PS2 Julian's various PS2 projects (Worklog)

Some notes on memory mapping:

For OSDSYS (HDD, 1.10U):
Some memory accesses 0x1F0000-
The main executable starts at 0x200000
Assets are read then decompressed from 0x680000
Some memory accesses 0x17C0000-0x18C094C
Assets are loaded starting at 0x18F0000 (bump allocator)
malloc used for usb keyboard related code

For OSDSYS (ROM, 2.30):
Some memory accesses 0x1F0000-0x1F13C4
The main executable starts at 0x200000
Assets are read then decompressed from 0x700000
Some memory accesses 0x1840000-0x1920018
Assets are loaded starting at 0x1A00000 (bump allocator)

For DVD Player (ROM, 3.11):
The main executable starts at 0x200000
CMN01 starts at 0x223700
NUMBXX is stored at 0x3B5E00
MSGBXX is stored at 0x3BF300
HLPBXX is stored at 0x43BF80
LGBBXX is stored at 0x451500
BTNBXX is stored at 0x49A700
Some memory accesses 0x3BB598-0x49DC60
CMN02 starts at 0x49DC80
malloc used
 
Some notes on XATAPI:

Vendor specific SCSI/ATAPI command for spindle PS2 <-> ATAPI (spin status related?): F6h
Vendor specific SCSI/ATAPI command (sceCdAtapi SC/BC): F9h
Flashing firmware start (done before using 3Bh to transfer firmware): DFh

For 12h INQUIRY, these are the values checked before firmware update (at least on 2.xx)
Code: 
Vendor ID: "SONY   "
Product ID: "DVD RW DW-DX02A "
 
Last edited:
dsedb/dsidb related:

For "dt" (display threads), "ds" (display semaphores), "intr" (display interrupt handlers), at least DBGP protocol 3.10 is needed (not in SDK 1.3.4).

For "memlist" command (display memory blocks and associated modules), at least DBGP protocol 3.20 (for EE) or 3.1 (for IOP) is needed (not in SDK 1.3.4).
 
When relocating the buffer containing argc/argv to a different location, make sure the pointers to strings are also updated to the new location.

---

Some useful info for if you want to add a custom allocator API to your library: https://nullprogram.com/blog/2023/12/17/

---

My work on PS2 related stuff will probably slow down for next month of February because I'll be participating in Metaverse Maker Competition 2025 which will be happening at that time.
 
A note on dev9 partial emulation handling in DECKARD:

Reads:
0x4 (SPD_R_REV_3) returns the value set at 0xfffe0190
0xE (SPD_R_REV_8) always return 2
0x2C (SPD_R_PIO_DIR) returns the saved value
0x2E (SPD_R_PIO_DATA) is overrided relating to EEPROM/MAC address handling
0x90 (SPD_UART_R_CR1) returns the saved value
0x205C (SMAP_R_EMAC3_STA_CTRL) returns the value with 0xc000000 masked out
Rest is passed through

Writes:
0x2C (SPD_R_PIO_DIR) saves the value
0x2E (SPD_R_PIO_DATA) is overrided relating to EEPROM/MAC address handling
0x90 (SPD_UART_R_CR1) saves x + (x >> 3)
0x205C (SMAP_R_EMAC3_STA_CTRL) sets the value with 0xc000000 masked out and 0x4000000 ored in
Rest is passed through

---

For dev5 region partial emulation handling in DECKARD:

The whole region is passed through, except
wrting to 0x1F402016(CDVDreg_SCOMMAND) with the value 0x15(sceCdForbidDVDP)
 
Last edited:
Finally got around to hooking up my BDZ-ET1200.

A really "brief" comparison (compared to DESR-5700):
HD output resolution
Digital signal support
B-CAS card support
BD support
System buttons/indicators and remote hardware are labeled almost entirely in Japanese
Some streaming service support (e.g. Tsutaya TV/T's TV)
Can't play PS1 or PS2 games
x-DJ feature removed
Quick menu system (including the XMB interface)
Sample music no longer exposed in "Music" tab of XMB (but can still be accessed from x-Pict Story HD)
Replaced sample pictures: 30 sample images SMPL0001 (2008/10/9 6:32PM)-SMPL0030 (2009/11/30 6:27PM)
Most sample music in common with those included with DESR-5700 (need to write what was added)
Can update system software from USB
No memory stick slot
Changed front panel buttons: navigation buttions were removed, remaining are power, eject, one touch record
Time to inserting a commercial DVD/BD disc to playback is shorter
The initial loading of the system after power is that instead of showing the loading indicator at the top right while showing the current channel, it shows a loading text at the bottom right while showing the current channel
The music visualizers are gone. It's now just a static background
Importing from CDDA is no longer possible.
Can transfer recordings to other compatible systems over network.
Can transfer recordings to USB.
Can record to USB.
Can replace the HDD (even using non-Sony ones). However, this will result in the HDD being formatted and old HDDs becoming unreadable.

x-Pict Story HD sample BGM list
Bolded items are also in DESR.
Le depart
Memories
Mystique
Poetry of breeze
sleepin' baby
wish
afternoon tea
Bossa Samba
Cafe Salvador
Sunny smile
Watercolors
be natural
Crystal tone
Ryukyu
fairy, airily, Mary
fragrance
Go for it!
Jellybeans
Jungle Park
Playful kids
easygoing
Strike!
Party of Love
another days
midnight rendez-vous
Skyward
Glory
Life is beautiful
Merry-go-round
Winners take all
 
Last edited:
A note on multitaps and memory cards:

I think it should be possible to emulate 4x memory cards on one device because it just communicates via sio2 memory card port (even when changing slots for controller port). You probably have to fail when probed for controller port slot count (see `get_slot_number_check_td`) so it can fallback, but should otherwise work.
Should allow 4 memory cards to be displayed at once in OSDSYS on ROM 1.10 and up

I'm not sure of the behavior of multitap commands when a multitap is behind another multitap.
 
RDZ-D5 is the first DVD player model introduced in 2005. It doesn't have photo/x-Pict Story HD functionality.
x-Pict Story HD appears to have been introduced with RDZ-D50/RDZ-D70/RDZ-D90, which are the models that came after RDZ-D5 (and before BDZ-V7/BDZ-V9).

I checked my BDZ-V9, and it has the same sample BGM as BDZ-ET1200 for x-Pict Story HD. However, the sample photos are different (timestamp 2006/7/1 6:27:00-2006/7/1 21:05:00).
 
I think it should be possible to shim dev9x:, hdd:, and pfs: access. The tricky part will be either iomanX grabbing devices/fds from newer versions of ioman, or iomanX replacing the functionality of newer ioman (no longer needing the hooking functionality).

Once I get diffing of IOPRP image working, I'll be able to figure out what APIs got added/stubbed and what modules have changes in code. This is especially important for fileio since it has breaking RPC changes.
 
It looks like, for dev9, `DECKARD` redirects 0x10000000 (original SPEED address for dev9) to 0x13000000, and redirects DMAC2 channel 8 to DMAC3 (originally (un)used for IEEE1394).

If CS9/DACK9/CDACK9/IVSS9/DREQ9/CDREQ9/CS9C/CS9/CCS9 pins still exist on IOP, it should be possible to hook up SPEED chip supporting IDE HDD (CXD9731GP) and add support for it with just a `DECKARD` patch
 
sdrdrv versioning:

Version string -> PsII string
"sdr driver version 1.4.0 (C)SCEI" -> "PsIIsdrdrv 14"
"sdr driver version 1.4.0 (C)SCEI" -> "PsIIsdrdrv 1510"
"sdr driver version 1.4.0 (C)SCEI" -> "PsIIsdrdrv 1600"
"SDR driver version 2.0.0 (C)SCEI" -> "PsIIsdrdrv 2000"
"SDR driver version 2.0.0 (C)SCEI" -> "PsIIsdrdrv 2100"
"SDR driver version 2.0.0 (C)SCEI" -> "PsIIsdrdrv 2200"
"SDR driver version 4.0.1 (C) SCEI" -> "PsIIsdrdrv 2300"
"SDR driver version 4.0.1 (C) SCEI" -> "PsIIsdrdrv 2400"
"SDR driver version 4.0.1 (C) SCEI" -> "PsIIsdrdrv 2500"
"SDR driver version 4.0.1 (C) SCEI" -> "PsIIsdrdrv 2530"
"SDR driver version 4.0.1 (C) SCEI" -> "PsIIsdrdrv 2600"
"SDR driver version 4.0.1 (C) SCEI" -> "PsIIsdrdrv 2700"
"SDR driver version 4.0.1 (C) SCEI" -> "PsIIsdrdrv 2800"
"SDR driver version 4.0.1 (C) SCEI" -> "PsIIsdrdrv 3000"
"SDR driver version 4.0.1 (C) SCEI" -> "PsIIsdrdrv 3100"

Summary of changes
1.4.0 -> 2.0.0: callback thread priority changable with command line parameter thpri= and RPC cmd 0x8F10
2.0.0 -> 4.0.1: module unloadable, new libsd APIs exposed (sceSdStopTrans, sceSdCleanEffectWorkArea, sceSdSetEffectMode, sceSdSetEffectModeParams), obsolete APIs unexposed (sceSdSetTransCallback, sceSdSetIRQCallback), IOP-side handler for handler functions removed when removed from EE (sceSdSetTransIntrHandler, sceSdSetSpu2IntrHandler), user command functions, method for deleting the handler thread, sceSdrChangeThreadPriority and sceSdrSetUserCommandFunction exposed to IOP, handler functions now set a bitmask for xfer to EE (0x80000704) instead of overwriting the last value, handler functions copy to temp buffer before sending.

The backwards incompatibilities are the missing obsolete APIs, and the handler functions now sending bitmasks.
To resolve the missing obsolete APIs, they can be added back.
To resolve the differing handler functions result as bitmask, send the interrupt value twice: old value which new libsdr will ignore because either low bits or removed functions, then send the new (bitmask) value with the high bit set to make old libsdr ignore it since it does equality instead of mask test.
 
Last edited:
OSDSND (from hosdsys) is basically SDRDRV with integrated libosds functionality with SDR driver at 2.0.0.
OSDSDRDRV is basically SDRDRV with integrated CSL (ezmidi) and libosds functionality with SDR driver at 2.0.0. The RPC command IDs are different (including the libsd interface), however.
PSDRDRV is basically basically SDRDRV with integrated CSL (ezmidi) and libosds functionality SDR driver at 4.0.1. The RPC commands for libsd interface are the same for common, and the libosds RPC numbers are the same as for OSDSND (from hosdsys), but the CSL (ezmidi) RPC numbers are different.
 
A note after dumping .obj from OSDSYS with PCSX2 0.9.8:

After importing into Blender, scale all axes by 1/1024, scale Y axis by 1/1024, then scale Z axis by 2.

Z axis may need to be adjusted for 4:3 aspect ratio.
 
Last edited:
lseek behavior differences:
pfs does not allow seek past end of file.
mcman allows seek past end of file (unchecked: and will automatically expand the file for write).
bdm_fatfs allows seek past end of file and will automatically expand the file for write.
apa allows seek past end of file (up to around 2 ^ 22), but does not automatically expand the partition. Instead, it allows out of bounds read/write.
cdvdman does allows seek past end of file, but will clamp to the file's size.
romdrv does allows seek past end of file, but will clamp to the file's size.
 
A tidbit on SSBUS, wide (32-bit) DMA transfers, and data timing:

DMA address destination, block size/count is configured from IOP against DMAC registers.
This is unlike PCI, where address/data multiplexed lines have address first, then data for a certain length. Reportedly G2 bus on Dreamcast is similar to PCI.

Max BCR = 0 (for 0x10000 4 byte integers, or 262144, or 256KiB)
For each block unit, it can be paused by making DREQ inactive.
For RP2040, 256KiB can fit in SRAM. However, there is not enough GPIO for 32 data lines.

This can be worked around by using 2x RP2040, one hooked up to high 16 data lines, another hooked up to low 16 data lines.
In that case then it should be possible to double buffer. 128KiB is used in DMA processing to SSBUS while the other half is received/sent using another faster protocol with the remaining GPIO (USB? (Q)SPI? SDIO?)
Once that is done the 2x RP2040 can be reconfigured back into address/data PIO mode. The /WAIT signal can be used when reconfiguring input/output GPIO, or when interpreting the address and need to process the data output.

I guess the question remains if the 2x RP2040 configuration can handle SSBUSC delay DMAT=0xF 0.5 cycles (13.5 ns?).
 
Last edited:
Sony has been using Linux in their TVs back to 2003 (example: KDL-32XBR950). For 2007 and newer (example: KDL-40D3000) they started using the XMB interface.

Sony open source archive 2009 and previous: https://web.archive.org/web/20131203044403/https://products.sel.sony.com/opensource/index.htm
Sony open source archive 2014 and previous: https://web.archive.org/web/20140724163034/http://www.sony.net/Products/Linux/common/search.html
Sony open source archive 2015+: https://oss.sony.net/Products/Linux/common/search.html
 
You must log in or register to reply here.

Similar threads

Back
Top