Main Processor

Main SoC

See Kermit.

Cortex A9 MPcore

The custom SoC includes the ARM Cortex-A9 MPCore as its CPU, mounting four little-endian ARM Cortex-A9 processor cores, which is common in modern high performance embedded devices like cell phones and tablets. The PSVita cores have a MIDR value of 0x412FC09A, meaning it is Cortex-A9 r2p10. Indeed there are usage of undocumented CP15 registers.

Implemented Coprocessor registers

Register	Name	Used by	Description
p14, #0, r0, c0, c0, #4	DBGBVR0	SceKernelThreadMgr	Breakpoint Value Register 0
p14, #0, r0, c0, c1, #4	DBGBVR1	SceKernelThreadMgr	Breakpoint Value Register 1
p14, #0, r0, c0, c2, #4	DBGBVR2	SceKernelThreadMgr	Breakpoint Value Register 2
p14, #0, r0, c0, c3, #4	DBGBVR3	SceKernelThreadMgr	Breakpoint Value Register 3
p14, #0, r0, c0, c4, #4	DBGBVR4	SceKernelThreadMgr	Breakpoint Value Register 4
p14, #0, r0, c0, c5, #4	DBGBVR5	SceKernelThreadMgr	Breakpoint Value Register 5
p14, #0, r0, c0, c0, #5	DBGBCR0	SceKernelThreadMgr	Breakpoint Control Register 0
p14, #0, r0, c0, c1, #5	DBGBCR1	SceKernelThreadMgr	Breakpoint Control Register 1
p14, #0, r0, c0, c2, #5	DBGBCR2	SceKernelThreadMgr	Breakpoint Control Register 2
p14, #0, r0, c0, c3, #5	DBGBCR3	SceKernelThreadMgr	Breakpoint Control Register 3
p14, #0, r0, c0, c4, #5	DBGBCR4	SceKernelThreadMgr	Breakpoint Control Register 4
p14, #0, r0, c0, c5, #5	DBGBCR5	SceKernelThreadMgr	Breakpoint Control Register 5
p14, #0, r0, c0, c0, #6	DBGWVR0	SceKernelThreadMgr	Watchpoint Value Register 0
p14, #0, r0, c0, c1, #6	DBGWVR1	SceKernelThreadMgr	Watchpoint Value Register 1
p14, #0, r0, c0, c2, #6	DBGWVR2	SceKernelThreadMgr	Watchpoint Value Register 2
p14, #0, r0, c0, c3, #6	DBGWVR3	SceKernelThreadMgr	Watchpoint Value Register 3
p14, #0, r0, c0, c0, #7	DBGWCR0	SceKernelThreadMgr	Watchpoint Control Register 0
p14, #0, r0, c0, c1, #7	DBGWCR1	SceKernelThreadMgr	Watchpoint Control Register 1
p14, #0, r0, c0, c2, #7	DBGWCR2	SceKernelThreadMgr	Watchpoint Control Register 2
p14, #0, r0, c0, c3, #7	DBGWCR3	SceKernelThreadMgr	Watchpoint Control Register 3
p14, #0, r0, c0, c2, #2	DBGDSCRext	SceKernelThreadMgr	Debug Status and Control Register external view
p14, #6, r0, c0, c0, #0	TEECR	SKBL/NSKBL	ThumbEE Configuration Register
p14, #6, r0, c1, c0, #0	TEEHBR	SKBL/NSKBL	ThumbEE Handler Base Register
p14, #7, r0, c1, c0, #0	JOSCR	SKBL/NSKBL	Jazelle OS Control Register
p15, #0, r0, c0, c0, #0	MIDR	N/A	Main ID Register
p15, #0, r0, c0, c0, #1	CTR	N/A	Cache Type Register
p15, #0, r0, c0, c0, #2	TCMTR	N/A	TCM Type Register
p15, #0, r0, c0, c0, #3	TLBTR	N/A	TLB Type Register
p15, #0, r0, c0, c0, #5	MPIDR	SceSysmem/SceExcpmgr	Multiprocessor Affinity Register
p15, #0, r0, c0, c0, #6	REVIDR	N/A	Revision ID Register
p15, #0, r0, c0, c1, #0	ID_PFR0	N/A	Processor Feature Register 0
p15, #0, r0, c0, c1, #1	ID_PFR1	N/A	Processor Feature Register 1
p15, #0, r0, c0, c1, #2	ID_DFR0	N/A	Debug Feature Register 0
p15, #0, r0, c0, c1, #3	ID_AFR0	N/A	Auxiliary Feature Register 0
p15, #0, r0, c0, c1, #4	ID_MMFR0	N/A	Memory Model Feature Register 0
p15, #0, r0, c0, c1, #5	ID_MMFR1	N/A	Memory Model Feature Register 1
p15, #0, r0, c0, c1, #6	ID_MMFR2	N/A	Memory Model Feature Register 2
p15, #0, r0, c0, c1, #7	ID_MMFR3	N/A	Memory Model Feature Register 3
p15, #0, r0, c0, c2, #0	ID_ISAR0	N/A	Instruction Set Attribute Register 0
p15, #0, r0, c0, c2, #1	ID_ISAR1	N/A	Instruction Set Attribute Register 1
p15, #0, r0, c0, c2, #2	ID_ISAR2	N/A	Instruction Set Attribute Register 2
p15, #0, r0, c0, c2, #3	ID_ISAR3	N/A	Instruction Set Attribute Register 3
p15, #0, r0, c0, c2, #4	ID_ISAR4	N/A	Instruction Set Attribute Register 4
p15, #0, r0, c0, c2, #5	ID_ISAR5	N/A	Instruction Set Attribute Register 5
p15, #1, r0, c0, c0, #0	CCSIDR	N/A	Cache Size ID Register
p15, #1, r0, c0, c0, #1	CLIDR	N/A	Cache Level ID Register
p15, #1, r0, c0, c0, #7	AIDR	N/A	Auxiliary ID Register
p15, #2, r0, c0, c0, #0	CSSELR	NSKBL	Cache Size Selection Register
p15, #0, r0, c1, c0, #0	SCTLR	SKBL/SceDriverTzs/NSKBL/SceSysmem	System Control Register
p15, #0, r0, c1, c0, #1	ACTLR	SKBL	Auxiliary Control Register
p15, #0, r0, c1, c0, #2	CPACR	SKBL	Coprocessor Access Control Register
p15, #0, r0, c1, c1, #0	SCR	SKBL	Secure Configuration Register
p15, #0, r0, c1, c1, #1	SDER	N/A	Secure Debug Enable Register
p15, #0, r0, c1, c1, #2	NSACR	SKBL	Non-Secure Access Control Register
p15, #0, r0, c2, c0, #0	TTBR0	SKBL/SceSysmem	Translation Table Base Register 0
p15, #0, r0, c2, c0, #1	TTBR1	SKBL/SceSysmem/ScePower	Translation Table Base Register 1
p15, #0, r0, c2, c0, #2	TTBCR	SKBL/NSKBL	Translation Table Base Control Register
p15, #0, r0, c3, c0, #0	DACR	SKBL/SceSysmem	Domain Access Control Register
p15, #0, r0, c3, c0, #1	DACR	ScePower	Undocumented. Write-Only.
p15, #0, r0, c3, c0, #2	DACR	ScePower	Undocumented. Unknown.
p15, #0, r0, c5, c0, #0	DFSR	SceExcpmgr	Data Fault Status Register
p15, #0, r0, c5, c0, #1	IFSR	SceExcpmgr	Instruction Fault Status Register
p15, #0, r0, c5, c1, #0	ADFSR	SceExcpmgr	Auxiliary Data Fault Status Register
p15, #0, r0, c5, c1, #1	AIFSR	SceExcpmgr	Auxiliary Instruction Fault Status Register
p15, #0, r0, c6, c0, #0	DFAR	SceExcpmgr	Data Fault Address Register
p15, #0, r0, c6, c0, #2	IFAR	SceExcpmgr	Instruction Fault Address Register
p15, #0, r0, c7, c1, #0	ICIALLUIS	SKBL/SceSysmem	Instruction cache invalidate all PoU, IS
p15, #0, r0, c7, c1, #6	BPIALLIS	SKBL/SceSysmem	Branch predictor invalidate all IS
p15, #0, r0, c7, c4, #0	PAR	SceSysmem	Physical Address Register
p15, #0, r0, c7, c5, #0	ICIALLU	SKBL/SceSysmem	Instruction cache invalidate all PoU
p15, #0, r0, c7, c5, #1	ICIMVAU	SceSysmem	Instruction cache invalidate
p15, #0, r0, c7, c5, #6	BPIALL	SceSysmem	Branch predictor invalidate all
p15, #0, r0, c7, c6, #1	DCIMVAC	SceSysmem	Data cache invalidate by MVA PoC
p15, #0, r0, c7, c6, #2	DCISW	SKBL/SceSysmem	Data cache invalidate by set/way
p15, #0, r0, c7, c8, #0	ATS1CPR	SceSysmem	Stage 1 Current state PL1 read
p15, #0, r0, c7, c8, #1	ATS1CPW	SceSysmem	Stage 1 Current state PL1 write
p15, #0, r0, c7, c8, #2	ATS1CUR	SceSysmem	Stage 1 Current state unprivileged read
p15, #0, r0, c7, c8, #3	ATS1CUW	SceSysmem	Stage 1 Current state unprivileged write
p15, #0, r0, c7, c10, #1	DCCMVAC	SceSysmem	Data cache clean by MVA PoC
p15, #0, r0, c7, c10, #2	DCCSW	SceSysmem	Data cache clean by set/way
p15, #0, r0, c7, c14, #1	DCCIMVAC	SceSysmem	Data cache clean and invalidate by MVA PoC
p15, #0, r0, c7, c14, #2	DCCISW	SceSysmem	Data cache clean and invalidate by set/way
p15, #0, r0, c8, c3, #1	TLBIMVAIS	SceSysmem	Invalidate unified TLB by MVA IS
p15, #0, r0, c8, c3, #3	TLBIMVAAIS	SceSysmem	Invalidate unified TLB by MVA, all ASID IS
p15, #0, r0, c8, c7, #0	TLBIALL	ScePower	Invalidate entire unified TLB
p15, #0, r0, c9, c12, #0	PMCR	ScePerf	perf
p15, #0, r0, c9, c12, #1	PMCNTENSET	ScePerf	perf
p15, #0, r0, c9, c12, #2	PMCNTENCLR	ScePerf	perf
p15, #0, r0, c9, c12, #3	PMOVSR	ScePerf	perf
p15, #0, r0, c9, c12, #4	PMSWINC	ScePerf	perf
p15, #0, r0, c9, c12, #5	PMSELR	ScePerf	perf
p15, #0, r0, c9, c13, #0	PMCCNTR	ScePerf	perf
p15, #0, r0, c9, c13, #1	PMXEVTYPER	ScePerf	perf
p15, #0, r0, c9, c13, #2	PMXEVCNTR	ScePerf	perf
p15, #0, r0, c9, c14, #0	PMUSERENR	ScePerf	perf
p15, #0, r0, c9, c14, #1	PMINTENSET	ScePerf	perf
p15, #0, r0, c9, c14, #2	PMINTENCLR	ScePerf	perf
p15, #0, r0, c10, c2, #0	PRRR	ScePower	Primary Region Remap Register
p15, #0, r0, c10, c2, #1	NMRR	ScePower	Normal Memory Remap Register
p15, #0, r0, c12, c0, #0	VBAR	NSKBL/ScePower/SceKernelThreadMgr	Vector Base Address Register
p15, #0, r0, c12, c0, #1	MVBAR	SKBL	Monitor Vector Base Address Register
p15, #0, r0, c12, c1, #0	ISR	N/A	Interrupt Status Register
p15, #0, r0, c13, c0, #0	FCSEIDR	N/A	FCSE Process ID Register
p15, #0, r0, c13, c0, #1	CONTEXTIDR	SKBL/NSKBL/ScePower	Context ID Register
p15, #0, r0, c13, c0, #2	TPIDRURW	NSKBL	User Read/Write Thread ID Register
p15, #0, r0, c13, c0, #3	TPIDRURO	NSKBL/SceLibKernel/SceKernelThreadMgr	User Read-Only Thread ID Register. Value is TLS pointer.
p15, #0, r0, c13, c0, #4	TPIDRPRW	NSKBL/SceExcpmgr/SceKernelThreadMgr	PL1 only Thread ID Register. Value is SceKernelThreadObject pointer.
p15, #0, r0, c15, c0, #0	PCTLR	SKBL	Power Control Register
p15, #0, r0, c15, c0, #1	N/A	SKBL	Diagnostic Control Register (undocumented, used for errata workarounds)

Each core includes the following features:

• L1 Instruction Cache of 32 KiB and Data Cache of 32 KiB
• Media Processing Engine (MPE) that can execute Advanced SIMD instructions (NEONv1) and Vector Floating-Point v3 instructions (VFPv3)

In addition, there is a L2 cache of 2 MiB shared by all cores, while precisely speaking, it's external to the ARM processor core.

Documentation

A lot of useful information is available about ARM (Advanced RISC Machines) on the internet including ARM Ltd. official site.

• Refer to the following document for the instruction set, memory model and programmers' model: ARM Architecture Reference Manual ARMv7-A and ARMv7-R edition.

• The ARM Cortex-A9 Technical Reference Manual gives a good overview of the specific processor features and is a good reference for what ARMv7 implementation specific features are enabled.

• Another manual that's important is the ARM Cortex-A9 MPCore Technical Reference Manual which is specific to the multi-core system the Vita uses. The main information of use are descriptors for the private memory region defined with the PERIPHBASE signal. This is mapped to physical address 0x1A000000.

• Some reserved registers are documented in the Cortex-A9 Errata Notices (r0/r1/r2/r3/r4)

• Cortex-A9 Technical Reference Manual

(corresponding to the chip revision supposed to be included in DevKit):

http://infocenter.arm.com/help/topic/com.arm.doc.ddi0388f/DDI0388F_cortex_a9_r2p2_trm.pdf

• Cortex-A9 NEON Media Processing Engine Technical Reference Manual

(NEON: Advanced SIMD instructions)

http://infocenter.arm.com/help/topic/com.arm.doc.ddi0409f/DDI0409F_cortex_a9_neon_mpe_r2p2_trm.pdf

• Cortex-A9 NEON MPE > VFPv3 architecture hardware support

http://infocenter.arm.com/help/topic/com.arm.doc.ddi0409f/CHDEEJDB.html

(The above reference destination has been confirmed as of June 26, 2014. Note that pages may have been subsequently moved or its contents modified.)

Identification registers

Register name	Value
AIDR	0x00000000
CCSIDR	0x701FE019
CLIDR	0x09200003
CTR	0x83338003
ID_AFR0	0x00000000
ID_DFR0	0x00010444
ID_ISAR0	0x00101111
ID_ISAR1	0x13112111
ID_ISAR2	0x21232041
ID_ISAR3	0x11112131
ID_ISAR4	0x00011142
ID_ISAR5	0x00000000
ID_MMFR0	0x00100103
ID_MMFR1	0x20000000
ID_MMFR2	0x01230000
ID_MMFR3	0x00102111
ID_PFR0	0x00001231
ID_PFR1	0x00000011
MIDR	0x412FC09A
MPIDR	0x80000003
REVIDR	0x412FC09A
TCMTR	0x00000000
TLBTR	0x00000402

Interrupt Controller

As part of the Cortex A9 MPcore, the Vita also implements the Generic Interrupt Controller Architecture. More information on interrupts can be found here.

L2 Cache

PSVita uses the PL310 r3p1-50rel0 L2 cache (Cache ID Register = 0x410000C7) that is mapped to paddr 0x1A002000.

RO registers

Register name	Value
Cache ID Register	0x410000c7
Cache Type Register	0x1e440440

Configuration

It seems NSKBL initializes the Tag Latency Control Register to <1, 1, 1> (writes 0<(code> to the L2 register), and Tag Latency Control Register to <2, 4, 2> (writes 0x131<(code> to the L2 register).