Hardware Debug

The PSP has an on-board debugging facilities which allows for hardware breakpoints and single-stepping. The debugging interface and facilities seem similar to the one in the NEC MIPS-IV 64bit Processor: VR5432.

Enabling debugging

Even though the debug facilities seems similar to that of the VR5432 the format of the Status Register is different. Notably Bit 24 of the VR5432 Status Register (DME: Debug Mode Enable) is the one needed to be set to enable debug mode while in the PSP Allegrex it is Bit 19.

In the Allegrex User Manual accompanying the official PSP SDK 6.60 Bit 19 is documented to have a value of 0 (meaning reserved) but it is a separate field from Bit 18-16 which is also reserved. If bits 19 to 16 are reserved then they could haved just bundled those together as one reserved field but they didn't. This could mean Bit 19 is a secret field documented only in the internal version of the Allegrex User Manual (which it is). In the MIPS32/64 Specifications Bit 19 when set dictates that an NMI occured.

Debug Mode

Once debug mode is enabled executing a DBREAK instruction causes a Debug Break Exception and control flows to the Debug Vector Address 0xBFC01000 and enters Debug Mode. NMI and Interrupts are ignored in Debug Mode and documented in the VR5432 only Load/Store exceptions are allowed in this mode, causing other exceptions is undefined behavior. To return to the program and exit Debug Mode execute a DRET instruction. You can interface with the debug registers via the MTDR and MFDR instructions. These register are used to set hardware breakpoints, enable single-stepping, etc. If Bit 19 was cleared these instructions would have caused a Reserved Instruction Exception instead.

Debug Vector and Debug Registers

For more information about the Debug Vector and Debug Registers check out Yet Another PSP Documentation at https://hitmen-console.org . They also have link to VR5432 Manual (Volume II) which contatins information about debug mode.

Debug Vector in the PSP-3000 Series

The hitmen-console documentation did not state any reference where they got contents of the Debug Vector and the program https://github.com/pspdev/psplinkusb seems to initialize 0xBFC01000 rather than leaving it alone. The program initializes it with what specified in the document.

In the PSP-3000 the Debug Vector on every power up is initialized with this pattern for every 0x100 bytes upto 0xBFC01FFF:

   beqz v0, <random address beyond this point>
   xori zero, t8, 0x1500
   <random>
   <random>
   nop
   nop
   ...

Example:

address 0xBFC01000:

   beqz v0, 0xBFC01004
   xori zero, t8, 0x1500
   <random>
   <random>
   nop
   nop
   ...

address 0xBFC011F8:

   nop
   nop

address 0xBFC01100:

   beqz v0, 0xBFC01104
   xori zero, t8, 0x1500
   <random>
   <random>
   nop
   nop
   ...

The 2 random "instructions" are the same throughout. The instructions need not be any valid instruction.