Main Processor
Jump to navigation
Jump to search
Main SoC
See Kermit.
Cortex A9 MPcore
The custom SoC includes the ARM Cortex-A9 MPCore as its CPU, mounting four little-endian ARM Cortex-A9 processor cores, which is common in modern high performance embedded devices like cell phones and tablets. The PSVita cores have a MIDR value of 0x412FC09A, meaning it is Cortex-A9 r2p10. Indeed there are usage of undocumented CP15 registers.
Implemented Coprocessor registers
| Register | Name | Used by | Description |
|---|---|---|---|
| p14, #0, r0, c0, c0, #4 | DBGBVR0 | SceKernelThreadMgr | Breakpoint Value Register 0 |
| p14, #0, r0, c0, c1, #4 | DBGBVR1 | SceKernelThreadMgr | Breakpoint Value Register 1 |
| p14, #0, r0, c0, c2, #4 | DBGBVR2 | SceKernelThreadMgr | Breakpoint Value Register 2 |
| p14, #0, r0, c0, c3, #4 | DBGBVR3 | SceKernelThreadMgr | Breakpoint Value Register 3 |
| p14, #0, r0, c0, c4, #4 | DBGBVR4 | SceKernelThreadMgr | Breakpoint Value Register 4 |
| p14, #0, r0, c0, c5, #4 | DBGBVR5 | SceKernelThreadMgr | Breakpoint Value Register 5 |
| p14, #0, r0, c0, c0, #5 | DBGBCR0 | SceKernelThreadMgr | Breakpoint Control Register 0 |
| p14, #0, r0, c0, c1, #5 | DBGBCR1 | SceKernelThreadMgr | Breakpoint Control Register 1 |
| p14, #0, r0, c0, c2, #5 | DBGBCR2 | SceKernelThreadMgr | Breakpoint Control Register 2 |
| p14, #0, r0, c0, c3, #5 | DBGBCR3 | SceKernelThreadMgr | Breakpoint Control Register 3 |
| p14, #0, r0, c0, c4, #5 | DBGBCR4 | SceKernelThreadMgr | Breakpoint Control Register 4 |
| p14, #0, r0, c0, c5, #5 | DBGBCR5 | SceKernelThreadMgr | Breakpoint Control Register 5 |
| p14, #0, r0, c0, c0, #6 | DBGWVR0 | SceKernelThreadMgr | Watchpoint Value Register 0 |
| p14, #0, r0, c0, c1, #6 | DBGWVR1 | SceKernelThreadMgr | Watchpoint Value Register 1 |
| p14, #0, r0, c0, c2, #6 | DBGWVR2 | SceKernelThreadMgr | Watchpoint Value Register 2 |
| p14, #0, r0, c0, c3, #6 | DBGWVR3 | SceKernelThreadMgr | Watchpoint Value Register 3 |
| p14, #0, r0, c0, c0, #7 | DBGWCR0 | SceKernelThreadMgr | Watchpoint Control Register 0 |
| p14, #0, r0, c0, c1, #7 | DBGWCR1 | SceKernelThreadMgr | Watchpoint Control Register 1 |
| p14, #0, r0, c0, c2, #7 | DBGWCR2 | SceKernelThreadMgr | Watchpoint Control Register 2 |
| p14, #0, r0, c0, c3, #7 | DBGWCR3 | SceKernelThreadMgr | Watchpoint Control Register 3 |
| p14, #0, r0, c0, c2, #2 | DBGDSCRext | SceKernelThreadMgr | Debug Status and Control Register external view |
| p14, #6, r0, c0, c0, #0 | TEECR | SKBL/NSKBL | ThumbEE Configuration Register |
| p14, #6, r0, c1, c0, #0 | TEEHBR | SKBL/NSKBL | ThumbEE Handler Base Register |
| p14, #7, r0, c1, c0, #0 | JOSCR | SKBL/NSKBL | Jazelle OS Control Register |
| p15, #0, r0, c0, c0, #0 | MIDR | N/A | Main ID Register |
| p15, #0, r0, c0, c0, #1 | CTR | N/A | Cache Type Register |
| p15, #0, r0, c0, c0, #2 | TCMTR | N/A | TCM Type Register |
| p15, #0, r0, c0, c0, #3 | TLBTR | N/A | TLB Type Register |
| p15, #0, r0, c0, c0, #5 | MPIDR | SceSysmem/SceExcpmgr | Multiprocessor Affinity Register |
| p15, #0, r0, c0, c0, #6 | REVIDR | N/A | Revision ID Register |
| p15, #0, r0, c0, c1, #0 | ID_PFR0 | N/A | Processor Feature Register 0 |
| p15, #0, r0, c0, c1, #1 | ID_PFR1 | N/A | Processor Feature Register 1 |
| p15, #0, r0, c0, c1, #2 | ID_DFR0 | N/A | Debug Feature Register 0 |
| p15, #0, r0, c0, c1, #3 | ID_AFR0 | N/A | Auxiliary Feature Register 0 |
| p15, #0, r0, c0, c1, #4 | ID_MMFR0 | N/A | Memory Model Feature Register 0 |
| p15, #0, r0, c0, c1, #5 | ID_MMFR1 | N/A | Memory Model Feature Register 1 |
| p15, #0, r0, c0, c1, #6 | ID_MMFR2 | N/A | Memory Model Feature Register 2 |
| p15, #0, r0, c0, c1, #7 | ID_MMFR3 | N/A | Memory Model Feature Register 3 |
| p15, #0, r0, c0, c2, #0 | ID_ISAR0 | N/A | Instruction Set Attribute Register 0 |
| p15, #0, r0, c0, c2, #1 | ID_ISAR1 | N/A | Instruction Set Attribute Register 1 |
| p15, #0, r0, c0, c2, #2 | ID_ISAR2 | N/A | Instruction Set Attribute Register 2 |
| p15, #0, r0, c0, c2, #3 | ID_ISAR3 | N/A | Instruction Set Attribute Register 3 |
| p15, #0, r0, c0, c2, #4 | ID_ISAR4 | N/A | Instruction Set Attribute Register 4 |
| p15, #0, r0, c0, c2, #5 | ID_ISAR5 | N/A | Instruction Set Attribute Register 5 |
| p15, #1, r0, c0, c0, #0 | CCSIDR | N/A | Cache Size ID Register |
| p15, #1, r0, c0, c0, #1 | CLIDR | N/A | Cache Level ID Register |
| p15, #1, r0, c0, c0, #7 | AIDR | N/A | Auxiliary ID Register |
| p15, #2, r0, c0, c0, #0 | CSSELR | NSKBL | Cache Size Selection Register |
| p15, #0, r0, c1, c0, #0 | SCTLR | SKBL/SceDriverTzs/NSKBL/SceSysmem | System Control Register |
| p15, #0, r0, c1, c0, #1 | ACTLR | SKBL | Auxiliary Control Register |
| p15, #0, r0, c1, c0, #2 | CPACR | SKBL | Coprocessor Access Control Register |
| p15, #0, r0, c1, c1, #0 | SCR | SKBL | Secure Configuration Register |
| p15, #0, r0, c1, c1, #1 | SDER | N/A | Secure Debug Enable Register |
| p15, #0, r0, c1, c1, #2 | NSACR | SKBL | Non-Secure Access Control Register |
| p15, #0, r0, c2, c0, #0 | TTBR0 | SKBL/SceSysmem | Translation Table Base Register 0 |
| p15, #0, r0, c2, c0, #1 | TTBR1 | SKBL/SceSysmem/ScePower | Translation Table Base Register 1 |
| p15, #0, r0, c2, c0, #2 | TTBCR | SKBL/NSKBL | Translation Table Base Control Register |
| p15, #0, r0, c3, c0, #0 | DACR | SKBL/SceSysmem | Domain Access Control Register |
| p15, #0, r0, c3, c0, #1 | DACR | ScePower | Undocumented. Write-Only. |
| p15, #0, r0, c3, c0, #2 | DACR | ScePower | Undocumented. Unknown. |
| p15, #0, r0, c5, c0, #0 | DFSR | SceExcpmgr | Data Fault Status Register |
| p15, #0, r0, c5, c0, #1 | IFSR | SceExcpmgr | Instruction Fault Status Register |
| p15, #0, r0, c5, c1, #0 | ADFSR | SceExcpmgr | Auxiliary Data Fault Status Register |
| p15, #0, r0, c5, c1, #1 | AIFSR | SceExcpmgr | Auxiliary Instruction Fault Status Register |
| p15, #0, r0, c6, c0, #0 | DFAR | SceExcpmgr | Data Fault Address Register |
| p15, #0, r0, c6, c0, #2 | IFAR | SceExcpmgr | Instruction Fault Address Register |
| p15, #0, r0, c7, c1, #0 | ICIALLUIS | SKBL/SceSysmem | Instruction cache invalidate all PoU, IS |
| p15, #0, r0, c7, c1, #6 | BPIALLIS | SKBL/SceSysmem | Branch predictor invalidate all IS |
| p15, #0, r0, c7, c4, #0 | PAR | SceSysmem | Physical Address Register |
| p15, #0, r0, c7, c5, #0 | ICIALLU | SKBL/SceSysmem | Instruction cache invalidate all PoU |
| p15, #0, r0, c7, c5, #1 | ICIMVAU | SceSysmem | Instruction cache invalidate |
| p15, #0, r0, c7, c5, #6 | BPIALL | SceSysmem | Branch predictor invalidate all |
| p15, #0, r0, c7, c6, #1 | DCIMVAC | SceSysmem | Data cache invalidate by MVA PoC |
| p15, #0, r0, c7, c6, #2 | DCISW | SKBL/SceSysmem | Data cache invalidate by set/way |
| p15, #0, r0, c7, c8, #0 | ATS1CPR | SceSysmem | Stage 1 Current state PL1 read |
| p15, #0, r0, c7, c8, #1 | ATS1CPW | SceSysmem | Stage 1 Current state PL1 write |
| p15, #0, r0, c7, c8, #2 | ATS1CUR | SceSysmem | Stage 1 Current state unprivileged read |
| p15, #0, r0, c7, c8, #3 | ATS1CUW | SceSysmem | Stage 1 Current state unprivileged write |
| p15, #0, r0, c7, c10, #1 | DCCMVAC | SceSysmem | Data cache clean by MVA PoC |
| p15, #0, r0, c7, c10, #2 | DCCSW | SceSysmem | Data cache clean by set/way |
| p15, #0, r0, c7, c14, #1 | DCCIMVAC | SceSysmem | Data cache clean and invalidate by MVA PoC |
| p15, #0, r0, c7, c14, #2 | DCCISW | SceSysmem | Data cache clean and invalidate by set/way |
| p15, #0, r0, c8, c3, #1 | TLBIMVAIS | SceSysmem | Invalidate unified TLB by MVA IS |
| p15, #0, r0, c8, c3, #3 | TLBIMVAAIS | SceSysmem | Invalidate unified TLB by MVA, all ASID IS |
| p15, #0, r0, c8, c7, #0 | TLBIALL | ScePower | Invalidate entire unified TLB |
| p15, #0, r0, c9, c12, #0 | PMCR | ScePerf | perf |
| p15, #0, r0, c9, c12, #1 | PMCNTENSET | ScePerf | perf |
| p15, #0, r0, c9, c12, #2 | PMCNTENCLR | ScePerf | perf |
| p15, #0, r0, c9, c12, #3 | PMOVSR | ScePerf | perf |
| p15, #0, r0, c9, c12, #4 | PMSWINC | ScePerf | perf |
| p15, #0, r0, c9, c12, #5 | PMSELR | ScePerf | perf |
| p15, #0, r0, c9, c13, #0 | PMCCNTR | ScePerf | perf |
| p15, #0, r0, c9, c13, #1 | PMXEVTYPER | ScePerf | perf |
| p15, #0, r0, c9, c13, #2 | PMXEVCNTR | ScePerf | perf |
| p15, #0, r0, c9, c14, #0 | PMUSERENR | ScePerf | perf |
| p15, #0, r0, c9, c14, #1 | PMINTENSET | ScePerf | perf |
| p15, #0, r0, c9, c14, #2 | PMINTENCLR | ScePerf | perf |
| p15, #0, r0, c10, c2, #0 | PRRR | ScePower | Primary Region Remap Register |
| p15, #0, r0, c10, c2, #1 | NMRR | ScePower | Normal Memory Remap Register |
| p15, #0, r0, c12, c0, #0 | VBAR | NSKBL/ScePower/SceKernelThreadMgr | Vector Base Address Register |
| p15, #0, r0, c12, c0, #1 | MVBAR | SKBL | Monitor Vector Base Address Register |
| p15, #0, r0, c12, c1, #0 | ISR | N/A | Interrupt Status Register |
| p15, #0, r0, c13, c0, #0 | FCSEIDR | N/A | FCSE Process ID Register |
| p15, #0, r0, c13, c0, #1 | CONTEXTIDR | SKBL/NSKBL/ScePower | Context ID Register |
| p15, #0, r0, c13, c0, #2 | TPIDRURW | NSKBL | User Read/Write Thread ID Register |
| p15, #0, r0, c13, c0, #3 | TPIDRURO | NSKBL/SceLibKernel/SceKernelThreadMgr | User Read-Only Thread ID Register. Value is TLS pointer. |
| p15, #0, r0, c13, c0, #4 | TPIDRPRW | NSKBL/SceExcpmgr/SceKernelThreadMgr | PL1 only Thread ID Register. Value is SceKernelThreadObject pointer. |
| p15, #0, r0, c15, c0, #0 | PCTLR | SKBL | Power Control Register |
| p15, #0, r0, c15, c0, #1 | N/A | SKBL | Diagnostic Control Register (undocumented, used for errata workarounds) |
Each core includes the following features:
- L1 Instruction Cache of 32 KiB and Data Cache of 32 KiB
- Media Processing Engine (MPE) that can execute Advanced SIMD instructions (NEONv1) and Vector Floating-Point v3 instructions (VFPv3)
In addition, there is a L2 cache of 2 MiB shared by all cores, while precisely speaking, it's external to the ARM processor core.
Documentation
A lot of useful information is available about ARM (Advanced RISC Machines) on the internet including ARM Ltd. official site.
- Refer to the following document for the instruction set, memory model and programmers' model: ARM Architecture Reference Manual ARMv7-A and ARMv7-R edition.
- The ARM Cortex-A9 Technical Reference Manual gives a good overview of the specific processor features and is a good reference for what ARMv7 implementation specific features are enabled.
- Another manual that's important is the ARM Cortex-A9 MPCore Technical Reference Manual which is specific to the multi-core system the Vita uses. The main information of use are descriptors for the private memory region defined with the
PERIPHBASEsignal. This is mapped to physical address0x1A000000.
- Cortex-A9 Technical Reference Manual
(corresponding to the chip revision supposed to be included in DevKit):
http://infocenter.arm.com/help/topic/com.arm.doc.ddi0388f/DDI0388F_cortex_a9_r2p2_trm.pdf
- Cortex-A9 NEON Media Processing Engine Technical Reference Manual
(NEON: Advanced SIMD instructions)
http://infocenter.arm.com/help/topic/com.arm.doc.ddi0409f/DDI0409F_cortex_a9_neon_mpe_r2p2_trm.pdf
- Cortex-A9 NEON MPE > VFPv3 architecture hardware support
http://infocenter.arm.com/help/topic/com.arm.doc.ddi0409f/CHDEEJDB.html
(The above reference destination has been confirmed as of June 26, 2014. Note that pages may have been subsequently moved or its contents modified.)
Identification registers
| Register name | Value |
|---|---|
| AIDR | 0x00000000 |
| CCSIDR | 0x701FE019 |
| CLIDR | 0x09200003 |
| CTR | 0x83338003 |
| ID_AFR0 | 0x00000000 |
| ID_DFR0 | 0x00010444 |
| ID_ISAR0 | 0x00101111 |
| ID_ISAR1 | 0x13112111 |
| ID_ISAR2 | 0x21232041 |
| ID_ISAR3 | 0x11112131 |
| ID_ISAR4 | 0x00011142 |
| ID_ISAR5 | 0x00000000 |
| ID_MMFR0 | 0x00100103 |
| ID_MMFR1 | 0x20000000 |
| ID_MMFR2 | 0x01230000 |
| ID_MMFR3 | 0x00102111 |
| ID_PFR0 | 0x00001231 |
| ID_PFR1 | 0x00000011 |
| MIDR | 0x412FC09A |
| MPIDR | 0x80000003 |
| REVIDR | 0x412FC09A |
| TCMTR | 0x00000000 |
| TLBTR | 0x00000402 |
Interrupt Controller
As part of the Cortex A9 MPcore, the Vita also implements the Generic Interrupt Controller Architecture. More information on interrupts can be found here.
L2 Cache
PSVita uses the PL310 r3p1-50rel0 L2 cache (Cache ID Register = 0x410000C7) that is mapped to paddr 0x1A002000.
RO registers
| Register name | Value |
|---|---|
| Cache ID Register | 0x410000c7 |
| Cache Type Register | 0x1e440440 |
Configuration
It seems NSKBL initializes the Tag Latency Control Register to <1, 1, 1> (writes 0 to the L2 register), and Tag Latency Control Register to <2, 4, 2> (writes 0x131 to the L2 register).