Allegrex

The PSP's CPU, named Allegrex — is a dual core 32-bit Little Endian MIPS processor, based on the R4000 design with a few custom instructions.

Both CPU cores have their own 16 KiB Instruction and 16 KiB Data caches. The main CPU has an internal 16 KiB of scratchpad RAM, that is accessed directly without going through the system bus.

The main CPU has three coprocessors:

• COP0: general system control
• COP1: 32-bit Floating Point Unit
• COP2: Vector Floating Point Unit (up to 3.2 GFLOPS)

It has some instructions from MIPS IV: ext, ins, wsbw, seb, seh, rotr, rot(r)v, bitrev, clz, clo.

It does not seem to have:

• 64-bit instructions (of course)
• ll, ldc1, ldc2, lwc2, sc, sdc1, sdc2, swc2 (some of them are actually replaced by VFPU instructions with different names)
• T* (trap and TLB) instructions
• bltzal, bgezal, bltzall, bgezall

It also has its own instructions:

• halt (opcode 0x70000000): This instructions waits for an interruption to wake it up.
• mfic (opcode 0x70000024 with mask 0xFFFF07FF): It retrieves the interrupt controller state (1: interruptions enabled, 0: interruptions disabled) into the register described by mask 0x0000F800.
• mtic (opcode 0x70000026 with mask 0xFFFF07FF): It sets the interrupt controller state to the value which is in the register described by mask 0x0000F800.

The CPU defaults to 222 MHz, but can be configured to run from 1-333 MHz.

The CPU cores are connected to main memory and other peripherals like the Graphics Engine through a system bus, that is limited to half of the CPU's configured clock speed.

Since the PSP doesn't have a MMU, the COP0 registers related to TLBs are unused. The PSP also uses the obscure instructions cfc0/ctc0 to access "control registers" which are used by the PSP firmware to store various low level data.

Calling convention

The PSP calling convention seems a bit non-standard:

• Arguments are passed through following registers: $a0, $a1, $a2, $a3, $t0, $t1, $t2, $t3, then on the stack
• Registers $s0, $s1, $s2, $s3, $s4, $s5, $s6, $s7, $fp (used as a normal registers), $ra (return address), $sp (stack pointer) are saved (or restored) by the callee
• Registers $t4, $t5, $t6, $t7, $t8, $t9 are temporary registers, not saved by the callee
• Registers $v0, $v1 contain the return value of a function: $v0 for the lower 32-bits and $v1 for the higher 32-bits (if appliable)

Some registers are used only by the kernel:

• $gp and $k0 are used in only a few specific places in the kernel
• $k1 is used to check permissions: each time an user function is called, it shifts $k1 left by 11 bits. The function is in user mode if the $k1 value has then its first (highest value) bit set. In then checks either if a pointer has its higher bit set, and/or if its end has its higher bit set, and/or if its size has its higher bit set. If one of those bits is set and we're in user mode, the function returns an error (if it checked the pointer/buffer, which is not always the case).
• $at (assembly temporary) is used as a temporary register, for hardware manipulation sometimes (to store the hardware register address when reading/writing from/to it).