BIOS

512KB OS ROM that holds the PlayStation kernel, boot loader, shell and fonts.

This is an old revision of this page, as edited by RemmyLee at 02:45, 23 October 2026. Edit this revision | Latest revision

Overview

The PlayStation has a 512KB OS ROM, which stores the OS kernel and the boot loader. Sony prohibits direct access to the ROM and does not disclose its internal addresses.¹ The ROM is mapped at 0x1FC00000 to 0x1FC7FFFF in segments P, Q and R, and the CPU starts executing at 0xBFC00000 immediately after power on reset.²³ The kernel in the ROM is the PS-X OS, and its services are called through the A, B and C function tables and the syscall instruction described below.

Programmers know the ROM as the BIOS. Besides the kernel it holds the intro screens, the boot menu that appears when no disc is inserted, and the character sets used by Krom2RawAdd().⁴⁵ The boot menu plays audio CDs and copies and erases saved games on Memory Cards.⁴

The ROM has an 8-bit data bus, so it is slow to execute from. For this reason part of the kernel is copied into the first 64K bytes of main memory at boot. The original BIOS nevertheless runs most of its functions from uncached ROM, and a call such as memcpy() takes about 160 cycles per byte.⁴⁶

ROM Map

The 512KB ROM is divided as shown below.⁷

The kernel header near the start of the ROM identifies the build.⁷

Kernel Memory

The kernel uses the first 64K bytes of main memory, and the addresses available to the user begin at 0x00010000.⁸ The fixed locations in that area are shown below.⁹

A few early games read address 0 through uninitialized pointers. They therefore depend on the leftover bytes there, which are a copy of the 16-byte exception handler with the first word overwritten by 0x00000003.¹⁰

The kernel keeps a 4K interrupt stack for event handlers in its reserved area. GetSysSp() returns the highest address of this stack.¹¹¹² The Run-Time Library Reference gives the size of this stack as 2K bytes.¹² The kernel does not allocate or use the scratchpad at 0x1F800000 to 0x1F8003FF, so a program may use all 1K bytes of it.¹³

Table of Tables

The kernel represents its system tables with the structure ToT (Table of Tables) at address 0x00000100. Each entry holds the start address and the size in bytes of one table, so a program can reach every table in the same way.¹⁴ The entries are shown below with the names used by Sony and by psx-spx.

The sources for this table are the Run-Time Library Overview, the PlayStation Operating System manual, and psx-spx.¹⁴¹⁵¹⁶ Sony lists entries 5 to 31 as system reserved, while psx-spx finds the file and device control blocks at entries 8 and 10.

A file descriptor fd converts to its FCB as [0x140] + fd * 0x2C, and an event descriptor converts to its EvCB as [0x120] + (event AND 0xFFFF) * 0x1C.¹⁶

Calling the BIOS

Kernel services are reached through three function vectors and the syscall instruction. A caller loads the function number into R9 and jumps to 0xA0, 0xB0 or 0xC0. The syscall functions instead take their number in R4.¹⁷ The function tables are listed on separate pages:

• A functions: file I/O, standard C functions, executable loading, GPU, CD-ROM and Memory Card helpers.
• B functions: timers, events, threads, controllers, exceptions, file system and devices.
• C functions: interrupt chains, kernel setup and device internals.
• Syscalls and breaks: critical sections and the PC file server.

Arguments are passed in R4 to R7 and then on the stack from [SP+0x10] up. The caller must reserve one stack word for every argument, including the first four, because the called function may use those words. The return value is in R2.¹⁷ A BIOS function or callback may destroy R1 to R15, R24, R25, R31 and HI/LO, but must preserve R16 to R23, SP and FP. R26 (K0) is reserved for the exception handler.¹⁷

Sony's kernel library libapi gives applications a C interface to the same services. Its reference documents many functions under the same names, such as OpenEvent(), LoadExec() and _96_init().¹⁸¹⁹²⁰

Related Pages

• Events: event classes, types, modes and control blocks.
• Threads: TCB layout and thread switching.
• File I/O: devices and the CD-ROM and Memory Card file functions.
• Boot: boot sequence, license check and executable loading.

Kernel Versions

The kernel was changed only a few times. Most consoles have the kernel dated 4 December 1995 with no PAL or NTSC differences.²¹ The date and version string can be read with GetSystemInfo().²¹

The CEX-7000 kernel differs from the 1995 kernel mainly in its first instruction, which sets the BIOS ROM size in port 0x1F801010 to 1MB instead of 512KB.²¹

Boot Menu Versions

The intro and boot menu part of the ROM was updated more often than the kernel. It is customized for PAL or NTSC display, for language, and for the region check.²¹ Games communicate only with the kernel, so the differences in this part have little effect on compatibility.²¹ The known versions are shown below.²¹

The SCPH-1000 runs uncompressed boot menu code and shows the Sony Computer Entertainment intro. Later versions use self-decompressing code and show both the Sony Computer Entertainment and the PlayStation intro screens.²¹ In v4.1 and v4.5 the A and E regions use the same GUI code, and the last letter of the version string selects PAL or NTSC.²¹

Character Sets

The kernel ROM includes a 16 x 16 dot 2-value bitmap kanji font with a character size of 15 x 15 dots. It covers the JIS first standard kanji and non-kanji in Shift-JIS order. Because the font data is not stored consecutively, Krom2RawAdd() is used to obtain the start address of each character from its Shift-JIS code.²²²³ In each pattern the upper left byte comes first, followed by the upper right byte, and the most significant bit is on the left.²⁴

Krom2RawAdd() accepts Shift-JIS codes 0x8140 to 0x84BE and 0x889F to 0x9872. A code that falls on a blank area of the code table returns an unrelated pattern, and Sony therefore recommends Krom2RawAdd2(), which returns a space pattern in that case.²³²⁵ The character sets occupy 112K bytes of the ROM as shown below.⁵

References