Tachyon: Difference between revisions

From PSP Developer wiki
Jump to navigation Jump to search
(VFPU bug section is added; Incorrect info was removed, PSP CPU has branching instructions (https://pspdev.github.io/vfpu-docs/#bvf))
No edit summary
 
(4 intermediate revisions by 2 users not shown)
Line 1: Line 1:
[[File:PSP CXD2962GG.jpg|thumb|PSP CXD2962GG]]
[[File:PSP CXD2962GG.jpg|thumb|PSP CXD2962GG]]


<b>Tachyon</b> is the codename of the PSP main CPU SoC IC. It is a Sony custom-made LSI which holds the main CPU (Allegrex), the VFPU coprocessor, the Media Engine CPU and its embedded DRAM, the Graphics Engine, the AVC decoder, the Virtual Mobile Engine DSP, the [[Kirk]] and [[Spock]] crypto engines, and the 4KB embedded mask ROM which holds the [[PRE-IPL|iplloader]] and routines to boot into service mode.
<b>Tachyon</b> is the codename of the PSP main CPU SoC IC. It is a Sony custom-made LSI which holds the main CPU (Allegrex), the VFPU coprocessor, the Media Engine CPU and its embedded DRAM, the Graphics Engine, the AVC decoder, the Virtual Mobile Engine DSP, the [[Kirk]] and [[Spock]] crypto engines, and the 4KB embedded mask ROM which holds the [[iplloader]] and routines to boot into service mode.


Tachyon has one primary CPU core which is responsible for running the [[XMB]] and games, and a second CPU core (<i>[[#Media_Engine|Media Engine]]</i>) which implements the audio and video decoding functionality of the PSP.
Tachyon has one primary CPU core which is responsible for running the [[XMB]] and games, and a second CPU core (<i>[[Media Engine]]</i>) which implements the audio and video decoding functionality of the PSP.


== Main Core "SC" ==
== Main Core "SC" ==


The PSP's CPU, named <b>Allegrex</b> — is a dual core 32-bit Little Endian MIPS processor, based on the R4000 design with a few custom instructions.
See [[Allegrex]].
 
Both CPU cores have their own 16 KiB Instruction and 16 KiB Data caches. The main CPU has an internal 16 KiB of scratchpad RAM, that is accessed directly without going through the system bus.
 
The main CPU has three coprocessors:
* <b>COP0</b>: general system control
* <b>[[COP1]]</b>: 32-bit Floating Point Unit
* <b>[[COP2]]</b>: Vector Floating Point Unit (up to 3.2 GFLOPS)
 
It has some instructions from <b>MIPS IV:</b> <code>ext, ins, wsbw, seb, seh, rotr, rot(r)v, bitrev, clz, clo</code>.
 
It doesn't seem to have:
* 64-bit instructions (of course)
* <code>ll, ldc1, ldc2, lwc2, sc, sdc1, sdc2, swc2</code> (<i>some of them are actually replaced by VFPU instructions with different names</i>)
* T* (<i>trap and TLB</i>) instructions
*<code>bltzal, bgezal, bltzall, bgezall</code>
 
It also has its own instructions:
* <code>halt</code> (<i>opcode 0x70000000</i>): This instructions waits for an interruption to wake it up.
* <code>mfic</code> (<i>opcode 0x70000024 with mask 0xFFFF07FF</i>): It retrieves the interrupt controller state (<i>1: interruptions enabled, 0: interruptions disabled</i>) into the register described by mask 0x0000F800.
* <code>mtic</code> (<i>opcode 0x70000026 with mask 0xFFFF07FF</i>): It sets the interrupt controller state to the value which is in the register described by mask 0x0000F800.
 
The CPU defaults to 222 MHz, but can be configured to run from 1-333 MHz.
 
The CPU cores are connected to main memory and other peripherals like the Graphics Engine through a system bus, that is limited to half of the CPU's configured clock speed.
 
Since the PSP doesn't have a MMU, the COP0 registers related to TLBs are unused. The PSP also uses the obscure instructions <code>cfc0</code>/<code>ctc0</code> to access "control registers" which are used by the PSP firmware to store various low level data.
 
=== Calling convention ===
 
The PSP calling convention seems a bit non-standard:
*<b>Arguments are passed</b> through following registers: <code>$a0, $a1, $a2, $a3, $t0, $t1, $t2, $t3</code>, then on the stack
*Registers <code>$s0, $s1, $s2, $s3, $s4, $s5, $s6, $s7, $fp</code> (<i>used as a normal registers</i>), <code>$ra</code> (<i>return address</i>), <code>$sp</code> (<i>stack pointer</i>) <b>are saved</b> (<i>or restored</i>) by the callee
*Registers <code>$t4, $t5, $t6, $t7, $t8, $t9</code> are temporary registers, <b>not saved</b> by the callee
*Registers <code>$v0, $v1</code> contain the <b>return value</b> of a function: <code>$v0</code> for the lower 32-bits and <code>$v1</code> for the higher 32-bits (if appliable)
 
Some registers are used only by the kernel:
*<code>$gp</code> and <code>$k0</code> are used in only a few specific places in the kernel
*<code>$k1</code> <b>is used to check permissions</b>: each time an user function is called, it shifts <code>$k1</code> left by 11 bits. The function is in user mode if the <code>$k1</code> value has then its first (highest value) bit set. In then checks either if a pointer has its higher bit set, and/or if its end has its higher bit set, and/or if its size has its higher bit set. If one of those bits is set and we're in user mode, the function returns an error (if it checked the pointer/buffer, which is not always the case).
*<code>$at</code> (<i>assembly temporary</i>) <b>is used as a temporary register</b>, for hardware manipulation sometimes (to store the hardware register address when reading/writing from/to it).


== Media Engine ==
== Media Engine ==


<b>The Media Engine</b> (<i>or shortly ME</i>) — is a second MIPS based CPU core, that was not directly accessible by licensed developers. Instead, Sony runs code on the ME to facilitate decoding audio and video assets, along with the help of more specialized hardware like the Virtual Mobile Engine and "AVC".
See [[Media Engine]].


The ME runs at the same clock frequency as the main CPU core. It seems to have the same instruction set.
== Virtual Mobile Engine ==


The ME has two co-processors:
See [[Virtual Mobile Engine]].
* <b>COP0</b>: general system control
* <b>[[COP1]]</b>: 32-bit Floating Point Unit


It has three instructions the main CPU doesn't have (or used):
== Graphics Engine ==
* <code>DBREAK</code> (<i>also present on other MIPS processors</i>): used only once in the ME firmware
* <code>MTVME</code>
* <code>MFVME</code>


These two last instructions actually have the same opcodes as LDL and SDL, which this CPU doesn't have.
The instructions are actually encoded like this:
<pre>
ldl $reg, off($a3) <=> mfvme $reg, $off
sdl $reg, off($a3) <=> mtvme $reg, $off
</pre>
They might be used to store and retrieve information from and to the VME. They seem to be only used for video decoding.
== Graphics Engine ==
: <i>See main article: <b>[[Graphics]]</b></i>
: <i>See main article: <b>[[Graphics]]</b></i>
== Virtual Mobile Engine ==
The VME appears to be one half of Sony's "Virtual Mobile Engine Concept 2" where a CPU would take care of "lightweight control tasks" and reconfigurable hardware logic (the VME) would do all of the "heavy work in a power efficient manner". See [https://www.yumpu.com/en/document/read/10961029/virtual-mobile-enginetm-vme-sony Virtual Mobile Engine - LSI that "Changes its Spots"].
It might be something like a reconfigurable DSP; noone has been able to interpret its "firmware" yet.
It can be accessed from the ME through the mfvme/mtvme instructions or through DMA with addresses from 0x440F8000 to 0x44100000 (excluded).


== Memory mapping ==
== Memory mapping ==
Line 96: Line 35:
| 0x08000000 || 0x087FFFFF || 0x00800000 (<i>8MiB</i>)  || Allegrex Kernel memory (RAM)
| 0x08000000 || 0x087FFFFF || 0x00800000 (<i>8MiB</i>)  || Allegrex Kernel memory (RAM)
|-
|-
| 0x08800000 || 0x097FFFFF || 0x01800000 (<i>24MiB</i>) || Allegrex User memory (RAM)
| 0x08800000 || 0x09FFFFFF || 0x01800000 (<i>24MiB</i>) || Allegrex User memory (RAM)
|-
|-
| 0x1C000000 || ?          || ?                        || Hardware registers
| 0x1C000000 || ?          || ?                        || Hardware registers
Line 131: Line 70:
PSP-1000 CPU has broken <code>ulv.q</code> instruction, that causes FPU registers corruption.
PSP-1000 CPU has broken <code>ulv.q</code> instruction, that causes FPU registers corruption.


You can see more about it [https://sites.google.com/a/davidgf.es/davidgf-net/home/psp-dev/vfpu-test?tmpl=%2Fsystem%2Fapp%2Ftemplates%2Fprint%2F here]
You can see more about it [https://sites.google.com/a/davidgf.es/davidgf-net/home/psp-dev/vfpu-test?tmpl=%2Fsystem%2Fapp%2Ftemplates%2Fprint%2F here].


== Versions ==  
== Versions ==  

Latest revision as of 21:32, 17 June 2024

PSP CXD2962GG

Tachyon is the codename of the PSP main CPU SoC IC. It is a Sony custom-made LSI which holds the main CPU (Allegrex), the VFPU coprocessor, the Media Engine CPU and its embedded DRAM, the Graphics Engine, the AVC decoder, the Virtual Mobile Engine DSP, the Kirk and Spock crypto engines, and the 4KB embedded mask ROM which holds the iplloader and routines to boot into service mode.

Tachyon has one primary CPU core which is responsible for running the XMB and games, and a second CPU core (Media Engine) which implements the audio and video decoding functionality of the PSP.

Main Core "SC"[edit | edit source]

See Allegrex.

Media Engine[edit | edit source]

See Media Engine.

Virtual Mobile Engine[edit | edit source]

See Virtual Mobile Engine.

Graphics Engine[edit | edit source]

See main article: Graphics

Memory mapping[edit | edit source]

This memory mapping is shared by the SC, the GE & the ME, except the VRAM which is accessible only by the SC and the GE.

Start End Size Description
0x00010000 0x00013FFF 0x00004000 (16KiB) Allegrex Scratchpad
0x04000000 0x041FFFFF 0x00200000 (2MiB) Graphics Engine VRAM
0x08000000 0x087FFFFF 0x00800000 (8MiB) Allegrex Kernel memory (RAM)
0x08800000 0x09FFFFFF 0x01800000 (24MiB) Allegrex User memory (RAM)
0x1C000000 ? ? Hardware registers
0x1FC00000 0x1FDFFFFF 0x00200000 MIPS Reset Vector
0x1FE00000 ? ? Hardware registers

See Hardware Registers for details about the hardware registers.

Access can be cached & privileged or not by changing the first 4 bits (31-28 bits) of the address using this virtual memory mapping:

Address Name Is it cached? Permission Description
0x00000000 KU0 Cached User/Supervisor/Kernel Main memory
0x40000000 KU1 Uncached User/Supervisor/Kernel Often used for VRAM
0x80000000 K0 Cached Kernel Main kernel memory
0xA0000000 K1 Uncached Kernel Mainly used for hardware registers
0xC0000000 K2/KS Cached Supervisor/Kernel Usage unknown/unconfirmed
0xE0000000 K3 Cached Kernel Usage unknown/unconfirmed

PSP-1000 VFPU bug[edit | edit source]

PSP-1000 CPU has broken ulv.q instruction, that causes FPU registers corruption.

You can see more about it here.

Versions[edit | edit source]

PSP-1000[edit | edit source]

  • CPU and DDR are discrete ICs on the motherboard
  • 32 MiB main memory (DDR)
  • 2 MiB Media Engine memory (eDRAM)

PSP-2000 and later[edit | edit source]

  • DDR is brought into the CPU's package
  • 64 MiB main memory (DDR)
  • 4 MiB Media Engine memory (eDRAM)

See also[edit | edit source]

Retrieved from "http://www.psdevwiki.com/psp/index.php?title=Tachyon&oldid=12667"