I/O Map

Addresses of every hardware register of the PlayStation.

This is an old revision of this page, as edited by RemmyLee at 02:44, 23 October 2026. Edit this revision | Latest revision

Summary

The hardware registers of the PlayStation are mapped in segment X of the logical space, from 0x1F801000 to 0x1FBFFFFF, where the cache is not effective. Interface registers of the peripheral devices are mapped there as memory mapped I/O. Memory may be accessed in units of 1 to 4 bytes, but each interface register must be accessed in its own unit size, and any other size causes a bus error.¹²

The tables below list every register by address. psx-spx marks the names it has not found in Sony's code or documentation with a question mark, and this page keeps those marks.³

The I/O ports are also mirrored in KSEG1 at BF801000h, where the CPU write queue is bypassed. psx-spx therefore recommends the KSEG1 addresses for hardware with state machines such as the CD-ROM controller, although Sony's own code uses the KUSEG addresses and flushes the write queue with dummy writes.⁴

Expansion and Scratchpad

Table 1: DEV0 and scratchpad
Address	Size	Content
1F000000h	80000h	DEV0 expansion region (default 512 KB, max 8 MB)
1F000000h	100h	DEV0 expansion ROM header (IDs and entry points)
1F800000h	400h	Scratchpad (1 KB fast RAM; D-cache at a fixed address)

System Bus Interface

These registers set the base, size and timing of each bus device. The memory control page gives their bit layouts.³

Table 2: System bus interface registers
Address	Size	Name	Content
1F801000h	4	DEV0_ADDR?	DEV0 (PIO) base address
1F801004h	4	DEV8_ADDR?	DEV8 (debug) base address
1F801008h	4	DEV0_DELAY	DEV0 (PIO) delay and size
1F80100Ch	4	DEV1_DELAY	DEV1 (debug) delay and size
1F801010h	4	DEV2_DELAY	DEV2 (BIOS ROM) delay and size
1F801014h	4	DEV4_DELAY	DEV4 (SPU) delay and size
1F801018h	4	DEV5_DELAY	DEV5 (CD-ROM) delay and size
1F80101Ch	4	DEV8_DELAY	DEV8 (debug) delay and size
1F801020h	4	COM_DELAY	Common delay values
1F801060h	4/2	DRAM_CTRL?	RAM configuration

Peripheral I/O Ports

SIO0 serves the controllers and Memory Cards, and SIO1 serves the serial port.³

Table 3: Serial interface registers
Address	Size	Name	Content
1F801040h	1/4	SIO0_DR	Controller and Memory Card data (R/W)
1F801044h	4	SIO0_SR	Controller and Memory Card status (R)
1F801048h	2	SIO0_MR	Controller and Memory Card mode (R/W)
1F80104Ah	2	SIO0_CR	Controller and Memory Card control (R/W)
1F80104Eh	2	SIO0_BR	Controller and Memory Card baud rate (R/W)
1F801050h	1/4	SIO1_DR	Serial port data (R/W)
1F801054h	4	SIO1_SR	Serial port status (R)
1F801058h	2	SIO1_MR	Serial port mode (R/W)
1F80105Ah	2	SIO1_CR	Serial port control (R/W)
1F80105Ch	2	SIO1_?	Serial port internal register (R/W)
1F80105Eh	2	SIO1_BR	Serial port baud rate (R/W)

Interrupt Control

The interrupt controller page gives the bit layout of these two registers.³

Table 4: Interrupt control registers
Address	Size	Name	Content
1F801070h	2	I_STAT	Interrupt status (I_REG)
1F801074h	2	I_MASK	Interrupt mask

DMA Registers

Each of the 7 DMA channels has three registers in a 10h-byte block. The two control registers follow the last block.³

Table 5: DMA registers
Address	Size	Name	Content
1F801080h	4	D0_MADR	Channel 0 (MDECin) memory address (R/W)
1F801084h	4	D0_BCR	Channel 0 (MDECin) block count (R/W)
1F801088h	4	D0_CHCR	Channel 0 (MDECin) channel control (R/W)
1F801090h	12	D1_*	Channel 1 (MDECout)
1F8010A0h	12	D2_*	Channel 2 (GPU)
1F8010B0h	12	D3_*	Channel 3 (CD-ROM)
1F8010C0h	12	D4_*	Channel 4 (SPU)
1F8010D0h	12	D5_*	Channel 5 (PIO)
1F8010E0h	12	D6_*	Channel 6 (OTC)
1F8010F0h	4	DPCR	DMA priority control (D_PCR)
1F8010F4h	4	DICR	DMA interrupt control (D_ICR)
1F8010F8h	4		Unknown
1F8010FCh	4		Unknown

Timers

The three hardware root counters each have a 10h-byte block of registers.³

Table 6: Timer registers
Address	Size	Name	Content
1F801100h	2	T0_COUNT	Timer 0 (dot clock) current value (R/W)
1F801104h	2	T0_MODE	Timer 0 (dot clock) mode (R/W)
1F801108h	2	T0_COMP	Timer 0 (dot clock) target value (R/W)
1F801110h	12	T1_*	Timer 1 (H-blank)
1F801120h	12	T2_*	Timer 2 (system clock)

CD-ROM Registers

The CD-ROM controller has four byte-wide ports. The index in bits 0 and 1 of 1F801800h selects which register the other three ports reach, so the table gives each register as address, direction and index.³

Table 7: CD-ROM registers
Address	Access	Index	Name	Content
1F801800h	R	any	HSTS	Index and status register
1F801801h	R	any	RESULT	Response FIFO
1F801802h	R	any	RDDATA	Data FIFO
1F801803h	R	0	HINTMSK	Interrupt enable register
1F801803h	R	1	HINTSTS	Interrupt flag register
1F801800h	W	any	ADDRESS	Index register (bits 0 and 1)
1F801801h	W	0	COMMAND	Command register
1F801802h	W	0	PARAMETER	Parameter FIFO
1F801803h	W	0	HCHPCTL	Request register
1F801801h	W	1	WRDATA	Sound map data
1F801802h	W	1	HINTMSK	Interrupt enable register
1F801803h	W	1	HCLRCTL	Interrupt flag register
1F801801h	W	2	CI	Sound map coding info
1F801802h	W	2	ATV0	Volume, left CD out to left SPU in
1F801803h	W	2	ATV1	Volume, left CD out to right SPU in
1F801801h	W	3	ATV2	Volume, right CD out to right SPU in
1F801802h	W	3	ATV3	Volume, right CD out to left SPU in
1F801803h	W	3	ADPCTL	Apply volume changes (write bit 5 = 1)

GPU Registers

The GPU has two 32-bit ports. Each has a different function for reads and writes.³

Table 8: GPU registers
Address	Access	Name	Content
1F801810h	W	GP0	GP0 commands and packets (drawing and VRAM access)
1F801810h	R	GP0	Responses to GP0(C0h) and GP1(10h)
1F801814h	W	GP1	GP1 commands (display control)
1F801814h	R	GP1	GPU status register (GPUSTAT)

MDEC Registers

The MDEC also has two 32-bit ports. One carries commands and data and the other carries control and status.³

Table 9: MDEC registers
Address	Access	Name	Content
1F801820h	W	MDEC0	Command and parameter register
1F801820h	R	MDEC0	Data and response register
1F801824h	W	MDEC1	Control and reset register
1F801824h	R	MDEC1	Status register

SPU Registers

The SPU occupies 1F801C00h to 1F801FFFh. The first 180h bytes hold 8 registers for each of the 24 voices in 10h bytes per voice.³

Table 10: SPU voice registers (voice N = 0 to 23)
Address	Size	Name	Content
1F801C00h + 10h x N	2	VOLL	Volume left
1F801C02h + 10h x N	2	VOLR	Volume right
1F801C04h + 10h x N	2	PITCH	Sample rate
1F801C06h + 10h x N	2	SSA	Sample start address
1F801C08h + 10h x N	2	ADSR1	ADSR attack and decay
1F801C0Ah + 10h x N	2	ADSR2	ADSR sustain and release
1F801C0Ch + 10h x N	2	ENVX	ADSR current volume
1F801C0Eh + 10h x N	2	LSAX	Loop start address

The control registers follow at 1F801D80h. Key on, key off and the per-voice modes take two registers each, one for voices 0 to 15 and one for voices 16 to 23.³

Table 11: SPU control registers
Address	Size	Name	Content
1F801D80h	2	MVOLL	Main volume left
1F801D82h	2	MVOLR	Main volume right
1F801D84h	2	EVOLL	Reverb volume left
1F801D86h	2	EVOLR	Reverb volume right
1F801D88h	2	KON0	Key on, voices 0 to 15 (W)
1F801D8Ah	2	KON1	Key on, voices 16 to 23 (W)
1F801D8Ch	2	KOF0	Key off, voices 0 to 15 (W)
1F801D8Eh	2	KOF1	Key off, voices 16 to 23 (W)
1F801D90h	2	PMON0	Pitch modulation, voices 1 to 15 (R/W)
1F801D92h	2	PMON1	Pitch modulation, voices 16 to 23 (R/W)
1F801D94h	2	NON0	Noise mode, voices 0 to 15 (R/W)
1F801D96h	2	NON1	Noise mode, voices 16 to 23 (R/W)
1F801D98h	2	EON0	Reverb mode, voices 0 to 15 (R/W)
1F801D9Ah	2	EON1	Reverb mode, voices 16 to 23 (R/W)
1F801D9Ch	2	ENDX0	Voice status, voices 0 to 15 (R)
1F801D9Eh	2	ENDX1	Voice status, voices 16 to 23 (R)
1F801DA0h	2		Unused
1F801DA2h	2	ESA	Sound RAM reverb work area start address
1F801DA4h	2	IRQA	Sound RAM IRQ address
1F801DA6h	2	TSA	Sound RAM transfer start address
1F801DA8h	2	DATA?	Sound RAM data write FIFO
1F801DAAh	2	ATTR	SPU attribute register
1F801DACh	2	RAM_CTRL?	Sound RAM size control
1F801DAEh	2	STATX	SPU status register (R)
1F801DB0h	2	AVOLL	I2SA (CD-ROM) volume left
1F801DB2h	2	AVOLR	I2SA (CD-ROM) volume right
1F801DB4h	2	BVOLL	I2SB (PIO) volume left
1F801DB6h	2	BVOLR	I2SB (PIO) volume right
1F801DB8h	2	MVOLXL	Current main volume left
1F801DBAh	2	MVOLXR	Current main volume right
1F801DBCh	4		Unused (R/W)

The reverb configuration area holds the parameters of the reverb unit. All of its names are unofficial.³

Table 12: SPU reverb configuration area
Address	Size	Name	Content
1F801DC0h	2	dAPF1?	APF offset 1
1F801DC2h	2	dAPF2?	APF offset 2
1F801DC4h	2	vIIR?	Reflection volume 1
1F801DC6h	2	vCOMB1?	Comb volume 1
1F801DC8h	2	vCOMB2?	Comb volume 2
1F801DCAh	2	vCOMB3?	Comb volume 3
1F801DCCh	2	vCOMB4?	Comb volume 4
1F801DCEh	2	vWALL?	Reflection volume 2
1F801DD0h	2	vAPF1?	APF volume 1
1F801DD2h	2	vAPF2?	APF volume 2
1F801DD4h	4	mSAME?	Same side reflection address 1, left and right
1F801DD8h	4	mCOMB1?	Comb address 1, left and right
1F801DDCh	4	mCOMB2?	Comb address 2, left and right
1F801DE0h	4	dSAME?	Same side reflection address 2, left and right
1F801DE4h	4	mDIFF?	Different side reflection address 1, left and right
1F801DE8h	4	mCOMB3?	Comb address 3, left and right
1F801DECh	4	mCOMB4?	Comb address 4, left and right
1F801DF0h	4	dDIFF?	Different side reflection address 2, left and right
1F801DF4h	4	mAPF1?	APF address 1, left and right
1F801DF8h	4	mAPF2?	APF address 2, left and right
1F801DFCh	4	vIN?	Input volume, left and right

The internal registers report the current volume of each voice:³

Table 13: SPU internal registers
Address	Size	Name	Content
1F801E00h + 4h x N	2	VOLXL	Voice N current volume left
1F801E02h + 4h x N	2	VOLXR	Voice N current volume right
1F801E60h	20h		Unused (R/W)
1F801E80h	180h		Unused (reads FFh)

DEV8 Region

DEV8 is an 8-bit expansion region at 1F802000h, 128 bytes by default and 8 KB at most. psx-spx reports that a 16-bit access there may crash. It holds a dual serial port for a TTY debug terminal, the DTL-H2000 ports and the POST port that shows the BIOS boot status.³

Table 14: DEV8 dual serial port
Address	Access	Content
1F802020h	1st/2nd	DUART mode registers 1.A and 2.A (R/W)
1F802021h	R	DUART status register A
1F802021h	W	DUART clock select register A
1F802022h	R	DUART toggle baud rate generator test mode (strobe)
1F802022h	W	DUART command register A
1F802023h	R	DUART Rx holding register A (FIFO)
1F802023h	W	DUART Tx holding register A
1F802024h	R	DUART input port change register
1F802024h	W	DUART aux. control register
1F802025h	R	DUART interrupt status register
1F802025h	W	DUART interrupt mask register
1F802026h	R	DUART counter/timer current value, bits 15 to 8
1F802026h	W	DUART counter/timer reload value, bits 15 to 8
1F802027h	R	DUART counter/timer current value, bits 7 to 0
1F802027h	W	DUART counter/timer reload value, bits 7 to 0
1F802028h	1st/2nd	DUART mode registers 1.B and 2.B (R/W)
1F802029h	R	DUART status register B
1F802029h	W	DUART clock select register B
1F80202Ah	R	DUART toggle 1X/16X test mode (strobe)
1F80202Ah	W	DUART command register B
1F80202Bh	R	DUART Rx holding register B (FIFO)
1F80202Bh	W	DUART Tx holding register B
1F80202Ch		DUART reserved register
1F80202Dh	R	DUART input port
1F80202Dh	W	DUART output port configuration register
1F80202Eh	R	DUART start counter command (strobe)
1F80202Eh	W	DUART set output port bits (output low)
1F80202Fh	R	DUART stop counter command (strobe)
1F80202Fh	W	DUART reset output port bits (output high)

Table 15: DEV8 development and POST ports
Address	Size	Content
1F802000h	1	DTL-H2000: ATCONS STAT (R)
1F802002h	1	DTL-H2000: ATCONS DATA (R/W)
1F802004h	2	DTL-H2000: ATCONS DATA16 (R/W)
1F802030h	1/4	DTL-H2000: secondary IRQ10 flags
1F802032h	1	DTL-H2000: IRQ control
1F802040h	1	DTL-H2000: boot mode DIP switches (R)
1F802041h	1	POST: external 7-segment display of the BIOS boot status
1F802042h	1	DTL-H2000: POST/LED, 2 digits
1F802070h	1	POST2: used by the PlayStation 2 BIOS

DEV1 and BIOS Regions

DEV1 is 1 byte by default and 2 MB at most. Neither the BIOS nor any PlayStation game uses it, although the PlayStation 2 BIOS writes its POST3 code at 1FA00000h. The BIOS ROM region is 512 KB by default and 4 MB at most, and the reset entry point is at BFC00000h.³

Table 16: DEV1 and BIOS ROM
Address	Size	Content
1FA00000h		DEV1 (POST3 on the PlayStation 2)
1FC00000h	80000h	BIOS ROM (512 KB)

Cache Control and Coprocessors

The CW33300 core has one configuration register in KSEG2. This is BCC at FFFE0130h, and the memory control page describes it. The coprocessors are reached by coprocessor instructions instead of addresses. COP0 (System Control Coprocessor) has 32 registers and COP2 (GTE) has 64 registers, while COP1 and COP3 do not exist.³

Access Width

Most ports may be read in 8-bit, 16-bit or 32-bit units whatever their own size is. A 32-bit read of a 32-bit region that holds only one 16-bit port often returns garbage in the unused half.⁵

Writes behave differently. An 8-bit or 16-bit store puts all 32 bits of the source register on the bus, so a narrow store to a 32-bit port such as a DMA register writes the full register value. The Soundscope of the SCPH-7000 series relies on this when it writes the DMA registers with halfword stores.⁶

psx-spx gives the effect of each store size on each region as follows:⁷

Table 17: I/O write size behavior
Address	Content	8-bit write	16-bit write	32-bit write
00000000h to 00xFFFFFh	Main RAM	OK	OK	OK
1F800000h to 1F8003FFh	Scratchpad	OK	OK	OK
1F801000h to 1F801023h	Memory control	w32	w32	OK
1F80104xh	SIO0	w16	OK	Lower 16 bits
1F80105xh	SIO1	w16	OK	Lower 16 bits
1F801060h to 1F801063h	DRAM_CTRL	w32	w32	OK (crash when unaligned)
1F801070h to 1F801077h	Interrupt control	w32	w32	OK
1F8010x0h to 1F8010x3h	DMA address	w32	w32	OK
1F8010x4h to 1F8010x7h	DMA length	OK	OK	OK
1F8010x8h to 1F8010xFh	DMA control and mirror	w32	w32	OK
1F8010F0h to 1F8010F7h	DPCR and DICR	w32	w32	OK
1F8010F8h to 1F8010FFh	DMA unknown	Ignored	Ignored	Ignored
1F801100h to 1F80112Bh	Timers 0 to 2	w32	w32	OK
1F801800h to 1F801803h	CD-ROM	OK	Unknown	Unknown
1F801810h to 1F801817h	GPU	Unknown	Unknown	OK
1F801820h to 1F801827h	MDEC	Unknown	Unknown	OK
1F801C00h to 1F801E7Fh	SPU	i16	OK	OK
1F801E80h to 1F801FFFh	SPU unused	Ignored	Ignored	Ignored
1F802020h to 1F80202Fh	DUART	OK	Unknown	Unknown
1F802041h	POST	OK	Unknown	Unknown
FFFE0130h to FFFE0133h	Cache control	i32	i32	OK

In this table w32 writes the full 32 bits, shifted left when the address is not word aligned, and w16 does the same with 16 bits. i32 and i16 write the full width but are ignored at an unaligned address. 16-bit writes to DRAM_CTRL, I_STAT, I_MASK and the timer registers are therefore safe.⁷

Locked and Garbage Locations

The gaps in the I/O region are locked, and an access there raises an exception. The same holds in KSEG0 and KSEG1:⁸

Table 18: Locked regions
Address	Size	Condition
00800000h		When main RAM ends at 7FFFFFh
1F080000h	780000h	When DEV0 ends at 7FFFFh
1F800400h	C00h	After the scratchpad
1F801024h	1Ch	I/O gap
1F801064h	0Ch	I/O gap
1F801078h	08h	I/O gap
1F801140h	6C0h	I/O gap
1F801804h	0Ch	I/O gap
1F801818h	08h	I/O gap
1F801828h	3D8h	I/O gap
1F802080h	3FDF80h	When DEV8 ends at 7Fh
1FC80000h	60380000h	When the BIOS ROM ends at 7FFFFh
C0000000h	1FFE0000h	KSEG2 gap
FFFE0020h	E0h	KSEG2 gap
FFFE0140h	1FEC0h	KSEG2 gap

A few unused addresses inside the register blocks do not raise an exception. They hold nothing of use, and writes to them have no effect. Reads usually return zero, but the first byte of a 10h-byte block often returns the low 8 bits of its address.⁹

Table 19: Garbage locations
Address	Size	Area
1F801062h	2	Memory and interrupt control
1F801072h	2	Memory and interrupt control
1F801076h	2	Memory and interrupt control
1F801102h	2	Timer 0
1F801106h	2	Timer 0
1F80110Ah	6	Timer 0
1F801112h	2	Timer 1
1F801116h	2	Timer 1
1F80111Ah	6	Timer 1
1F801122h	2	Timer 2
1F801126h	2	Timer 2
1F80112Ah	22	Timer 2 and after
1F801820h	4	MDEC data out, when no data is ready
FFFE0000h	32	Cache control
FFFE0100h	48	Cache control
FFFE0132h	2	Upper half of BCC (write only)
FFFE0134h	12	Cache control

When BCC bit 11 is 0, reads from these garbage addresses return the next opcode to be executed instead.⁹

Legacy Names

Older documents and emulators use names from nocash's original psx-spx. The current psx-spx replaces them with the official names below:¹⁰

Table 20: Legacy register names
Legacy name	Current name
EXP1 (Expansion 1)	DEV0
EXP2 (Expansion 2)	DEV8
EXP3 (Expansion 3)	DEV1
JOY_TX_DATA, JOY_RX_DATA	SIO0_DR
JOY_STAT	SIO0_SR
JOY_MODE	SIO0_MR
JOY_CTRL	SIO0_CR
JOY_BAUD	SIO0_BR
SIO_TX_DATA, SIO_RX_DATA	SIO1_DR
SIO_STAT	SIO1_SR
SIO_MODE	SIO1_MR
SIO_CTRL	SIO1_CR
SIO_MISC	SIO1_?
SIO_BAUD	SIO1_BR
GPUREAD	GP0
GPUSTAT	GP1 (the BIOS calls it GP1 when reading)
SPUCNT	ATTR
SPUSTAT	STATX
DTC (Data Transfer Control)	RAM_CTRL?
Reverb mBASE	ESA
Reverb vLOUT, vROUT	EVOLL, EVOLR

References

^ Sony Computer Entertainment Inc. PlayStation Hardware. August 1998. Page 2-4, Table 2-2.
^ Sony Computer Entertainment Inc. PlayStation Operating System. August 1998. Page 2-5.
^ ^a ^b ^c ^d ^e ^f ^g ^h ⁱ ^j ^k ^l ^m ⁿ ^o ^p psx-spx. I/O Map. https://psx-spx.consoledev.net/iomap/
^ psx-spx. Memory Map, Write queue. https://psx-spx.consoledev.net/memorymap/
^ psx-spx. Unpredictable Things, I/O Read Datasize. https://psx-spx.consoledev.net/unpredictablethings/
^ psx-spx. Unpredictable Things, I/O Write Datasize (8-bit and 16-bit stores). https://psx-spx.consoledev.net/unpredictablethings/
^ ^a ^b psx-spx. Unpredictable Things, I/O Write Datasize. https://psx-spx.consoledev.net/unpredictablethings/
^ psx-spx. Unpredictable Things, Locked Locations in Memory and I/O Area. https://psx-spx.consoledev.net/unpredictablethings/
^ ^a ^b psx-spx. Unpredictable Things, Garbage Locations in I/O Area. https://psx-spx.consoledev.net/unpredictablethings/
^ psx-spx. I/O Map, Legacy names from outdated documentation. https://psx-spx.consoledev.net/iomap/

Categories: Hardware