first run's output as input. The handler must skip the command:¹⁵

if (cause AND 7Ch)=00h                ;if excode=interrupt
 if ([epc] AND FE000000h)=4A000000h   ;and opcode=cop2cmd
  epc=epc+4                           ;then skip that opcode

Only newer BIOS versions do this completely, and the fix does not work in a branch delay slot. The safe course is therefore to keep GTE commands out of branch delay slots. The Crash Bandicoot games, Jinx and Spyro the Dragon draw broken geometry when the interrupt handler does not skip the command.¹⁵

RFE - Return From Exception

RFE (COP0 command 10h) pops the interrupt enable and mode stack of SR. It copies bits 2 and 3 to bits 0 and 1 and bits 4 and 5 to bits 2 and 3, and leaves bits 4 and 5 unchanged.¹⁶

RFE does not jump. The handler copies EPC to a general register, normally K0, jumps to it and executes RFE in the branch delay slot of that jump. No register can survive this, because K0 holds the return address. A handler that expects nested exceptions also saves EPC and SR in memory.¹⁶

mfc0 k0, epc   ;get return address
...            ;handle the exception
jr   k0        ;jump to K0 after the next opcode
rfe            ;restore SR bits 0 to 5

cop0r8 - BadA - Bad Address

BadA holds the address whose reference caused an address error. It is updated only by address errors (excode 04h and 05h), and every other exception, bus errors included, leaves it unchanged.¹⁷

cop0r6 - TAR - Target Address

When an exception occurs in the delay slot of a branch or jump that is taken (CAUSE bits 31 and 30 both set), TAR holds the destination of the branch.¹⁸

cop0r15 - PRID - Processor Revision

Bits 0 to 7 hold the revision and bits 8 to 15 the implementation. On a PlayStation with the CXD8606CQ CPU PRID reads 00000002h.¹⁹

cop0r16 to r31 - Garbage

These registers return garbage without raising an exception. A read shortly after reading a valid register usually returns that register's value, while later reads return values such as 00000020h, 00000040h or 00000100h. They can be read even in user mode with COP0 disabled, where every other COP0 access raises a coprocessor unusable exception.²⁰

Debug Registers

The debug registers come from the LSI LR33300 family and are described in chapter 14 of the L64360 datasheet and chapter 4 of the LR33300/LR33310 datasheet. Ordinary R30xx CPUs such as the IDT R3041 and R3051 do not have them.²¹

cop0r7 - DCIC - Debug and Cache Invalidate Control

On a breakpoint match the CPU jumps to 80000040h instead of 80000080h. CAUSE then holds excode 09h as for a BREAK instruction, and EPC holds the return address. The handler at 80000040h must disable the breakpoints before it jumps to the actual exception handler, and a trace break in particular must be disabled first.²¹

Breakpoint Address Registers

BPC (cop0r3) and BPCM (cop0r11) set the program counter breakpoint, which fires when ((PC XOR BPC) AND BPCM) is 0. BDA (cop0r5) and BDAM (cop0r9) set the data breakpoint, which fires when ((addr XOR BDA) AND BDAM) is 0.²¹

A BREAK instruction patched into the code gives further breakpoints. It sets the same excode 09h but goes to the normal handler at 80000080h.²¹

Jump Redirection

With DCIC bits 12 to 13 nonzero the CPU watches for a load of a register followed by a jump or call through that register. On that sequence it sets PC to the word at 00000000h and stores nothing useful in COP0, not even EPC. psx-spx therefore considers jump redirection close to unusable.²¹

Other Uses

Legacy of Kain: Soul Reaver stores LibCrypt copy protection values in the debug registers as a hidden location. Cheat devices use COP0 breaks as a hook during boot, because the expansion ROM header has only pre-boot and post-boot entry points. Older cheat firmware breaks at BFC06xxxh in the BIOS ROM and later firmware at 80030000h in RAM.²¹

References