PS-X EXE File Format – Memory map and registers

The addresses a PlayStation program uses

Introduction

A PlayStation program is full of constants such as lui $t0, 0x1F80 followed by a load or store of an offset such as 0x1070: that is the interrupt status register at $1F801070. This page gives the map and the names the explorer puts in the notes of the disassembly. Names and addresses are those of the Nocash PSX-SPX “Memory Map” and “I/O Map” tables; the one-line roles are written here from the names.

Segments

The same memory appears at three addresses (the processor has no TLB):

SegmentAddressesPhysical addressUse
KUSEG$00000000–$7FFFFFFFthe addressthe user segment (the PlayStation maps only the low part)
KSEG0$80000000–$9FFFFFFFaddress − $80000000cached; where programs run
KSEG1$A0000000–$BFFFFFFFaddress − $A0000000uncached; used for hardware registers and the BIOS ROM
KSEG2$C0000000 and up—the cache control register at $FFFE0130

Memory map

KUSEGKSEG0KSEG1SizeWhat is there
$00000000$80000000$A00000002 MiBMain RAM; the first 64 KiB are reserved for the BIOS; mirrored across the first 8 MiB by default.
$1F000000$9F000000$BF0000008 MiBExpansion region 1 (ROM or RAM on the expansion port).
$1F800000$9F800000—1 KiBScratchpad (fast data cache RAM).
$1F801000$9F801000$BF8010008 KiBI/O ports.
$1F802000$9F802000$BF8020008 KiBExpansion region 2 (I/O of the expansion port).
$1FA00000$9FA00000$BFA000002 MiBExpansion region 3.
$1FC00000$9FC00000$BFC00000512 KiBBIOS ROM (up to 4 MiB).

Registers the viewer names

Addresses are the physical ones; the viewer names the same register through KUSEG, KSEG0 and KSEG1. “Meaning” is a short role from the register’s name; the bit fields are not described.

AddressNameMeaning
$1F801000EXP1_BASEExpansion 1 base address
$1F801004EXP2_BASEExpansion 2 base address
$1F801008EXP1_DELAYExpansion 1 delay and size
$1F80100CEXP3_DELAYExpansion 3 delay and size
$1F801010BIOS_DELAYBIOS ROM delay and size
$1F801014SPU_DELAYSPU delay and size
$1F801018CDROM_DELAYCD-ROM delay and size
$1F80101CEXP2_DELAYExpansion 2 delay and size
$1F801020COM_DELAYCommon delay
$1F801040JOY_DATAJoypad and memory card data
$1F801044JOY_STATJoypad and memory card status
$1F801048JOY_MODEJoypad and memory card mode
$1F80104AJOY_CTRLJoypad and memory card control
$1F80104EJOY_BAUDJoypad and memory card baud rate
$1F801050SIO_DATASerial port data
$1F801054SIO_STATSerial port status
$1F801058SIO_MODESerial port mode
$1F80105ASIO_CTRLSerial port control
$1F80105CSIO_MISCSerial port miscellaneous
$1F80105ESIO_BAUDSerial port baud rate
$1F801060RAM_SIZERAM size configuration
$1F801070I_STATInterrupt status (bits cleared by writing 0)
$1F801074I_MASKInterrupt mask
$1F801080–$1F8010EFDMAn_MADR, _BCR, _CHCRSeven DMA channels of 16 bytes: base address, block control and channel control at +0, +4 and +8. Channels: 0 MDEC in, 1 MDEC out, 2 GPU, 3 CD-ROM, 4 SPU, 5 expansion port (PIO), 6 OTC (clears an ordering table)
$1F8010F0DPCRDMA control register
$1F8010F4DICRDMA interrupt register
$1F801100TIMER0_COUNTTimer 0 current counter value
$1F801104TIMER0_MODETimer 0 counter mode
$1F801108TIMER0_TARGETTimer 0 counter target value
$1F801110TIMER1_COUNTTimer 1 current counter value
$1F801114TIMER1_MODETimer 1 counter mode
$1F801118TIMER1_TARGETTimer 1 counter target value
$1F801120TIMER2_COUNTTimer 2 current counter value
$1F801124TIMER2_MODETimer 2 counter mode
$1F801128TIMER2_TARGETTimer 2 counter target value
$1F801800CD_INDEX_STATUSCD-ROM index and status
$1F801801CD_RESPONSE_COMMANDCD-ROM response FIFO (read) or command (write)
$1F801802CD_DATA_PARAMETERCD-ROM data FIFO (read) or parameter FIFO (write)
$1F801803CD_IRQ_REQUESTCD-ROM interrupt enable (read) or request (write)
$1F801810GP0GPU drawing and data port (write), GPUREAD (read)
$1F801814GP1GPU control port (write), GPUSTAT (read)
$1F801820MDEC_COMMANDMDEC command or parameter (write), data or response (read)
$1F801824MDEC_CONTROLMDEC control or reset (write), status (read)
$1F801C00–$1F801D7FSPU_Vn_VOL_L, _VOL_R, _PITCH, _START, _ADSR_LO, _ADSR_HI, _CUR_VOL, _REPEATThe 24 SPU voices, 16 bytes each: volume left and right, ADPCM sample rate, ADPCM start address, ADSR (two halves), current volume, ADPCM repeat address
$1F801D80SPU_MAIN_VOL_LSPU main volume left
$1F801D82SPU_MAIN_VOL_RSPU main volume right
$1F801D84SPU_REVERB_VOLSPU reverb output volume left and right
$1F801D88SPU_KEY_ONSPU voices 0-23 key on (start attack, decay, sustain)
$1F801D8CSPU_KEY_OFFSPU voices 0-23 key off (start release)
$1F801D90SPU_FM_MODESPU voices 0-23 frequency modulation mode
$1F801D94SPU_NOISE_MODESPU voices 0-23 noise mode
$1F801D98SPU_REVERB_MODESPU voices 0-23 reverb mode
$1F801D9CSPU_VOICE_STATUSSPU voices 0-23 on or off status
$1F801DA2SPU_REVERB_STARTSPU sound RAM reverb work area start
$1F801DA4SPU_IRQ_ADDRSPU sound RAM interrupt address
$1F801DA6SPU_TRANSFER_ADDRSPU sound RAM data transfer address
$1F801DA8SPU_TRANSFER_FIFOSPU sound RAM data transfer FIFO
$1F801DAASPUCNTSPU control register
$1F801DACSPU_TRANSFER_CTRLSPU sound RAM data transfer control
$1F801DAESPUSTATSPU status register
$1F801DB0SPU_CD_VOLSPU CD volume left and right
$1F801DB4SPU_EXT_VOLSPU external volume left and right
$1F801DB8SPU_CURRENT_VOLSPU current main volume left and right
$1F802020DUARTExpansion 2 DUART (debug TTY), $1F802020–$1F80202F
$1F802040DIP_POSTExpansion 2 DIP switches and POST, $1F802040–$1F802042
$FFFE0130CACHE_CONTROLCache control (KSEG2)

The names are the ones the explorer uses in the notes; they are not Sony’s. The DMA channel register names (MADR, BCR, CHCR) and the order within a channel are the usual ones; the I/O map the names are taken from lists the channels only by their 16-byte blocks.

How the viewer finds a register

The explorer looks back up to 16 instructions from a load, a store, an ori or an addiu for the lui that set the base register (lui $t0, 0x1F80 or 0xBF80), adds the offsets it can see and names the address when it is on the list. It stops at a jump and does not follow branches, so the note is a guess about the value at run time, marked “from the LUI above”; it never changes the instruction text.

Not described

Known, not yet covered

  • Reference: the bit fields of every register, the GPU command set, the CD-ROM commands, the SPU reverb registers ($1F801DC0 and up) and internal registers ($1F801E00 and up), the exception vectors and the BIOS memory allocation.

Links

Reference