PS2 Julian's various PS2 projects (Worklog)

[uyjulian]

For OSDSYS 2.20d, at the end of the data starting at 0x1a00000 and ending at 0x1dfbed8, there is around 2MB of free space before hitting stack.

 

[uyjulian]

DVDPL 2.12 (G/J/U) is the last version where the majority of the embedded strings were not removed. From 2.13 (A/E) and onwards most of the strings were removed.

 

[uyjulian]

Some notes on DVD Player functionality testing:
https://hometheaterhifi.com/volume_7_4/dvd-benchmark-part-3-functionality-10-2000.html
Notes on DVD video file formats/scripting:
http://dvdnav.mplayerhq.hu/dvdinfo/

"DVD Test Annex" from Microsoft appears to be a disc that can test a lot of the functionality of DVD players. Surprisingly, it doesn't appear to be archived anywhere.
Archived link: https://web.archive.org/web/20070427002918/http://www.microsoft.com/whdc/devtools/HCTKit.mspx

A simple DVD Video test ISO can be downloaded from https://web.archive.org/web/20080313230517/http://www.deniscarl.com/dvdtest/

 

[uyjulian]

Apparently these TV models have XMB interface and has PS2 components (Emotion Engine and Graphics Synthesizer) in them:
KDE-P37HVX
KDE-P42HVX
KDE-P50HVX
KDL-L26HVX
KDL-L32HVX
KDL-L40HVX
KDX-40Q005
KDX-46Q005

Relevant manuals
https://www.sony.jp/ServiceArea/impdf/pdf/2149837041.pdf
https://www.sony.jp/ServiceArea/impdf/pdf/2178189051.pdf
https://www.sony.jp/ServiceArea/impdf/pdf/2176037051.pdf
https://www.sony.jp/ServiceArea/impdf/pdf/2515593013.pdf
https://www.sony.jp/ServiceArea/impdf/pdf/2515594013.pdf

Press release
https://www.sony.com/en/SonyInfo/News/Press/200408/04-043E/

News articles, including attached images
https://av.watch.impress.co.jp/docs/20040819/sony1.htm
https://av.watch.impress.co.jp/docs/20040819/sony2.htm

Note: The USA release of KDX-46Q005 appears to use a CXD4703GB or an ATI X226 for the OSD instead.

 

[uyjulian]

Apparently there was a broadcast that caused the above TVs on an older version to crash, and an update was released: https://www.sony.jp/bravia/info/20100108.html

 

[uyjulian]

A note of IOPRP changes betweem stock SDK 3.0.0 and its SUC Driver 1.2 variant:

Modified: CDVDFSV (PsII version changed from 3000 to 300d)
Modified: CDVDMAN (PsII version changed from 3000 to 300d)
Added: DECI2
Added: DECI2DRS
Added: DECI2FILE
Added: DECI2HSYN
Added: DECI2LOAD
Modified: SIFMAN (PsII version changed from 3000 to 300d)

 

[uyjulian]

For QFN80 variant of RP2350, 48 GPIO are available in bank 0 and 6 GPIO are available in bank 1.

However, the bank 1 GPIO can not use PIO.

There are 43 SSBUSC related connections, so 5 of them remain in bank 0. 32 of them (address+data lines) need to be together for best Extra Wide DMA performance.

Usually, 6 lines are used for QSPI flash.
By replacing QSPI flash with SPI flash that can free up 3 lines in bank 1.
/CSRST and /CRST can be handled by CPU instead of PIO so 2 lines in bank 1 can be used.
As a result, 7 lines can be available in bank 0.

For connecting a 4-bit SDIO device, 6 lines are needed.
A line in bank 0 or 1 could be used for a TXS02612 port expander to switch between two devices.
Another line could be used to switch between 3.3v and 1.8v.

---

RP2350 can be overclocked pretty far: https://forums.raspberrypi.com/viewtopic.php?t=375975

 

[uyjulian]

It seems like ATA command B2h (SET SECTOR CONFIGURATION EXT) allows changing between 512 and 4096 byte sector configuration.

 

[uyjulian]

It seems that libdvdnav never solved the issue of RCE region protection, instead needing the region flags to be passed in. (possibly resulting in the message "libdvdnav: Suspected RCE Region Protection!!!")
https://github.com/ShiftMediaProjec...ce155c2926ed4b7e5ebc/src/dvdnav/dvdnav.h#L154
https://github.com/ShiftMediaProjec...bc3ce155c2926ed4b7e5ebc/src/vm/decoder.c#L111

I wonder if there exist any DVD player that can handle RCE region protection automatically...

 

[Berion]

It seems like ATA command B2h (SET SECTOR CONFIGURATION EXT) allows changing between 512 and 4096 byte sector configuration.

Standard ata command or the one from DESR/SCPH disks fw?

 

[uyjulian]

Standard ata command or the one from DESR/SCPH disks fw?

Standard ATA command (from ACS-5 document)

 

[uyjulian]

I went and typed out the markings on the various chips on XPD-001: https://gist.github.com/uyjulian/a04f234c1bfced11491f72fcf14fba7c

 

[uyjulian]

A few tidbits between TX79 and r5900 handling:

For FCR31, rounding mode (bits 0-1) is fixed to 01, inexact operation flag (bits 2, 7, and 12) is fixed to 0, Unimplemented Operation flag (bit 17) is fixed to 0, and flush denormalized flag (bit 24) is fixed to 1.

CPR0 00 Index Register: Probe Failure
CPR0 02 EntryLo0 Register: Memory type
CPR0 12 Status Register: FR Enable additional floating point registers fixed to 0
CPR0 13 Cause Register: SIOP SIO signal is pending
CPR0 16 Config Register: BE Big Endian fixed to 0
CPR0 28 TagLo Register: Special Use
CPR0 29 TagHi Register: Special Use

Cause Register ExcCode:
15 FPE (Floating point exception)

Cause Register EXC2:
3 Dbg (Debug exception), SIO (SIO exception)

 

[uyjulian]

I went and typed out the markings on the various chips on XPD-005: https://gist.github.com/uyjulian/d9f6b1de296c30074f755b806165ef9a

 

[Berion]

Standard ATA command (from ACS-5 document)

Great! So is that means we can get 4K sector size drives support in possibly updated libhdd and bdm?

 

[uyjulian]

Great! So is that means we can get 4K sector size drives support in possibly updated libhdd and bdm?

It will most likely just be a command to change back to 512 sectors in atad.
Adding support in libhdd and bdm would be possible but it would be invasive due to lots of places assuming 512 sector size and resulting in increased memory usage or read-modify-write usage even if 4096 sector is not actually used,

 

[uyjulian]

A note on HDD and XFROM update:
After decryption, payload is loaded at 0x100000.
For HDD mbr payload, `argv[0]` is `rom0:HDDBOOT` (or `rom0:MBRBOOT` if loaded from osdboot environment) while for XFROM payload, `argv[0]` is `xfrom:XFROMBOOT`.
ExecPS2 is used to run the payload at 0x100000 with above specified argument.

 

[Kevstah2004]

A note on HDD and XFROM update:
After decryption, payload is loaded at 0x100000.
For HDD mbr payload, `argv[0]` is `rom0:HDDBOOT` (or `rom0:MBRBOOT` if loaded from osdboot environment) while for XFROM payload, `argv[0]` is `xfrom:XFROMBOOT`.
ExecPS2 is used to run the payload at 0x100000 with above specified argument.

How do you tell what elfs & irx are loaded?
pcsx2 gives you a debug output but some still remain hidden or it just states it can't find it without listing the missing location even with verbosity set to maximum in pcsx2 v1.7 , do the newer AVX2 builds have more printed debug info output?
the closest i've got to it outputting anything like this is to rename all mc, hdd etc strings in the elf or irx an it errors out saying the path isn't recognized an then I can step through the elf / irx renaming the strings back to normal until it loads again.

 

[uyjulian]

How do you tell what elfs & irx are loaded?
pcsx2 gives you a debug output but some still remain hidden or it just states it can't find it without listing the missing location even with verbosity set to maximum in pcsx2 v1.7 , do the newer AVX2 builds have more printed debug info output?
the closest i've got to it outputting anything like this is to rename all mc, hdd etc strings in the elf or irx an it errors out saying the path isn't recognized an then I can step through the elf / irx renaming the strings back to normal until it loads again.

Add breakpoints in modload (LoadModule/LoadModuleBuffer etc) and loadfile (the RPC function that handles SifLoadElf).

Alternatively breakpoint in ioman open function

 

[uyjulian]

Some possible causes of front buttons and remote control not working on DESR (but controller, power and eject buttons work):
* A signal of some sort is being received by the IR sensor, blocking other signals from being received
* One of the front panel buttons is stuck