Skip to content

NEC VR4131 CPU

The NEC VR4131 is the system-on-chip at the heart of the BE-300. It implements a MIPS32 little-endian core running at 166 MHz, rated at 280 MIPS, with integrated memory controller, interrupt controller, timers, GPIO, serial interfaces, and PCI bridge.

CPU Core

Parameter Value
Architecture MIPS32, little-endian
Clock 166 MHz
Performance 280 MIPS
PRId 0x00000C81
Endianness Little-endian

CP0 Configuration

The CP0 (System Control Coprocessor) manages virtual memory, exceptions, and processor state.

Register Value Notes
Status 0x00008401 BEV=0 after NK.exe init; BEV=1 during ROM/SPL
Config 0x10135923 Cache configuration, kseg0 coherency
PageMask 0x00001800 4 KB default page size
Wired 2 Two fixed TLB entries for kernel mapping

Key CP0 Registers

  • Status ($12): Controls interrupt enables, kernel/user mode, BEV (Boot Exception Vectors)
  • Cause ($13): Exception code, pending interrupts
  • EPC ($14): Exception Program Counter
  • Config ($16): Cache and bus configuration
  • EntryHi/EntryLo0/EntryLo1 ($10, $2, $3): TLB entry manipulation
  • Context ($4): TLB refill handler page table pointer
  • Count/Compare ($9, $11): Timer (Count increments every other cycle)

TLB

The VR4131 has a 32-entry fully-associative TLB with support for variable page sizes.

Parameter Value
Entries 32
Wired entries 2 (set by NK.exe cold-start)
Page sizes 4 KB, 16 KB (via PageMask)
Replacement Random (entries Wired..31)

TLB refill exceptions go to the handler at PA 0x0000 (normal mode) or 0xBFC00200 (BEV mode). The kernel installs its own TLB refill handler by copying code from VA 0x8008C418 to PA 0x0000 during cold-start initialization.

Address Spaces

Range Name Description
0x00000000 - 0x7FFFFFFF kuseg User space, TLB-mapped
0x80000000 - 0x9FFFFFFF kseg0 Kernel, cached, unmapped (PA = VA - 0x80000000)
0xA0000000 - 0xBFFFFFFF kseg1 Kernel, uncached, unmapped (PA = VA - 0xA0000000)
0xC0000000 - 0xFFFFFFFF kseg2/kseg3 Kernel, TLB-mapped

Kseg0 vs Kseg1

The same physical memory is accessible through both kseg0 (cached) and kseg1 (uncached). During early boot, code runs from kseg1 to avoid cache coherency issues. NK.exe switches to kseg0 after cache initialization. For example, PA 0x00076B50 is VA 0x80076B50 (kseg0) or VA 0xA0076B50 (kseg1).

Caches

The VR4131 has separate instruction and data caches. The SPL writes CP0 TagLo ($28) during cache initialization but does not modify the Status register cache control bits.

On-Chip Peripherals

All VR4131 on-chip peripherals are memory-mapped starting at physical address 0x0F000000 (accessible via kseg1 at 0xAF000000).

Peripheral Offset Kseg1 Address Description
BCU 0x000 0xAF000000 Bus Control Unit
CMU 0x060 0xAF000060 Clock Mask Unit
ICU 0x080 0xAF000080 Interrupt Control Unit
PMU 0x0C0 0xAF0000C0 Power Management Unit
RTC 0x100 0xAF000100 Real-Time Clock
GIU 0x140 0xAF000140 General-purpose I/O Unit
SDRAMU 0x400 0xAF000400 SDRAM Unit
SIU 0x800 0xAF000800 Serial Interface Unit (VR4131 internal)
DSIU 0x820 0xAF000820 Debug Serial Interface Unit
PCI 0xC00 0xAF000C00 PCI Interface
PCICONF 0xD00 0xAF000D00 PCI Configuration

VR4131 SIU vs VRC4173 SIU

The BE-300 uses the VRC4173 companion chip SIU at 0xAA008680 for its external serial port, not the VR4131 on-chip SIU at 0xAF000800. Both exist in the address space but serve different purposes.

Reference